微盾PHP指令碼加密專家php解密演算法

<?php $filename="play-js.php";//要解密的檔案 $lines = file($filename);//0,1,2行 //第一次base64解密 $content=""; if(preg_match("/O0O0000O0\('.*'\)/",$lines[1],$y)) { $content=str_replace("O0O0000O0('","",$y[0]); $content=str_replace("')","",$content); $content=base64_decode($content); } //第一次base64解密後的內容中尋找密鑰 $decode_key=""; if(preg_match("/\),'.*',/",$content,$k)) { $decode_key=str_replace("),'","",$k[0]); $decode_key=str_replace("',","",$decode_key); } //尋找要截取字串長度 $str_length=""; if(preg_match("/,\d*\),/",$content,$k)) { $str_length=str_replace("),","",$k[0]); $str_length=str_replace(",","",$str_length); } //截取檔案加密後的密文 $Secret=substr($lines[2],$str_length); //echo $Secret; //直接還原密文輸出 echo "<?php\n".base64_decode(strtr($Secret,$decode_key,'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'))."?>"; ?>

微盾PHP指令碼破解

<?php function get_filetree($path){ $tree = array(); foreach(glob($path . '/*') as $single){ if(is_dir($single)){ $tree = array_merge($tree,get_filetree($single)); } else { $tree[] = $single; } } return $tree; } function eval_decode($File) { $Lines = file($File); $Content; if(preg_match("/O0O0000O0\('.*'\)/", $Lines[1], $S)){ $Content = str_replace("O0O0000O0('", "", $S[0]); $Content = str_replace("')", "", $Content); $Content = base64_decode($Content); } else { return "file not encode!"; } $Key; if(preg_match("/\),'.*',/", $Content, $K)){ $Key = str_replace("),'", "", $K[0]); $Key = str_replace("',", "", $Key); } else { return "not decode key!"; } $Length; if(preg_match("/,\d*\),/", $Content, $K)){ $Length = str_replace("),", "", $K[0]); $Length = str_replace(",", "", $Length); } else { return "not decode base64 string!"; } $Secret = substr($Lines[2], $Length); $Decode = "<?php".base64_decode(strtr($Secret,$Key,'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/')) ."?>"; file_put_contents($File, $Decode); return "file decode success!"; } $filelist = get_filetree("D:/PHPnow/htdocs/1"); foreach($filelist as $value){ echo $value." :\t\t".eval_decode($value) . "\n\r<br>"; } ?>