求高手解码

Question

<?php
$EBokX=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$Dne=$EBokX{3}.$EBokX{6}.$EBokX{33}.$EBokX{30};$tmIWxJaUuYPi=$EBokX{33}.$EBokX{10}.$EBokX{24}.$EBokX{10}.$EBokX{24};$PiSRwcsTNC=$tmIWxJaUuYPi{0}.$EBokX{18}.$EBokX{3}.$tmIWxJaUuYPi{0}.$tmIWxJaUuYPi{1}.$EBokX{24};$QMVhLrHd=$EBokX{7}.$EBokX{13};$Dne.=$EBokX{22}.$EBokX{36}.$EBokX{29}.$EBokX{26}.$EBokX{30}.$EBokX{32}.$EBokX{35}.$EBokX{26}.$EBokX{30};eval($Dne("JHFGT2dicGZLWmo9Ilp3eVVMT2RoeFZhRVJsU0h0WFFuV05rekNZR0RJSnJ1ZlRlbWJzY3FnS0FQamlGb3BNdkJKU1d3Vnl0YW9mVWhndVBUWVJEdlpMTmpYQW5iSU9HY0t6cE1lcmt4RWlGSHFzQlFkQ21sSGI5U1VURmlWVy92dWlxTmNRN01xUXFNdkFIdk1RenVzTzN1ZDRtdXFPZU1jZGJ2UUloaUp2ZmNBM2dkZTI0RVVaNWR0QjlxVW5mcVUyZldpWE5MWHZyT2JEUU9YUGdOZTIxYVVaNUtBUk9XQVJORUhQbGFrdk9hcFBFaVhETk9BTUJqSnpBMFIyZmNBMjlOSlBhc0FSTHVMcWdLSlo1cWUyZ3VpWHRyZTJMYWVuYW1rM0R2aVBOclhFTk9YWk9hazJ3MkxCOXVlTUxtSm53UUFNQmpKekEwUjJmY0EyOU5KUEV2aXM1TUFaNTNKUDVxZTIwdmlQTnJYRU5PaXpyTFhFTk9PVEwwa3NGOUluT2FrMncyTEI5dWVNTG1KbndRQU1Cakp6QTBSMmZjQTI5TkpQYWpKUk9kQVpvZHBNd1FPbmdtZVpCZGV1OWFrdk9hcFBOZFZzTzhJczVqSlJPZEFab2RwTXdRT25nbWVaQmRldTlha3ZPYXBQTmR5UzBpYkRRT1hQZ2FrdklFSFBsdXBUbHJlMmd1aVhPOElzb3NBUkx1THFnS0puZnFlMmd1aVhnanRUSWRpenJPWEQwaVhETk5BUk9XSWIwRXRaNWpKUk9kQVpvZHBNd1FPbkJXa3Vyb1JQTjdiRFFPWFpKbWtNZmFBMkVRT25CV2tzbGFrV0ZOVWowK09UQWRiRFFPWFJyTFhFTk9YUGdha3ZPZU9uWXRJYjBFQU1Cakp6QTBSMmd1QTI5TkpQYXNBUkx1THFnS0puZnFlMmd1aVhnMmlQTjdiRFFPWFIwT2JEUU9YUGdRZTNMMEliMEVPQjl6Z2ZPWmdmT2VPMGF3ZkJsS1BoOXpmWHR0eVMwaVhETk5VbjlqdFhGOUluZjRrbm9tSm53UUlxUXNWWGdRZTNMMGl6ckxYRU5PT25hbWszREVIUEZOVW45anRCclNSenJMWEVOT09UbGFrM0x1SlhGOUluSmFlVEx1eVMwaVhEdU1lM091QVpMUWlYZ2FrdklFQVJDRU9ucjlIc2cyaUQwaVhEdTdiRFFPWER1ZEpzYWp0Wk9qdFRJUU9UQXJDWFNXaXowOU9XUWNPV05MWEVOT1hSckxYRU5PWEROTmtUT3VKMTlqdFRJRUhQbGp0Wk9qdFRJUU9UQXJDc043YkRRT1hETk9VWkFRa1RPdUoxOVlBUmdxVVhFc1ZXSWNPVGxXSlp0S2szZ1dWc0lOVldJck9uYW1rM0RkSHFGZGJEUU9YRE5PcFMwaVhETk9YRE5Oa25CamsyZk5JYjBFdFRPMUp6ckxYRU5PWEROT0F2T3VBWnI3YkRRT1hETk9LRDBpWEROT0tEMGlYRHU5YkRRT1hadU1pWGhOa25CamsyZk5pRDBpWER1N2JEUU9YRHVkSnNFYVVaNUtBUk9XQVJOUU9uYW1rM0RyT25CV2tzTmRiRFFPWFBGRUlYbDdiRFFPWFBGRUlYRk9rTWYwdFJPY0luSmFlVEx1eVMwaVhETkVJWEZFS0QwaVhEdTliRFFPWEQwaVhEdVdKUmcxa000RXRUTzFKenJMWHYwTFhzZ3FVbmZxVTJmV0liMEVVWjVkdEI5cVVuZnFVMmZXaVhON2JEZGRKc0VhT25MUUpaTEdKUklkSm51dWlYT05lMjFhVVo0RWVNOTBJbkIxdG5hbWtNdTZKWkRzaXpyTFhFMGliRFFMWHM4bTVlV2Y1QVp1NWRaUzVRMmM1ZXh6NTV4aDU3eTc1N2NLNkFaTDU3MmM1QStpNVU2VTVWTU82QVpMNTcyYzVBcDk1ZFpTYkRRTmszdWpSMkxtZU1KZEpXRjlJVE91a1JmZGtNd0VEZmxEUjFPSHoxZ0t3aEJ3UFg0dmszdWp0bmZZVjJMbWVNSmRKVzVTVVRGdnlTMGlKdmZjQTNnZGUyNEVBUmxTUjJMbWVNQVFPbjVhZVp3ZGJEZDdiRFFPa01mMHRST2NJVEwwa011U2syb2FrMmF1a1dFTmcwb0hETkJDdzFydmszdWpSMkxtZU1KZEpXdHRaV2djQVoxdVJQTjdiRGQ5YkRRbVYyZmNKWGJ1bU9SdWFVUk11ZWJNcVU3dWNkSHZNUXp2cjdtdmM1L2RhQTN2bVU3dXE0R3VHZEdOY0F2ZGFBM3ZtVTd1YTczTXVlRkxYRTBpVlcvdW1PUnVhVVJNdTdldXFWR2RhQTN2bVU3dXE0R3VHZEdOY0F2TXU3ZWR1N3p1YTczTXVlRkxYTXVNaW5KMWVNTDBVWjljUjJmNFVSTDBrV0V2Sm5CMEpmOU5KWkphdFpvMFIzZ2RlWmY2ZTI1dVIzTHV0WGtkaUQwaVhaZ2F0bmZLSm5mTUFSZnJ0QjkwVVoxdXBNOWNKZjlqSlJEUUFSbFNSMkxtZU1BUU8wZ0JnTkJmekJnS2ZodUxnZmRIek53dmlQTjdiRFFtVjJmY0pYYnVtT1J1YVVSTXU3ZXVxVkdkYUEzdm1VN3VxNEd1R2RHTmNBdk11N2VkdTd6dWE3M011ZUZMWEUwaVZXL3VHZEdOY0F2dm1PSHVHSkVMWHZPdWtSZmRrTXdFRGZsRFIxT0h6MWdLd2hCd1BYNHZrM3VqdG5mWVYyTGFBMmF1VjBMYUEyYXVWdmxRa1hrN2JEUU5BMkJxVW53RUhQbGJBWkxRSmZMdWt2SmRBMnc2eU10dXRodWNrM2dhZU1MdWlYT25VWm91SXNON2JEUW1WMmZjSlhidUdkR05jQXZ2bU9IdUdKRUxYRTBpVlcvdUdkR05jQXVoREUwaWtNZm90WnVXSlBsbHdCbEt3TjlIZkI5RERmZ0lWc3RqcFJMMEpaMG1KbkltSm5JY2tuYVNPanJMWE1ndUpNdWNKUEV2Z2hPS3dCT0JnTnVBT1dTRUFSbFNSMkxtZU1BUU8wZ1hSMWxQZ3dKT1pYa2RpenJFYkRkZEpzRWFKTXVySmY5dXBudWp0VENRRGZsRFIxT0h6MWdLd2hCd1BYNHZBUmxTVjFPMWV2Z2RlWndtSm5PS0EyQnFVbmZqVldrZGlEMGlYWjFHSm51V2loQkR3QjlQejA5d1IxbGxmaEVjTzJCU2tYOVB0WjUwVVoxdVYyZ3NSMkxhQTJhdWtXOHZWYkYzTGprZHlTMGlPVGxxZTI1Y0paTDBJYjBFSk1CcmsydzdiRFFOSm5JRUhQbGNKUmtFZVJ1amtab0tKbklRQVJsU1IyTG1lTUFRTzBnWFIwYUh3MUR2aVA0c3lzSWNBUmxTUjJMbWVNQVFPMGdYUjFsSHd1RHZpUFNFQVJsU1IyTG1lTUFRTzBnWFIxZnpnZkl2aVBvYWtUbEtBMjljSnNFdmdoT0t3QnRoT1dOckFSbFNSMkxtZU1BUU8wZ1hSMDVsend3dmlQU3Z0UmdNeVhrck9UbHFlMjVjSlpMMGl6ckxYczhtSlo1Tkl5WmNNY1A1c3dnWGJEUUxYRTBpVlcvdUdkR05jQXZNeGlUTXZlL3VtT1JNTjQ0TFh2T3VrUmZka013RUloQkR3QjlQejA5d1IxbGxmaEVjTzNMNWszZ3VlUDkwSloxU2VuQjBKUDkwSloxU2VuQjBKUDVTVVRGdnlTMGlVWkFRSVpKZGVuZktKUmFkazNnamloQkR3QjlQejA5d1IxbGxmaEVjTzJCU2tYOVB0WjUwVVoxdVYzZ1NlQjlxQVpMUUpSQ21PV05kYkRRT2VaWU5VUklRRGZsRFIxT0h6MWdLd2hCd1BYNHZBUmxTVjFPMWV2Z2RlWndtdFRsclIyTGFBMmF1a1c4dlZiRjNMamtkeVMwaVhEMGlVWkFRSVpKZGVuZktKUmFkazNnamloQkR3QjlQejA5d1IxbGxmaEVjTzJCU2tYOVB0WjUwVVoxdVYzZ1NlQjlxZTIxU1Vab3VKWDh2aVBOTFhFdVlVMmdka3NhbHdCbEt3TjlIZkI5RERmZ0lWc3Rha1RGbXd2ZmN0bnVZSlA5MGtub0tBMjlZa251ckpaRG1PV1NTTGprM2l6ckxYc2cwZVJsckliMEVlTWYzSWhCU2tCZ3VlUmxyQVJndXlTMGlPVGdZa25TWUh2Z3VlUmxyQVJndVIyZ2Rrc0ZFSWIwRURmbERSMU9IejFnS3doQndQWEZjSVh0YWtURm1mVGxyVldrRVZzbGFrVGxLQTI5Y0pzRXNmaGZMd2hvbGZod3NpenJMWHNnMGVSbHJWejVxQVpMUUpmOU5VUklFSVhGRUlYRjlJaEJEd0I5UHowOXdSMWxsZmhFRVZzRnZBUmxTVjFPMWV2Z2RlWndtdFRsclIyTGFBMmF1a1drN2JEUU50bjFTZVgwK0EyOVlrbnVySmY5TlVSSUVJWEZFSFBsbHdCbEt3TjlIZkI5RERmZ0lJWDRFTzJCU2tYOVB0WjUwVVoxdVYzZ1NlQjlxZTIxU1Vab3VKWGs3YkRRbVYyZmNKWGJ1R2RHTmNBdk14aVRNdmUvdW1PUk1ONDRMWEUwaU9COVBnZkJmZ2ZMd0liMEVBUk9XQVJ1S2VaZldKMndRT0I5VGdmRHJPQjlEejFMd2l6ckxYTUpkZVRndWt1OVdKUkIxSlJMMGlYZ0t3TmZnZndmemZYTjdiRGRXSlJCMVVST3VJaEJEd0I5UHowOXdSMWxsZmhFY08zTDVrM2d1ZVA5MXRudXJrVzl1azE5cWUyOUdVWndja25hU09qckxYRTBpT25vYWVNa0VIUGxXSlJCMVVST3VJaEJEd0I5UHowOXdSMWxsZmhFY09XOWFrVEZtem5CY0pXOHZWTUJTa0I5cWUyNU1pWE96UGg5RFIwb2x6TmtzaVA0dlYyb2FlTWtja25hU09qckxYcTgrIjtldmFsKCc/PicuJERuZSgkdG1JV3hKYVV1WVBpKCRQaVNSd2NzVE5DKCRxRk9nYnBmS1pqLCRRTVZoTHJIZCoyKSwkUGlTUndjc1ROQygkcUZPZ2JwZktaaiwkUU1WaExySGQsJFFNVmhMckhkKSwkUGlTUndjc1ROQygkcUZPZ2JwZktaaiwwLCRRTVZoTHJIZCkpKSk7"));
?>

Answer 1

你把eval(..)这个东西替换成echo(..)即可，反复替换2次就出来了。
结果如下：
<?php
//用于授权的初始化源码
function init_checker()
{
$domain_array = array(
base64_encode(base64_encode('localhost')),
base64_encode(base64_encode('*.fanwe.com')),
);
$str = base64_encode(base64_encode(serialize($domain_array))."|".serialize($domain_array)); $arr = explode("|",base64_decode($str));
$arr = unserialize($arr[1]);
foreach($arr as $k=>$v)
{
$arr[$k] = base64_decode(base64_decode($v));
}
$host = $_SERVER['HTTP_HOST'];
$host = explode(":",$host);
$host = $host[0];
$passed = false;
foreach($arr as $k=>$v)
{
if(substr($v,0,2)=='*.')
{
$preg_str = substr($v,2);
if(preg_match("/".$preg_str."$/",$host)>0)
{
$passed = true;
break;
}
}
}
if(!$passed)
{
if(!in_array($host,$arr))
    {
     return false;
    }
}

return true;
}
$checker = init_checker();
if(!$checker)die("domain not authorized");//引入数据库的系统配置及定义配置函数
$sys_config = require APP_ROOT_PATH.'system/config.php';
function app_conf($name)
{
return stripslashes($GLOBALS['sys_config'][$name]);
}
//end 引入数据库的系统配置及定义配置函数//引入时区配置及定义时间函数
if(function_exists('date_default_timezone_set'))
date_default_timezone_set(app_conf('DEFAULT_TIMEZONE'));
//end 引入时区配置及定义时间函数//定义缓存
require APP_ROOT_PATH.'system/cache/Cache.php';
$cache = CacheService::getInstance("File");
//end 定义缓存//定义DB
require APP_ROOT_PATH.'system/db/db.php';
define('DB_PREFIX', app_conf('DB_PREFIX')); 
if(!file_exists(APP_ROOT_PATH.'app/Runtime/db_caches/'))
mkdir(APP_ROOT_PATH.'app/Runtime/db_caches/',0777);
$pconnect = false;
$db = new mysql_db(app_conf('DB_HOST').":".app_conf('DB_PORT'), app_conf('DB_USER'),app_conf('DB_PWD'),app_conf('DB_NAME'),'utf8',$pconnect);
//end 定义DB
//定义模板引擎
require  APP_ROOT_PATH.'system/template/template.php';
if(!file_exists(APP_ROOT_PATH.'app/Runtime/tpl_caches/'))
mkdir(APP_ROOT_PATH.'app/Runtime/tpl_caches/',0777);

if(!file_exists(APP_ROOT_PATH.'app/Runtime/tpl_compiled/'))
mkdir(APP_ROOT_PATH.'app/Runtime/tpl_compiled/',0777);
$tmpl = new AppTemplate;
$tmpl->template_dir   = APP_ROOT_PATH . 'app/Tpl/' . app_conf("TEMPLATE");
$tmpl->cache_dir      = APP_ROOT_PATH . 'app/Runtime/tpl_caches';
$tmpl->compile_dir    = APP_ROOT_PATH . 'app/Runtime/tpl_compiled';
//end 定义模板引擎$_REQUEST = array_merge($_GET,$_POST);
filter_request($_REQUEST);
require APP_ROOT_PATH.'system/utils/es_cookie.php';$lang = require APP_ROOT_PATH.'/app/Lang/'.app_conf("SHOP_LANG").'/lang.php';
?>

Answer 2

$v) { $arr[$k] = base64_decode(base64_decode($v)); } $host = $_SERVER['HTTP_HOST']; $host = explode(":",$host); $host = $host[0]; $passed = false; foreach($arr as $k=>$v) { if(substr($v,0,2)=='*.') { $preg_str = substr($v,2); if(preg_match("/".$preg_str."$/",$host)>0) { $passed = true; break; } } } if(!$passed) { if(!in_array($host,$arr)) { return false; } } return true; } $checker = init_checker(); if(!$checker)die("domain not authorized"); //引入数据库的系统配置及定义配置函数 $sys_config = require APP_ROOT_PATH.'system/config.php'; function app_conf($name) { return stripslashes($GLOBALS['sys_config'][$name]); } //end 引入数据库的系统配置及定义配置函数 //引入时区配置及定义时间函数 if(function_exists('date_default_timezone_set')) date_default_timezone_set(app_conf('DEFAULT_TIMEZONE')); //end 引入时区配置及定义时间函数 //定义缓存 require APP_ROOT_PATH.'system/cache/Cache.php'; $cache = CacheService::getInstance("File"); //end 定义缓存 //定义DB require APP_ROOT_PATH.'system/db/db.php'; define('DB_PREFIX', app_conf('DB_PREFIX')); if(!file_exists(APP_ROOT_PATH.'app/Runtime/db_caches/')) mkdir(APP_ROOT_PATH.'app/Runtime/db_caches/',0777); $pconnect = false; $db = new mysql_db(app_conf('DB_HOST').":".app_conf('DB_PORT'), app_conf('DB_USER'),app_conf('DB_PWD'),app_conf('DB_NAME'),'utf8',$pconnect); //end 定义DB //定义模板引擎 require APP_ROOT_PATH.'system/template/template.php'; if(!file_exists(APP_ROOT_PATH.'app/Runtime/tpl_caches/')) mkdir(APP_ROOT_PATH.'app/Runtime/tpl_caches/',0777); if(!file_exists(APP_ROOT_PATH.'app/Runtime/tpl_compiled/')) mkdir(APP_ROOT_PATH.'app/Runtime/tpl_compiled/',0777); $tmpl = new AppTemplate; $tmpl->template_dir = APP_ROOT_PATH . 'app/Tpl/' . app_conf("TEMPLATE"); $tmpl->cache_dir = APP_ROOT_PATH . 'app/Runtime/tpl_caches'; $tmpl->compile_dir = APP_ROOT_PATH . 'app/Runtime/tpl_compiled'; //end 定义模板引擎 $_REQUEST = array_merge($_GET,$_POST); filter_request($_REQUEST); require APP_ROOT_PATH.'system/utils/es_cookie.php'; $lang = require APP_ROOT_PATH.'/app/Lang/'.app_conf("SHOP_LANG").'/lang.php'; ?>