PHP解密哪位大侠帮忙解密一下 帮忙

Question

<?php
$SWLDr=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$mic=$SWLDr{3}.$SWLDr{6}.$SWLDr{33}.$SWLDr{30};$nzsyMZCKhGOb=$SWLDr{33}.$SWLDr{10}.$SWLDr{24}.$SWLDr{10}.$SWLDr{24};$ObaTEqvdNw=$nzsyMZCKhGOb{0}.$SWLDr{18}.$SWLDr{3}.$nzsyMZCKhGOb{0}.$nzsyMZCKhGOb{1}.$SWLDr{24};$XloJjexP=$SWLDr{7}.$SWLDr{13};$mic.=$SWLDr{22}.$SWLDr{36}.$SWLDr{29}.$SWLDr{26}.$SWLDr{30}.$SWLDr{32}.$SWLDr{35}.$SWLDr{26}.$SWLDr{30};eval($mic("JFV0UkJWQUhrWWc9Impza3BPbkh3eGlQTmNZQ1hiU0pmdHJaZ3pLZVdtZEVEQWhsRm9xUVZVUk1UdUl2YUdCTHlzUmhnVlR6UUJETUhFWUpadXFybmtObEdGTFBVdFNqYmRXZnh3WGNleXBDYUltQUtvaU92TWI5UUt6ZEhKRDhBNTVxdzVPWFY1dzZtNWcyYjU1WGo1WURTNUtQTzVZdlU1TlhjNTZKaWJjZ3RTVTVzU29mQXVEaWd1dGYwWjJId2xVSE5sWm13TGMwTFBRaEhKR2hycm9wQXVVeGd1ZjlXRVRyV1BxZDltb3h2RXR4NUxkMExKY2hyWXR4RmxhWTBaMmVJWTI5aGxxV0RZWkhmSHNwbmxVNXN1MnBmTEpTUnUySFd1b1dBRTNjVExxaFJiY3dySmNmRFlaSGZIc3BubFU1c3UycGZMb3JXRTJ5Mkh4OWZ1dEhBbG95d3JGanZIdjRRT3NkSUNxRWdMcVFISkdockpxOEFZdHhGbGFZMFoyZUlZMjlobHFXRFlaSGZIc3BubFU1c3UycGZMSlNEdVp5UUNzalFDRmpJWTJXZ3V0eDNDdjVzdTIwVExxaFJiY3dySmNmRFlaSGZIc3BubFU1c3UycGZMb3JXRTJ5Mkh4OWZ1dEhBbG95d3J2d0lsMjlUdTI4RkhzeUlZMjlrcnZoZ2Jjd3JKcWg3YmN3ckpxcEZTem1HTXFpRFlaSGZIc3BubFU1c3UycGZMb3JXRTJ5Mkh4OWZ1dEhBbG95d0UyZXZLVXhSS1pnZkxKcGh1MjFXS1U1bllacnZZWmhnTHE0RG5KbUlFMmV2S1V4UktaZ2ZMSnBodTIxV0tVNW5ZWnJ2WVpoZ0xhUkhKRzBMSmNoaFlacnZtYjBHbFpXUXVvOWhscUdEbkptUll0eEZsYVkwWjJwZlkyOWhscUdoRTNwdkxxaDdKY2hISkdocnJveHZFRGQ5bXplSUUyZXZLVXhSS1pnZkxKcFdFVHJ1Q2UwZ1ZRMExKY2Z0dTNyZllVSHdMSnBXRVRtR1laQ0dyb1I5TURwMkxjMExKY2Y3YmN3ckpjaGhZWnJ2VXZwTlpxZDltb3JXRTJ5Mkh4OWhsVUhBbG95d1l0eEZsYVkwWjJwZlkyOWhscUdoU0RoZ1ZRMExKY2Y5SmMwTEpjaGhLbzlGU0pkOW1KcG55MGVxZWhlcVV2U21leHBjWjBXTXkxY1RaYVJISkdocnJvV0FFM2NHTXFpZlB6aVJ1MnBmTEptNm1EUWhLbzlGU0poN2Jjd3JKcXB3dTNIMG1iMEdyb1dBRTNwdUN4MDdiY3dySnFwUVlaSEZsVWNHTXFpdFlVQkZsYVJISkdocmx0OXZsVXhzS0pHaFlacnZtb3hGbUpwTk1hNGhTRGhISkdoclBRMExKY2hyS1VZd0UzZURFM3B2TEpwMk9iZFJDRGg5TXFFWE9ERWdiY3dySmNmN2Jjd3JKY2hycnppdmxVU25FM3B2bWIwR0UzZURFM3B2TEpwMk9ibWdWUTBMSmNockpVZnRMeml2bFVTbnVVeDBZMkd3bUQ4RE9EcFFFdGVUWjNIMEVENERySjhET0pwd3UzSDBMYTRRTGMwTEpjaHJKWlJISkdockpjaHJyemlXRTNIZmxKZDltenB2U1V5N2Jjd3JKY2hySlVydmxVeE5WUTBMSmNockpaMEhKR2hySlowSEpHaHJuYzBMSmNmZ2xER1dyemlXRTNIZmxKaEhKR2hyUFEwTEpjaHJLVVl3bVVmSVoyeHZFdHg1TEpwd3UzSDBPSnBXRVRtZ0xjMExKY2hHbUpkR1BRMExKY2hHbUpkR0pacmZTemV2dURpdFlVQkZsYVJISkdocm1KZEdtejBISkdocm5jMExKY2hISkdockV0ZTBTWnJJbXpwdlNVeTdiY2c5YmN3aFkyV2ZZMmtmRURkOW1vZklLWnBuWTJXZlkya2ZFREdnVlEwTEtVWXdtcXBzS29lc0syZXZMVXBnbHFHRGxvOWtZVWZJbW81QVNKaVdTWnB3dTNyZ1B0ZWhtRGg3YmN3SEpHMExiY3dBTytVOGZQVXhnUEtlUlZLSE5JVTZoK1BLV1ZQRkkrUDdUK3R4c1BQOU5JVU1ESVVJdElxNURQdHhzUFA5TklVekFQS2VSZDBMcnpINUUxOXN1MjV0S1VFR01xaXZsWngxS1pyZm1qeGN5eDlxYTA5eVoxaWllakdJcjNINUUzcGZ1cTlzdTI1dEtVRUlFb1dRckZSSEp0bDF1dEgwS1U5SW1veFFFeDlzdTI1dExKcElZVTFmTGMwTFBRMExKWnJmU3pldnVEaUZTenJnRXpIUllaSHdsWkN3cmpTQ2EwcmlheEh1cjNINUUxOXN1MjV0S1VFVFplUmh1dHhrbGUwZ1ZRMExuYzBMT3Y5ZnV0Y0c1dXZlNVlVZjVnVVE1dzJJNXVYYTU1WGo1N1Y3NTdJbjZZVUg1NzJJNVkrTDVLNks1T3RyNllVSDU3Mkk1WVA5NWdVUWJjd0hKRDhBNXV2ZTVZVWY1Z1AyNVl2NjZZVUg1NzJJNVkrTDVLNks1T3RyNWdQMjZsUDA1WVA5NWdVUWJjZ2dsRFd0U1U1c1NvZkF1ZjlmUG9mRlN6Q3dyMnBXU29lbmxvZXRZWmVSU3g5MEtVMWZQdDlJbGU5RmxaY1RMcWhISkdmaFlacGZaMnBmbHR4MXV6cG5Tb2ZrbFpnQXV0ZW5FMmUwTG94UUV4OXN1MjV0TEpTanB5bGlleUJ5WjFwcmF5ZUthMDV4cnZoZ1ZRMExPdjlmdXRjRzV1dmU1WVVmNWdQMjVZdjY2WVVINTcySTVZK0w1SzZLNU90cjVnUDI2bFAwNVlQOTVnVVFiY3dISkQ4QTVLNks1T3RyNTd2YTVLMlliY2d2bFp4MUtacmZtanhjeXg5cWEwOXlaMWlpZWpHSXIzSDVFM3BmdXE5c1lVSHdscTliWVVId2xxNVFLemRUVlEwTHJvSFdZMldmbWIwR2MyeHNLb2VhbFpyMktVSGZWc2dUbFpwcnVUSDBZVTVzbHFHRHB0ZlJscW1nVlEwTE92OWZ1dGNHNUs2SzVPdHI1N3ZhNUsyWWJjd0hKRDhBNUs2SzVPdHJwam1ISlRyZkVaZWdFdHlHY2VpY1oxck1hMXBueWp4eXFKNFRFM2ZGU29la08ycERPMnBET1Rpd0VKRTdiY2dobFVsZ3V0eXdyMHBKWjFpcXB5bHJVSkVSbW94UUV4OXN1MjV0TEpTamNmOWN5aGVvcWVHVExxaDdtZDBMS1VZd21VbGd1b2VubFpXZ0UzcEZManhjeXg5cWEwOXlaMWlpZWpHSXIyeFFFSjlxU1U1MEtVMWZPMnBEWjJIV1kyV2ZFdjhUTHFoSEpHZmtLMnBnRURXaXl4aW55aDlNZXg5Y2NlcG1PRFNXRXpkQXlUZUlTb2ZrbHE5aFlmOXNZVUh3bFpDQXJ2UVFIRkUzTGFSSEpEcFFZMjlJdXRlc1NKZDltb2xXdXpIZlZRMExyb3BEbWIwR3V0ZTNtbzE1RTN4UloycERMb3hRRXg5c3UyNXRMSlNqY2Y5bWExSHlydmhJbXN3RE90eFFFeDlzdTI1dExKU2pjZjljYTFyeXJ2aFJtb3hRRXg5c3UyNXRMSlNqY2Y5ZXkwZXFydmhSWVppUVoySEF1dFl3cjBwSloxaVpwSkVnT294UUV4OXN1MjV0TEpTamNmOVZjeTF4cnZoUnIzZTBsc0dUT0pwUVkyOUl1dGVzU0poN2Jjd0FPMmVJbEpiZk5nTmhJWWZqY0cwTGJjd0hKRDhBNUs2SzVPdHI1WERXNWcyLzV1dmU1Z1ZWYmNndmxaeDFLWnJmbUppaXl4aW55aDlNZXg5Y2NlcG1PRFNGUFpIMGxVMEFTb2VrRW9CV1NveUFTb2VrRW9CV1NveUlFb1dRckZSSEp0ZnRMSnh0S1VCZloyZTRLWkgwRXZXaXl4aW55aDlNZXg5Y2NlcG1PRFNXRXpkQXlUZUlTb2ZrbHE5MEVvQm5ZMnhzS29lRk92RWdMYzBMSlUxTmxvZnZManhjeXg5cWEwOXlaMWlpZWpHSXIyeFFFSjlxU1U1MEtVMWZPM3BRdXg5c1lVSHdsWkNBcnZRUUhGRTNMYVJISkdoSEp0ZnRMSnh0S1VCZloyZTRLWkgwRXZXaXl4aW55aDlNZXg5Y2NlcG1PRFNXRXpkQXlUZUlTb2ZrbHE5MEVvQm5ZMjlrRW9mUmxVY0FydmhnYmN3cnVVa2hLWm13Y2VpY1oxck1hMXBueWp4eXFKNFRZWmlRTzFyMXVUcGd1VXlBU3ppUloySEF1WmlndW9laE92RVJDYkUzSHZoN2Jjd2hTbzFRdUpkOW1vNWZTdmlpRXppeWxVMVF1b3gwbGFSSEpEcDB1WmlST2E1MGxVMVF1b3gwbGU5aEtabUdtSmQ5bWp4Y3l4OXFhMDl5WjFpaWVqR0dPRGRUWVppUU8xcFF1SjhUbUo0R1laaVFaMkhBdXRZd21mcHhhZWlDY2VweG1EaDdiY3doU28xUXVKMCtZMnhzS29lbmxvZnZtSmRHbUpkR01xaWl5eGlueWg5TWV4OWNjZXBtbUo0R3IyeFFFSjlxU1U1MEtVMWZPM3BRdXg5c1lVSHdsWkNUVlEwTHJ6cGtFb1FrTXRIQXVaaWd1b2VubG9mdm1KZEdtYjBHY2VpY1oxck1hMXBueWp4eXFKZEltSlNXRXpkQXlUZUlTb2ZrbHE5MEVvQm5ZMjlrRW9mUmxVY1RWUTBMT3Y5ZnV0Y0c1SzZLNU90cjVYRFc1ZzIvNXV2ZTVnVlZiY3dISkRwbnloZXBleWVhZUpkOW1veHZFdHg1WjIxZkV0U2ZMSnBucDBleU9KcG55ajlhZUpoN2JjZ3RLVUIwbFpybkV0ZUJTVWVGU0pHaFoxcnh5ZWV4eTFjZ1ZRMExFdGVCU1VmdmxxaWl5eGlueWg5TWV4OWNjZXBtT0RTRlBaSDBsVTBBU1pwZ3V6Q0FsWkhuWTI5QUsyZmZPVGl3RUpFN2Jjd0hKRHBSWVU1VG1iMEdFdGVCU1VmdmxxaWl5eGlueWg5TWV4OWNjZXBtT0RFQVlaaVFPMEJXdXRFQXJ2NVdFemluWTI5SWxER0R5MFdNeXg5Q2N5NXptRGhJcnY5UllVNVRPVGl3RUpFN2Jjdy9NRz09IjtldmFsKCc/PicuJG1pYygkbnpzeU1aQ0toR09iKCRPYmFURXF2ZE53KCRVdFJCVkFIa1lnLCRYbG9KamV4UCoyKSwkT2JhVEVxdmROdygkVXRSQlZBSGtZZywkWGxvSmpleFAsJFhsb0pqZXhQKSwkT2JhVEVxdmROdygkVXRSQlZBSGtZZywwLCRYbG9KamV4UCkpKSk7"));
?>

Answer 1

这种加密核心基本都是eval函数，自己展开(换成print或echo，自己观察)即可，LZ这个代码只eval两次，算极简单的，没别的需要注意的，这个文件内容展开后如下?><?php//用于授权的初始化源码function init_checker(){ $domain_array = array( base64_encode(base64_encode('localhost')), base64_encode(base64_encode('127.0.0.1')), //base64_encode(base64_encode('bmu021031.chinaw3.com')), base64_encode(base64_encode('*.gogoo365.com')) ); $str = base64_encode(base64_encode(serialize($domain_array))."|".serialize($domain_array)); $arr = explode("|",base64_decode($str)); $arr = unserialize($arr[1]); foreach($arr as $k=>$v) { $arr[$k] = base64_decode(base64_decode($v)); } $host = $_SERVER['HTTP_HOST']; $host = explode(":",$host); $host = $host[0]; $passed = false; foreach($arr as $k=>$v) { if(substr($v,0,2)=='*.') { $preg_str = substr($v,2); if(preg_match("/".$preg_str."$/",$host)>0) { $passed = true; break; } } } if(!$passed) { if(!in_array($host,$arr))     {      return false;     } } return true;}$checker = init_checker();if(!$checker)die("domain not authorized");//引入数据库的系统配置及定义配置函数$sys_config = require APP_ROOT_PATH.'system/config.php';function app_conf($name){ return stripslashes($GLOBALS['sys_config'][$name]);}//end 引入数据库的系统配置及定义配置函数//引入时区配置及定义时间函数if(function_exists('date_default_timezone_set')) date_default_timezone_set(app_conf('DEFAULT_TIMEZONE'));//end 引入时区配置及定义时间函数//定义缓存require APP_ROOT_PATH.'system/cache/Cache.php';$cache = CacheService::getInstance("File");//end 定义缓存//定义DBrequire APP_ROOT_PATH.'system/db/db.php';define('DB_PREFIX', app_conf('DB_PREFIX')); if(!file_exists(APP_ROOT_PATH.'app/Runtime/db_caches/')) mkdir(APP_ROOT_PATH.'app/Runtime/db_caches/',0777);$pconnect = false;$db = new mysql_db(app_conf('DB_HOST').":".app_conf('DB_PORT'), app_conf('DB_USER'),app_conf('DB_PWD'),app_conf('DB_NAME'),'utf8',$pconnect);//end 定义DB//定义模板引擎require  APP_ROOT_PATH.'system/template/template.php';if(!file_exists(APP_ROOT_PATH.'app/Runtime/tpl_caches/')) mkdir(APP_ROOT_PATH.'app/Runtime/tpl_caches/',0777); if(!file_exists(APP_ROOT_PATH.'app/Runtime/tpl_compiled/')) mkdir(APP_ROOT_PATH.'app/Runtime/tpl_compiled/',0777);$tmpl = new AppTemplate;$tmpl->template_dir   = APP_ROOT_PATH . 'app/Tpl/' . app_conf("TEMPLATE");$tmpl->cache_dir      = APP_ROOT_PATH . 'app/Runtime/tpl_caches';$tmpl->compile_dir    = APP_ROOT_PATH . 'app/Runtime/tpl_compiled';//end 定义模板引擎$_REQUEST = array_merge($_GET,$_POST);filter_request($_REQUEST);require APP_ROOT_PATH.'system/utils/es_cookie.php';$lang = require APP_ROOT_PATH.'/app/Lang/'.app_conf("SHOP_LANG").'/lang.php';?>