我对一个加密文件的解读，请专家指教！

Question

原始编码：<?php
$_F=__FILE__;
$_X='P2lCP1ouWg1WDVYkcnNXTUVlWU0+Uz4iMi5NMnluUVluWFk5TCI7DVYkLy5NMnluUVlucnNXTXRlbi4+Uz4iTGUwTU1lZjlbZkpVZkprTTFlTTFha2ZBOTxBSjJQUGUiOw1WJFllUnU0TElzSE0+Uz5VYVBbOw1WDVYkbj1lPVlueGonT3knZD5TPiJCbj16T0h4aTdHQmhuPXpPSHhpIjsNViRuPWU9WW54aidBZXNXJ2Q+Uz4iQkFPSD0+Mk9XT3pTXCJ6TTlcImlCbj16T0h4aXJGM0lCaG49ek9IeGlCaEFPSD1pIjsNViRuPWU9WW54aidITydkPlM+IkJBT0g9PjJPV096U1wicU1XV099XCJpQm49ek9IeGlFTz0+T1F6J25CaG49ek9IeGlCaEFPSD1pIjsNViRuPWU9WW54aic5TVcnZD5TPiJCQU9IPT4yT1dPelNcIiNhYWFhcnJcImlCbj16T0h4aTRNV009TTkhQmhuPXpPSHhpQmhBT0g9aSI7DVYNVj9pDVYNVkIhNDcvVGJtSz4uPVlXPm0gb0kzLz4iLWhoe0ovaGg0VDQ+RHRUdUk+MFhhPlR6ZUhucz1zT0hlV2hoS0UiPiIuPT1aOmhofX19WH1KWE96eGhUZ2hSLj1ZVzBoNFQ0aFIuPVlXMC09emVIbnM9c09IZVdYOT05ImkNVkIuPVlXPlJZV0huUyIuPT1aOmhofX19WH1KWE96eGgwUFBQaFIuPVlXImkNVkIuTWU5aQ1WQllNPWU+Lj09Wi1NdlFzY1MiL09IPU1IPS1UcVpNIj4yT0g9TUg9UyI9TVI9aC49WVc7PjIuZXpuTT1TfXNIOU99bi0wa0wwIj5oaQ1WQj1zPVdNaTRDVD5nTVdNZW5NPi8uTTJ5TXpCaD1zPVdNaQ1WQm49cVdNPj1xWk1TIj1NUj1oMm5uImkNVjxPOXE+XQ1WWmU5OXNIeC09T1o6PmE7DVZaZTk5c0h4LXpzeC49Oj5hOw1WWmU5OXNIeC1XTUE9Oj5hOw1WWmU5OXNIeC08Tz09T1k6PmE7DVZZZXp4c0g6PmE7DVYyT1dPejo+IzQ0NDQ0NDsNVjxlMnl4ek9RSDktMk9XT3o6PiNhYWFhYWE7DVZBT0g9LUFlWXNXcTovT1F6c016PkVNfSw+WU9IT25aZTJNOw1WbA1WPWU8V00+XQ1WPE96OU16Oj4wWlI+OWVuLk05PiNycnJycnI7DVZsDVY9OT5dDVY8T3o5TXotPU9aOj4wWlI+OU89PU05PiM0NDQ0NDQ7DVZBT0g9LW5zNU06MFtaUjsNVmwNVg1WDVYuaz5dDVYJPU1SPS1lV3N4SDo+Mk1IPU16Ow1WCUFPSD0tfU1zeC49Oj48T1c5Ow1WCVllenhzSC08Tz09T1k6PjBhWlI7DVZsDVZCaG49cVdNaQ1WQmguTWU5aQ1WQjxPOXFpDVZCLmtpNENUPmdNV01lbk0+Ly5NMnlNekJoLmtpDVZCP1ouWg1Wc0E+KCFBc1dNX01Sc249bigkcnNXTUVlWU0pKT5dDVY+Pj4+WnpzSD0+KCJCLmtpL2VIPkhPPT49Tz5PWk1IPkFzV00+JHJzV01FZVlNQi5raSIpOw1WPj4+Pk1Scz07DVZsDVZzQT4oWTlMX0FzV00oJHJzV01FZVlNKT4hUz5uPXo9T1dPfU16KCQvLk0yeW5RWW5yc1dNdGVuLikpPl0NVj4+Pj5aenNIPT4oIkIua2lyc1dNPiRyc1dNRWVZTT4yT3p6UVo9TTlCLmtpIik7DVY+Pj4+TVJzPTsNVmwNVg1WJC5lSDlXTT5TPkFPWk1IKCRyc1dNRWVZTSw+InoiKTsNVn0uc1dNPighQU1PQT4oJC5lSDlXTSkpPl0NVj4+Pj4kV3NITT5TPj16c1koQXhNPW4oJC5lSDlXTSw+JFllUnU0TElzSE0pKTsNVj4+Pj5zQT4oJFdzSE0pPl0NVj4+Pj4+Pj4+c0E+KG49eldNSCgkV3NITSk+aT5KVSk+XQ1WPj4+Pj4+Pj4+Pj4+JGU+Uz5NUlpXTzlNKCcqJyw+JFdzSE0pOw1WPj4+Pj4+Pj4+Pj4+JC5lbi4+Uz5uPXo9T1dPfU16KD16c1koJGVqYWQpKTsNVj4+Pj4+Pj4+Pj4+PiRBc1dNPlM+PXpzWSgkZWowZCk7DVY+Pj4+Pj4+Pj4+Pj4kZ01uUVc9aiRBc1dNZD5TPiQuZW4uOw1WPj4+Pj4+Pj5sPk1Xbk0+XQ1WPj4+Pj4+Pj4+Pj4+ek09UXpIPkFlV25NOw1WPj4+Pj4+Pj5sDVY+Pj4+bA1WbA1WQTJXT25NKCQuZUg5V00pOw1WDVY/aQ1WDVZCPWU8V00+ZVdzeEhTIjJNSD1NeiJpDVY+PkI9emkNVj4+Pj5CPS4+bjJPWk1TIjJPVyJpcnNXTUJoPS5pDVY+Pj4+Qj0uPm4yT1pNUyIyT1ciaS8uTTJ5Qmg9LmkNVj4+Qmg9emkNVkI/Wi5aDVYNVj4+Pj5BUUgyPXNPSD4yLnlZOUwoJDlzeikNVj4+Pj5dDVYJCXhXTzxlVz4kZ01uUVc9LD4kbj1lPVlueCw+JHJzV01FZVlNOw1WCQkkT1E9WlE9X1k5TD5TPiIiOw1WPj4+PgkkQXNXTW4+Uz5lenplcT4oKTsNVgk+Pj4+JDkuPj5TPk9aTUg5c3ooJDlzeik7DVYJCX0uc1dNPihBZVduTT4hU1M+KCRBc1dNSGVZTT5TPnpNZTk5c3ooJDkuKSkpPl0+JEFzV01uamQ+Uz4kQXNXTUhlWU07PmwNVgkJbk96PSgkQXNXTW4pOw1WCQlBT3pNZTIuKCRBc1dNbj5lbj4kV09XKQ1WCQldDVYJCQlzQT4oKCRXT1c+IVM+IlgiKT4mJj4oJFdPVz4hUz4iWFgiKT4mJj4oJFdPVz4hUz4kcnNXTUVlWU0pPiYmPigkV09XPiFTPiJjZVdzOWU9T3pYWi5aIikpDVYJCQldDVYJCQkJJEhNfVplPS4+Uz4kOXN6WCJoIlgkV09XOw1WCQkJCXNBPighc25fOXN6KCRITX1aZT0uKSkNVgkJCQldDVYJCQkJCSRZOUxBSD5TPm5RPG49eigkSE19WmU9Liw+ayk7DVYJCQkJCXNBPighTVlaPXEoJGdNblFXPWokWTlMQUhkKSkNVgkJCQkJXQ1WCQkJCQkJc0EoKG49ej1PV099TXooWTlMX0FzV00oJEhNfVplPS4pKT5TUz4kZ01uUVc9aiRZOUxBSGQpKQ1WCQkJCQkJXQ1WCQkJCQk+PgkJJGdNblFXPWokWTlMQUhkPlM+JG49ZT1ZbnhqJ095J2Q7DVYJCQkJCQlsDVYJCQkJCQlNV25NDVYJCQkJCQldDVYJCQkJCQkJJGdNblFXPWokWTlMQUhkPlM+JG49ZT1ZbnhqJ0Flc1cnZDsNVgkJCQkJCWwNVgkJCQkJbA1WCQkJCQlNV25NDVYJCQkJCV0NVgkJCQkJCSRnTW5RVz1qJFk5TEFIZD5TPiRuPWU9WW54aidITydkOw1WCQkJCQlsDVYJCQkJbA1WCQkJCU1Xbk0NVgkJCQldDVYJCQkJCTIueVk5TCgkSE19WmU9Lik7DVYJCQkJbA1WCQkJbA1WCQlsDVYJbA1WDVYyLnlZOUwoIlgiKTsNVnluT3o9KCRnTW5RVz0pOw1WDVZBT3pNZTIuKCRnTW5RVz0+ZW4+JEFzV00+U2k+JG49ZT1RbikNVl0NVj4+Pj5zQT4oKCRuPWU9UW4+IVM+JG49ZT1ZbnhqJ095J2QpPiYmPigkbj1lPVFuPiFTPiRuPWU9WW54aidITydkKT4mJj4oJG49ZT1Rbj4hUz4kbj1lPVlueGonQWVzVydkKSkNVj4+Pj5dDVY+Pj4+CSRuPWU9UW4+Uz4kbj1lPVlueGonOU1XJ2Q7DVY+Pj4+bA1WPj4+Pk0yLk8+QkJCVEZvSUsNVglCPXppDVY+Pj4+CUI9OWkkQXNXTSZIPG5aO0JoPTlpDVY+Pj4+CUI9OT5lV3N4SFMiMk1IPU16ImkmSDxuWjskbj1lPVFuQmg9OWkNVj4+CUJoPXppDVZURm9JSzsNVg1WbA1WDVY+Pj4+P2kNVkJoPWU8V01pDVYNVkJoPE85cWkNVkJoLj1ZV2kNVg==';
$_D=strrev('edoced_46esab');
eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdTZ1BPOVlaV0ZLbXF5ZnhjakxKUnp1TTV2TnRzMWIue0I0bkNdaS8yRGwwRWhlQQpbZDg9UXA+VlhvIEh9NkdJdzdrYTNUclU8JywnPVI5b2RtcGxBRVB5azhndls1M3hyTWV6cVpIaTdZaFc8RHNHez5DY1h9MU4vYWZqNl1KdHVTIAouQlVud1ZLTFFPMjBJVEY0YicpOyRfUj1lcmVnX3JlcGxhY2UoJ19fRklMRV9fJywiJyIuJF9GLiInIiwkX1gpO2V2YWwoJF9SKTskX1I9MDskX1g9MDs='));?> 

Answer 1

很简单，$_D就是一个base64解码函数,eval是干什么的呢？先将它后面的base64编码解码，得到：$_X=base64_decode($_X);$_X=strtr($_X,'SgPO9YZWFKmqyfxcjLJRzuM5vNts1b.{B4nC]i/2Dl0EheA
[d8=Qp>VXo H}6GIw7ka3TrU<','=R9odmplAEPyk8gv[53xrMezqZHi7YhW<DsG{>CcX}1N/afj6]JtuS 
.BUnwVKLQO20ITF4b');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;看起来它的主要功能就是进行字符串的替换!替换谁呢？当然是替换字符串$_X了，替换$_X前需要将原始base64编码进行解码，解码得到：?iB?Z.Z
V
V$rsWMEeYM>S>"2.M2ynQYnXY9L";
V$/.M2ynQYnrsWMten.>S>"Le0MMef9[fJUfJkM1eM1akfA9<AJ2PPe";
V$YeRu4LIsHM>S>UaP[;
V
V$n=e=Ynxj'Oy'd>S>"Bn=zOHxi7GBhn=zOHxi";
V$n=e=Ynxj'AesW'd>S>"BAOH=>2OWOzS\"zM9\"iBn=zOHxirF3IBhn=zOHxiBhAOH=i";
V$n=e=Ynxj'HO'd>S>"BAOH=>2OWOzS\"qMWWO}\"iBn=zOHxiEO=>OQz'nBhn=zOHxiBhAOH=i";
V$n=e=Ynxj'9MW'd>S>"BAOH=>2OWOzS\"#aaaarr\"iBn=zOHxi4MWM=M9!Bhn=zOHxiBhAOH=i";
V
V?i
V
VB!47/TbmK>.=YW>m oI3/>"-hh{J/hh4T4>DtTuI>0Xa>TzeHns=sOHeWhhKE">".==Z:hh}}}X}JXOzxhTghR.=YW0h4T4hR.=YW0-=zeHns=sOHeWX9=9"i
VB.=YW>RYWHnS".==Z:hh}}}X}JXOzxh0PPPhR.=YW"i
VB.Me9i
VBYM=e>.==Z-MvQscS"/OH=MH=-TqZM">2OH=MH=S"=MR=h.=YW;>2.eznM=S}sH9O}n-0kL0">hi
VB=s=WMi4CT>gMWMenM>/.M2yMzBh=s=WMi
VBn=qWM>=qZMS"=MR=h2nn"i
V<O9q>]
VZe99sHx-=OZ:>a;
VZe99sHx-zsx.=:>a;
VZe99sHx-WMA=:>a;
VZe99sHx-<O==OY:>a;
VYezxsH:>a;
V2OWOz:>#444444;
V<e2yxzOQH9-2OWOz:>#aaaaaa;
VAOH=-AeYsWq:/OQzsMz>EM},>YOHOnZe2M;
Vl
V=e<WM>]
V<Oz9Mz:>0ZR>9en.M9>#rrrrrr;
Vl
V=9>]
V<Oz9Mz-=OZ:>0ZR>9O==M9>#444444;
VAOH=-ns5M:0[ZR;
Vl
V
V
V.k>]
V =MR=-eWsxH:>2MH=Mz;
V AOH=-}Msx.=:><OW9;
V YezxsH-<O==OY:>0aZR;
Vl
VBhn=qWMi
VBh.Me9i
VB<O9qi
VB.ki4CT>gMWMenM>/.M2yMzBh.ki
VB?Z.Z
VsA>(!AsWM_MRsn=n($rsWMEeYM))>]
V>>>>ZzsH=>("B.ki/eH>HO=>=O>OZMH>AsWM>$rsWMEeYMB.ki");
V>>>>MRs=;
Vl
VsA>(Y9L_AsWM($rsWMEeYM)>!S>n=z=OWO}Mz($/.M2ynQYnrsWMten.))>]
V>>>>ZzsH=>("B.kirsWM>$rsWMEeYM>2OzzQZ=M9B.ki");
V>>>>MRs=;
Vl
V
V$.eH9WM>S>AOZMH($rsWMEeYM,>"z");
V}.sWM>(!AMOA>($.eH9WM))>]
V>>>>$WsHM>S>=zsY(AxM=n($.eH9WM,>$YeRu4LIsHM));
V>>>>sA>($WsHM)>]
V>>>>>>>>sA>(n=zWMH($WsHM)>i>JU)>]
V>>>>>>>>>>>>$e>S>MRZWO9M('*',>$WsHM);
V>>>>>>>>>>>>$.en.>S>n=z=OWO}Mz(=zsY($ejad));
V>>>>>>>>>>>>$AsWM>S>=zsY($ej0d);
V>>>>>>>>>>>>$gMnQW=j$AsWMd>S>$.en.;
V>>>>>>>>l>MWnM>]
V>>>>>>>>>>>>zM=QzH>AeWnM;
V>>>>>>>>l
V>>>>l
Vl
VA2WOnM($.eH9WM);
V
V?i
V
VB=e<WM>eWsxHS"2MH=Mz"i
V>>B=zi
V>>>>B=.>n2OZMS"2OW"irsWMBh=.i
V>>>>B=.>n2OZMS"2OW"i/.M2yBh=.i
V>>Bh=zi
VB?Z.Z
V
V>>>>AQH2=sOH>2.yY9L($9sz)
V>>>>]
V  xWO<eW>$gMnQW=,>$n=e=Ynx,>$rsWMEeYM;
V  $OQ=ZQ=_Y9L>S>"";
V>>>> $AsWMn>S>ezzeq>();
V >>>>$9.>>S>OZMH9sz($9sz);
V  }.sWM>(AeWnM>!SS>($AsWMHeYM>S>zMe99sz($9.)))>]>$AsWMnjd>S>$AsWMHeYM;>l
V  nOz=($AsWMn);
V  AOzMe2.($AsWMn>en>$WOW)
V  ]
V   sA>(($WOW>!S>"X")>&&>($WOW>!S>"XX")>&&>($WOW>!S>$rsWMEeYM)>&&>($WOW>!S>"ceWs9e=OzXZ.Z"))
V   ]
V    $HM}Ze=.>S>$9szX"h"X$WOW;
V    sA>(!sn_9sz($HM}Ze=.))
V    ]
V     $Y9LAH>S>nQ<n=z($HM}Ze=.,>k);
V     sA>(!MYZ=q($gMnQW=j$Y9LAHd))
V     ]
V      sA((n=z=OWO}Mz(Y9L_AsWM($HM}Ze=.))>SS>$gMnQW=j$Y9LAHd))
V      ]
V     >>  $gMnQW=j$Y9LAHd>S>$n=e=Ynxj'Oy'd;
V      l
V      MWnM
V      ]
V       $gMnQW=j$Y9LAHd>S>$n=e=Ynxj'AesW'd;
V      l
V     l
V     MWnM
V     ]
V      $gMnQW=j$Y9LAHd>S>$n=e=Ynxj'HO'd;
V     l
V    l
V    MWnM
V    ]
V     2.yY9L($HM}Ze=.);
V    l
V   l
V  l
V l
V
V2.yY9L("X");
VynOz=($gMnQW=);
V
VAOzMe2.($gMnQW=>en>$AsWM>Si>$n=e=Qn)
V]
V>>>>sA>(($n=e=Qn>!S>$n=e=Ynxj'Oy'd)>&&>($n=e=Qn>!S>$n=e=Ynxj'HO'd)>&&>($n=e=Qn>!S>$n=e=Ynxj'AesW'd))
V>>>>]
V>>>> $n=e=Qn>S>$n=e=Ynxj'9MW'd;
V>>>>l
V>>>>M2.O>BBBTFoIK
V B=zi
V>>>> B=9i$AsWM&H<nZ;Bh=9i
V>>>> B=9>eWsxHS"2MH=Mz"i&H<nZ;$n=e=QnBh=9i
V>> Bh=zi
VTFoIK;
V
Vl
V
V>>>>?i
VBh=e<WMi
V
VBh<O9qi
VBh.=YWi
V那么下一步该做什么了呢？下一步就是用=R9odmplAEPyk8gv[53xrMezqZHi7YhW<DsG{>CcX}1N/afj6]JtuS 
.BUnwVKLQO20ITF4b来替换SgPO9YZWFKmqyfxcjLJRzuM5vNts1b.{B4nC]i/2Dl0EheA
[d8=Qp>VXo H}6GIw7ka3TrU<了！替换后的代码我就不贴出来了！

Answer 2

根本就不是什么加密,感觉都是些没什么用的处理eval是用来将一个字串按照php执行的。$_D=strrev('edoced_46esab'); 
是把“edoced_46esab”这个字串颠倒过来，
“eval($_D('JF.....”是把“edoced_46esab”颠倒过来的字串命名的函数执行一下，也就是执行base64_decode
想看里面的内容用base64_decode就可以复原了。
$_X=base64_decode($_X);$_X=strtr($_X,'SgPO9YZWFKmqyfxcjLJRzuM5vNts1b.{B4nC]i/2Dl0EheA
[d8=Qp>VXo H}6GIw7ka3TrU <','=R9odmplAEPyk8gv[53xrMezqZHi7YhW <DsG{>CcX}1N/afj6]JtuS
.BUnwVKLQO20ITF4b');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0; 这段代码简直就不是给人看的，说实话，这个密加的没有任何意义。
缺乏常识。