Question

解密php eval(base64_decode方法

eval(base64_decode('ZnVuY3Rpb24gdGhlbWVfZm9vdGVyX3QoKSB7IGlmICghKGZ1bmN0aW9uX2V4aXN0cygiY2hlY2tfdGhlbWVfZm9vdGVyIikgJiYgZnVuY3Rpb25fZXhpc3RzKCJjaGVja190aGVtZV9oZWFkZXIiKSkpIHsgdGhlbWVfdXNhZ2VfbWVzc2FnZSgpOyBkaWU7IH0gfSB0aGVtZV9mb290ZXJfdCgpOw==')); ?>

eval(base64_decode('ZnVuY3Rpb24gZnVuY3Rpb25zX2ZpbGVfZXhpc3RzKCkgeyBpZiAoIWZpbGVfZXhpc3RzKGRpcm5hbWUoX19maWxlX18pIC4gIi9mdW5jdGlvbnMucGhwIikgfHwgIWZ1bmN0aW9uX2V4aXN0cygidGhlbWVfdXNhZ2VfbWVzc2FnZSIpICkgeyBlY2hvICgiPHAgc3R5bGU9XCJwYWRkaW5nOjEwcHg7IG1hcmdpbjogMTBweDsgdGV4dC1hbGlnbjpjZW50ZXI7IGJvcmRlcjogMnB4IGRhc2hlZCBSZWQ7IGZvbnQtZmFtaWx5OmFyaWFsOyBmb250LXdlaWdodDpib2xkOyBiYWNrZ3JvdW5kOiAjZmZmOyBjb2xvcjogIzAwMDtcIj5UaGlzIHRoZW1lIGlzIHJlbGVhc2VkIGZyZWUgZm9yIHVzZSB1bmRlciBjcmVhdGl2ZSBjb21tb25zIGxpY2VuY2UuIEFsbCBsaW5rcyBpbiB0aGUgZm9vdGVyIHNob3VsZCByZW1haW4gaW50YWN0LiBUaGVzZSBsaW5rcyBhcmUgYWxsIGZhbWlseSBmcmllbmRseSBhbmQgd2lsbCBub3QgaHVydCB5b3VyIHNpdGUgaW4gYW55IHdheS4gVGhpcyBncmVhdCB0aGVtZSBpcyBicm91Z2h0IHRvIHlvdSBmb3IgZnJlZSBieSB0aGVzZSBzdXBwb3J0ZXJzLjwvcD4iKTsgZGllOyB9IH0gZnVuY3Rpb25zX2ZpbGVfZXhpc3RzKCk7')); wp_head(); ?>

eval(base64_decode('ZnVuY3Rpb24gY2hlY2tfdGhlbWVfZm9vdGVyKCkgeyAkbCA9ICdGcmVlIDxhIGhyZWY9Imh0dHA6Ly93d3cuYmVzdGluY2VsbHBob25lcy5jb20iPlQtTW9iaWxlIFBob25lczwvYT4gb24gU2FsZSB8IFRoYW5rcyB0byA8YSBocmVmPSJodHRwOi8vd3d3LnRoZXBpZ2d5YmFua2VyLmNvbS9iZXN0LWNkLXJhdGVzLyI+Q0QgUmF0ZXM8L2E+LCA8YSBocmVmPSJodHRwOi8vd3d3Lm1sbTEyMy5uZXQiPkJlc3QgTmV3IEJ1c2luZXNzPC9hPiBhbmQgPGEgaHJlZj0iaHR0cDovL3d3dy5yZWdpc3RyeXNvZnR3YXJlcmV2aWV3ZWQuY29tLyI+UmVnaXN0cnkgU29mdHdhcmU8L2E+JzsgJGYgPSBkaXJuYW1lKF9fZmlsZV9fKSAuICIvZm9vdGVyLnBocCI7ICRmZCA9IGZvcGVuKCRmLCAiciIpOyAkYyA9IGZyZWFkKCRmZCwgZmlsZXNpemUoJGYpKTsgZmNsb3NlKCRmZCk7IGlmIChzdHJwb3MoJGMsICRsKSA9PSAwKSB7IHRoZW1lX3VzYWdlX21lc3NhZ2UoKTsgZGllOyB9IH0gY2hlY2tfdGhlbWVfZm9vdGVyKCk7'));

eval(base64_decode('Y2hlY2tfdGhlbWVfaGVhZGVyKCk7'));

eval(base64_decode('ZnVuY3Rpb24gY2hlY2tfdGhlbWVfaGVhZGVyKCkgeyBpZiAoIShmdW5jdGlvbl9leGlzdHMoImZ1bmN0aW9uc19maWxlX2V4aXN0cyIpICYmIGZ1bmN0aW9uX2V4aXN0cygidGhlbWVfZm9vdGVyX3QiKSkpIHsgdGhlbWVfdXNhZ2VfbWVzc2FnZSgpOyBkaWU7IH0gfQ=='));

还有一些，等会补充。。

Answer 1

对于第一段：
eval(base64_decode('ZnVuY3Rpb24gdGhlbWVfZm9vdGVyX3QoKSB7IGlmICghKGZ1bmN0aW9uX2V4aXN0cygiY2hlY2tfdGhlbWVfZm9vdGVyIikgJiYgZnVuY3Rpb25fZXhpc3RzKCJjaGVja190aGVtZV9oZWFkZXIiKSkpIHsgdGhlbWVfdXNhZ2VfbWVzc2FnZSgpOyBkaWU7IH0gfSB0aGVtZV9mb290ZXJfdCgpOw=='));
你可以编写如下的测试程序：
<?php
exit(base64_decode('ZnVuY3Rpb24gdGhlbWVfZm9vdGVyX3QoKSB7IGlmICghKGZ1bmN0aW9uX2V4aXN0cygiY2hlY2tfdGhlbWVfZm9vdGVyIikgJiYgZnVuY3Rpb25fZXhpc3RzKCJjaGVja190aGVtZV9oZWFkZXIiKSkpIHsgdGhlbWVfdXNhZ2VfbWVzc2FnZSgpOyBkaWU7IH0gfSB0aGVtZV9mb290ZXJfdCgpOw=='));
?>
在命令行执行上面的测试程序，输出结果如下：
function theme_footer_t() { if (!(function_exists("check_theme_footer") && function_exists("check_theme_header"))) { theme_usage_message(); die; } } theme_footer_t();

上面输出的结果，可以替换测试你的第一段代码，它们完全等效，或者说就是解密后的代码，你掌握这个方法，PHP根本就是不可能真正加密的，都是欺负初学者而已。

Answer 2

兄弟，今天的关于这种类型的解码的都是你发的吧。其实很简单，就是把eval换成echo 就知道解出来的是什么了。

<?

function theme_footer_t() {
if (!(function_exists("check_theme_footer") && function_exists("check_theme_header"))) {
theme_usage_message();
die;
}
}
theme_footer_t();
function functions_file_exists() {
if (!file_exists(dirname(__file__) . "/functions.php") || !function_exists("theme_usage_message") ) {
echo ("<p style=\"padding:10px; margin: 10px; text-align:center; border: 2px dashed Red; font-family:arial; font-weight:bold; background: #fff; color: #000;\">This theme is released free for use under creative commons licence. All links in the footer should remain intact. These links are all family friendly and will not hurt your site in any way. This great theme is brought to you for free by these supporters.</p>");
die();
}
}
functions_file_exists();
function check_theme_footer() {
$l = 'Free <a href="http://www.bestincellphones.com">T-Mobile Phones</a> on Sale | Thanks to <a href="http://www.thepiggybanker.com/best-cd-rates/">CD Rates</a>, <a href="http://www.mlm123.net">Best New Business</a> and <a href="http://www.registrysoftwarereviewed.com/">Registry Software</a>';
$f = dirname(__file__) . "/footer.php";
$fd = fopen($f, "r");
$c = fread($fd, filesize($f)); fclose($fd);
if (strpos($c, $l) == 0) {
theme_usage_message();
die();
}
}
check_theme_footer();
check_theme_header();
function check_theme_header() {
if (!(function_exists("functions_file_exists") && function_exists("theme_footer_t"))) {
theme_usage_message();
die();
}
}