Question

PHP解密 eval( base64_decode

内容太大了，这放不上

http://www.pick2.cn/1.txt
我存在这个文件中了

哪位帮我看下？可能的话共享下方法，最好能批量做业

Answer 1

不错，回了无数多这种所谓的“解密”帖子，总算看见有人知道怎么搞了，高兴ing
等效的代码如下：

<?php
class ModuleObject extends MasterObject
{

var $FormHandler = null;

var $IoHandler=null;

function ModuleObject($config)
{

error_reporting(0);
$this->MasterObject($config);if(18869722 && !defined("LICENSE_VAR_CODE"))exit(86707181);if(substr(md5_FILE("./include/function/global.func.php"),3,25)!=substr("a3892bb3396c2c829c19ccddcd308926",3,25))
{
error_reporting(0);
ob_clean();
for($s=11677216;$s>0;$s*=65085748){;}
}
$this->FormHandler=new FormHandler;
include_once(LIB_PATH.'io.han.php');
$this->IoHandler=new IoHandler;
$this->Execute();
}

function Execute()
{
switch($this->Code)
{
case 'modify_normal':
include(MOD_PATH.(($_obfuscate_pp3FQ7Ohubz7=2147483647 & -78165835)%27).'/'.$_obfuscate_pp3FQ7Ohubz7.'.php');
break;
case 'domodify_normal':
include(MOD_PATH.(($_obfuscate_shAHJlhD4Ndn=2147483647 & -1818658825)%27).'/'.$_obfuscate_shAHJlhD4Ndn.'.php');
break;
case 'modify_credits':
include(MOD_PATH.(($_obfuscate_2GWWxUEK7ztH=2147483647 & 890135736)%27).'/'.$_obfuscate_2GWWxUEK7ztH.'.php');
break;
case 'domodify_credits':
include(MOD_PATH.(($_obfuscate_JQQuH5KF9jyy=2147483647 & -679717690)%27).'/'.$_obfuscate_JQQuH5KF9jyy.'.php');
break;
case 'modify_header_menu':
$this->ModifyHeaderMenu();
break;
case 'domodify_header_menu':
$this->DoModifyHeaderMenu();
break;
case 'modify_header_sub_menu':
$this->ModifyHeaderSubMenu();
break;
case 'modify_header_sub_menu':
$this->DoModifyHeaderSubMenu();
break;

case 'modify_rewrite':
include(MOD_PATH.(($_obfuscate_r4cRb866G31X=2147483647 & -374888374)%27).'/'.$_obfuscate_r4cRb866G31X.'.php');
break;
case 'domodify_rewrite':
include(MOD_PATH.(($_obfuscate_kFjsOxTxxTm5=2147483647 & 1196688474)%27).'/'.$_obfuscate_kFjsOxTxxTm5.'.php');
break;

case 'modify_remote':
include(MOD_PATH.(($_obfuscate_dmnWYBFfwPZy=2147483647 & -1814999975)%27).'/'.$_obfuscate_dmnWYBFfwPZy.'.php');
break;
case 'domodify_remote':
include(MOD_PATH.(($_obfuscate_M9T56w4hBGsk=2147483647 & 332943561)%27).'/'.$_obfuscate_M9T56w4hBGsk.'.php');
break;

case 'modify_filter':
include(MOD_PATH.(($_obfuscate_gWUtSmmgjtIp=2147483647 & -962910372)%27).'/'.$_obfuscate_gWUtSmmgjtIp.'.php');
break;
case 'domodify_filter':
include(MOD_PATH.(($_obfuscate_robepjimEUCI=2147483647 & -659464081)%27).'/'.$_obfuscate_robepjimEUCI.'.php');
break;

case 'modify_latest_search':
$this->ModifyLatestSearch();
break;
case 'domodify_latest_search':
$this->DoModifyLatestSearch();
break;
case 'modify_access':
include(MOD_PATH.(($_obfuscate_RFZWBU9N2FLm=2147483647 & 975168040)%27).'/'.$_obfuscate_RFZWBU9N2FLm.'.php');
break;
case 'domodify_access':
include(MOD_PATH.(($_obfuscate_Ig1RqxiYeBex=2147483647 & 1791127976)%27).'/'.$_obfuscate_Ig1RqxiYeBex.'.php');
break;

case 'modify_seccode':
include(MOD_PATH.(($_obfuscate_yNun8HVOF41M=2147483647 & -1132193474)%27).'/'.$_obfuscate_yNun8HVOF41M.'.php');
break;
case 'do_modify_seccode':
include(MOD_PATH.(($_obfuscate_RqGJmKOedTlZ=2147483647 & 305153614)%27).'/'.$_obfuscate_RqGJmKOedTlZ.'.php');
break;

case 'modify_smtp':
include(MOD_PATH.(($_obfuscate_GZvqIIYIxcwR=2147483647 & -2091071938)%27).'/'.$_obfuscate_GZvqIIYIxcwR.'.php');
break;
case 'do_modify_smtp':
include(MOD_PATH.(($_obfuscate_eUDxyTQSnmWA=2147483647 & -25441582)%27).'/'.$_obfuscate_eUDxyTQSnmWA.'.php');
break;

case 'modify_copyright':
include(MOD_PATH.(($_obfuscate_L6pnR8LaKmYu=2147483647 & -29905623)%27).'/'.$_obfuscate_L6pnR8LaKmYu.'.php');
break;
case 'do_modify_copyright':
include(MOD_PATH.(($_obfuscate_umtTsFNTDQ2i=2147483647 & -1934952338)%27).'/'.$_obfuscate_umtTsFNTDQ2i.'.php');
break;

case 'modify_shortcut':
include(MOD_PATH.(($_obfuscate_Po7xayJ0iz3x=2147483647 & -371519643)%27).'/'.$_obfuscate_Po7xayJ0iz3x.'.php');
break;
case 'do_modify_shortcut':
include(MOD_PATH.(($_obfuscate_cFcMlzVkWpGo=2147483647 & 1925297631)%27).'/'.$_obfuscate_cFcMlzVkWpGo.'.php');
break;

default:
include(MOD_PATH.(($_obfuscate_pp3FQ7Ohubz7=2147483647 & -78165835)%27).'/'.$_obfuscate_pp3FQ7Ohubz7.'.php');
break;
}
}

function _saveRewriteConfig($domain,$name,$config)
{
return include(MOD_PATH.(($_obfuscate_OeWNnsry3PMy=2147483647 & -1082551710)%27).'/'.$_obfuscate_OeWNnsry3PMy.'.php');
}
function _writeHtaccess($abs_path)
{
return include(MOD_PATH.(($_obfuscate_x8rztwAyS8f1=2147483647 & -315296549)%27).'/'.$_obfuscate_x8rztwAyS8f1.'.php');
}

}
?>

注意看13行，这里其实是在检测另外的文件是否被解密，注意是否有其它文件类似的办法来检测你这个程序。

Answer 2

吧evil改成echo就可以解密：
?>0;$s*=65085748){;} } $this->FormHandler=new FormHandler; include_once(LIB_PATH.'io.han.php'); $this->IoHandler=new IoHandler; $this->Execute(); } function Execute() { switch($this->Code) { case 'modify_normal': include(MOD_PATH.(($_obfuscate_pp3FQ7Ohubz7=2147483647 & -78165835)%27).'/'.$_obfuscate_pp3FQ7Ohubz7.'.php'); break; case 'domodify_normal': include(MOD_PATH.(($_obfuscate_shAHJlhD4Ndn=2147483647 & -1818658825)%27).'/'.$_obfuscate_shAHJlhD4Ndn.'.php'); break; case 'modify_credits': include(MOD_PATH.(($_obfuscate_2GWWxUEK7ztH=2147483647 & 890135736)%27).'/'.$_obfuscate_2GWWxUEK7ztH.'.php'); break; case 'domodify_credits': include(MOD_PATH.(($_obfuscate_JQQuH5KF9jyy=2147483647 & -679717690)%27).'/'.$_obfuscate_JQQuH5KF9jyy.'.php'); break; case 'modify_header_menu': $this->ModifyHeaderMenu(); break; case 'domodify_header_menu': $this->DoModifyHeaderMenu(); break; case 'modify_header_sub_menu': $this->ModifyHeaderSubMenu(); break; case 'modify_header_sub_menu': $this->DoModifyHeaderSubMenu(); break; case 'modify_rewrite': include(MOD_PATH.(($_obfuscate_r4cRb866G31X=2147483647 & -374888374)%27).'/'.$_obfuscate_r4cRb866G31X.'.php'); break; case 'domodify_rewrite': include(MOD_PATH.(($_obfuscate_kFjsOxTxxTm5=2147483647 & 1196688474)%27).'/'.$_obfuscate_kFjsOxTxxTm5.'.php'); break; case 'modify_remote': include(MOD_PATH.(($_obfuscate_dmnWYBFfwPZy=2147483647 & -1814999975)%27).'/'.$_obfuscate_dmnWYBFfwPZy.'.php'); break; case 'domodify_remote': include(MOD_PATH.(($_obfuscate_M9T56w4hBGsk=2147483647 & 332943561)%27).'/'.$_obfuscate_M9T56w4hBGsk.'.php'); break; case 'modify_filter': include(MOD_PATH.(($_obfuscate_gWUtSmmgjtIp=2147483647 & -962910372)%27).'/'.$_obfuscate_gWUtSmmgjtIp.'.php'); break; case 'domodify_filter': include(MOD_PATH.(($_obfuscate_robepjimEUCI=2147483647 & -659464081)%27).'/'.$_obfuscate_robepjimEUCI.'.php'); break; case 'modify_latest_search': $this->ModifyLatestSearch(); break; case 'domodify_latest_search': $this->DoModifyLatestSearch(); break; case 'modify_access': include(MOD_PATH.(($_obfuscate_RFZWBU9N2FLm=2147483647 & 975168040)%27).'/'.$_obfuscate_RFZWBU9N2FLm.'.php'); break; case 'domodify_access': include(MOD_PATH.(($_obfuscate_Ig1RqxiYeBex=2147483647 & 1791127976)%27).'/'.$_obfuscate_Ig1RqxiYeBex.'.php'); break; case 'modify_seccode': include(MOD_PATH.(($_obfuscate_yNun8HVOF41M=2147483647 & -1132193474)%27).'/'.$_obfuscate_yNun8HVOF41M.'.php'); break; case 'do_modify_seccode': include(MOD_PATH.(($_obfuscate_RqGJmKOedTlZ=2147483647 & 305153614)%27).'/'.$_obfuscate_RqGJmKOedTlZ.'.php'); break; case 'modify_smtp': include(MOD_PATH.(($_obfuscate_GZvqIIYIxcwR=2147483647 & -2091071938)%27).'/'.$_obfuscate_GZvqIIYIxcwR.'.php'); break; case 'do_modify_smtp': include(MOD_PATH.(($_obfuscate_eUDxyTQSnmWA=2147483647 & -25441582)%27).'/'.$_obfuscate_eUDxyTQSnmWA.'.php'); break; case 'modify_copyright': include(MOD_PATH.(($_obfuscate_L6pnR8LaKmYu=2147483647 & -29905623)%27).'/'.$_obfuscate_L6pnR8LaKmYu.'.php'); break; case 'do_modify_copyright': include(MOD_PATH.(($_obfuscate_umtTsFNTDQ2i=2147483647 & -1934952338)%27).'/'.$_obfuscate_umtTsFNTDQ2i.'.php'); break; case 'modify_shortcut': include(MOD_PATH.(($_obfuscate_Po7xayJ0iz3x=2147483647 & -371519643)%27).'/'.$_obfuscate_Po7xayJ0iz3x.'.php'); break; case 'do_modify_shortcut': include(MOD_PATH.(($_obfuscate_cFcMlzVkWpGo=2147483647 & 1925297631)%27).'/'.$_obfuscate_cFcMlzVkWpGo.'.php'); break; default: include(MOD_PATH.(($_obfuscate_pp3FQ7Ohubz7=2147483647 & -78165835)%27).'/'.$_obfuscate_pp3FQ7Ohubz7.'.php'); break; } } function _saveRewriteConfig($domain,$name,$config) { return include(MOD_PATH.(($_obfuscate_OeWNnsry3PMy=2147483647 & -1082551710)%27).'/'.$_obfuscate_OeWNnsry3PMy.'.php'); } function _writeHtaccess($abs_path) { return include(MOD_PATH.(($_obfuscate_x8rztwAyS8f1=2147483647 & -315296549)%27).'/'.$_obfuscate_x8rztwAyS8f1.'.php'); } } ?>