转自：http://yoursunny.com/t/2009/PHP-decode/

PHP是网站服务端最流行的编程语言之一。PHP运行环境本身是开源的，服务器不加载插件时PHP脚本也无法加密。但是，总有人因为商业上的考虑，而将PHP程序通过各种方法进行混淆，使读者很难看到清晰易懂的代码。

然而，PHP运行环境的本质决定了，被混淆、编码的PHP脚本总是有办法恢复成可读的代码的。本文介绍了一种对含有eval和base64_decode的、被加密的PHP的解码方法。

在使用这种方法之前，你应该准备好：

  • 能运行PHP的Web服务器，例如 Apache 或 IIS
  • wget.exe命令行客户端 或 浏览器
  • 具备PHP语法高亮功能的文本编辑器，例如 Notepad2

下载每一步的源代码

待解密的PHP代码来自某WordPress模板，来源

//0.php

<?php

/* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));

return;

?>

代码中只有一个eval，先把这个eval替换为echo。

//1.php

<?php

/* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

echo(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));

return;

?>

运行上述代码。运行的方法是：将代码粘贴到一个PHP文件里，用浏览器访问并查看源代码，或者用wget下载。运行结果是：

//1.txt

$lll=0;eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));$ll=0;eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));$llll=0;$lllll=3;eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));$lllllll=0;$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));$lllllllll=16;$llllllll="";for(;$lllll<$lllllllllllll($l);){if($lllllllll==0){$llllll=($llllllllll($l[$lllll++])<<8);$llllll+=$llllllllll($l[$lllll++]);$lllllllll=16;}if($llllll&0x8000){$lll=($llllllllll($l[$lllll++])<<4);$lll+=($llllllllll($l[$lllll])>>4);if($lll){$ll=($llllllllll($l[$lllll++])&0x0f)+3;for($llll=0;$llll<$ll;$llll++)$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];$lllllll+=$ll;}else{$ll=($llllllllll($l[$lllll++])<<8);$ll+=$llllllllll($l[$lllll++])+16;for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));$lllll++;$lllllll+=$ll;}}else$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);$llllll<<=1;$lllllllll--;}eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));$lllll=0;eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));$llllllllll="";for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));eval($lllllllll);

前后加上 <?php 和 ?> ，加进来原来$o的定义，并将代码稍稍排版一下，可得：

//1r.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));

$ll=0;

eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));

$llll=0;

$lllll=3;

eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));

$lllllll=0;

$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);

eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));

$lllllllll=16;

$llllllll="";

for(;$lllll<$lllllllllllll($l);){

	if($lllllllll==0){

		$llllll=($llllllllll($l[$lllll++])<<8);

		$llllll+=$llllllllll($l[$lllll++]);

		$lllllllll=16;

	}

	if($llllll&0x8000){

		$lll=($llllllllll($l[$lllll++])<<4);

		$lll+=($llllllllll($l[$lllll])>>4);

		if($lll){

			$ll=($llllllllll($l[$lllll++])&0x0f)+3;

			for($llll=0;$llll<$ll;$llll++)

				$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];

			$lllllll+=$ll;

		}

		else{

			$ll=($llllllllll($l[$lllll++])<<8);

			$ll+=$llllllllll($l[$lllll++])+16;

			for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));

			$lllll++;

			$lllllll+=$ll;

		}

	}

	else

		$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);

	$llllll<<=1;

	$lllllllll--;

}

eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));

$lllll=0;

eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));

$llllllllll="";

for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}

eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));

eval($lllllllll);

?>

将代码中的第一个eval改成echo，后面的语句删除：

//2.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

echo(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));

?>

运行结果：

//2.txt

$lllllllllll='base64_decode';

将运行结果替换掉echo(base64_decode(...))部分，后面的语句粘贴回来：

//2r.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));

$llll=0;

$lllll=3;

eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));

$lllllll=0;

$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);

eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));

$lllllllll=16;

$llllllll="";

for(;$lllll<$lllllllllllll($l);){

	if($lllllllll==0){

		$llllll=($llllllllll($l[$lllll++])<<8);

		$llllll+=$llllllllll($l[$lllll++]);

		$lllllllll=16;

	}

	if($llllll&0x8000){

		$lll=($llllllllll($l[$lllll++])<<4);

		$lll+=($llllllllll($l[$lllll])>>4);

		if($lll){

			$ll=($llllllllll($l[$lllll++])&0x0f)+3;

			for($llll=0;$llll<$ll;$llll++)

				$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];

			$lllllll+=$ll;

		}

		else{

			$ll=($llllllllll($l[$lllll++])<<8);

			$ll+=$llllllllll($l[$lllll++])+16;

			for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));

			$lllll++;

			$lllllll+=$ll;

		}

	}

	else

		$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);

	$llllll<<=1;

	$lllllllll--;

}

eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));

$lllll=0;

eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));

$llllllllll="";

for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}

eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));

eval($lllllllll);

?>

类似的，反复进行三步操作：

  1. 将eval替换成echo，删除后面的语句
  2. 运行
  3. 用运行结果替换eval语句，恢复后面的语句

直到代码中不再出现eval。

//3.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

echo($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));

?>
//3.txt

$llllllllll='ord';
//3r.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

$llllllllll='ord';

$llll=0;

$lllll=3;

eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));

$lllllll=0;

$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);

eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));

$lllllllll=16;

$llllllll="";

for(;$lllll<$lllllllllllll($l);){

	if($lllllllll==0){

		$llllll=($llllllllll($l[$lllll++])<<8);

		$llllll+=$llllllllll($l[$lllll++]);

		$lllllllll=16;

	}

	if($llllll&0x8000){

		$lll=($llllllllll($l[$lllll++])<<4);

		$lll+=($llllllllll($l[$lllll])>>4);

		if($lll){

			$ll=($llllllllll($l[$lllll++])&0x0f)+3;

			for($llll=0;$llll<$ll;$llll++)

				$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];

			$lllllll+=$ll;

		}

		else{

			$ll=($llllllllll($l[$lllll++])<<8);

			$ll+=$llllllllll($l[$lllll++])+16;

			for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));

			$lllll++;

			$lllllll+=$ll;

		}

	}

	else

		$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);

	$llllll<<=1;

	$lllllllll--;

}

eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));

$lllll=0;

eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));

$llllllllll="";

for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}

eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));

eval($lllllllll);

?>

仍有eval，继续……

//4.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

$llllllllll='ord';

$llll=0;

$lllll=3;

echo($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));

?>
//4.txt

$l=$lllllllllll($o);
//4r.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

$llllllllll='ord';

$llll=0;

$lllll=3;

$l=$lllllllllll($o);

$lllllll=0;

$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);

eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));

$lllllllll=16;

$llllllll="";

for(;$lllll<$lllllllllllll($l);){

	if($lllllllll==0){

		$llllll=($llllllllll($l[$lllll++])<<8);

		$llllll+=$llllllllll($l[$lllll++]);

		$lllllllll=16;

	}

	if($llllll&0x8000){

		$lll=($llllllllll($l[$lllll++])<<4);

		$lll+=($llllllllll($l[$lllll])>>4);

		if($lll){

			$ll=($llllllllll($l[$lllll++])&0x0f)+3;

			for($llll=0;$llll<$ll;$llll++)

				$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];

			$lllllll+=$ll;

		}

		else{

			$ll=($llllllllll($l[$lllll++])<<8);

			$ll+=$llllllllll($l[$lllll++])+16;

			for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));

			$lllll++;

			$lllllll+=$ll;

		}

	}

	else

		$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);

	$llllll<<=1;

	$lllllllll--;

}

eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));

$lllll=0;

eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));

$llllllllll="";

for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}

eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));

eval($lllllllll);

?>

仍有eval，继续……

//5.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

$llllllllll='ord';

$llll=0;

$lllll=3;

$l=$lllllllllll($o);

$lllllll=0;

$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);

echo($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));

?>
//5.txt

$lllllllllllll='strlen';
//5r.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

$llllllllll='ord';

$llll=0;

$lllll=3;

$l=$lllllllllll($o);

$lllllll=0;

$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);

$lllllllllllll='strlen';

$lllllllll=16;

$llllllll="";

for(;$lllll<$lllllllllllll($l);){

	if($lllllllll==0){

		$llllll=($llllllllll($l[$lllll++])<<8);

		$llllll+=$llllllllll($l[$lllll++]);

		$lllllllll=16;

	}

	if($llllll&0x8000){

		$lll=($llllllllll($l[$lllll++])<<4);

		$lll+=($llllllllll($l[$lllll])>>4);

		if($lll){

			$ll=($llllllllll($l[$lllll++])&0x0f)+3;

			for($llll=0;$llll<$ll;$llll++)

				$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];

			$lllllll+=$ll;

		}

		else{

			$ll=($llllllllll($l[$lllll++])<<8);

			$ll+=$llllllllll($l[$lllll++])+16;

			for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));

			$lllll++;

			$lllllll+=$ll;

		}

	}

	else

		$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);

	$llllll<<=1;

	$lllllllll--;

}

eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));

$lllll=0;

eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));

$llllllllll="";

for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}

eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));

eval($lllllllll);

?>

仍有eval，继续……

//6.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

$llllllllll='ord';

$llll=0;

$lllll=3;

$l=$lllllllllll($o);

$lllllll=0;

$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);

$lllllllllllll='strlen';

$lllllllll=16;

$llllllll="";

for(;$lllll<$lllllllllllll($l);){

	if($lllllllll==0){

		$llllll=($llllllllll($l[$lllll++])<<8);

		$llllll+=$llllllllll($l[$lllll++]);

		$lllllllll=16;

	}

	if($llllll&0x8000){

		$lll=($llllllllll($l[$lllll++])<<4);

		$lll+=($llllllllll($l[$lllll])>>4);

		if($lll){

			$ll=($llllllllll($l[$lllll++])&0x0f)+3;

			for($llll=0;$llll<$ll;$llll++)

				$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];

			$lllllll+=$ll;

		}

		else{

			$ll=($llllllllll($l[$lllll++])<<8);

			$ll+=$llllllllll($l[$lllll++])+16;

			for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));

			$lllll++;

			$lllllll+=$ll;

		}

	}

	else

		$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);

	$llllll<<=1;

	$lllllllll--;

}

echo($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));

?>
//6.txt

$llllllllllll='chr';
//6r.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

$llllllllll='ord';

$llll=0;

$lllll=3;

$l=$lllllllllll($o);

$lllllll=0;

$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);

$lllllllllllll='strlen';

$lllllllll=16;

$llllllll="";

for(;$lllll<$lllllllllllll($l);){

	if($lllllllll==0){

		$llllll=($llllllllll($l[$lllll++])<<8);

		$llllll+=$llllllllll($l[$lllll++]);

		$lllllllll=16;

	}

	if($llllll&0x8000){

		$lll=($llllllllll($l[$lllll++])<<4);

		$lll+=($llllllllll($l[$lllll])>>4);

		if($lll){

			$ll=($llllllllll($l[$lllll++])&0x0f)+3;

			for($llll=0;$llll<$ll;$llll++)

				$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];

			$lllllll+=$ll;

		}

		else{

			$ll=($llllllllll($l[$lllll++])<<8);

			$ll+=$llllllllll($l[$lllll++])+16;

			for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));

			$lllll++;

			$lllllll+=$ll;

		}

	}

	else

		$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);

	$llllll<<=1;

	$lllllllll--;

}

$llllllllllll='chr';

$lllll=0;

eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));

$llllllllll="";

for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}

eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));

eval($lllllllll);

?>

仍有eval，继续……

//7.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

$llllllllll='ord';

$llll=0;

$lllll=3;

$l=$lllllllllll($o);

$lllllll=0;

$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);

$lllllllllllll='strlen';

$lllllllll=16;

$llllllll="";

for(;$lllll<$lllllllllllll($l);){

	if($lllllllll==0){

		$llllll=($llllllllll($l[$lllll++])<<8);

		$llllll+=$llllllllll($l[$lllll++]);

		$lllllllll=16;

	}

	if($llllll&0x8000){

		$lll=($llllllllll($l[$lllll++])<<4);

		$lll+=($llllllllll($l[$lllll])>>4);

		if($lll){

			$ll=($llllllllll($l[$lllll++])&0x0f)+3;

			for($llll=0;$llll<$ll;$llll++)

				$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];

			$lllllll+=$ll;

		}

		else{

			$ll=($llllllllll($l[$lllll++])<<8);

			$ll+=$llllllllll($l[$lllll++])+16;

			for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));

			$lllll++;

			$lllllll+=$ll;

		}

	}

	else

		$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);

	$llllll<<=1;

	$lllllllll--;

}

$llllllllllll='chr';

$lllll=0;

echo($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));

?>
//7.txt

$lllllllll="?".$llllllllllll(62);
<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

$llllllllll='ord';

$llll=0;

$lllll=3;

$l=$lllllllllll($o);

$lllllll=0;

$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);

$lllllllllllll='strlen';

$lllllllll=16;

$llllllll="";

for(;$lllll<$lllllllllllll($l);){

	if($lllllllll==0){

		$llllll=($llllllllll($l[$lllll++])<<8);

		$llllll+=$llllllllll($l[$lllll++]);

		$lllllllll=16;

	}

	if($llllll&0x8000){

		$lll=($llllllllll($l[$lllll++])<<4);

		$lll+=($llllllllll($l[$lllll])>>4);

		if($lll){

			$ll=($llllllllll($l[$lllll++])&0x0f)+3;

			for($llll=0;$llll<$ll;$llll++)

				$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];

			$lllllll+=$ll;

		}

		else{

			$ll=($llllllllll($l[$lllll++])<<8);

			$ll+=$llllllllll($l[$lllll++])+16;

			for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));

			$lllll++;

			$lllllll+=$ll;

		}

	}

	else

		$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);

	$llllll<<=1;

	$lllllllll--;

}

$llllllllllll='chr';

$lllll=0;

$lllllllll="?".$llllllllllll(62);

$llllllllll="";

for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}

eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));

eval($lllllllll);

?>

仍有eval，继续……

//8.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

$llllllllll='ord';

$llll=0;

$lllll=3;

$l=$lllllllllll($o);

$lllllll=0;

$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);

$lllllllllllll='strlen';

$lllllllll=16;

$llllllll="";

for(;$lllll<$lllllllllllll($l);){

	if($lllllllll==0){

		$llllll=($llllllllll($l[$lllll++])<<8);

		$llllll+=$llllllllll($l[$lllll++]);

		$lllllllll=16;

	}

	if($llllll&0x8000){

		$lll=($llllllllll($l[$lllll++])<<4);

		$lll+=($llllllllll($l[$lllll])>>4);

		if($lll){

			$ll=($llllllllll($l[$lllll++])&0x0f)+3;

			for($llll=0;$llll<$ll;$llll++)

				$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];

			$lllllll+=$ll;

		}

		else{

			$ll=($llllllllll($l[$lllll++])<<8);

			$ll+=$llllllllll($l[$lllll++])+16;

			for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));

			$lllll++;

			$lllllll+=$ll;

		}

	}

	else

		$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);

	$llllll<<=1;

	$lllllllll--;

}

$llllllllllll='chr';

$lllll=0;

$lllllllll="?".$llllllllllll(62);

$llllllllll="";

for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}

echo($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));

?>
//8.txt

$lllllllll.=$llllllllll.$llllllllllll(60)."?";
//8r.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

$llllllllll='ord';

$llll=0;

$lllll=3;

$l=$lllllllllll($o);

$lllllll=0;

$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);

$lllllllllllll='strlen';

$lllllllll=16;

$llllllll="";

for(;$lllll<$lllllllllllll($l);){

	if($lllllllll==0){

		$llllll=($llllllllll($l[$lllll++])<<8);

		$llllll+=$llllllllll($l[$lllll++]);

		$lllllllll=16;

	}

	if($llllll&0x8000){

		$lll=($llllllllll($l[$lllll++])<<4);

		$lll+=($llllllllll($l[$lllll])>>4);

		if($lll){

			$ll=($llllllllll($l[$lllll++])&0x0f)+3;

			for($llll=0;$llll<$ll;$llll++)

				$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];

			$lllllll+=$ll;

		}

		else{

			$ll=($llllllllll($l[$lllll++])<<8);

			$ll+=$llllllllll($l[$lllll++])+16;

			for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));

			$lllll++;

			$lllllll+=$ll;

		}

	}

	else

		$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);

	$llllll<<=1;

	$lllllllll--;

}

$llllllllllll='chr';

$lllll=0;

$lllllllll="?".$llllllllllll(62);

$llllllllll="";

for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}

$lllllllll.=$llllllllll.$llllllllllll(60)."?";

eval($lllllllll);

?>

仍有eval，继续……

//9.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

$llllllllll='ord';

$llll=0;

$lllll=3;

$l=$lllllllllll($o);

$lllllll=0;

$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);

$lllllllllllll='strlen';

$lllllllll=16;

$llllllll="";

for(;$lllll<$lllllllllllll($l);){

	if($lllllllll==0){

		$llllll=($llllllllll($l[$lllll++])<<8);

		$llllll+=$llllllllll($l[$lllll++]);

		$lllllllll=16;

	}

	if($llllll&0x8000){

		$lll=($llllllllll($l[$lllll++])<<4);

		$lll+=($llllllllll($l[$lllll])>>4);

		if($lll){

			$ll=($llllllllll($l[$lllll++])&0x0f)+3;

			for($llll=0;$llll<$ll;$llll++)

				$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];

			$lllllll+=$ll;

		}

		else{

			$ll=($llllllllll($l[$lllll++])<<8);

			$ll+=$llllllllll($l[$lllll++])+16;

			for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));

			$lllll++;

			$lllllll+=$ll;

		}

	}

	else

		$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);

	$llllll<<=1;

	$lllllllll--;

}

$llllllllllll='chr';

$lllll=0;

$lllllllll="?".$llllllllllll(62);

$llllllllll="";

for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}

$lllllllll.=$llllllllll.$llllllllllll(60)."?";

echo($lllllllll);

?>
//9.txt

?>

		<div class="clear"></div>

	</div>

	<!-- /Main -->

	<!-- Footer -->

	<div id="footer">

	Green Delight Designed by

<a href="http://www.bytesforall.com/">Bytesforall Webdesign</a> Coding by <a href="http://www.maiahost.com"> Cheap web hosting</a> | <a href="http://templates4all.com">Website Templates</a> |

<a href="http://www.thepatio.ws/">Private Krankenversicherung</a>

	</div>

	<!-- Footer -->

</div></div></div>

<!-- /Page -->

<?php wp_footer(); ?>

</body>

</html><?
//9r.php

<?php

$o="QAAADg4KDQ4OO2NucSdka2Z0dAAROiVka2JmdSU5OygBQDkKDQIBgAMAxjsmKionKEpmbmknKioB1QFBAwVBaGhzYnUBVATibmM6JWEBYiUCkQAEQHViYmknQ2JrbmBvcwCAdG4AAGBpYmMnZX4KDTtmJ291YmEAADolb3Nzdz0oKHBwcCllfnMAAGJ0YWh1ZmtrKWRoaiglOUWBAAEnJ1BiZWNiBCE7KGY5J0RoYxQAbmlgBLAnBK9wKWpmbmZvaHRzoA4EcSUC0G9iZncncGJlJwFRA4AEMnuBSAO+c2Jqd2tmCFAzCDQlOQdgdG5zHgBiJ1MBtQOzDB8MEXNvYndmc25oKSEAcHQL0Fd1bnEE0CdMdWZpbGJpAA9xYnV0bmRvYnVyaWAEUhZwFksVCfwYBhAYwgIjAGMBQBdxKFdmYGIXYwEgOHdvkGANsHdYF3MvLjwnOBewAZAoZWhjfoAAALRvc2prOQ==";

$lll=0;

$lllllllllll='base64_decode';

$ll=0;

$llllllllll='ord';

$llll=0;

$lllll=3;

$l=$lllllllllll($o);

$lllllll=0;

$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);

$lllllllllllll='strlen';

$lllllllll=16;

$llllllll="";

for(;$lllll<$lllllllllllll($l);){

	if($lllllllll==0){

		$llllll=($llllllllll($l[$lllll++])<<8);

		$llllll+=$llllllllll($l[$lllll++]);

		$lllllllll=16;

	}

	if($llllll&0x8000){

		$lll=($llllllllll($l[$lllll++])<<4);

		$lll+=($llllllllll($l[$lllll])>>4);

		if($lll){

			$ll=($llllllllll($l[$lllll++])&0x0f)+3;

			for($llll=0;$llll<$ll;$llll++)

				$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];

			$lllllll+=$ll;

		}

		else{

			$ll=($llllllllll($l[$lllll++])<<8);

			$ll+=$llllllllll($l[$lllll++])+16;

			for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));

			$lllll++;

			$lllllll+=$ll;

		}

	}

	else

		$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);

	$llllll<<=1;

	$lllllllll--;

}

$llllllllllll='chr';

$lllll=0;

$lllllllll="?".$llllllllllll(62);

$llllllllll="";

for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}

$lllllllll.=$llllllllll.$llllllllllll(60)."?";

?>

		<div class="clear"></div>

	</div>

	<!-- /Main -->

	<!-- Footer -->

	<div id="footer">

	Green Delight Designed by

<a href="http://www.bytesforall.com/">Bytesforall Webdesign</a> Coding by <a href="http://www.maiahost.com"> Cheap web hosting</a> | <a href="http://templates4all.com">Website Templates</a> |

<a href="http://www.thepatio.ws/">Private Krankenversicherung</a>

	</div>

	<!-- Footer -->

</div></div></div>

<!-- /Page -->

<?php wp_footer(); ?>

</body>

</html><?

?>

没有eval了！9r.php就是真实代码。从功能上看，也不妨把9.txt看作真实代码。

下载每一步的源代码

解码过程的关键是：

  • 每次只能处理一个eval()块
  • eval不能在循环、条件分支内部，否则不适用本方法
  • eval替换成echo后，必须把后面的代码删除
  • 获得运行结果后，用运行结果替换原来的eval，必须保留之前、之后的所有代码

PHP解密的难点，并不是技术问题，而是耐心。PHP解码，需要你作好打持久战的准备，才能顺利完成。

如果你正被形如eval(base64_decode(...))的PHP代码困扰，祝您在阅读本文后能顺利解密PHP代码。

base64加密PHP脚本的解码方法的更多相关文章

  1. C#中Base64之编码,解码方法

    原文:C#中Base64之编码,解码方法 1.base64  to  string string strPath =  "aHR0cDovLzIwMy44MS4yOS40Njo1NTU3L1 ...

  2. android与php使用base64加密的字符串结果不一样解决方法

    base64将字符串转换为字节得到同一个值 一.错误 String signString = Base64.encodeToString(signContent.getBytes(),Base64.N ...

  3. 解码base64加密的图片并打印到前台

    经过base64加密的图片对象是一串字符串,我们解码后可通过流将其打印出来: utils类: package com.aebiz.app.web.modules.controllers.open.ap ...

  4. 用C#实现Base64处理，加密解密，编码解码

    using System; using System.Text; namespace Common { /// <summary> /// 实现Base64加密解密 /// 作者:周公 / ...

  5. Linux下使用MD5加密BASE64加密

    这里以字符串123456为例子,它的md5密文值为:e10adc3949ba59abbe56e057f20f883e 这里以1.txt为需要被加密的文件. 一. 用oppnssl md5 加密字符串和 ...

  6. java 和 Android Base64加密

    Java8 Base64 Java 8 新特性 在Java 8中,Base64编码已经成为Java类库的标准. Java 8 内置了 Base64 编码的编码器和解码器. Base64工具类提供了一套 ...

  7. Java中使用BASE64加密&解密

    package com.bao.tools.encryption; import java.io.IOException; import org.junit.Test; import sun.misc ...

  8. Base64加密解密原理以及代码实现（VC++）

    Base64加密解密原理以及代码实现 转自:http://blog.csdn.net/jacky_dai/article/details/4698461 1. Base64使用A--Z,a--z,0- ...

  9. Jmeter编写Base64加密函数

    方法一: 使用Beanshell Sampler.BSF Sampler等实现,现已Base64加密为例,脚本如下: import sun.misc.BASE64Decoder; String res ...

随机推荐

  1. Unity 查找

    GameObject.Find().Transform.Find查找游戏对象 1.前置条件 Unity中常用到查找对象,非隐藏的.隐藏的,各种方法性能有高有低,使用又有各种条件限制. 在此对查找的性能 ...

  2. 【转】Visual Studio 2013 Tools for Unity安装目录，Visual Studio 2013 Tools.unitypackage

    http://blog.csdn.net/dynastyting/article/details/46505349 Visual Studio 2013 Tools for Unity安装目录 D:\ ...

  3. 【bzoj4999】This Problem Is Too Simple！ 树链剖分+动态开点线段树

    题目描述 给您一颗树,每个节点有个初始值. 现在支持以下两种操作: 1. C i x(0<=x<2^31) 表示将i节点的值改为x. 2. Q i j x(0<=x<2^31) ...

  4. 经典SQL语句大全、50个常用的sql语句

    50个常用的sql语句 Student(S#,Sname,Sage,Ssex) 学生表 Course(C#,Cname,T#) 课程表 SC(S#,C#,score) 成绩表 Teacher(T#,T ...

  5. SPOJ - SUBLEX 【后缀自动机】

    题目 求第K小子串 题解 建好SAM后,拓扑排序,反向传递后面所形成的串的数量 最后从根开始,按照儿子形成串的数量与k比较走就好了 #include<iostream> #include& ...

  6. 排列计数（permutation）

    排列计数(permutation) 题目描述 求有多少种长度为n的序列A,满足以下条件: 1) 1~n这n个数在序列中各出现了一次 2) 若第i个数A[i]的值为i,则称i是稳定的.序列恰好有m个数是 ...

  7. String.intern() (jdk1.8)

    1.通过字面量赋值创建字符串 (如:String str=”aaa”)时,会先在常量池中查找是否存在相同的字符串,若存在,则将栈中的引用直接指向该字符串:若不存在,则在常量池中生成一个字符串,再将栈中 ...

  8. iOS资讯详情页实现—WebView和TableView混合使用（转）

    iOS资讯详情页实现—WebView和TableView混合使用 如果要实现一个底部带有相关推荐和评论的资讯详情页,很自然会想到WebView和TableView嵌套使用的方案. 这个方案是WebVi ...

  9. C# 获取NTP远程同步时间

    收到一个需要定时同步远程服务器的需求,用C# 实现 网上搜索到解决方案,代码如下: 获取远程时间 参数配置:"NTPServer"  远程时间服务器地址 获取远程服务器时间代码: ...

  10. hdu 1423 最长上升递增子序列

    #include <iostream> #include <cstdio> #include <cstring> using namespace std; ; in ...