
混淆不同于加密解密,因为原来有意义的字符已经被替换了,不存在算法上的反推,任何的技术不可能再得出原来的那些有意义的字符。
所以理论上,混淆后的代码无法解密。但因为它的整个运算逻辑关系链是完整的,与混做凯淆前的代码关系链是完全一致的,所以非要“破解”,只能说摸清它的逻辑关系链,人为去棚缓做的话,烧脑又复杂。技术上需要一定的运算能力来做这个工作,比如云计算甚至超级计算机,但即便“破解”,它也是只能分析出一个函数大致是干什么用的,原来的关键字符名称还是不可能得出。
$file = 'plugin.php' //要破解的文件$fp = fopen($file, 'r')
$str = fread($fp, filesize($file))
fclose($fp)
copy($file, '0_'.$file)
$n = 1
while($n <10){
$code = strdecode($str)
if($n == 1){
$code = str_replace("__FILE__", "'0_$file'", $code)
}
$replace = '$decode'.$n.'=trim'
if(strpos($code, 'eval(') >0){
$code = str_replace('eval(', $replace.'(', $code)
}else{
preg_match("/@\\$(.*)\(\\$(.*),(.*)\(/isU", $code, $res)
嫌答衡 $code = str_replace($res[3], "'$replace", $code)
}
$code = preg_replace('/\\$(.*)=false(.*?)\(\)/', '', $code)//上一版本
$code = preg_replace('/\|\|@\\$(.*?)\(\)/', '|| print("ok")', $code)
$code = destr($code)
$tmp_file = 'detmp'.$n.'.php'
file_put_contents($tmp_file, $code)
include($tmp_file)
$val = 'decode'.$n
$str = $$val
unlink($tmp_file)
if(strpos($str, '?>') === 0){
$decode = $str
break
}
$str = " $n++
}
$decode = preg_replace("/^(.*)exit\('Access Denied'\)/", " $del = strrchr($decode, 'unset')
$decode = str_replace($del, "\举滚r\n?>", $decode)
file_put_contents($file.'.de.php' ,$decode)
unlink('0_'.$file)
echo 'done'
////////////
function val_replace($code, $val, $deval){
$code = str_replace('$'.$val.',', '$'.$deval.',', $code)
$code = str_replace('$'.$val.'', '$'.$deval.'', $code)
$code = str_replace('$'.$val.'=', '$'.$deval.'=', $code)
$code = str_replace('$'.$val.'(', '$'.$deval.'(', $code)
$code = str_replace('$'.$val.')', '$'.$deval.')', $code)
$code = str_replace('$'.$val.'.', '$'.$deval.'.', $code)
$code = str_replace('$'.$val.'/', '$'.$deval.'/', $code)
$code = str_replace('$'.$val.'>', '$'.$deval.'>', $code)
$code = str_replace('$'.$val.'<', '$'.$deval.'<', $code)
$code = str_replace('$'.$val.'^', '$'.$deval.'^', $code)
$code = str_replace('$'.$val.'||', '$'.$deval.'||', $code)
$code = str_replace('($'.$val.' ', '($'.$deval.' ', $code)
return $code
}
function fmt_code($code){
global $vals,$funs
preg_match_all("芹做/\\$[0-9a-zA-Z\[\]']+(,|)/iesU", $code, $res)
foreach($res[0] as $v){
$val = str_replace(array('$',',',''), '', $v)
$deval = destr($val, 1)
$vals[$val] = $deval
$code = val_replace($code, $val, $deval)
}
preg_match_all("/\\$[0-9a-zA-Z\[\]']+=/iesU", $code, $res)
foreach($res[0] as $v){
$val = str_replace(array('$','='), '', $v)
$deval = destr($val, 1)
$vals[$val] = $deval
$code = val_replace($code, $val, $deval)
}
preg_match_all("/function\s[0-9a-zA-Z\[\]]+\(/iesU", $code, $res)
foreach($res[0] as $v){
$val = str_replace(array('function ','('), '', $v)
$deval = destr($val, 1)
$funs[$val] = $deval
$code = str_replace('function '.$val.'(', 'function '.$deval.'(', $code)
$code = str_replace('='.$val.'(', '='.$deval.'(', $code)
$code = str_replace('return '.$val.'(', 'return '.$deval.'(', $code)
}
return $code
}
function strdecode($str){
$len = strlen($str)
$newstr = ''
for($i=0$i<$len$i++){
$n = ord($str[$i])
$newstr .= decode($n)
}
return $newstr
}
function decode($dec){
if(($dec >126 || $dec<32) &&$dec<>13 &&$dec<>10){
return '['.$dec.']'
}else{
return chr($dec)
}
}
function destr($str, $val=0){
$k = 0
$num = ''
$n = strlen($str)
$code = ''
for($i=0$i<$n$i++){
if($str[$i] == '[' &&($str[$i+1]==1 || $str[$i+1]==2)){
$k = 1
}elseif($str[$i] == ']' &&$k==1){
$num = intval($num)
if($val==1){
$num = 97 + fmod($num, 25)
}
$code .= chr($num)
$k = 0
$num = null
}else{
if($k == 1){
$num .= $str[$i]
}else{
$code .= $str[$i]
}
}
}
return $code
}
?>
欢迎分享,转载请注明来源:内存溢出
微信扫一扫
支付宝扫一扫
评论列表(0条)