加密前代码：
[PHP] 纯文本查看 复制代码
运行如下：
image.png (13.92 KB, 下载次数: 0)
下载附件
2024-4-11 01:11 上传
给php加密：
image.png (50.82 KB, 下载次数: 0)
下载附件
2024-4-11 01:15 上传
加密后代码：
[PHP] 纯文本查看 复制代码
访问：
image.png (13 KB, 下载次数: 0)
下载附件
2024-4-11 01:18 上传
破解过程：
代码格式化，发现一堆奇形怪状的函数：
image.png (63.11 KB, 下载次数: 0)
下载附件
2024-4-11 01:19 上传
二话不说，输出来看看：
[PHP] 纯文本查看 复制代码
关键代码长这样：
[PHP] 纯文本查看 复制代码echo $Kyddly." ".$ltJjKV." ".$sCFCgN." ".$dhGfsR." ".$Kyddly."
";
刷新网页得结果：
image.png (15.77 KB, 下载次数: 0)
下载附件
2024-4-11 01:21 上传
即 [PHP] 纯文本查看 复制代码.$Kyddly是[PHP] 纯文本查看 复制代码base64_decode。
果断把eval后面的$Kyddly替换成base64_decode，
运行，正常，发现猜测没错：
image.png (15.53 KB, 下载次数: 0)
下载附件
2024-4-11 01:25 上传
eval函数改成echo:
image.png (64.74 KB, 下载次数: 0)
下载附件
2024-4-11 01:26 上传
吾爱破姐专用变成了看不懂的字符串：
image.png (39.84 KB, 下载次数: 0)
下载附件
2024-4-11 01:27 上传
全部内容如下：
[PHP] 纯文本查看 复制代码$ijsHOv="vPqfSVwROKHkEGJLoQnrgCAIWetiMUFzcZmahsTuybdNpjBlYXDxDjnfJvNmZwORtHFVPKEyTdlLuxMeWAaYqUSzhskGpcirCoXIbBgQjg9NzOlTUHvSzu5IwdiHzEFnvHsNrgtQFpQEUtrPcIqNrgtQwksRmIvvbACIjuFhq2A2ra9RUurDUHAPLSFnmoUUzkI0uvmub2mGABihvtR0kahdrHmbmovVzICYb210z1C6cHUzv2hnbYrRiR5giH1rxSmQuklQcvmaiHQovRCybkl5vvFvzaiRmYICUus1maFMxtMuWHQQbYrdqavbcaaIJtCDbIUNW1IuctvBmYvuuoaZK2mvmoFJiY09LeR7FOFvq2QMiY0RmIvvbACIuYriVemHvvvhJSvcrI0GFtUvvuawUvsYW10GFtUvvuawUvsYWa07FarSzAiMqk0RmIvvbACIuYWYBJ4RmIvvbACIuYtNBJ4RmIvvbACIuYL0BJ4RmIvvbACIuYtNBJ4RmIvvbACIuYL0BksRuIaDJt92jJmkUSIOcBacWa0GFtUvvuawUvsQZa0GFtUvvuawUvsYBJ4RA2UCm21QuYXiVemkUSIOcBacWv0GFtUvvuawUvspra07FtCZxSUmJg0RmIvvbACIuYiiVemHvvvhJSvcWkriZpmpvBrscBqGjJmHvvvhJSvcWoFiVemHvvvhJSvcWYUiVemHvvvhJSvcWoIiVemHvvvhJSvcWoUiVemHvvvhJSvcWYXiVemHvvvhJSvcWYFiVemHvvvhJSvcWYviVemHvvvhJSvcWoUiVemHvvvhJSvcWYXiZ2v2buNPFOFvq2QMipTeJRhZvSLYkEahzoXCUH1HAaPYmErJWBXsuSQJkurGUt5hmYawUvvJm2raJRMvm1F1AIhPvaUGvoXmvA42bvhZJvvBkSIAcHhzbkawuHasvRQeWovpAuQwmIabuRIRWOmrUAhNxIFauEromBXGuRvRASrvWvmozYvPbAA5cvtYcHCBmSQ2bvUNAvrbAIiUcaFbbIiuvSmBqt5zxSQ6bkFsrvvMUHahctC3ukrsA2rOkovvcRFNvvvNJuFukRQkvYaykAiFxvvMqOhkzSNYUaisvt0QkBhoWIPNvthHxIrAJRhJWHhKbYFzzA1nARhImBXmbordWIANmImRzYIMvkasA2rMzHMuWvUuuRmsi1mtmoXuutUVvRvRi2aBmkmoJaCbAoXPc1FMqtIev1FvA0Uzi2aGmBiRmYvwb2QRKIrbJSamWgINAvhZJvmOqarvW1CKkRUZzR9BqamRzRU2AuMNAICBigFzmBXmkus4i1muuIXrmuhzkAmJxarsAIrImSN1b2CuJvI5qYaZmSQPkImzzR1tvEFRWu8QUAUskA5AvS9hzSWYA2QHxarsAkrzWBXQvu5dzSvuJEiUW2Qkb0iortM5JkizuaCPbRrEcIX6rH5WzvF5vIhZq2Fbb29wmR5MbvvRiHrkU2MBctU2A0A5WRMgAECuvYI6bu1Dq0Caqt9IcvCJA0rDxAMki2MBctU2A0A5WRMgAECuvYI6bu1Dq0Caqt9IcvCJA0r3z1ryrkUzctUFJ1r3z1ismEUkmkRpJ0rJxIUBZBChcu9YkAr3z1ryrkUzctUFJ1ryqtMAqY0ewJR7jY48j3XPqdXRUuUCcSAPF3XHb1inJol0WktEVHiRK2hGvYl0WktCZpmbJOmRcvR9bSaYUkb0B2mIb29RUJTebSCHrIICZBmUvaUoUH5mi2aAJkmWutL0UahHrAMnuErocBmyuECsUICBzHCoW2m2kRr0cA16UOaeW2mvUH1Zq2vvcaIJuabNbYFNuamLJSMuvEXZuS1PAHavJR9euOXtAYXJAvAQctizWACVuuQHv1aBithUuHhsb0hHJuFEjk0ewksRUAm1cHCCjJmbJOmRcvIcW10GFahLiHmMuvs2BJ4Ruth0UH1UuYWYBJ4Ruth0UH1UuYWNBksRkRC5mtCBjJmbJOmRcvIcWYriVembJOmRcvIcWkXiVembJOmRcvIcWomiVembJOmRcvIcWkXiVembJOmRcvIcWomiZpmmvIrevOA9Ft5wxAmwv1sNBJ4Ruth0UH1UuYt4BJ4Ruth0UH1UuYriVemZJEItJIicWa0GFt5wxAmwv1sQBJ4Ruth0UH1UuYL0BksRzBizxSMAjJmbJOmRcvIcr10GFahLiHmMuvsQW107FHvtiuQnzJ49FahLiHmMuvspWI0GFahLiHmMuvsYrI0GFahLiHmMuvspZv0GFahLiHmMuvsprI0GFahLiHmMuvsYWa0GFahLiHmMuvsYWI0GFahLiHmMuvsYrv0GFahLiHmMuvsprI0GFahLiHmMuvsYWa07UBUhcdTRUAm1cHCCwdFwmRU3vSMzxar6WHIAmYIhbAi0xSvaJoUkzYI4uIqQKIrvrBXvm0UuvuMJWvIGKRQzWuhyvoaHWatprkrvWHhHUHQzqvCMkIvJcHN1AolQxuFHcaimvIUFuoF4raAQmRvzut5KuS5wA1ayqtCum2NpuRqQW2mvWAmeW0UhvAA1kabpqOvIuOXPAS5dzIiaUH9JvBhCUti0J2mncahkvYvMvus1K1CyWBIAcShpbAmwvSvGJR9BvIPNkordkaUscaIAWtCJbS5NrSrGctrRcOXBkgXNkR1LvoFBcaR0A2CZraUMkS1rJaU5vH1zkSryxHhJz2Qrk0AQxvFMxtrUWtCMUuMNz1rbJRIoW055uorZxImuKRvovBmFARrYramBqOIvzYvOk0rYzA8pvoFUv3iDJEP4w0C5rHMzvvLQbRiNqtMgAR9kcSQaA2Qoc0CHmIivWRCvUarEz1vbKIiJcRUWktrJqHKQqgUhWvaQkuIyq0CHmIivWRCvUarEz1vbKIiJcRUWktrJqHKQqgUhWvaYJRisW1iGqOFuK2MYJRUHv1ApJIvRA2iyvvhdv1FGmRQWmtaYJRisW1iGqOFuK2MNJ1ryrpLCwks/jT==";eval('?>'.$Kyddly($ltJjKV($sCFCgN($ijsHOv,$dhGfsR*2),$sCFCgN($ijsHOv,$dhGfsR,$dhGfsR),$sCFCgN($ijsHOv,0,$dhGfsR))));
猜测$ijsHOv还是base64_decode你就错了，base64_decode得到乱码，我就不掩饰不拐弯墨迹了，直接来干活！
他后面还有一段eval('?>'.$Kyddly($ltJjKV($sCFCgN($ijsHOv,$dhGfsR*2),$sCFCgN($ijsHOv,$dhGfsR,$dhGfsR),$sCFCgN($ijsHOv,0,$dhGfsR)))，去掉eval,设$text = $ijsHOv,把这些函数用上面输出的名称替换后得：
[PHP] 纯文本查看 复制代码base64_decode(strtr(substr($text,52*2),substr($text,52,52),substr($text,0,52)))
写点代码：
[PHP] 纯文本查看 复制代码$pattern = '/="([^"]+)"/';
preg_match_all($pattern, $decodestr1, $matches);
$text = implode('', $matches[1]);
echo $text;
echo "
";
$decodestr2 = strtr(substr($text,52*2),substr($text,52,52),substr($text,0,52));
//运行看看
echo $decodestr2;
echo "
再 base64_decode看看
";
echo base64_decode($decodestr2);
image.png (135.62 KB, 下载次数: 0)
下载附件
2024-4-11 01:57 上传
一开始用骨锅，看了好久看不出啥，这里得用360浏览器看看。
看到的内容：
[PHP] 纯文本查看 复制代码
其实可以递归解密，但是我不会，我硬是手工重复了以上操作，得：
[PHP] 纯文本查看 复制代码//下面是F12复制来的代码：
/*
*/
$firsttext =base64_decode("JHNVb3Nqaj0idmFPZ3FsR1plZlRMcndNaG1JeURGcEJKUGRuRXhTVnV0QUN6aXNIUWNiTlhZa1JXalVLb25rQlJFQXZId0tMeHpzREZscEpnZEdRcU1Tck5haE9mQ3ljWFlvaVpQSXRWYlRXbWVVdWpNZzlza2l5UmdaalJwY3lScGN5UnBpUUpIbVNLSW1kMGIyUmpxSjl3dWlTM1Mxc2Z0THFzSTJHR0hPc2ZiMjRHeEpQb3B2U0FTdk9mU1lScmhkV1VVZDlwTDF0VXFKVEdwaWE4cHZXR0hoRmpIbWRUSFZwanEwdG5JcldBSXJaQ09pQXNITGpSU3ZPNFNjOWpTdjFvQkpRZWt2ZEpQMk8wTVZPMEhZMDRxSlRSeFl5cjVIYys1NFlhNTZjMDVrd1o1eFlMNTVoajc3SlFxSlQ3Z1pqUnBjeVJwY3lScGc4KyI7ZXZhbCgnPz4nLiRyVXNsbXcoJFNmaUdtcSgkWlFvSE92KCRzVW9zamosJEpOemZRSCoyKSwkWlFvSE92KCRzVW9zamosJEpOemZRSCwkSk56ZlFIKSwkWlFvSE92KCRzVW9zamosMCwkSk56ZlFIKSkpKTs=");
$secondetext = base64_decode("JFFwVkZxSz0iTG9aaGtzeEJ6Sk9xZW1BSU5pUGFVUkR1YnBLZ1hkV1F0Q253U0hFdlZqZmNURll5R01ybFlWQVVIZ2x4U1FEZXNPZnJSQkpJVGl2ZG13dU1Db3FaUE5LV2pueXphRnBjWEdoRUxidGtKdjlXSW5mUk5CZk1yTnhraDJVenJOWVZ0N3BLVllYT0JRbnp6cnlCdlpWL0pNMHV2WlY4SjN4VmNmMHVyTmZNckxhRklMOE1yRmxCY0JmekpkSXJIc3NyZ3NzTVBEcUtIRCs4TWpyUk5GOCsiO2V2YWwoJz8+Jy4kZUR1bGppKCROSnlESlcoJFFWU2JUdSgkUXBWRnFLLCRpd1p6a1QqMiksJFFWU2JUdSgkUXBWRnFLLCRpd1p6a1QsJGl3WnprVCksJFFWU2JUdSgkUXBWRnFLLDAsJGl3WnprVCkpKSk7");
echo "
上面代码第二次解密后得下面两个代码
";
echo $firsttext;
echo "
";
echo $secondetext;
echo "
";
image.png (182.29 KB, 下载次数: 0)
下载附件
2024-4-11 02:05 上传
[PHP] 纯文本查看 复制代码
echo "一而再再而三解密：";
$pattern = '/="([^"]+)"/';
preg_match_all($pattern, $firsttext, $matches);
$text = implode('', $matches[1]);
echo $text;
echo "
";
$firsttextdec = (strtr(substr($text,52*2),substr($text,52,52),substr($text,0,52)));
preg_match_all($pattern, $secondetext, $matches);
$text = implode('', $matches[1]);
echo $text;
echo "
";
$secondetextdec = (strtr(substr($text,52*2),substr($text,52,52),substr($text,0,52)));
echo "
又看看啊？
";
echo base64_decode($firsttextdec);
echo "
";
echo base64_decode($secondetextdec);
echo "
";
image.png (191.07 KB, 下载次数: 0)
下载附件
2024-4-11 02:19 上传
完整代码发一波：
[PHP] 纯文本查看 复制代码
*/
$firsttext =base64_decode("JHNVb3Nqaj0idmFPZ3FsR1plZlRMcndNaG1JeURGcEJKUGRuRXhTVnV0QUN6aXNIUWNiTlhZa1JXalVLb25rQlJFQXZId0tMeHpzREZscEpnZEdRcU1Tck5haE9mQ3ljWFlvaVpQSXRWYlRXbWVVdWpNZzlza2l5UmdaalJwY3lScGN5UnBpUUpIbVNLSW1kMGIyUmpxSjl3dWlTM1Mxc2Z0THFzSTJHR0hPc2ZiMjRHeEpQb3B2U0FTdk9mU1lScmhkV1VVZDlwTDF0VXFKVEdwaWE4cHZXR0hoRmpIbWRUSFZwanEwdG5JcldBSXJaQ09pQXNITGpSU3ZPNFNjOWpTdjFvQkpRZWt2ZEpQMk8wTVZPMEhZMDRxSlRSeFl5cjVIYys1NFlhNTZjMDVrd1o1eFlMNTVoajc3SlFxSlQ3Z1pqUnBjeVJwY3lScGc4KyI7ZXZhbCgnPz4nLiRyVXNsbXcoJFNmaUdtcSgkWlFvSE92KCRzVW9zamosJEpOemZRSCoyKSwkWlFvSE92KCRzVW9zamosJEpOemZRSCwkSk56ZlFIKSwkWlFvSE92KCRzVW9zamosMCwkSk56ZlFIKSkpKTs=");
$secondetext = base64_decode("JFFwVkZxSz0iTG9aaGtzeEJ6Sk9xZW1BSU5pUGFVUkR1YnBLZ1hkV1F0Q253U0hFdlZqZmNURll5R01ybFlWQVVIZ2x4U1FEZXNPZnJSQkpJVGl2ZG13dU1Db3FaUE5LV2pueXphRnBjWEdoRUxidGtKdjlXSW5mUk5CZk1yTnhraDJVenJOWVZ0N3BLVllYT0JRbnp6cnlCdlpWL0pNMHV2WlY4SjN4VmNmMHVyTmZNckxhRklMOE1yRmxCY0JmekpkSXJIc3NyZ3NzTVBEcUtIRCs4TWpyUk5GOCsiO2V2YWwoJz8+Jy4kZUR1bGppKCROSnlESlcoJFFWU2JUdSgkUXBWRnFLLCRpd1p6a1QqMiksJFFWU2JUdSgkUXBWRnFLLCRpd1p6a1QsJGl3WnprVCksJFFWU2JUdSgkUXBWRnFLLDAsJGl3WnprVCkpKSk7");
echo "
上面代码第二次解密后得下面两个代码
";
echo $firsttext;
echo "
";
echo $secondetext;
echo "
";
echo "一而再再而三解密：";
$pattern = '/="([^"]+)"/';
preg_match_all($pattern, $firsttext, $matches);
$text = implode('', $matches[1]);
echo $text;
echo "
";
$firsttextdec = (strtr(substr($text,52*2),substr($text,52,52),substr($text,0,52)));
preg_match_all($pattern, $secondetext, $matches);
$text = implode('', $matches[1]);
echo $text;
echo "
";
$secondetextdec = (strtr(substr($text,52*2),substr($text,52,52),substr($text,0,52)));
echo "
又看看啊？
";
echo base64_decode($firsttextdec);
echo "
";
echo base64_decode($secondetextdec);
echo "
";
?>
希望来个大佬写出递归调用形式，谢谢！
