现在的位置: 首页 > IT运维 > 正文

byterun解码程序php源代码

2014年05月06日 IT运维 ⁄ 共 2098字 暂无评论 ⁄ 被围观 36+

在php中遇到形如$_F=__FILE__;$_X=的编码文件时,我们需要解码才能还原原始代码,这种形式的编码方式称作:byterun编码,以下为解码源代码:

[php]<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=UTF-8" http-equiv="Content-Type">
<?php
$self=__FILE__;
$fn='';
if (isset($_GET['fn'])){
$fn=$_GET['fn'];
}else if (isset($_POST['fn'])){
$fn=$_POST['fn'];
}
if (empty($fn)) {echo 'no input file/dir...<br />use: http://www.opensoce.com/files/byterun_decode.php?fn=xxx';exit;}
$fname=array();
if (is_dir($fn)){
file_list($fn);
}else
$fname=array($fn);
foreach($fname as $fn){
if (substr($fn,-4)!='.php'||$fn==$self) {continue;}
$s=file_get_contents($fn);
if (strpos($s,'<?php $_F=__FILE__;$_X=')===false) continue;
$len=strlen($s);
$s=substr($s,5,$len-11);
$pos=strpos($s,"eval(base64_decode('");
$s1=substr($s,0,$pos);
$s2=substr($s,$pos+20);
//echo $s2;
$s2=base64_decode($s2);
$pos2=strpos($s2,'$_R=ereg_replace');
$s2=substr($s2,0,$pos2);
eval($s1.$s2);
$s= substr($_X,2);
$m=array();
while(preg_match("/&#\d+;/i",$s,$m)){
$x=$m[0];
$s=str_replace($x,unicode_decode($x, 'UTF-8', false, '&#', ';'),$s);
}
file_put_contents($fn,$s);
echo $fn.' parsing finished...<br />';
}
function file_list($path) {
global $fname;
if ($handle = opendir($path)) {
while (false !== ($file = readdir($handle))) {
if ($file != "." && $file != "..") {
if (is_dir($path."/".$file)) {
file_list($path."/".$file);
} else {
$fname[]=$path."/".$file;
}
}
}
}
}
/*汉字转Unicode编码*/
function unicode_encode($str, $encoding = 'UTF-8', $ishex = false, $prefix = '&#', $postfix = ';') {
$str = iconv($encoding, 'UCS-2', $str);
$arrstr = str_split($str, 2);
$unistr = '';
for($i = 0, $len = count($arrstr); $i < $len; $i++) {
$dec = $ishex ? bin2hex($arrstr[$i]) : hexdec(bin2hex($arrstr[$i]));
$unistr .= $prefix . $dec . $postfix;
}
return $unistr;
}
/*Unicode编码转汉字*/
function unicode_decode($unistr, $encoding = 'UTF-8', $ishex = false, $prefix = '&#', $postfix = ';') {
$arruni = explode($prefix, $unistr);
$unistr = '';
for($i = 1, $len = count($arruni); $i < $len; $i++) {
if (strlen($postfix) > 0) {
$arruni[$i] = substr($arruni[$i], 0, strlen($arruni[$i]) - strlen($postfix));
}
$temp = $ishex ? hexdec($arruni[$i]) : intval($arruni[$i]);
$unistr .= ($temp < 256) ? chr(0) . chr($temp) : chr($temp / 256) . chr($temp % 256);
}
return iconv('UCS-2', $encoding, $unistr);
}[/php]

给我留言

您必须 [ 登录 ] 才能发表留言!

×
#