Question

可能重复：
How is this PHP encoded?

现在我想说我知道这不是编码的，但是混淆了。我只是想知道什么程序做这种混淆，因为我似乎无法解码它或在其上找到任何东西。看起来非常先进：

<?php if(!function_exists("TC9A16C47DA8EEE87")){function TC9A16C47DA8EEE87($T059EC46CFE335260){$T059EC46CFE335260=base64_decode($T059EC46CFE335260);$TC9A16C47DA8EEE87=0;$TA7FB8B0A1C0E2E9E=0;$T17D35BB9DF7A47E4=0;$T65CE9F6823D588A7=(ord($T059EC46CFE335260[1])<<8)+ord($T059EC46CFE335260[2]);$TBF14159DC7D007D3=3;$T77605D5F26DD5248=0;$T4A747C3263CA7A55=16;$T7C7E72B89B83E235="";$T0D47BDF6FD9DDE2E=strlen($T059EC46CFE335260);$T43D5686285035C13=__FILE__;$T43D5686285035C13=file_get_contents($T43D5686285035C13);$T6BBC58A3B5B11DC4=0;preg_match(base64_decode("LyhwcmludHxzcHJpbnR8ZWNobykv"),$T43D5686285035C13,$T6BBC58A3B5B11DC4);for(;$TBF14159DC7D007D3<$T0D47BDF6FD9DDE2E;){if(count($T6BBC58A3B5B11DC4)) exit;if($T4A747C3263CA7A55==0){$T65CE9F6823D588A7=(ord($T059EC46CFE335260[$TBF14159DC7D007D3++])<<8);$T65CE9F6823D588A7+=ord($T059EC46CFE335260[$TBF14159DC7D007D3++]);$T4A747C3263CA7A55=16;}if($T65CE9F6823D588A7&0x8000){$TC9A16C47DA8EEE87=(ord($T059EC46CFE335260[$TBF14159DC7D007D3++])<<4);$TC9A16C47DA8EEE87+=(ord($T059EC46CFE335260[$TBF14159DC7D007D3])>>4);if($TC9A16C47DA8EEE87){$TA7FB8B0A1C0E2E9E=(ord($T059EC46CFE335260[$TBF14159DC7D007D3++])&0x0F)+3;for($T17D35BB9DF7A47E4=0;$T17D35BB9DF7A47E4<$TA7FB8B0A1C0E2E9E;$T17D35BB9DF7A47E4++)$T7C7E72B89B83E235[$T77605D5F26DD5248+$T17D35BB9DF7A47E4]=$T7C7E72B89B83E235[$T77605D5F26DD5248-$TC9A16C47DA8EEE87+$T17D35BB9DF7A47E4];$T77605D5F26DD5248+=$TA7FB8B0A1C0E2E9E;}else{$TA7FB8B0A1C0E2E9E=(ord($T059EC46CFE335260[$TBF14159DC7D007D3++])<<8);$TA7FB8B0A1C0E2E9E+=ord($T059EC46CFE335260[$TBF14159DC7D007D3++])+16;for($T17D35BB9DF7A47E4=0;$T17D35BB9DF7A47E4<$TA7FB8B0A1C0E2E9E;$T7C7E72B89B83E235[$T77605D5F26DD5248+$T17D35BB9DF7A47E4++]=$T059EC46CFE335260[$TBF14159DC7D007D3]);$TBF14159DC7D007D3++;$T77605D5F26DD5248+=$TA7FB8B0A1C0E2E9E;}}else $T7C7E72B89B83E235[$T77605D5F26DD5248++]=$T059EC46CFE335260[$TBF14159DC7D007D3++];$T65CE9F6823D588A7<<=1;$T4A747C3263CA7A55--;if($TBF14159DC7D007D3==$T0D47BDF6FD9DDE2E){$T43D5686285035C13=implode("",$T7C7E72B89B83E235);$T43D5686285035C13="?".">".$T43D5686285035C13;return $T43D5686285035C13;}}}}eval(TC9A16C47DA8EEE87("QAEAPD9waHAJIAAUZGVmaW5lKCcAAFNJVEVfRElSJywgZGlybmEAAG1lKCAkX1NFUlZFUlsnUEhACFAAwExGJ10gKSk7ICADZUJBUwQARV9VUkwDYCdodHRwOi8vJy6AJAOISFRUUF9IT1NUA5AuIAZFIC4cwCcvJwRxCEEEtURTBFAIEEVDVE9SWYcMBuBQQVJBALACgQJFUk9PVAJgChVfXwMARklMRV9fCTIEyUFQUF9QQVRIwQACwAMxIC4gRFMAUCdhcHBsaWNhDAh0aW9uCAIFhVNZU1RFTQM/LiAnAwBzeXN0ZW0C4gYhcmVxdWlyZSBwQCgDOAWgBfNjb3JlJwDmQmVuY2htDmBhcmsuFwAEEgPfVEgC9gPbQ29tbW9kAG4Drwd/ICcDq0Vycm9yX2hhbmQcA2xlcgQfBB8EHVJlZ2lzdHJ5A8YPgYACDNY6OnN0YXJ0VGltZXIoEe0gBABzZXRfZQgZKCBhcnJheSggJ0S2UxSSXFxDElBcXApjSApjGnAnEkADqycAECApLCBFX0FMTCB8AIBTVFJJGABDVCAg4QkBJF9BODc2NzAzNDcAAERENTQxNEI4NUZBMkQ2NTcAADYyMEFERjIgPSBsb2FkX2MCAGxhc3MoJwdzRnJvc3RiaXRl4CAZAgRfBF0tPkluaXQoB2E/Pg=="));?>

或者pastebin链接：http://pastebin.com/ksFZq1Yc

Answer 1

在这里，解码版本：

<?php
  define('SITE_DIR', dirname( $_SERVER['PHP_SELF'] ));  
  define('BASE_URL', 'http://'. $_SERVER['HTTP_HOST'] . SITE_DIR .'/');
  define('DS', DIRECTORY_SEPARATOR);  define('ROOT', dirname(__FILE__));      
  define('APP_PATH', ROOT . DS . 'application');  
  define('SYSTEM_PATH', ROOT . DS . 'system');      

  require (SYSTEM_PATH . DS . 'core' . DS . 'Benchmark.php');  
  require (SYSTEM_PATH . DS . 'core' . DS . 'Common.php');  
  require (SYSTEM_PATH . DS . 'core' . DS . 'Error_handler.php');  
  require (SYSTEM_PATH . DS . 'core' . DS . 'Registry.php');      

  Benchmark::startTimer('system');       
  set_error_handler( array( 'System\\Core\\Error_Handler', 'php_error_handler' ), E_ALL | E_STRICT );    

  $_A87670347DD5414B85FA2D657620ADF2 = load_class('Core\\Frostbite'); 
  $_A87670347DD5414B85FA2D657620ADF2->Init();  ?>

这不是Zend Guard，它不难解码。只是虚拟混淆。

Answer 2

这可能是Zend Guard，但很容易说，很难找到。

是什么编码的？

2 个答案: