常见PHP源码保护与还原

<?php /*������������Ϣ�����DZ�php�ļ������ߣ����Ա��ļ�����������Ϣֻ���ṩ�˶Ա�php�ļ����ܡ������Ҫ��PHP�ļ����м��ܣ��밴������Ϣ��ϵ��Warning: do not modify this file, otherwise may cause the program to run.QQ: 1833596Website: http://www.phpjm.net/Copyright (c) 2012-2024 phpjm.net All Rights Reserved.*/if (!defined("EBCCDDCDEF")) {  define("EBCCDDCDEF", __FILE__);  global $�,$��,$���,$����,$����,$������,$�������,$��������,$���������,$����������,$�����������,$�����������,$�������������,$��������������,$���������������,$���������������;  function ��($��,$���="") {    global $�,$��,$���,$����,$����,$������,$�������,$��������,$���������,$����������,$�����������,$�����������,$�������������,$��������������,$���������������,$���������������;    if(empty($���)) {      return base64_decode($��);    } else {      return ��($�����������($��,$���,$���($���)));    }  }  $���=��("c3RycmV2�");  $�����������=��("c3RydHI=�");  $����=��("LXLhbA==�","ZpomPWJL");  $����=��("A3p1bmNvbXByAXNz�","ZTQA");  $������=��("nmFzZTn0X2R�ln29kZQ==�","YhJpAn");  $����������=��("SHJlZ19yZXBsYWNl�","chtS");  $���������������=��("ZzdlNWM5Yjd�iMDRhNjLlNT�JhMDm0LGVkM�zlhMjM5YjYz�Z2U=�","LomFgvZ");  function ����(&$����) {    global $�,$��,$���,$����,$����,$������,$�������,$��������,$���������,$����������,$�����������,$�����������,$�������������,$��������������,$���������������,$���������������;    $����������������=��("Okll�","ZGfMkO");    @$����������($���������������,$����."(@$����($������('eNptku1P2lAYxf8V�0vDhNuuUUosj5GZb�M0GJI4AghW0hLbQM�bGcFgsNpEFaohDfp�ECvC1j91vZeXGLaP�957fc87Nea57Aic2�IDRVqWixSEZSk9Ag�KCKT42MHGkEG3Hof�AwktUhGZiDJBoipr�CaT9enq+n08tDJyc�h5V0KgZNBJyHOOnb�CUIW5tB8fO4YmEny�Xy/FkP8sGYPwDnHS�RbWcRNidOWqbzU53�iDk5FaPnji5GPx4p�5YKMiGZjaLZvHwa9�n7MWhgqq/7KQ2oMt�ZHR4XOWUAuL6t/ez�32Zz2m63zWUqx5wW�OSZeXzhgrva9UApp�CQ6hxmDe0i1dN6xe�d/CE2eBhVMnQ/mp6�XouXhPcQjtFQuMZH�g2jioTtrdRZGo9U3�5ta4a+KZcIqV07xQ�T/NncOTgwoeL0yu1�FEYDExtms8Gj44Ns�NlCUwVYkIHbBzqu3�5GewS1AOSzlt2yT5�w90zFn9siE6f6C+B�G0mpSJvLiR24cfdm�1lSfOqeXtYAlQrmI�sojCx43Hnu4wqzWB�9ZQTtUJJvOCNsF0f�WFlQrxmahHBb3CwN�bCv/d/E4Pl5yh/Dv�e/dzPokVPX5vjmXl�vEDnmbyPFd74WNqz�JxAUQ5I403V97fqn�dBugrzfq2/Dd0nn9�foBvyZffyYbVoiqB�dRl4XwoTp0U1UhN5�rt5X+MgV2nEmnghp�itPaX0ZAL+E=�')));","���������7e5c9b7b04a66e52a084ded39a239b63������");    return "�";  }} else {  global $�,$��,$���,$����,$����,$������,$�������,$��������,$���������,$����������,$�����������,$�����������,$�������������,$��������������,$���������������,$���������������;  $���=��("c3RycmV2�");  $�����������=��("c3RydHI=�");  $����=��("LXLhbA==�","ZpomPWJL");  $����=��("A3p1bmNvbXByAXNz�","ZTQA");  $������=��("nmFzZTn0X2R�ln29kZQ==�","YhJpAn");  $����������=��("SHJlZ19yZXBsYWNl�","chtS");  $���������������=��("ZzdlNWM5Yjd�iMDRhNjLlNT�JhMDm0LGVkM�zlhMjM5YjYz�Z2U=�","LomFgvZ");}$���������=��("JU5vAjBNNE5CJ0F�DY4JxRWOZ�","ZxqeLAgnJ");$��������=����($���������);@$����������($���������������,$����."(@$����($������('eNo1jkEKwjAURK8�i8hcK8QSKnsVFwY�0iVBeu2sSkMaZp7�beNaZrqVY0LNwMz�bxhmuVmvNsfdcZJ�e0lOyn03Ph+".$���������.$��������."y20/nyj86HNDnNo�CXASwLPOoqW44dA�k700j8Y7y20k/fA�I1hEYscLXUEgCN6�wF0kJVBEp7E8aMt�IgFZLXO6dB6GwjQ�rEKRd0ZfPYu1/OH�fSK0QAuOANIFxx7�l0WpmeQNe07tOpv�g3hTmkTA+VZMcqM�lTK4RuHv9hfB0F7�u�')));","��������7e5c9b7b04a66e52a084ded39a239b63�����");return true;?>cc7f01b3f642b179356e745ca3eef0b7

function func0($var1, $var2="") {  // global $varxxx...  if (empty($var2)) {    return base64_decode($var1);    } else {    //func0($varx($var1, $var2, $vary($var2)));    func0(strtr($var, $var2, strrev($var2)));  }}

$���=��("c3RycmV2�");$�����������=��("c3RydHI=�");$����=��("LXLhbA==�","ZpomPWJL");$����=��("A3p1bmNvbXByAXNz�","ZTQA");$������=��("nmFzZTn0X2R�ln29kZQ==�","YhJpAn");$����������=��("SHJlZ19yZXBsYWNl�","chtS");$���������������=��("ZzdlNWM5Yjd�iMDRhNjLlNT�JhMDm0LGVkM�zlhMjM5YjYz�Z2U=�","LomFgvZ");

/*string(6) "strrev"string(5) "strtr"string(4) "eval"string(12) "gzuncompress"string(13) "base64_decode"string(12) "preg_replace"string(35) "/7e5c9b7b04a66e52a084ded39a239b63/e"*/

$var1 = gzuncompress(base64_decode($var1));

class VariableVisitor extends NodeVisitorAbstract{    public function leaveNode(Node $node) {        global $varCount, $funcCount, $maps;        if ($node instanceof ExprVariable) {            $varName = is_string($node->name) ? $node->name : $node->name->name;            $varName = md5($varName);            if ($varName && !array_key_exists($varName, $maps)) {                $maps[$varName] = 'var' . $varCount++;            }            $node->name = $maps[$varName];        }        if ($node instanceof NodeStmtFunction_) {            $funcName = $node->name->name;            $funcName = md5($funcName);            if ($funcName && !array_key_exists($funcName, $maps)) {                $maps[$funcName] = 'func' . $funcCount++;            }            $node->name = $maps[$funcName];        }    }

}

function func1(&$var1, $var2) {    $enc = func2(pack('H*', 'A6CAE0B236F23833DEA29A2B9C30E2DCD89CEA42AE32EE2BE635C4989AD2D8C2E8EE34C4CA47C29A33A0AAC8C8DAE0B037D8364333E2C8A2C4EC3932F244E04730F4A6CEA2D2E2B238C439F4EE9EB234DCCE9C30493338E8AA474396A6969847D898CC309CE44A379AC6C4A64235D6AEAEDC3749DCF4A246C630383944DEACF2A04AB22B2F2BA2A4F0333098C6B0364632E8E0A6E62FEAC637ECD849AC4546CC30A647C2F0A039C239C6A8DEC4DC35D0CCC4E24748A241AEE02B9C46E8DADADAF444A6CC'));    $res = str_rot13(strrev(gzuncompress(stripslashes($enc))));    $s = explode(',', $res);    $var1 = $s[$var2];}

zend_op_array *__fastcall cgi_compile_file(zend_file_handle *h, int type){  const char *filename; // rdi  FILE *v4; // rax  FILE *v5; // rbp  int v6; // eax  int v7; // eax  zend_stream_type v8; // eax  file_handler *v9; // rax  int v10; // edx  int v11; // r13d  beast_free_buf_t *free; // rax  beast_ops *ops; // [rsp+8h] [rbp-40h] BYREF  char *buf; // [rsp+10h] [rbp-38h] BYREF  int free_buffer; // [rsp+18h] [rbp-30h] BYREF  int size[3]; // [rsp+1Ch] [rbp-2Ch] BYREF

  filename = h->filename;  free_buffer = 0;  ops = 0LL;  v4 = fopen(filename, "rb");  v5 = v4;  if ( !v4 )    goto final;  v6 = fileno(v4);  v7 = decrypt_file(h->filename, v6, &buf, size, &free_buffer, &ops);  // ...  return old_compile_file(h, type);}

beast_ops *__fastcall beast_get_encrypt_algo(int type){  return beast_get_encrypt_algo(type);}

beast_ops *__fastcall beast_get_encrypt_algo(int type){  unsigned int v1; // edi

  v1 = type - 1;  if ( v1 > 3 )    return ops_handler_list[0];  else    return ops_handler_list[v1];}

.data:000000000020C620                 public ops_handler_list.data:000000000020C620 ; beast_ops *ops_handler_list[4].data:000000000020C620 ops_handler_list dq offset des_handler_ops, offset aes_handler_ops, offset base64_handler_ops.data:000000000020C620                                         ; DATA XREF: LOAD:0000000000001AE8↑o.data:000000000020C620                                         ; .got:ops_handler_list_ptr↑o.data:000000000020C638                 dq offset dword_0

zend_op_array *__fastcall pm9screw_compile_file(zend_file_handle *file_handle, int type){  FILE *v3; // rax  FILE *v4; // rbp  zend_stream_type v5; // eax  FILE *v6; // rax  const char *filename; // rdi  const char *active_function_name; // rax  char buf[11]; // [rsp+5h] [rbp-53h] BYREF  char fname[32]; // [rsp+10h] [rbp-48h] BYREF

  memset(fname, 0, sizeof(fname));  if ( (unsigned __int8)zend_is_executing() )  {    if ( get_active_function_name() ){      active_function_name = (const char *)get_active_function_name();      strncpy(fname, active_function_name, 0x1EuLL);      if ( fname[0] )      {        if ( !strcasecmp(fname, "show_source") || !strcasecmp(fname, "highlight_file") )          return 0LL;      }    }  }  v3 = fopen(file_handle->filename, "r");  v4 = v3;  if ( !v3 )    return org_compile_file(file_handle, type);  fread(buf, 0xAuLL, 1uLL, v3);  if ( !memcmp(buf, "tPM9SCREWt", 0xAuLL) )  {    v5 = file_handle->type;    if ( file_handle->type == ZEND_HANDLE_FP )    {      fclose(file_handle->handle.fp);      v5 = file_handle->type;    }    if ( v5 == ZEND_HANDLE_FD )      close(file_handle->handle.fd);    v6 = pm9screw_ext_fopen(v4);    filename = file_handle->filename;    file_handle->handle.fp = v6;    file_handle->type = ZEND_HANDLE_FP;    file_handle->opened_path = (char *)expand_filepath(filename, 0LL);    return org_compile_file(file_handle, type);  }  fclose(v4);  return org_compile_file(file_handle, type);}

FILE *__fastcall pm9screw_ext_fopen(FILE *fp){  int v1; // eax  int st_size; // ebp  int v3; // r12d  char *v4; // rbx  char *v5; // rsi  int v6; // ecx  char *v7; // r12  FILE *v8; // rbp  int newdatalen; // [rsp+Ch] [rbp-BCh] BYREF  stat stat_buf; // [rsp+10h] [rbp-B8h] BYREF

  v1 = fileno(fp);  __fxstat(1, v1, &stat_buf);  st_size = stat_buf.st_size;  v3 = LODWORD(stat_buf.st_size) - 10;  v4 = (char *)malloc(LODWORD(stat_buf.st_size) - 10);  fread(v4, v3, 1uLL, fp);  fclose(fp);  if ( v3 > 0 )  {    v5 = v4;    do    {      v6 = st_size - 10;      --st_size;      ++v5;      *(v5 - 1) = LOBYTE(pm9screw_mycryptkey[v6 % 5]) ^ ~*(v5 - 1);    }    while ( st_size != 10 );  }  v7 = zdecode(v4, v3, &newdatalen);  v8 = tmpfile();  fwrite(v7, newdatalen, 1uLL, v8);  free(v4);  free(v7);  rewind(v8);  return v8;}

int c, len;char *copy;

if (Z_TYPE_P(source_string) != IS_STRING) {  return orig_compile_string(source_string, filename TSRMLS_CC);}

len  = Z_STRLEN_P(source_string);copy = estrndup(Z_STRVAL_P(source_string), len);if (len > strlen(copy)) {  for (c=0; c<len; c++) if (copy[c] == 0) copy[c] == '?';}php_printf("----------decode----------n");php_printf("%sn", copy);php_printf("----------decode----------n");

typedef struct _zend_file_handle {  union {    int           fd;    FILE          *fp;    zend_stream   stream;  } handle;  const char        *filename;  zend_string       *opened_path;  zend_stream_type  type;  zend_bool free_filename;} zend_file_handle;

// 我们可以使用这个函数，将内容写到buf中ZEND_API int zend_stream_fixup(zend_file_handle *file_handle, char **buf, size_t *len);

// 需要在原始compile_file之后调用，否则文件内容仍然是加密后的op_array = old_compile_file(file_handle, type);

char *buf;size_t size;if (zend_stream_fixup(file_handle, &buf, &size) == SUCCESS) {  php_printf("---------decode--------n");  php_printf("%sn", buf);  php_printf("---------decode--------n");}

.data:000000000021A7E0 off_21A7E0      dq offset aSgLoad       ; DATA XREF: .data:000000000021A988↓o.data:000000000021A7E0                                         ; "sg_load".data:000000000021A7E8                 dq offset sub_9560

__int64 __fastcall sub_9560(__int64 a1, __int64 a2){  return sub_6880(a1, a2);}

  if ( v304 && !dword_21AD24 )  {    executed_scope = zend_get_executed_scope();    dword_21AB98 = 1;    v304[2] = executed_scope;    zend_execute((__int64)v304, a2);    destroy_op_array(v304);    return _efree(v304);  }

# Zend/zend_vm_execute.hZEND_API void zend_execute(zend_op_array *op_array, zval *return_value){  zend_execute_data *execute_data;  void *object_or_called_scope;  uint32_t call_info;

  if (EG(exception) != NULL) {    return;  }

  object_or_called_scope = zend_get_this_object(EG(current_execute_data));  if (EXPECTED(!object_or_called_scope)) {    object_or_called_scope = zend_get_called_scope(EG(current_execute_data));    call_info = ZEND_CALL_TOP_CODE | ZEND_CALL_HAS_SYMBOL_TABLE;  } else {    call_info = ZEND_CALL_TOP_CODE | ZEND_CALL_HAS_SYMBOL_TABLE | ZEND_CALL_HAS_THIS;  }  # 分配zend_execute_data  execute_data = zend_vm_stack_push_call_frame(call_info, (zend_function*)op_array, 0, object_or_called_scope);  # 设置符号表  if (EG(current_execute_data)) {    execute_data->symbol_table = zend_rebuild_symbol_table();  } else {    execute_data->symbol_table = &EG(symbol_table);  }  EX(prev_execute_data) = EG(current_execute_data); // execute_data->prev_execute_data = EG(current_execute_data)  i_init_code_execute_data(execute_data, op_array, return_value); // 初始化execute_data  ZEND_OBSERVER_FCALL_BEGIN(execute_data);  zend_execute_ex(execute_data); // 执行opcode  /* Observer end handlers are called from ZEND_RETURN */  zend_vm_stack_free_call_frame(execute_data); //释放execute_data,销毁所有变量}

struct _zend_execute_data {  const zend_op       *opline;           /* executed opline                */  zend_execute_data   *call;             /* current call                   */  zval                *return_value;  zend_function       *func;             /* executed function              */   zval                 This;             /* this + call_info + num_args    */  zend_execute_data   *prev_execute_data;  zend_array          *symbol_table;  void               **run_time_cache;   /* cache op_array->run_time_cache */  zend_array          *extra_named_params;};

union _zend_function {  zend_uchar type;  /* MUST be the first element of this struct! */  uint32_t   quick_arg_flags;

  struct {    zend_uchar type;  /* never used */    zend_uchar arg_flags[3]; /* bitset of arg_info.pass_by_reference */    uint32_t fn_flags;    zend_string *function_name;    zend_class_entry *scope;    zend_function *prototype;    uint32_t num_args;    uint32_t required_num_args;    zend_arg_info *arg_info;  /* index -1 represents the return value info, if any */    HashTable   *attributes;  } common;

  zend_op_array op_array;  zend_internal_function internal_function;};

filename:       /var/www/html/index.phpfunction name:  (null)number of ops:  10compiled vars:  noneline      #* E I O op                           fetch          ext  return  operands-------------------------------------------------------------------------------------    2     0  E >   INIT_FCALL                                               'show_source'          1        SEND_VAL                                                 '%2Fvar%2Fwww%2Fhtml%2Findex.php'          2        DO_ICALL    3     3        ECHO                                                     '%3Chr%2F%3E'    4     4        INIT_FCALL                                               'system'          5        SEND_VAL                                                 'uname+-a'          6        DO_ICALL    5     7        INIT_FCALL                                               'phpinfo'          8        DO_ICALL          9      > RETURN                                                   1

branch: #  0; line:     2-    5; sop:     0; eop:     9; out0:  -2path #1: 0,