某PHP加密代码解密过程

对于程序加密可能是出于程序创作者对于自己的产品产权保护、授权验证，也有一些人把一些后面程序以及黑链等加密发布的。
某PHP加密代码解密过程
默认的PHP代码肯定不是这样的，那么我们今天就来一步一步的对这个PHP程序进行解密。这类加密就是采用了微盾的方式进行的，我们姑且不去管网上有对应的解密工具，直接手工吧。
源代码如下：

<?php function vdBuj($UenD)
{ 
$UenD=gzinflate(base64_decode($UenD));
 for($i=0;$i<strlen($UenD);$i++)
 {
$UenD[$i] = chr(ord($UenD[$i])-1);
 }
 return $UenD;
 }eval(vdBuj("pVZhb+M2Ev0B9yuKxRloUaAQJUtJU.........="));?>

首先我们把代码中的eval改成echo得到如下代码.

$O00OO0=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$O00O0O=$O00OO0{3}.$O00OO0{6}.$O00OO0{33}.$O00OO0{30};$O0OO00=$O00OO0{33}.$O00OO0{10}.$O00OO0{24}.$O00OO0{10}.$O00OO0{24};$OO0O00=$O0OO00{0}.$O00OO0{18}.$O00OO0{3}.$O0OO00{0} .$O0OO00{1}.$O00OO0{24};$OO0000=$O00OO0{7}.$O00OO0{13};$O00O0O.=$O00OO0{22}.$O00OO0{36} .$O00OO0{29}.$O00OO0{26}.$O00OO0{30}.$O00OO0{32}.$O00OO0{35}.$O00OO0{26}.$O00OO0{30}; eval($O00O0O("JE8wTzAwMD0ia25pdHhNZkliT2pHS3F2c1ZCd3BVbGRlYVRyTE5IQURKeVh6UEN1Umha..........Ow=="));?>

到这里是不是感觉很熟悉了,与微盾的加密特征很像,我们继续
先来看看$O00OO0是什么内容.下面解密的过程写到代码里

<?php $O00OO0=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$O00O0O=$O00OO0{3}.$O00OO0{6}.$O00OO0{33}.$O00OO0{30};$O0OO00=$O00OO0{33}.$O00OO0{10}.$O00OO0{24}.$O00OO0{10}.$O00OO0{24};$OO0O00=$O0OO00{0}.$O00OO0{18}.$O00OO0{3}.$O0OO00{0} .$O0OO00{1}.$O00OO0{24};$OO0000=$O00OO0{7}.$O00OO0{13};$O00O0O.=$O00OO0{22}.$O00OO0{36} .$O00OO0{29}.$O00OO0{26}.$O00OO0{30}.$O00OO0{32}.$O00OO0{35}.$O00OO0{26}.$O00OO0{30}; 

echo'第一步:$O00O0O内容：'.$O00O0O;
echo'<br /><br />********************************************************<br /><br />';
//得到$O00O0O为base64_decode那么把下面的代码改一下，eval是用来执行php代码，这里不需要执行，只需要解出php代码即可，那么去掉eavl并把$O00O0O换成上面解出来的值

//源代码内容
//eval($O00O0O("JE8wTzAwMD0ia25pdHhNZkliT2pHS3F2c1ZCd3BVbGRlYVRyTE5IQURKeVh6UEN1Umhab21ZV1NGY2dRRXVtUldmS3NQRUdTeUxESGhhQ0ZaYmlxQkpqd056UWNkWHhlWWxJZ1RrVlVNcnB2dEFPb25sZDlGSlFjTEp5YWtWeWF4TElxZEUyNTBWcDUwTmVUNUF5YjZxeWE0cUk5REEyOWdYeHU3WHluOVh0OW9qMXpicHhxdUUzcWdxZVhoWDEwN0pwclVWcDFGcVF1VVh0OWpUYVhwVGFYRVgwa2JhdENzYnVheVRhWHRiUnFxTGVmOFZwMUZxUXVVWHluWkxlV2lCeWkwTHlaWUUyNXNWcDVTRTJUaUx5dHhBTXQ1TElxU0UyVGlYWTAremRjRk5JcVdBMkFtbGo0bTVyMlE1N0RtNUp2ZjZOdmk3N3hLNkwrMzVyZy81TmdHNlYyQjV3R2E2SnkxNlYyUjVVTWo1RXhjNzd4Q1h4dWhxUVgxVnZ1WkczMVpWUmtpRWVDMEJ2T3VlMHpsajBXWFRhaG1ycFRXSnA1c0VNdFdWdnFxTGVmOFh0OWRqMDlOdmJhRVgydHVFcGlnZTI1a0VwYm1ldm45bHZUc1QwYWJweHFncnAxaVgxMFpCMmE0SmVvVUptekhFaTlpRU16SFZ5YlVyZVh4cmV1VVgyekhWeWJtbGo0MEtkY2hYMjFZVnhBOWxSc2lTcnNtZ0RzaVpOUVVXTGVISFBZTU9EU21NNjdpUnIzTU1ML01tTHdtTUVIWk1yRW1Sd0VNT1BRSEhQbm1MdmYwQW1haUx2dTdzdlRSbHBrMHFRQ1NFM0M1TElUa0xqV1pWUk91clMwOVZNdGhBMmJaQjJhNEplb1VKbXpIRWk5aUVNekhWeWJVcmVYeHJldVVYMnpIVnlibWxqNHhLZG5oWDIxWVZ4QTlsUnNpU3JzbWdEc2laTlFVV0xlSEhQWU1pNmRNaDVldWdQSFVIRTNpU3JzbWdEc2lTUGVNaVVzdWc3RUhIUFFVdzdzaWhYM1V3NWVNUnJIaVJEU3VnUEhVSEUzTWlVc3VnN0VVWlVFbU01RU1NN2pNaXdjbUx2ZjBBbWFpTHZ1N3N2VFNscDVpcXhDSkplQ0NBTXpVSmVWaUxJdTdKcHJVWHlLV2xNOUZWcDRVWHlQWmxqMDlxUVgxVnZpN1h5S1dsTWE0cVFYa3IzVGJFeE9tTlI4bUxqaHVyeDArcjJmSEEyYlVMalcxRU1mWkVNaFVYeVBaRzJhU0p5OE9KbXpIRWk5aUVNekhWeWJVcmVYeHJldVVYMnpIVnlibWxqNHhLZGNoWDIxWVZ4QTlsUnNpU3JzbWdEc01SWGRpUlovSEhQUWlaVU5NbVpZTW1QbVppNjdaVVpTSEhQWVV3N3NpUzR3TWk3RWlTNDNaWlVTSEhQbm1MdmYwQW1haUxqVzlWcGZZVmVXaXIya0hQeVpZRTI1c1ZwNVNFMlRpTHl0eEFNdDVMSXFTRTJUaVhZMCtLU2NmTklxV0EyQW1sajRtNXIyUTU3RG01SnZmNk52aTc3eEs1WkJPNXdHYTZMQlM1cjZONTd4WjVyMlE1N0RtNXJ4dDVaSlE1TmcyNzd4SzZMKzM1RUlxNkwrYTVVTU41ckRVNU5STjZOMjk1WkpRNU5nMjZMSnk1NWdwNVpnMDVaSkY3N3hDWHh1aHFRWDFWdnU3c3BWMUVNejBKcDlnUHlrMHFRQ1NFM0M1TElUdU5JVGlsdlBSTklUTWxqbkZMZWh1VmoxaUVlQzBCdk91VnZ1L0F5dDBKeWlnVk04VVh5b2hibnRidm5pR1R1OXNvdXRqVGI1Q2piYlpHUlRpR3hUbWxlQ2txeWtaRU1WSExJVGlOdENDYW5rWGp1VmxlMFRYYnU1Q2piYlpHeHRaQTE5dUplUFVYeUFaWFJWY0VwV3VKZVBVWHlBaEtkQTF6dmYwQW1haUxqaHVWZDFZcVFYc0FNYUZFeXRTVnZPbVBJQWhYeGJ4S0lBaFh5b1pHMmlNTHlWMUVNejBKcDlnZTJhNEplejBBeE9tcjNheEV0OVpFTWkwWHh1WkJ4VFVscHoxQU1mc0pwNVpxSU9aRzJ6MUFNZnNBMmEwRTNDMExJVFVObnphYnVmbGJ0VHNhYVhLTklUdUxqV1NxZVhoZTN6aXF5OUZxSU91SklmZGFhWEtqMUNiZTFUWGpiYWxhYW9oWHlyWkcyejFBTWZzQTJhMEUzQzBMSVRVTm56YWJ1ZmxidFRzYnVhYmFhWEdhdFhDaml6eVRhUGhxUVgxVnZ1N1h5dTlyM2F4RXQ5aUJ5YVNMSVRVTGpXWlZSa2NWTWloVmE5RnFlVHNyMjlncXlhZ3FRS1VYeWJoWHl1WlhScmtyM2F4RXQ5aUFtWEhBUk91Skl1WkIzWGlxUWF4RVJjdVZqVzlWcGZZVmVXeFZlVDFBTTRPVk10aEEyYjdzZTFpRVF6aUJ4VERscHR4QU10NUxJcVVxUVRGWFkwK3JlWHhyZXVVWDIxaXF5a0hWSUE5bFJxUVRhb21OSXFVVnB0dVZlUG1sajRtWHhGbXF5aVdWcDkxcUlBOWxSVE1MdnU3WHloOUEzVHhWcHRXZTJ6SEVtVGlCUVRzcjNYaXJlVGlMSVRETGpXWlZSa2NyMjlGQnZPdVZJRnVWdkZ1Snh1WkIzWGlxUWF4RVJjdVZqVzlWcGZZVmVXeFZlVDFBTTRPVk10aEEyYjdzZTE5IjsgIAogICAgICAgIGV2YWwoJz8+Jy4kTzAwTzBPKCRPME9PMDAoJE9PME8wMCgkTzBPMDAwLCRPTzAwMDAqMiksJE9PME8wMCgkTzBPMDAwLCRPTzAwMDAsJE9PMDAwMCksICAgIAogICAgICAgICRPTzBPMDAoJE8wTzAwMCwwLCRPTzAwMDApKSkpOw=="));


//修改后得到

echo'第二步得到代码：';
echo'<br /><br />';
echo base64_decode("JE8wTzAwMD0ia25pdHhNZkliT2pHS3F2c1ZCd3BVbGRlYVRyTE5IQURKeVh6UEN1Umhab21ZV1NGY2dRRXVtUldmS3NQRUdTeUxESGhhQ0ZaYmlxQkpqd056UWNkWHhlWWxJZ1RrVlVNcnB2dEFPb25sZDlGSlFjTEp5YWtWeWF4TElxZEUyNTBWcDUwTmVUNUF5YjZxeWE0cUk5REEyOWdYeHU3WHluOVh0OW9qMXpicHhxdUUzcWdxZVhoWDEwN0pwclVWcDFGcVF1VVh0OWpUYVhwVGFYRVgwa2JhdENzYnVheVRhWHRiUnFxTGVmOFZwMUZxUXVVWHluWkxlV2lCeWkwTHlaWUUyNXNWcDVTRTJUaUx5dHhBTXQ1TElxU0UyVGlYWTAremRjRk5JcVdBMkFtbGo0bTVyMlE1N0RtNUp2ZjZOdmk3N3hLNkwrMzVyZy81TmdHNlYyQjV3R2E2SnkxNlYyUjVVTWo1RXhjNzd4Q1h4dWhxUVgxVnZ1WkczMVpWUmtpRWVDMEJ2T3VlMHpsajBXWFRhaG1ycFRXSnA1c0VNdFdWdnFxTGVmOFh0OWRqMDlOdmJhRVgydHVFcGlnZTI1a0VwYm1ldm45bHZUc1QwYWJweHFncnAxaVgxMFpCMmE0SmVvVUptekhFaTlpRU16SFZ5YlVyZVh4cmV1VVgyekhWeWJtbGo0MEtkY2hYMjFZVnhBOWxSc2lTcnNtZ0RzaVpOUVVXTGVISFBZTU9EU21NNjdpUnIzTU1ML01tTHdtTUVIWk1yRW1Sd0VNT1BRSEhQbm1MdmYwQW1haUx2dTdzdlRSbHBrMHFRQ1NFM0M1TElUa0xqV1pWUk91clMwOVZNdGhBMmJaQjJhNEplb1VKbXpIRWk5aUVNekhWeWJVcmVYeHJldVVYMnpIVnlibWxqNHhLZG5oWDIxWVZ4QTlsUnNpU3JzbWdEc2laTlFVV0xlSEhQWU1pNmRNaDVldWdQSFVIRTNpU3JzbWdEc2lTUGVNaVVzdWc3RUhIUFFVdzdzaWhYM1V3NWVNUnJIaVJEU3VnUEhVSEUzTWlVc3VnN0VVWlVFbU01RU1NN2pNaXdjbUx2ZjBBbWFpTHZ1N3N2VFNscDVpcXhDSkplQ0NBTXpVSmVWaUxJdTdKcHJVWHlLV2xNOUZWcDRVWHlQWmxqMDlxUVgxVnZpN1h5S1dsTWE0cVFYa3IzVGJFeE9tTlI4bUxqaHVyeDArcjJmSEEyYlVMalcxRU1mWkVNaFVYeVBaRzJhU0p5OE9KbXpIRWk5aUVNekhWeWJVcmVYeHJldVVYMnpIVnlibWxqNHhLZGNoWDIxWVZ4QTlsUnNpU3JzbWdEc01SWGRpUlovSEhQUWlaVU5NbVpZTW1QbVppNjdaVVpTSEhQWVV3N3NpUzR3TWk3RWlTNDNaWlVTSEhQbm1MdmYwQW1haUxqVzlWcGZZVmVXaXIya0hQeVpZRTI1c1ZwNVNFMlRpTHl0eEFNdDVMSXFTRTJUaVhZMCtLU2NmTklxV0EyQW1sajRtNXIyUTU3RG01SnZmNk52aTc3eEs1WkJPNXdHYTZMQlM1cjZONTd4WjVyMlE1N0RtNXJ4dDVaSlE1TmcyNzd4SzZMKzM1RUlxNkwrYTVVTU41ckRVNU5STjZOMjk1WkpRNU5nMjZMSnk1NWdwNVpnMDVaSkY3N3hDWHh1aHFRWDFWdnU3c3BWMUVNejBKcDlnUHlrMHFRQ1NFM0M1TElUdU5JVGlsdlBSTklUTWxqbkZMZWh1VmoxaUVlQzBCdk91VnZ1L0F5dDBKeWlnVk04VVh5b2hibnRidm5pR1R1OXNvdXRqVGI1Q2piYlpHUlRpR3hUbWxlQ2txeWtaRU1WSExJVGlOdENDYW5rWGp1VmxlMFRYYnU1Q2piYlpHeHRaQTE5dUplUFVYeUFaWFJWY0VwV3VKZVBVWHlBaEtkQTF6dmYwQW1haUxqaHVWZDFZcVFYc0FNYUZFeXRTVnZPbVBJQWhYeGJ4S0lBaFh5b1pHMmlNTHlWMUVNejBKcDlnZTJhNEplejBBeE9tcjNheEV0OVpFTWkwWHh1WkJ4VFVscHoxQU1mc0pwNVpxSU9aRzJ6MUFNZnNBMmEwRTNDMExJVFVObnphYnVmbGJ0VHNhYVhLTklUdUxqV1NxZVhoZTN6aXF5OUZxSU91SklmZGFhWEtqMUNiZTFUWGpiYWxhYW9oWHlyWkcyejFBTWZzQTJhMEUzQzBMSVRVTm56YWJ1ZmxidFRzYnVhYmFhWEdhdFhDaml6eVRhUGhxUVgxVnZ1N1h5dTlyM2F4RXQ5aUJ5YVNMSVRVTGpXWlZSa2NWTWloVmE5RnFlVHNyMjlncXlhZ3FRS1VYeWJoWHl1WlhScmtyM2F4RXQ5aUFtWEhBUk91Skl1WkIzWGlxUWF4RVJjdVZqVzlWcGZZVmVXeFZlVDFBTTRPVk10aEEyYjdzZTFpRVF6aUJ4VERscHR4QU10NUxJcVVxUVRGWFkwK3JlWHhyZXVVWDIxaXF5a0hWSUE5bFJxUVRhb21OSXFVVnB0dVZlUG1sajRtWHhGbXF5aVdWcDkxcUlBOWxSVE1MdnU3WHloOUEzVHhWcHRXZTJ6SEVtVGlCUVRzcjNYaXJlVGlMSVRETGpXWlZSa2NyMjlGQnZPdVZJRnVWdkZ1Snh1WkIzWGlxUWF4RVJjdVZqVzlWcGZZVmVXeFZlVDFBTTRPVk10aEEyYjdzZTE5IjsgIAogICAgICAgIGV2YWwoJz8+Jy4kTzAwTzBPKCRPME9PMDAoJE9PME8wMCgkTzBPMDAwLCRPTzAwMDAqMiksJE9PME8wMCgkTzBPMDAwLCRPTzAwMDAsJE9PMDAwMCksICAgIAogICAgICAgICRPTzBPMDAoJE8wTzAwMCwwLCRPTzAwMDApKSkpOw==");

//得到如下内容
//$O0O000="knitxMfIbOjGKqvsVBwpUldeaTrLNHADJyXzPCuRhZomYWSFcgQEumRWfKsPEGSyLDHhaCFZbiqBJjwNzQcdXxeYlIgTkVUMrpvtAOonld9FJQcLJyakVyaxLIqdE250Vp50NeT5Ayb6qya4qI9DA29gXxu7Xyn9Xt9oj1zbpxquE3qgqeXhX107JprUVp1FqQuUXt9jTaXpTaXEX0kbatCsbuayTaXtbRqqLef8Vp1FqQuUXynZLeWiByi0LyZYE25sVp5SE2TiLytxAMt5LIqSE2TiXY0+zdcFNIqWA2Amlj4m5r2Q57Dm5Jvf6Nvi77xK6L+35rg/5NgG6V2B5wGa6Jy16V2R5UMj5Exc77xCXxuhqQX1VvuZG31ZVRkiEeC0BvOue0zlj0WXTahmrpTWJp5sEMtWVvqqLef8Xt9dj09NvbaEX2tuEpige25kEpbmevn9lvTsT0abpxqgrp1iX10ZB2a4JeoUJmzHEi9iEMzHVybUreXxreuUX2zHVybmlj40KdchX21YVxA9lRsiSrsmgDsiZNQUWLeHHPYMODSmM67iRr3MML/MmLwmMEHZMrEmRwEMOPQHHPnmLvf0AmaiLvu7svTRlpk0qQCSE3C5LITkLjWZVROurS09VMthA2bZB2a4JeoUJmzHEi9iEMzHVybUreXxreuUX2zHVybmlj4xKdnhX21YVxA9lRsiSrsmgDsiZNQUWLeHHPYMi6dMh5eugPHUHE3iSrsmgDsiSPeMiUsug7EHHPQUw7sihX3Uw5eMRrHiRDSugPHUHE3MiUsug7EUZUEmM5EMM7jMiwcmLvf0AmaiLvu7svTSlp5iqxCJJeCCAMzUJeViLIu7JprUXyKWlM9FVp4UXyPZlj09qQX1Vvi7XyKWlMa4qQXkr3TbExOmNR8mLjhurx0+r2fHA2bULjW1EMfZEMhUXyPZG2aSJy8OJmzHEi9iEMzHVybUreXxreuUX2zHVybmlj4xKdchX21YVxA9lRsiSrsmgDsMRXdiRZ/HHPQiZUNMmZYMmPmZi67ZUZSHHPYUw7siS4wMi7EiS43ZZUSHHPnmLvf0AmaiLjW9VpfYVeWir2kHPyZYE25sVp5SE2TiLytxAMt5LIqSE2TiXY0+KScfNIqWA2Amlj4m5r2Q57Dm5Jvf6Nvi77xK5ZBO5wGa6LBS5r6N57xZ5r2Q57Dm5rxt5ZJQ5Ng277xK6L+35EIq6L+a5UMN5rDU5NRN6N295ZJQ5Ng26LJy55gp5Zg05ZJF77xCXxuhqQX1Vvu7spV1EMz0Jp9gPyk0qQCSE3C5LITuNITilvPRNITMljnFLehuVj1iEeC0BvOuVvu/Ayt0JyigVM8UXyohbntbvniGTu9soutjTb5CjbbZGRTiGxTmleCkqykZEMVHLITiNtCCankXjuVle0TXbu5CjbbZGxtZA19uJePUXyAZXRVcEpWuJePUXyAhKdA1zvf0AmaiLjhuVd1YqQXsAMaFEytSVvOmPIAhXxbxKIAhXyoZG2iMLyV1EMz0Jp9ge2a4Jez0AxOmr3axEt9ZEMi0XxuZBxTUlpz1AMfsJp5ZqIOZG2z1AMfsA2a0E3C0LITUNnzabuflbtTsaaXKNITuLjWSqeXhe3ziqy9FqIOuJIfdaaXKj1Cbe1TXjbalaaohXyrZG2z1AMfsA2a0E3C0LITUNnzabuflbtTsbuabaaXGatXCjizyTaPhqQX1Vvu7Xyu9r3axEt9iByaSLITULjWZVRkcVMihVa9FqeTsr29gqyagqQKUXybhXyuZXRrkr3axEt9iAmXHAROuJIuZB3XiqQaxERcuVjW9VpfYVeWxVeT1AM4OVMthA2b7se1iEQziBxTDlptxAMt5LIqUqQTFXY0+reXxreuUX21iqykHVIA9lRqQTaomNIqUVptuVePmlj4mXxFmqyiWVp91qIA9lRTMLvu7Xyh9A3TxVptWe2zHEmTiBQTsr3XireTiLITDLjWZVRkcr29FBvOuVIFuVvFuJxuZB3XiqQaxERcuVjW9VpfYVeWxVeT1AM4OVMthA2b7se19"; eval('?>'.$O00O0O($O0OO00($OO0O00($O0O000,$OO0000*2),$OO0O00($O0O000,$OO0000,$OO0000), $OO0O00($O0O000,0,$OO0000))));'.$O00O0O($O0OO00($OO0O00($O0O000,$OO0000*2),$OO0O00($O0O000,$OO0000,$OO0000), $OO0O00($O0O000,0,$OO0000)))); 

echo'第三步得到代码：';
//在显示eval里面的内容,把eval改成echo

$O0O000="knitxMfIbOjGKqvsVBwpUldeaTrLNHADJyXzPCuRhZomYWSFcgQEumRWfKsPEGSyLDHhaCFZbiqBJjwNzQcdXxeYlIgTkVUMrpvtAOonld9FJQcLJyakVyaxLIqdE250Vp50NeT5Ayb6qya4qI9DA29gXxu7Xyn9Xt9oj1zbpxquE3qgqeXhX107JprUVp1FqQuUXt9jTaXpTaXEX0kbatCsbuayTaXtbRqqLef8Vp1FqQuUXynZLeWiByi0LyZYE25sVp5SE2TiLytxAMt5LIqSE2TiXY0+zdcFNIqWA2Amlj4m5r2Q57Dm5Jvf6Nvi77xK6L+35rg/5NgG6V2B5wGa6Jy16V2R5UMj5Exc77xCXxuhqQX1VvuZG31ZVRkiEeC0BvOue0zlj0WXTahmrpTWJp5sEMtWVvqqLef8Xt9dj09NvbaEX2tuEpige25kEpbmevn9lvTsT0abpxqgrp1iX10ZB2a4JeoUJmzHEi9iEMzHVybUreXxreuUX2zHVybmlj40KdchX21YVxA9lRsiSrsmgDsiZNQUWLeHHPYMODSmM67iRr3MML/MmLwmMEHZMrEmRwEMOPQHHPnmLvf0AmaiLvu7svTRlpk0qQCSE3C5LITkLjWZVROurS09VMthA2bZB2a4JeoUJmzHEi9iEMzHVybUreXxreuUX2zHVybmlj4xKdnhX21YVxA9lRsiSrsmgDsiZNQUWLeHHPYMi6dMh5eugPHUHE3iSrsmgDsiSPeMiUsug7EHHPQUw7sihX3Uw5eMRrHiRDSugPHUHE3MiUsug7EUZUEmM5EMM7jMiwcmLvf0AmaiLvu7svTSlp5iqxCJJeCCAMzUJeViLIu7JprUXyKWlM9FVp4UXyPZlj09qQX1Vvi7XyKWlMa4qQXkr3TbExOmNR8mLjhurx0+r2fHA2bULjW1EMfZEMhUXyPZG2aSJy8OJmzHEi9iEMzHVybUreXxreuUX2zHVybmlj4xKdchX21YVxA9lRsiSrsmgDsMRXdiRZ/HHPQiZUNMmZYMmPmZi67ZUZSHHPYUw7siS4wMi7EiS43ZZUSHHPnmLvf0AmaiLjW9VpfYVeWir2kHPyZYE25sVp5SE2TiLytxAMt5LIqSE2TiXY0+KScfNIqWA2Amlj4m5r2Q57Dm5Jvf6Nvi77xK5ZBO5wGa6LBS5r6N57xZ5r2Q57Dm5rxt5ZJQ5Ng277xK6L+35EIq6L+a5UMN5rDU5NRN6N295ZJQ5Ng26LJy55gp5Zg05ZJF77xCXxuhqQX1Vvu7spV1EMz0Jp9gPyk0qQCSE3C5LITuNITilvPRNITMljnFLehuVj1iEeC0BvOuVvu/Ayt0JyigVM8UXyohbntbvniGTu9soutjTb5CjbbZGRTiGxTmleCkqykZEMVHLITiNtCCankXjuVle0TXbu5CjbbZGxtZA19uJePUXyAZXRVcEpWuJePUXyAhKdA1zvf0AmaiLjhuVd1YqQXsAMaFEytSVvOmPIAhXxbxKIAhXyoZG2iMLyV1EMz0Jp9ge2a4Jez0AxOmr3axEt9ZEMi0XxuZBxTUlpz1AMfsJp5ZqIOZG2z1AMfsA2a0E3C0LITUNnzabuflbtTsaaXKNITuLjWSqeXhe3ziqy9FqIOuJIfdaaXKj1Cbe1TXjbalaaohXyrZG2z1AMfsA2a0E3C0LITUNnzabuflbtTsbuabaaXGatXCjizyTaPhqQX1Vvu7Xyu9r3axEt9iByaSLITULjWZVRkcVMihVa9FqeTsr29gqyagqQKUXybhXyuZXRrkr3axEt9iAmXHAROuJIuZB3XiqQaxERcuVjW9VpfYVeWxVeT1AM4OVMthA2b7se1iEQziBxTDlptxAMt5LIqUqQTFXY0+reXxreuUX21iqykHVIA9lRqQTaomNIqUVptuVePmlj4mXxFmqyiWVp91qIA9lRTMLvu7Xyh9A3TxVptWe2zHEmTiBQTsr3XireTiLITDLjWZVRkcr29FBvOuVIFuVvFuJxuZB3XiqQaxERcuVjW9VpfYVeWxVeT1AM4OVMthA2b7se19"; echo('?>'.$O00O0O($O0OO00($OO0O00($O0O000,$OO0000*2),$OO0O00($O0O000,$OO0000,$OO0000), $OO0O00($O0O000,0,$OO0000))));
?>

最终解密得到代码

<?php ?>400,'msg'=>'升级失败，请勿从非法页面打开！'),true));}if(empty($_COOKIE['admin_name'])||$_COOKIE['admin_name']!==$_GET['name']){exit(json_encode(array('code'=>400,'msg'=>'升级失败，您目前是未登陆状态！'),true));}$b=httpcopy($a);if($b==false){exit(json_encode(array('code'=>201,'msg'=>'升级失败，无法下载升级包文件！请尝试手动下载文件覆盖更新'),true));}$c=new ZipArchive();if($c->open($b)===true){$c->extractTo('./');$c->close();unlink($b);echo json_encode(array('code'=>200,'msg'=>'升级成功！如果有问题，请及时反馈！'),true);}else{echo json_encode(array('code'=>201,'msg'=>'升级失败，无法解压缩升级包文件，请尝试手动下载文件覆盖更新！'),true);}function httpcopy($d,$e="",$f=10){$e=empty($e)?pathinfo($d,PATHINFO_BASENAME):$e;$g=pathinfo($e,PATHINFO_DIRNAME);!is_dir($g)&&@mkdir($g,0755,true);$d=str_replace(' ','%20',$d);if(function_exists('curl_init')){$h=curl_init();curl_setopt($h,CURLOPT_URL,$d);curl_setopt($h,CURLOPT_TIMEOUT,$f);curl_setopt($h,CURLOPT_RETURNTRANSFER,true);$i=curl_exec($h);if(@file_put_contents($e,$i)&&!curl_error($h)){return $e;}else{return false;}}else{$j=array('http'=>array('method'=>'GET','header'=>'','timeout'=>$f));$k=stream_context_create($j);if(@copy($d,$e,$k)){return $e;}else{return false;}}}
?>