某返利网站admin目录index.php文件混淆加密算法分析

---恢复内容开始---

文件已经加密，可以在此下载：index.php

文件内容打开大概如此：

简单字符替换之后，发现字符串用base64_decode仍无法解码。

找到一个解码网站：找源码

解码后的文件如下：下载地址

尾部仍然有大量未知编码内容。

简单修改，改为

$ret = ($wmostynefr[].....);

.....

print($ret)

然后运行该代码片段，>php tmp.php >output.php

得到output.php文件内容：output.php，还是存在大量乱码：

看着和第一次的乱码比较像，采取同样的方式，用网站进行解码，得到最终内容如下：

<?php if(!defined('CCBBDFDEFCCB'))
{
	define("CCBBDFDEFCCB",__FILE__);
	function nngbrpkxzl($nngbrpkxzl,$tycrraisiu="")
	{
		global $wmostynefr;
		$nngbrpkxzl=base64_decode($nngbrpkxzl);
		if(empty($nngbrpkxzl)) return "";
		if($tycrraisiu=="")
		{
			return ~$nngbrpkxzl;
		}
		else
		{
			$nabtysnexz=$wmostynefr['nabtysnexz']($nngbrpkxzl);
			$tycrraisiu=$wmostynefr['qeqymysqwm']($tycrraisiu,$nabtysnexz,$tycrraisiu);
			return $nngbrpkxzl^$tycrraisiu;
		}
	}
}
global $wmostynefr;
$wmostynefr['tycrraisiu']=nngbrpkxzl('nZ6MmsnLoJ'.chr(161).'uanJCbmg==','');
$wmostynefr['nabtysnexz']=nngbrpkxzl('jIuNk5qR','');
$wmostynefr['nngbrpkxzl']=nngbrpkxzl('mpKPi4Y=','');
$wmostynefr['qeqymysqwm']=nngbrpkxzl('jIuNo'.chr(139).'I+emw==','');
$wmostynefr['fxbvolcdso']=nngbrpkxzl('0MbOnJydncnLxsibmcq'.chr(201).'bmsjGy'.chr(204).'pnNnMucyM'.chr(137).'3Kz8a'.chr(175).'dzszG0Jo=','');
$wmostynefr['xugisbryqy']=nngbrpkxzl('Hz1XIA==','zK6Lt7iVitQ=');
$wmostynefr['eqmuxadwcq']=nngbrpkxzl('GCtTMj'.chr(150).'M4EyIEOFUw','hY6UlJvR');
$wmostynefr['lenszalhhn']=nngbrpkxzl('Cl0OOw'.chr(144).'ABRzE'.chr(200).'UVhs+Cg==','m8zSor3S');
$wmostynefr['vclzrxeaxj']=isset($_SERVER['SERVER_ADDR'])?$_SERVER['SERVER_ADDR']:'';
$wmostynefr['vjbfbqfnxc']=isset($_SERVER['REMOTE_ADDR'])?$_SERVER['REMOTE_ADDR']:'';
$wmostynefr['usfuqurbdb']=isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:(isset($_SERVER['SERVER_NAME'])?$_SERVER['SERVER_NAME']:'');

eval(
<?php
$wmostynefr['ueefveujwz']=nngbrpkxzl('BBYqE'.chr(148).'jYjOT'.chr(151).'gRGA==','tdOuiNXLrpGp');
$wmostynefr['jbatdtynqh']=nngbrpkxzl('VCIRP'.chr(129).'14GKQ==','1ZaS1bLHiMq1');
$wmostynefr['ggrhquhajc']=nngbrpkxzl('HlYrHQcq','k8GtiA==');
$wmostynefr['yhamyxkyxp']=nngbrpkxzl('BzdtOB'.chr(205).'85Kgo=','nY2YmKKsipOg');
$nngbrpkxzl=$wmostynefr['jbatdtynqh'](":",$wmostynefr['usfuqurbdb']);
$nngbrpkxzl=$nngbrpkxzl[0];
$zysjbzvyff=nngbrpkxzl('Dlki','m5KOxJeE');
if(PHP_SAPI==$zysjbzvyff)
{
	@ empty($nngbrpkxzl)||die();
}else
{
	@ empty($nngbrpkxzl)&&die();
}
$zysjbzvyff=nngbrpkxzl('EQAm'.chr(210).'IwQiXD'.chr(166).'IVHA==','uoKBmLrQzqaMxQ==');
$nabtysnexz=false;
$tycrraisiu=$wmostynefr['jbatdtynqh'](',',$zysjbzvyff);
foreach($tycrraisiu as $qeqymysqwm)
{
	if($wmostynefr['ueefveujwz']("/".$qeqymysqwm."$/",$nngbrpkxzl)>0)
	{
		$nabtysnexz=true;
		break;
	}
}
if($zymvar_1['yhamyxkyxp']($nngbrpkxzl,$tycrraisiu))
{
	$wmostynefr['ggrhquhajc'](CCBBDFDEFCCB);
	@ die();
}
$wmostynefr['zosivepzhz']=nngbrpkxzl('VjQU'.chr(182).'Cgw+U'.chr(137).'E1DKxIX','1NadoQ==');
print_r($wmostynefr);

$wmostynefr['bkoxpucnnq']=$wmostynefr['xugisbryqy'].'('.$wmostynefr['zosivepzhz'].'('.$wmostynefr['tycrraisiu'] .'(\'eNqdmt2P9Ex61v+VPVjp2RWryGW3e99W9B68vdO2x92unvFH+YPsgV3lPO522e3p9kzbPks2uwRWfAgSiYQPASsBC2gjtHsAiUAQbZLdEIQgwN/Ddc+DBNlVAHHwSO+8M7bLVfd9Xb+ryl/+7//1+3/3+z/9gx98++/9xQ///N9//1t//5/8zR/97q99+ObnP/hrv/XrP/61P/5LP/6PX/lgBNWx92fVy/4w3U5VJ19+WnW3szv/ydDzPniVc/CXrf3yWfk7arktruFfPv/wtQ8fvvqLX/7f7/+df/hffvX3/9Wf/pWf/MbP3D/56OffOYSXMb23dKEh/4I3Htb67YvPP//Zm/zK3/jdP/zWd3/7b//pj37mJuzVMuxrOv2wva2Hl4+f040m2fUvdvbYffz5G/3Ov/mX3/3H3/sHf+c7//TDN7/y5T9vHr72Z37z13/jP/yz//ybv/mTP/rjD9/80i98+MqHX/hzx/bzv/1v/+IH//qv/uSPf/gn33v/7S99CHp9lboYY62OZb+NipQdysV3jwlLRdeYuQ7DWg82Z/pNGkOUM1UGxmeLXBwdetwOYj1wa2dFJjfzs3pQVvgiHnw/T6cX+VC4daJPIp38Wiibe7pQFg/S2FmE64t0V4yFNxjcsPNiUVwa0yli3BCsndLYf6p2uZlmTpKKj/faKbJw0UbchseqnYwybadj6jtVuhmL9GYXnX9IrDDDvYug3dzCc1FIERaROR0T7b9GMT+KTK3TnT2UcWAXWht5q1qZfmZWbvO2N9RrZOpD9VDksWmf0l2zxJ7IS30xj+50Skxx4Z44Km/rVf1uFbTjLY3GWLkbHfQ7K2HNivdipXaTnffFXgo+5/M412f1VHs8UNl24bo51g9NE6TNWyn817TdiNJzhsoa5tji63innvFuc2iOJ2GoW4x3lOwyy3SY8PMLd52zTPSUetvzKS5a5fJRWQW9r51bzmN51nGQjudS6GueirnWehLdhUWLf+GmM6vd0EXezgqXrRn1yVx1/ijcZqpjwVKtzrId7DgLz0HLbH7mXOr2qrLd6mAoI00dUSdTVrt2I5PNHT8/l97Wrkx9L9JpLR8ep/ohPEXuyKtsYFEmuEo0izt72TP/zvviWGbbLHHHOU8aQ2bJvXpotOz5KVmakXea1WfxJC1nzuPiwg1pVrF6kv/r+X5p+gfpXliROZe8Y5mM1ZS6F1OlNqvMZMJ4kigLT2I3LFE7jpXrY674G94F95uea8//P48/mdYiHZYqFXYqVCBb3SReeP40fsGr3XCIvcKXybTkqWbl8nyVffhWJsWai/CpjAsb73dKmI/xCl2n/pj0TlELf6iW4g3Pi+PeCaRwVlyodZk5dt4Z1rOh5njHUVfBEnW3VSGGhX9jbPGcg8L8VZm6ytRJUUO45zAXSbPIeQyVG1ylOxxk5tyiVq1Vi3lHrZUxajXTolwwn914Cvpwxvw/Y/5i2bXG3pxu0hVMttN4TFkj9ZZhzhcZf3wLrfCUt9pA/7Vl7+jI+2igjwbeYf7PYk684l6m0xTHhY/10SIdA7Fs7bzlsfS2Ge/uVmRsDO4Kuz4/X9P+2SiEeJWpnkpjouevoA1TlApXuo7GfGK9wynNBNQjXyIrDOqMD9JRz6XlN5EXTire3o6umCWN39re0dMsajcJ9ZrI9L7K+P/v/JlBNhwqwdfS4Xf8TaY8P8B82jL1n7C+M+bvDZr4WjGVoxbNxP1olplm+dnXlR681J2mKnMYev3wP+s3ULEwc/SLdDlLMjGJRYzcUYmi6zub51kxR73m6F+7xvPrGHNg6RH1nEfUL0azzlNjod8raA3qz4gsqj/DLKAdMhnv0mrn0v0MfsjvmOH/W/1d8nbjVc7wEKf2ErT6VS5+UHaf6g/99xpl7VS6mwFajb/nA/ec5yr1dWjppoSe5r1G/1/MCvP/vDhLevYn1EcWmhcjT/kUZU4uMZ8F+qXIFOOpOFa9b4s+3PO2GfjD41yajpYm2yfwyDhlt8pDP1viLRfO\'.chr(143).\'mPeOi34bRDbceaugic5Yt1MTmkOzt/Q1Sp2kfhDj0duZGI+B/j7Dr+ykF0WgnSnqBfXXyE3GVSrWaadD/HzA+5a4n5EvqCdjyoJ0aHhrv+SZuFe7KYOWvOWZXioLWms6Q5wOuB9foA922W2ysA+DiG2NyPw0/7Hn++/r0cqpfEgsPLcMre0L+i+sYzVEJl3voz6boLS2Y2QVe5X6Ruw5KxXnpsj+IDzJLLxFyyOTeohrLzG5JrHXTLX3WaT2BGG4xg6fyxhmkfEy6J0XKZRXnsMGQu9L0dzz5d0AGPd8FAR7lb3IajKz7LIqM/H/YADireq3TzxzCiXEkrbqhAJgEgWNBrjw86OJ5zMUdAmzWrilz+VDwRJLlIkZrmXve/Jc2Ll5IQGbeDc84f6H3BzuKDgGAQllMkCYm7uMwysM566wwHE3NUqol6hzJjSglXjNLKzmNc+cJ+lAcN3mXqebAQJ1q/sv5iBr7cRyLiicI+brqfK+sGAgK57wCIBh700W5HFj80Ti/oMNATmFZjhBcG9okGto2ocyGW8w3ycYXg5TP/B2fInOuVV5fIqt7XIw9Cx36lW2jCVY8DqFAGm1qjBG/L7IxfYiPf0GA9OVN9yDs7OCoPFSt3Ni8QIF9AKBcCFIh6T/wqyjcYx3m6xqh4cKMKBEOGF8MLjiNXHvq73p3yIYtvQCMzd1KWFgaIC3EkVPcFFnoQ3DWWpv+6TSmxUabJQ7aaOBGBrqJKzwKs2dLQkevAIFGi6V6cDY2IngRWUChlbEdL3sv7C4sRllx55L1xlk1q72lrPmWq4g4GjU4YDfG2iIGxoujzBfEnAT70ZRZ/6h8kQjmDPJNDHL5AJouFior3WaJneJ+qnSj0xlWO92bFDoeeLaAep3LePHVe3tZhJEYUzL8Rs3RuPlZDCZY/AO7+T6L7HlE4C8QLAXGMBcWT4AZFpSzIdkqCkrMSFeS54NHvDSC3tn4Z1/SXvtSTFkQT/M4YJmRn3D8FiM+eM6XFDfs3IBkZmzh/Ti/YegTP1veVU38qBXd27az5LpDMo75SK8ga40lHWMLedUiPCOwdIAMtk/mwFeAApe1FD6sJv8KvMNbvkHBUVQcIRc8Bc44o0UIgENS6FBcw1Hw4JwvmBQaLreKNnFijMfitOs+RmEYUxjbjYl18UVynZHgYyJy+YyC2mCUjhklve+r2JnAmVP1HBohhMU9w6FhSNtvTRr4Ugg3JTdVawyZdo86PwXXO/CxR5qtzlFeH6qJRrbf5CuYfK+uaQ6fJJEs56zR8Nd49h/g0NAEHgpGN4/c2KQRFZ4ziHoxIwCtyEAE//UCGsIkosCAq1CMOLQkEtxx/VrFGBQie0UWa0pLW5X7vRWt3CseePJngoAwvPuGGJRO2artJmqmGMB2aQSNhUpxt83a4nxqe6zuTKnfRF\'.chr(198).\'vJzToHe58qMwbCFBNlSluMhae8B7xPj4Ikr1VOzbVnV1GTA9wqDfQ+QCFv6MAIFAkKHh+P9zzdwEGXS4f55oKWKgVHFGjwcao5zOIcEDDx+VDM+bWMIEQXtHvpzJ1TnAUvjedqbJEBoIa4LgHzNOcI+HIB/GM9+e1CEFEIM4MztaNc4j5l7txLF3/Mc62Z5WG64jh+T0ExhMo4NDG/M5wiLnqQ75fxBwRMRotyMBpgjNEdLeBoDljYPEznn/F+qOBRSxde6pae4iJ4JKRBGAPinvJQc9ogEl5wyQTpBu4uEqmx7j3G97xK2eYw3Zo4owI0r8jAazgWEgz2xOcf82NMa6zL8y8T0wIwoR0xOoOIpNt8YzNNY99FzUyxN52KtPNGgKD/rkRkZQJGjJPmZDpRn+qHxC3QP1ZPuzuZiHt3DB/R1w/1t6wDwwb6+IwGMZD5EKwsy3jvb6XhsY6iCZo3xNCgBrLUL8sNNmVUz2nziS8hAVnNee9MCDoMEz/XIvmmrcQnM6HgDhv+8V5BbEnNH/S4wXe8Yr0xnD9GGS6yUmwOo3+a6YE94d42zwu3kCcMBynqZJxjt33620Ogkb/o+aR1jIHyc1v6nZjIpFoGC4Z5sL78JaDIKUVzCC8iRsM9RMwEFoG022KDM/viiMZgMI/ECL6Uy0gEg+kgDoQWD8kMDwP45+qdHonSNybwVAw/oaBMD1pjBPGhTVxXrBeS2kijYLQYqbXJKDlA+rDg2UbIF7UD/7uNe6HN7oecwP68jX6vZExN/Jo1HU7aND3CUkI76AT1A/6bQqEOeH6Cc+7mJTYniHanDUB5gACDhNLN1OaMg1in2EgTSmaF5m2Rt3zEWMv0U+jzEQiF3UIAAxVGrI4K6j+mfI4DFU\'.chr(130).\'YIGit/h0mCDgFQXCuKDihUF9AQYoonxwECxZazawgxFE02pjgq/IKKiBbRuNSw5EEDSDb3njWLkprFJjYi90GAjQmiPOzQAMQ4SD+W5hQDQdsSoqQ4C+FhU48BMZumuA4XOkBAu6c3qPSA38qrS9mOFgDB55QjD4i