解析gzinflate(base64_decode(base64_decode($str64)))的一个代码

78模板网今天分析gzinflate(base64_decode(base64_decode($str64)))的一个代码

/* <?php eval(base64_decode('JElJSUlJSUlJSUlJbD0nYmFzZTY0X2RlY29kZSc7JElJSUlJSUlJSUlJST0nZ3ppbmZsYXRlJzs='));

//eval($IIIIIIIIIIIl='base64_decode';$IIIIIIIIIIII='gzinflate';)

<?php

$OOO000000=urldecode('%61%68%36%73%62%65%68%71%6c%61%34%63%6f%5f%73%61%64');

//var_dump($OOO000000);die;

//$OOO000000=ah6sbehqla4co_sad

$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};

//var_dump($OOO0000O0);die;

//$OOO0000O0==base64_decode

$O0O0000O0='OOO0000O0';

<?php

$str64='clZoYmJ4TkhGSDd2cnhoV2JtY1h4WEVJYlI5SXZDalFFS1FtZ0dMVGx5aGFqWGZIOWlpekYzWm1EUTVCb3BWb3BTTG9RMHRWcEZhbE40R0VTcEFxVlcwUi9CcU1rMy9STTdPNzlpWTJJVEZJanIxenpuem5QdWZNNWozRW1zZ3NSVHhwc2FESkF1SlRWSzBpekFLWEp4N0ZGcnFPVm1tTENVbmpTM3FUaVRkbVoyWm44QlRDQzY1a0hacVNuWlJxemFGbUVnQTlETkFvMjFUaUZqelBPY2M0Q0hSeWlYdVd6b0xudzNjOWpGWm9rQ2c5R2d0a1R4TkF4UnRGTEhwTU9xdFVSR0VnS0o3S0pBd0lJT0xHME02OVROTzZqbG84YkJDT1NwdU5hS3BFWXNsY1R1Y2dVbWErS050MTZrZWNTRnF0R2lKc09vSUZMVTZOcmEyU3M3UllYek9ZWjZ3ZnF4cUdjcGk2N1JEaGVZOTFrTXVKRUZXRGdubCs2TTBhOWp3bkRjcUxkQlpFaVZSNU1PeWQ1OXN2bi8zZCsvMWg3K2szYUw2aXQ5cnplZ09TM1loV0RVbXZTUU14cjJyNFZKSTB5R0NPVDY0WlNNa1lSKzhRbmdBRFQ3ZWx6MFZFWFVhNDJ5YXhLSGkzQWloUnRnczRheHFEdFJWd3dzWnpiK0hTdzk5NmQyLzN0ci9zUC9qOFNDNUZJRzJzVHlsakFxY1U4QjE1OWVyZS9mNmoyenZiZis0OHVua2tyeFJ6ckZjcFl3S3ZGUEFkZWJYNzdZdFhkLy9vL2ZpMDk5T0lWMEoyT1ZoMmxYbXlmUXA5TlBQK25IR3dwNXdGRzJNOVRSa1RlS3FBZXoyOThSWVovUDZyL3VNSHRjV0x2VnQvN1g3M1pHZjd6c1FlQ3hwdTBPNGVYM1BTRWJ4TUlmdjkyOWV6c3Bab2ZsRHk0VWVvWmxOb1hYTW9KYSt0b3lwYUlSczBhNmttanNOUXFzYjY4cDludTcvK3NIdnJUdi81RTFnclVObHVoMEtpYVlRM0cwNGlhQ3dxc2sxOVd0RWFLejVod1hUVWprNFRWMVliUkRCWEtFSHFUNGFSVWpjY0JDUG0xcEtHMWw5aW5qSVZmTzVtSkRDUXhESHBtak9vYW1lUHVQZnpmLzFmYnU0OGVaRmFoNGZxT0cwcSs1dUVDMnBOb1JNRkVLUndpSUFnaXMweGdOa0NvSC92RnB6YVFReXdTc1FZeU1raTVPR3ozdGVQK28vdjk3LzRkd2owd3c0ZEJhcUJHTWFVdUcxa0ZoMG1BcFUybE14U3B6QWpDR3JIdEZrMWRIZ3haS0hVV1R1eHJySmhJTFUwWVgxeVhVMW9HU2NVbllhb2s3aEZaZFZ3R3B6QVFjTG9GR1REVWdoN1hrUWt5T3ZkTDJmaVpyVzRUQnJ6bEt4VUNRanp5MEY0dFNEQ3NEUFFqQWJOVjVSRXFFZVNWbU1od1pjREZnaEpPQjhaOTJNRzdaV0V4ZFFzdVNIY09GcU9PaWZGeW0zd3NCVVIyWWJ5YlRKT25mUk9ndWkxaUljZU5YRkZWV29SQzVNNXZhMkFRem40dFFYTWZOS2lvcUw4b29GbkRsVlk0eXIyY3N3UHRGT2RsZHhPWFJ4dk1EU21Nb21ESWZab1ptb040OHprY0Qrcmt4YTBrU0R4Ujd1QWtESFloU0ZuSlVsYUM1bWQ2V2xmb2dxNURBSk1uSjNrck1waHEzTTJUQUtKVlpuaVR4WnJaN0dWYzdVaXRYMVBmUStrcStxR2hUN2xvSDBhdE05elpnL3FXNWNWYkNqYkVPRkNwV25TQlpWd1hXNEVhZzFndXRqeTBJRzRNUkZnd3ZIREJnUkoxNXk2MDhMOVRJS2RUbTF4OWJQRjFUVjh2bDYvNUZ5R2xiT3d0SGloanRjdGJkMEFDQkhSUjFhUEVmaFZNa0JYRklxRGhFQUlWalFjRHN5eGFpWUNiVzJoUTBFWEFpOE9tVGNSdHNiNFJtVWk1S2NzOENZMCtBd243c1laR3NmZGllQVhJeG9UdE1JQzlqWndpSGNSUHBKRzFScnpMTDQyeFhrNURaaGppZ29za2hjU2Y5OGJBWndpNkpLUzZhNmtma3hMblRFcU05S0o0N01mSHY5NEJqNUFiZzNJT2FpY2J3V3UxeGljUTY4Qk0vOEtMOXVBU0FWZTRZcXA2WlJURjg0bmJOUTJZYXRzWDIxVDZLSHBZY3dPYkJWZWRLQ3ZPRFZKWkFKekVzTVVuc3A0ZHNhN0JQQTZLTWRUdVdtV1pXbk5jMm9lNytzTXFpM1U0WTVqWW9WVDdRdzJXdG1WMGxXOXdTd05tOUlnNG5IYTRSR2VucTZrSCtoeG9ndnZrSDRsRDNIRnpTZ09qSFdxcmhTcVBXbkZ5eUh4ek9LTFpJZkdyS25pVXRKUDNTVG1sbGFUcG5CQVZFYVVscFl2bmxsWXJxM2hqbXF5VXVEMVFVa01lYUNuRWZLVzV1MmZHYTgxbEtqMzB0elNnU2dsWjVPMDQ0TmthV1Q2N2JRcDhXZzhWb3dnTWpxc0dMaHRqY2p3U2ZQUVpqVGhDampHakpZcmcxUkVYZ05uYTZ2bjZuQVhEWFJWYXVwWlBkUFNZYXVIRmxTUWVoYUFNNHg4VjQxMDZPak91VU5ueUFGbWFvb1grdlI4ZldWWlRRajFYQ2lOOUY4V0RuU09UVEc0UjhGeldvK243ZjhC';

$jiemi= base64_decode($str64);

//var_dump ($jiemi);die;//第一层base64解密

$jiemi2=base64_decode('SUlJSUlJSUlJSUls');

//echo $jiemi2;die;IIIIIIIIIIIl

$jiemi3=base64_decode('SUlJSUlJSUlJSUlJ');

//echo $jiemi3;die;IIIIIIIIIIII

$jiemi4=$GLOBALS[$jiemi2];

// echo $jiemi4;die;

$jiemi5= base64_decode($jiemi);

// echo $jiemi5;die;

$jiemi6=gzinflate($jiemi5); //$zhijie=gzinflate(base64_decode(base64_decode($str64)));

echo $jiemi6;die;

$jiemi9=$GLOBALS[$jiemi3]($GLOBALS[$jiemi2]($jiemi));

var_dump ($jiemi9);die;

$yy= eval($GLOBALS[base64_decode('SUlJSUlJSUlJSUlJ')]($GLOBALS[base64_decode('SUlJSUlJSUlJSUls')]

(base64_decode($str64))));

echo $yy;die;

$jieguo=eval($GLOBALS[$GLOBALS['OOO0000O0']('SUlJSUlJSUlJSUlJ')]($GLOBALS[$GLOBALS['OOO0000O0']('SUlJSUlJSUlJSUls')]($GLOBALS['OOO0000O0']('clZoYmJ4TkhGSDd2cnhoV2JtY1h4WEVJYlI5SXZDalFFS1FtZ0dMVGx5aGFqWGZIOWlpekYzWm1EUTVCb3BWb3BTTG9RMHRWcEZhbE40R0VTcEFxVlcwUi9CcU1rMy9STTdPNzlpWTJJVEZJanIxenpuem5QdWZNNWozRW1zZ3NSVHhwc2FESkF1SlRWSzBpekFLWEp4N0ZGcnFPVm1tTENVbmpTM3FUaVRkbVoyWm44QlRDQzY1a0hacVNuWlJxemFGbUVnQTlETkFvMjFUaUZqelBPY2M0Q0hSeWlYdVd6b0xudzNjOWpGWm9rQ2c5R2d0a1R4TkF4UnRGTEhwTU9xdFVSR0VnS0o3S0pBd0lJT0xHME02OVROTzZqbG84YkJDT1NwdU5hS3BFWXNsY1R1Y2dVbWErS050MTZrZWNTRnF0R2lKc09vSUZMVTZOcmEyU3M3UllYek9ZWjZ3ZnF4cUdjcGk2N1JEaGVZOTFrTXVKRUZXRGdubCs2TTBhOWp3bkRjcUxkQlpFaVZSNU1PeWQ1OXN2bi8zZCsvMWg3K2szYUw2aXQ5cnplZ09TM1loV0RVbXZTUU14cjJyNFZKSTB5R0NPVDY0WlNNa1lSKzhRbmdBRFQ3ZWx6MFZFWFVhNDJ5YXhLSGkzQWloUnRnczRheHFEdFJWd3dzWnpiK0hTdzk5NmQyLzN0ci9zUC9qOFNDNUZJRzJzVHlsakFxY1U4QjE1OWVyZS9mNmoyenZiZis0OHVua2tyeFJ6ckZjcFl3S3ZGUEFkZWJYNzdZdFhkLy9vL2ZpMDk5T0lWMEoyT1ZoMmxYbXlmUXA5TlBQK25IR3dwNXdGRzJNOVRSa1RlS3FBZXoyOThSWVovUDZyL3VNSHRjV0x2VnQvN1g3M1pHZjd6c1FlQ3hwdTBPNGVYM1BTRWJ4TUlmdjkyOWV6c3Bab2ZsRHk0VWVvWmxOb1hYTW9KYSt0b3lwYUlSczBhNmttanNOUXFzYjY4cDludTcvK3NIdnJUdi81RTFnclVObHVoMEtpYVlRM0cwNGlhQ3dxc2sxOVd0RWFLejVod1hUVWprNFRWMVliUkRCWEtFSHFUNGFSVWpjY0JDUG0xcEtHMWw5aW5qSVZmTzVtSkRDUXhESHBtak9vYW1lUHVQZnpmLzFmYnU0OGVaRmFoNGZxT0cwcSs1dUVDMnBOb1JNRkVLUndpSUFnaXMweGdOa0NvSC92RnB6YVFReXdTc1FZeU1raTVPR3ozdGVQK28vdjk3LzRkd2owd3c0ZEJhcUJHTWFVdUcxa0ZoMG1BcFUybE14U3B6QWpDR3JIdEZrMWRIZ3haS0hVV1R1eHJySmhJTFUwWVgxeVhVMW9HU2NVbllhb2s3aEZaZFZ3R3B6QVFjTG9GR1REVWdoN1hrUWt5T3ZkTDJmaVpyVzRUQnJ6bEt4VUNRanp5MEY0dFNEQ3NEUFFqQWJOVjVSRXFFZVNWbU1od1pjREZnaEpPQjhaOTJNRzdaV0V4ZFFzdVNIY09GcU9PaWZGeW0zd3NCVVIyWWJ5YlRKT25mUk9ndWkxaUljZU5YRkZWV29SQzVNNXZhMkFRem40dFFYTWZOS2lvcUw4b29GbkRsVlk0eXIyY3N3UHRGT2RsZHhPWFJ4dk1EU21Nb21ESWZab1ptb040OHprY0Qrcmt4YTBrU0R4Ujd1QWtESFloU0ZuSlVsYUM1bWQ2V2xmb2dxNURBSk1uSjNrck1waHEzTTJUQUtKVlpuaVR4WnJaN0dWYzdVaXRYMVBmUStrcStxR2hUN2xvSDBhdE05elpnL3FXNWNWYkNqYkVPRkNwV25TQlpWd1hXNEVhZzFndXRqeTBJRzRNUkZnd3ZIREJnUkoxNXk2MDhMOVRJS2RUbTF4OWJQRjFUVjh2bDYvNUZ5R2xiT3d0SGloanRjdGJkMEFDQkhSUjFhUEVmaFZNa0JYRklxRGhFQUlWalFjRHN5eGFpWUNiVzJoUTBFWEFpOE9tVGNSdHNiNFJtVWk1S2NzOENZMCtBd243c1laR3NmZGllQVhJeG9UdE1JQzlqWndpSGNSUHBKRzFScnpMTDQyeFhrNURaaGppZ29za2hjU2Y5OGJBWndpNkpLUzZhNmtma3hMblRFcU05S0o0N01mSHY5NEJqNUFiZzNJT2FpY2J3V3UxeGljUTY4Qk0vOEtMOXVBU0FWZTRZcXA2WlJURjg0bmJOUTJZYXRzWDIxVDZLSHBZY3dPYkJWZWRLQ3ZPRFZKWkFKekVzTVVuc3A0ZHNhN0JQQTZLTWRUdVdtV1pXbk5jMm9lNytzTXFpM1U0WTVqWW9WVDdRdzJXdG1WMGxXOXdTd05tOUlnNG5IYTRSR2VucTZrSCtoeG9ndnZrSDRsRDNIRnpTZ09qSFdxcmhTcVBXbkZ5eUh4ek9LTFpJZkdyS25pVXRKUDNTVG1sbGFUcG5CQVZFYVVscFl2bmxsWXJxM2hqbXF5VXVEMVFVa01lYUNuRWZLVzV1MmZHYTgxbEtqMzB0elNnU2dsWjVPMDQ0TmthV1Q2N2JRcDhXZzhWb3dnTWpxc0dMaHRqY2p3U2ZQUVpqVGhDampHakpZcmcxUkVYZ05uYTZ2bjZuQVhEWFJWYXVwWlBkUFNZYXVIRmxTUWVoYUFNNHg4VjQxMDZPak91VU5ueUFGbWFvb1grdlI4ZldWWlRRajFYQ2lOOUY4V0RuU09UVEc0UjhGeldvK243ZjhC'))));

echo $jieguo;die;

$ok=gzinflate(base64_decode(base64_decode($str64))); //eval()里面的内容就相当于$ok;

echo $ok;die;

//eval里面内容解密后的源码

?> */

<?php

if ($pluginfiname == 'include')

{

RegisterPlugin('k2020', 'ActivePlugin_k2020');

function ActivePlugin_k2020() {

Add_Filter_Plugin('Filter_Plugin_Admin_TopMenu', 'k2020_AddMenu');

Add_Filter_Plugin('Filter_Plugin_Edit_Response','k2020_Response');

}

function k2020_Response(){

global $zbp,$article;

if($article->Template=="sof_single"||$_GET["id"]!="")

{ echo '<div class="editmod2"><label class="editinputname">软件大小 </label><input type="text" id="meta_k2020sofmax" name="meta_k2020sofmax" value="'.htmlspecialchars($article->Metas->k2020sofmax).'"></div>';

echo '<div class="editmod2"><label class="editinputname">解压密码 </label><input type="text" id="meta_k2020sofpass" name="meta_k2020sofpass" value="'.htmlspecialchars($article->Metas->k2020sofpass).'"></div>';

echo '<div class="editmod2"><label class="editinputname">教程语言 </label><input type="text" id="meta_k2020softype" name="meta_k2020softype" value="'.htmlspecialchars($article->Metas->k2020softype).'"></div>';

echo '<div class="editmod2"><label class="editinputname">链接地址 </label><input style="width: 50%;" type="text" id="meta_k2020soflink" name="meta_k2020soflink" value="'.htmlspecialchars($article->Metas->k2020soflink).'"></div>'; }

echo '<div class="editmod2"><label class="editinputname">文章SEO关键词 </label><input style="width: 50%;" type="text" id="meta_seokey" name="meta_seokey" value="'.htmlspecialchars($article->Metas->seokey).'"></div>'; }

function k2020_AddMenu(&$menus) {

global $zbp;

$menus[] = MakeTopMenu('root', '主题配置', $zbp->host . 'zb_users/theme/k2020/main.php?act=basics', '', 'topmenu_k2020');

}

function k2020_SubMenu($id) {

$arySubMenu = array(

0 => array('基础设置', 'basics', 'left', false),

1 => array('SEO设置', 'seosz', 'left', false),

2 => array('畅言配置', 'arti', 'left', false),

3 => array('移动站点配置', 'move', 'left', false),

);

foreach ($arySubMenu as $k => $v) {

echo '<a href="?act=' . $v[1] . '" ' . ($v[3] == true ? 'target="_blank"' : '') . '><span class="m-' . $v[2] . ' ' . ($id == $v[1] ? 'm-now' : '') . '">' . $v[0] . '</span></a>'; } }

function UninstallPlugin_k2020() {

}

function k2020_Require($config_name) {

global $blogpath;

$file_name = explode('/', $config_name);

include ($blogpath . 'zb_users/theme/k2020/images/' . end($file_name));

}

function k2020_Url($config_name) {

global $bloghost; $file_array = explode('/', $config_name);

return $bloghost . 'zb_users/theme/k2020/images/' . end($file_array);

}

function k2020_listTags($num) {

global $zbp;

$str = '';

$tagArray = $zbp->GetTagList('', '', array('tag_Count' => 'DESC'), array($num), '');

foreach ($tagArray as $tag) {

$str.= '<li><a href="' . $tag->Url . '">' . $tag->Name . '</a></li>';

}

return $str;

}

function k2020_is_mobile() {

if (empty($_SERVER['HTTP_USER_AGENT']))

{ $is_mobile = false; }

elseif

(strpos($_SERVER['HTTP_USER_AGENT'], 'Mobile') !== false || strpos($_SERVER['HTTP_USER_AGENT'], 'Android') !== false || strpos($_SERVER['HTTP_USER_AGENT'], 'Silk/') !== false || strpos($_SERVER['HTTP_USER_AGENT'], 'Kindle') !== false || strpos($_SERVER['HTTP_USER_AGENT'], 'BlackBerry') !== false || strpos($_SERVER['HTTP_USER_AGENT'], 'Opera Mini') !== false || strpos($_SERVER['HTTP_USER_AGENT'], 'Opera Mobi') !== false)

{ $is_mobile = true; }

else {

$is_mobile = false;

}

return $is_mobile; }

function k2020_postNum(){

global $zbp;

$nowtime = time();

$settime = 1*24*60*60;

$gettime = $nowtime-$settime;

$db = $zbp->db->sql->get();

$sql = $db->select('zbp_post')->where(array(array('=','log_Status','0'),array('>','log_PostTime',$gettime)))->sql;