I am trying to have this php code return the output of the second file.
File 1
<?
$fin=fopen(__FI开发者_如何转开发LE__,'rb');
fread($fin,0x47a);
$code=base64_decode(strtr(fread($fin,0x17c),
'EnteryouwkhRHYKNWOUTAaBbCcDdFfGgIiJjLlMmPpQqSsVvXxZz0123456789+/=',
'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'));
eval($code);
?>
Second File.
kr9NHenNHenNHe1zfukgFMaXdoyjcUImb19oUAxyb18mRtwmwJ4LT09NHr8XTzEXRJwmwJXLT09NHeEXHr8XhtONT08XHeEXHr8Pkr8XTzEXT08XHtILTzEXHr8XTzEXRtONTzEXTzEXHeEpRtfydmOlFmlvfbfqDykwBAsKa09aaryiWMkeC0OLOMcuc0lpUMpHdr1sAunOFaYzamcCGyp6HerZHzW1YjF4KUSvNUFSk0ytW0OyOLfwUApRTr1KT1nOAlYAaacbBylDCBkjcoaMc2ipDMsSdB5vFuyZF3O1fmf4GbPXHTwzYeA2YzI5hZ8mhULpK2cjdo9zcUILTzEXHr8XTzEXhTslfMyShtONTzEXTzEXTzEpKX==tmklFbapFMagd25jcUEPwtwVRJ9jd25MDBFVFoiXwJLIKXppcJEPwolVfucidtEPwtOgA0aTA0lNTlSJdo9mDB5gCBOsDB5gDBWJbUEpwe09weEIhWp7tMilCBOlFJEPwtkSd2YifolvdjppdMOlGt5XDuEJhUE7tMa4DbWIhtEpweShgWpZcby1Dbklb29VC2AIhtEJRJ4vC2xiF3YlFZ9sDbYjRMc1dMHVFoiXwJLIKXpZcby1Dbklb29VC2AIhtEJRJ4vC2xiF3YlFZ9sCB5pFuaSCbOlRmnPFtwpweShkoOiforINUnVcbFIOoy0CA1idMlXfBxifo9ZwtIIhUE7tJO0DbOScUE9wtOLCbOiRT5zcBxlC3WIhtEJA2l0cA1idMymcbwJRtwQwJxiFmkiGUEPwtkTDbOlaMyZDByJdoAJNT4JA2l0cA5idBAJhUEpweShkuOpfoxlwe0IkuOpfoxlBznfweSh
Please help me understand what i am doing wrong and how i can make File 1 parse the data in file 2.
Thanks
Don't use __FILE__
in the fopen()
call -- use the name of the second file. The obfuscated File 1 looks to have some tight tolerances given its reads of 0x47a and 0x17c bytes.
File 1 opens itself, reads the first 0x47a bytes, reads the next 0x17c bytes, tries to match the 'Enter you...
string, and the 'ABCDEF...
string is interpreted as TRUE
so strstr
is going to return everything BEFORE the matching string.
It then tries to base64 decode that (offset 0x47a to the start of "Enter you...") and evaluate it as code.
Based on that description, I'd say the code in File 1 has been modified from its original form, since I can't see it as working properly. The file offsets don't make sense, and the matching doesn't make sense either.
精彩评论