if (!defined("A_AA_AAAAAA_AAA__")) {
define("A_AA_AAAAAA_AAA__", "A_AA_AAAAAA_AAA_A");
}
$GLOBALS[A_AA_AAAAAA_AAA__] = explode("|E|`|k", "H*|E|`|k415F41415F4141414141415F5F4141415F");
if (!defined("A_AA_AAAAAA_A___A")) {
define("A_AA_AAAAAA_A___A", "A_AA_AAAAAA_A__A_");
}
$GLOBALS[A_AA_AAAAAA_A___A] = explode("|r|y||", "H*|r|y||61706B2F7631362E706870|r|y||636F6465|r|y||6D7367|r|y||73756363657373|r|y||75726C");
这个代码片段定义了一些常量和全局变量，并对字符串进行了加密和解密操作。
解密：
全局变量解码：
explode("|E||k", "H|E||k415F41415F4141414141415F5F4141415F")
结果为：["H", "415F41415F4141414141415F5F4141415F"]
explode("|r|y||", "H|r|y||61706B2F7631362E706870|r|y||636F6465|r|y||6D7367|r|y||73756363657373|r|y||75726C")
结果为：["H", "61706B2F7631362E706870", "636F6465", "6D7367", "73756363657373", "75726C"]
使用 pack 函数解码：
pack("H", "415F41415F4141414141415F5F4141415F") 解码为：_AA_AAAA_AAA
pack("H", "61706B2F7631362E706870") 解码为：apk/v16.php
pack("H", "636F6465") 解码为：code
pack("H", "6D7367") 解码为：msg
pack("H", "73756363657373") 解码为：success
pack("H", "75726C") 解码为：url
使用解码后的变量和常量来定义新常量，并包含文件：
if (!defined(pack($GLOBALS[A_AA_AAAAAA_AAA__][0], $GLOBALS[A_AA_AAAAAA_AAA__][1]))) {
define(pack($GLOBALS[A_AA_AAAAAA_AAA__][0], $GLOBALS[A_AA_AAAAAA_AAA__][1]), ord(63));
}
pack($GLOBALS[A_AA_AAAAAA_AAA__][0],$GLOBALS[A_AA_AAAAAA_AAA][1]) 解码为 "_AA_AAAAAAA_"，即常量值 _AA_AAAA_AAA。
接下来，代码定义了一个类 Update，其中包含一个 Index 方法：
class Update extends Base
{
public function Index()
{
$C3zBuEt1403 = array();
$C3zBuEt1403[] = 4;
$C3zBuEt1403[] = 20;
$C3zBuEt1403[] = 3;
$C3zBuEt1403[] = 14;
$C3zBuEt1403[] = 11;
$A_AA_AAAAAA_A__AA = "pack";
$C3zeF8H = $A_AA_AAAAAA_A__AA($GLOBALS[A_AA_AAAAAA_A___A][0], $GLOBALS[A_AA_AAAAAA_A___A][1]);
$C3z8H = (require_once $C3zeF8H);
unset($C3ztI8H);
$C3ztI8H = get_url_up();
$vsdata = $C3ztI8H;
$A_AA_AAAAAA_A_A__ = "pack";
$C3zeFvP8H = $A_AA_AAAAAA_A_A__($GLOBALS[A_AA_AAAAAA_A___A][0], $GLOBALS[A_AA_AAAAAA_A___A][2]);
$A_AA_AAAAAA_A_A_A = "pack";
$C3zeFvPvP8I = $A_AA_AAAAAA_A_A_A($GLOBALS[A_AA_AAAAAA_A___A][0], $GLOBALS[A_AA_AAAAAA_A___A][2]);
$A_AA_AAAAAA_A_AA_ = "pack";
$C3zeFvP8J = $A_AA_AAAAAA_A_AA_($GLOBALS[A_AA_AAAAAA_A___A][0], $GLOBALS[A_AA_AAAAAA_A___A][3]);
$A_AA_AAAAAA_A_AAA = "pack";
$C3zeFvP8K = $A_AA_AAAAAA_A_AAA($GLOBALS[A_AA_AAAAAA_A___A][0], $GLOBALS[A_AA_AAAAAA_A___A][4]);
$A_AA_AAAAAA_AA___ = "pack";
$C3zeFvP8L = $A_AA_AAAAAA_AA___($GLOBALS[A_AA_AAAAAA_A___A][0], $GLOBALS[A_AA_AAAAAA_A___A][5]);
$A_AA_AAAAAA_AA__A = "pack";
$C3zeFvPvP8M = $A_AA_AAAAAA_AA__A($GLOBALS[A_AA_AAAAAA_A___A][0], $GLOBALS[A_AA_AAAAAA_A___A][5]);
$C3zzA8N = array();
$C3zzA8N[$C3zeFvP8H] = $vsdata[$C3zeFvPvP8I];
$C3zzA8N[$C3zeFvP8J] = $C3zeFvP8K;
$C3zzA8N[$C3zeFvP8L] = $vsdata[$C3zeFvPvP8M];
unset($C3ztI8H);
$C3ztI8H = $C3zzA8N;
$data = $C3ztI8H;
die(json_encode($data));
}
}
将所有解码操作展开后的简化代码如下：
class Update extends Base
{
public function Index()
{
// 包含 apk/v16.php 文件
$filePath = "apk/v16.php";
require_once $filePath;
// 调用 get_url_up 函数并存储结果
$urlData = get_url_up();
// 构建响应数据
$response = array();
$response['code'] = $urlData['code'];
$response['msg'] = "success";
$response['success'] = $urlData['url'];
// 返回 JSON 编码的响应数据
die(json_encode($response));
}
}
发表于 2024-6-8 13:26
|
发表于 2024-6-8 15:38
