<?php
rename_function('gzuncompress','new_gzuncompress');
override_function('gzuncompress', '$arg', 'print(new_gzuncompress($arg)); return new_gzuncompress($arg);');require_once 'decryption.php';
decryption('decryption.php');

<?php
function decryption($fileName) {/*** 解码函数* @param  string $str 待解码字符串* @param  string $flg 是否解析后解码* @return string      已解码字符串*/function decode($str, $flg = '') {if($flg === '') {$ret = $str;} else {$ret = 'ۯ'; $i = 0; $l = strlen($str);while($i++ < $l) {$c = ord($str[$i-1]);$ret .= $c<245 ? ( $c>136 ? chr($c/2) : $str[$i-1] ) : "";}}return base64_decode($ret);}$err = '解码遇到错误，请联系教主处理该文件!';$str = file_get_contents($fileName);$path = pathinfo($fileName);$dirname = $path['dirname']; // 文件所在目录$baseName = $path['filename']; // 文件名if (preg_match('|IN_DECODE_(\w{32})|s', $str, $arr)) {// 防止解密自己，其实方法都已经告诉你了，自己动手解码才快乐$arr[1] === '761b5f52db6dff7ce91344e99dcedab7' && die("err: [-1] - 请勿试图用本工具解密本工具！");} else {die("err: [-1] - 没有发现神盾特征，你确定这是神盾加密？");}// 匹配代码主题部分// '';@\$[\x00-\xff]+\(\\'([\x00-\xff]+?)\\'\.\(preg_match('|\'\';@\$[\x00-\xff]+\(\\\\\'([\x00-\xff]+?)\\\\\'\.\(|s', $str, $arr) || die("err: [0] - ".$err);$code = $arr[1];// 匹配中间加密部分preg_match('|\(\'([\x00-\xff]+)\',\'|s', $code, $arr) || die("err: [1] - ".$err);$key = base64_decode(decode($arr[1], "decode"));$code = preg_replace('|\'\.[\x00-\xff]+\'\)\)\.\'|s', $key, $code);// 匹配尾部被加密代码preg_match('|=\'(x[\x00-\xff]+)\'\)\);|s', $str, $arr) || die("err: [2] - ".$err);$core = $arr[1];// 匹配验证keypreg_match('|[\w+/=]{59}=|s', $arr[1], $arr) || die("err: [3] - ".$err);$key = $arr[0];$core = str_replace($key, '', $core); // 去除key$suffix = gzuncompress($core); // 得到 base64 的末尾部分// 解码$code = gzuncompress(base64_decode($code . $suffix));// 匹配干净的代码if (preg_match('|<!--<\?php endif;\?>(<\?php[\r\n]{1,2}[\x00-\xff]+\?>)<\?php \$GLOBALS\[|s', $code, $arr)) {$code = $arr[1];}// 写到文件$source = $dirname . DIRECTORY_SEPARATOR . $baseName . "_source.php";file_put_contents($source, $code);die("解密成功，已经保存为: " . $source);
}