PHP eval gzinflate base64_decode str_rot13加密解密

昨天遇到了一个文件用eval(gzinflate(str_rot13(base64_decode(一串解密的，原以为替换eval为echo看下好了，谁知道，还有N层，一怒之下写了这个脚本，直接转换之。顺便弄个了在线版的，省得需要的朋友直接找我了。

以下为源码：

<?php 
/********************************************************************** 
*PHP eval gzinflate base64_decode str_rot13加密解密脚本 By:Neeao 
*目前只写了针对四种组合的,其他组合的可参考注释自行修改： 
*1.eval(gzinflate(str_rot13(base64_decode( 
*2.eval(gzinflate(base64_decode( 
*3.gzinflate(base64_decode(base64_decode(str_rot13( 
*4.eval(gzinflate(base64_decode(str_rot13( 
*Http://Neeao.com 
*2009-09-28 
***********************************************************************/ 
 
$filename='code.php';//要解密的文件 
$handle = fopen($filename, "r"); 
$contents = fread($handle, filesize ($filename)); 
$contents_arr=explode('NeeaoNeeao',htmlspecialchars(decode($contents))); 
echo "此代码被加密了".$contents_arr[0]."层,内容如下：<br>\n"; 
echo $contents_arr[1]; 
 
/* 
解密主函数 
$Str，要解密的文件内容 
*/ 
function decode($str,$i=0) 
{ 
     
    $content=""; 
    //eval(gzinflate(str_rot13(base64_decode( 
    //先正则查找是否相关组合加密的，base64编码后的正则是：[A-Za-z0-9\/\+=] 
    if(preg_match("/(eval\(gzinflate\(str_rot13\(base64_decode\(')([A-Za-z0-9\/\+=]*)'/",$str,$x)) 
    {    
        //替换掉没用的字符，获取加密后的密文 
        $content=str_replace("eval(gzinflate(str_rot13(base64_decode('","",$x[0]); 
        $content=str_replace("'","",$content); 
        //变量i是用来判断加密层数的，初始值为0，解密一次，层数加一 
        $i++; 
        //采用相关组合解密 
        $content=gzinflate(str_rot13(base64_decode($content))); 
        //递归判断下是不是已经结束了，没结束继续重复解密 
        $content=decode($content,$i); 
    } 
    //eval(gzinflate(base64_decode( 
    elseif(preg_match("/eval\(gzinflate\(base64_decode\('[A-Za-z0-9\/\+=]*'/",$str,$y)) 
    {    
         
        $content=str_replace("eval(gzinflate(base64_decode('","",$y[0]); 
        $content=str_replace("'","",$content); 
        $i++; 
        $content=gzinflate(base64_decode($content)); 
        $content=decode($content,$i); 
    } 
    //gzinflate(base64_decode(base64_decode(str_rot13( 
    elseif(preg_match("/eval\(gzinflate\(base64_decode\(base64_decode\(str_rot13\('[A-Za-z0-9\/\+=]*'/",$str,$z)) 
    { 
        $content=str_replace("eval(gzinflate(base64_decode(base64_decode(str_rot13('","",$z[0]); 
        $content=str_replace("'","",$content); 
        $i++; 
        $content=gzinflate(base64_decode(base64_decode(str_rot13(($content))))); 
        $content=decode($content,$i); 
    } 
    //eval(gzinflate(base64_decode(str_rot13( 
    elseif(preg_match("/eval\(gzinflate\(base64_decode\(str_rot13\('[A-Za-z0-9\/\+=]*'/",$str,$m)) 
    { 
        $content=str_replace("eval(gzinflate(base64_decode(str_rot13('","",$m[0]); 
        $content=str_replace("'","",$content); 
        $i++; 
        $content=gzinflate(base64_decode(str_rot13(($content)))); 
        $content=decode($content,$i); 
    } 
    else 
    { 
        $content=$i."NeeaoNeeao".$str; 
    } 
    return $content; 
     
} 
?> 

在线版地址：http://neeao.com/tools/decode/index_eval.php