2009年7月22日星期三

关于zend guard各版本对php源文件的加解密的研究

测试一个php程序文件用zend safeguard 3.6加密后   在该网站:http://www.showmycode.com/解密  100%还原

<?php

/*
    [Discuz!] (C)2001-2007 Comsenz Inc.
    This is NOT a freeware, use is subject to license terms

    $Id$
*/
if(!defined('IN_DISCUZ')) {
    exit('Access Denied');
}
require_once DISCUZ_ROOT.'./include/cache.func.php';
updatecache('settings');
$db->query("UPDATE {$tablepre}advertisements SET available='0' WHERE endtime>'0' AND endtime<='$timestamp'", 'UNBUFFERED');
if($db->affected_rows()) {
    updatecache(array('advs_archiver', 'advs_register', 'advs_index', 'advs_forumdisplay', 'advs_viewthread'));
}
$db->query("TRUNCATE {$tablepre}searchindex");
$db->query("DELETE FROM {$tablepre}threadsmod WHERE dateline<'$timestamp'-31536000", 'UNBUFFERED');
$db->query("DELETE FROM {$tablepre}subscriptions WHERE lastpost<'$timestamp'-7776000", 'UNBUFFERED');
$db->query("DELETE FROM {$tablepre}forumrecommend WHERE expiration<'$timestamp'", 'UNBUFFERED');

if($qihoo['status'] && $qihoo['relatedthreads']) {
    $db->query("DELETE FROM {$tablepre}relatedthreads WHERE expiration<'$timestamp'", 'UNBUFFERED');
}

$db->query("UPDATE {$tablepre}trades SET closed='1' WHERE expiration<>0 AND expiration<'$timestamp'", 'UNBUFFERED');
$db->query("DELETE FROM {$tablepre}tradelog WHERE status=0 AND lastupdate<'".($timestamp - 5 * 86400)."'", 'UNBUFFERED');

if($cachethreadon) {
    removedir($cachethreaddir, TRUE);
}

if($regstatus > 1) {
    $db->query("UPDATE {$tablepre}invites SET status='4' WHERE expiration<'$timestamp' AND status IN ('1', '3')");
}

?>


用5.0.1试用版加密后 解密仅有少数函数名,5%左右  如下
<?php
updatecache( );
( );
updatecache( );
( );
( );
( );
( );
( );
( );
( );
removedir( );
( );
?>

用4.0.1破解版加密 (用的是strong的模式)  解密95%  部分函数名未能解密
<?php
if ( defined( "IN_DISCUZ" ) )
{
exit( "Access Denied" );
}
require_once( DISCUZ_ROOT."./include/cache.func.php" );
_obfuscate_DQ9uFl9pbTBdemw�( "settings" );
$db->query( "UPDATE ".$tablepre."advertisements SET available='0' WHERE endtime>'0' AND endtime<='{$timestamp}'", "UNBUFFERED" );
if ( $db->_obfuscate_M3V4aHc2bwENBHl1aA��( ) )
{
_obfuscate_DQ9uFl9pbTBdemw�( array( "advs_archiver", "advs_register", "advs_index", "advs_forumdisplay", "advs_viewthread" ) );
}
$db->query( "TRUNCATE ".$tablepre."searchindex" );
$db->query( "DELETE FROM ".$tablepre."threadsmod WHERE dateline<'{$timestamp}'-31536000", "UNBUFFERED" );
$db->query( "DELETE FROM ".$tablepre."subscriptions WHERE lastpost<'{$timestamp}'-7776000", "UNBUFFERED" );
$db->query( "DELETE FROM ".$tablepre."forumrecommend WHERE expiration<'{$timestamp}'", "UNBUFFERED" );
if ( $qihoo['status'] && $qihoo['relatedthreads'] )
{
$db->query( "DELETE FROM ".$tablepre."relatedthreads WHERE expiration<'{$timestamp}'", "UNBUFFERED" );
}
$db->query( "UPDATE ".$tablepre."trades SET closed='1' WHERE expiration<>0 AND expiration<'{$timestamp}'", "UNBUFFERED" );
$db->query( "DELETE FROM ".$tablepre."tradelog WHERE status=0 AND lastupdate<'".( $timestamp - 432000 )."'", "UNBUFFERED" );
if ( $cachethreadon )
{
_obfuscate_FnNlawhuLXQF( $cachethreaddir, TRUE );
}
if ( 1 < $regstatus )
{
$db->query( "UPDATE ".$tablepre."invites SET status='4' WHERE expiration<'{$timestamp}' AND status IN ('1', '3')" );
}
?>

encode 和 basic模式 100%解开



没有评论: