找源码首页 - 技术文章

ioncube9混淆后的修复代码整理

更新日期:2016-07-23 09:07:20

IONCUBE 加密混淆后的数据,因为混淆会更改一些语句的结构,下面主要针对globalstatic的修复说明。

(此问题本网站已经解决, 在破解时请选择:清理修复代码,默认选择,即可自动修复)

下面为加密前源代码:

<?php
function get_memcache()
{
global $_W;
static $memcacheobj;

if (!extension_loaded('memcache'))
{
return error(1, 'Class Memcache is not found');
}
if (empty($memcacheobj))
{
$config = $_W['config']['setting']['memcache'];
$memcacheobj = new Memcache();
if ($config['pconnect'])
{
$connect = $memcacheobj -> pconnect($config['server'], $config['port']);
}
else
{
$connect = $memcacheobj -> connect($config['server'], $config['port']);
}
if (!$connect)
{
return error(-1, 'Memcache is not in work');
}
}
return $memcacheobj;
}
?>

注意红色部份代码,通过ioncube9混淆加密.再解密后的数据如下:

<?php
function get_memcache()
{
$_obfuscate_DQkwHSMENTUdBCw_OSQTMzIqK1s4FDI = &$GLOBALS['_W'];
$_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE = &'memcacheobj';

if (!extension_loaded('memcache'))
{
return error(1, 'Class Memcache is not found');
}
if (empty($_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE))
{
$_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE = $_obfuscate_DQkwHSMENTUdBCw_OSQTMzIqK1s4FDI['config']['setting']['memcache'];
$_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE = new Memcache();
if ($_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['pconnect'])
{
$_obfuscate_DQo1PDE_AR4PERMnPTw4BA8FP1wiGjI = $_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE -> pconnect($_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['server'], $_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['port']);
}
else
{
$_obfuscate_DQo1PDE_AR4PERMnPTw4BA8FP1wiGjI = $_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE -> connect($_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['server'], $_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['port']);
}
if (!$_obfuscate_DQo1PDE_AR4PERMnPTw4BA8FP1wiGjI)
{
return error(-1, 'Memcache is not in work');
}
}
return $_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE;
}
?> 


global的修复方法:

1\ 将 $_obfuscate_DQkwHSMENTUdBCw_OSQTMzIqK1s4FDI = &$GLOBALS['_W']; 替换成 global $_W;

2\ 将 $_obfuscate_DQkwHSMENTUdBCw_OSQTMzIqK1s4FDI 替换成 $_W


static的修复方法

1\ 将 $_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE = &'memcacheobj'; 替换成  static $memcacheobj;

2\ 将 $_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE 替换成  $memcacheobj


对于非混淆的代码,则无需处理,替换结果如下:(另2个混淆变量:$_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE 及 $_obfuscate_DQo1PDE_AR4PERMnPTw4BA8FP1wiGjI  无需修复可以正常使用)

<?php
function get_memcache()
{
global $_W;
static $memcacheobj;
if (!extension_loaded('memcache'))
{
return error(1, 'Class Memcache is not found');
}
if (empty($memcacheobj))
{
$_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE = $_W['config']['setting']['memcache'];
$memcacheobj = new Memcache();
if ($_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['pconnect'])
{
$_obfuscate_DQo1PDE_AR4PERMnPTw4BA8FP1wiGjI = $memcacheobj -> pconnect($_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['server'], $_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['port']);
}
else
{
$_obfuscate_DQo1PDE_AR4PERMnPTw4BA8FP1wiGjI = $memcacheobj -> connect($_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['server'], $_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['port']);
}
if (!$_obfuscate_DQo1PDE_AR4PERMnPTw4BA8FP1wiGjI)
{
return error(-1, 'Memcache is not in work');
}
}
return $memcacheobj;
}
?>

如何判断是否需要修复?  可以通过搜索工具检索:&$GLOBALS  或者 &' 来判断.