IONCUBE 加密混淆后的数据,因为混淆会更改一些语句的结构,下面主要针对global、static的修复说明。
下面为加密前源代码:
function get_memcache()
{
global $_W;
static $memcacheobj;
if (!extension_loaded('memcache'))
{
return error(1, 'Class Memcache is not found');
}
if (empty($memcacheobj))
{
$config = $_W['config']['setting']['memcache'];
$memcacheobj = new Memcache();
if ($config['pconnect'])
{
$connect = $memcacheobj -> pconnect($config['server'], $config['port']);
}
else
{
$connect = $memcacheobj -> connect($config['server'], $config['port']);
}
if (!$connect)
{
return error(-1, 'Memcache is not in work');
}
}
return $memcacheobj;
}
?>
注意红色部份代码,通过ioncube9混淆加密.再解密后的数据如下:
function get_memcache()
{
$_obfuscate_DQkwHSMENTUdBCw_OSQTMzIqK1s4FDI = &$GLOBALS['_W'];
$_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE = &'memcacheobj';
if (!extension_loaded('memcache'))
{
return error(1, 'Class Memcache is not found');
}
if (empty($_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE))
{
$_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE = $_obfuscate_DQkwHSMENTUdBCw_OSQTMzIqK1s4FDI['config']['setting']['memcache'];
$_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE = new Memcache();
if ($_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['pconnect'])
{
$_obfuscate_DQo1PDE_AR4PERMnPTw4BA8FP1wiGjI = $_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE -> pconnect($_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['server'], $_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['port']);
}
else
{
$_obfuscate_DQo1PDE_AR4PERMnPTw4BA8FP1wiGjI = $_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE -> connect($_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['server'], $_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['port']);
}
if (!$_obfuscate_DQo1PDE_AR4PERMnPTw4BA8FP1wiGjI)
{
return error(-1, 'Memcache is not in work');
}
}
return $_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE;
}
?>
global的修复方法:
1\ 将 $_obfuscate_DQkwHSMENTUdBCw_OSQTMzIqK1s4FDI = &$GLOBALS['_W']; 替换成 global $_W;
2\ 将$_obfuscate_DQkwHSMENTUdBCw_OSQTMzIqK1s4FDI 替换成 $_W
static的修复方法
1\ 将 $_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE = &'memcacheobj'; 替换成 static $memcacheobj;
2\ 将$_obfuscate_DREyAjUJGyERMiQxJwEEKTkqPhsBFBE 替换成 $memcacheobj
对于非混淆的代码,则无需处理,替换结果如下:(另2个混淆变量:$_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE 及 $_obfuscate_DQo1PDE_AR4PERMnPTw4BA8FP1wiGjI 无需修复可以正常使用)
function get_memcache()
{
global $_W;
static $memcacheobj;
if (!extension_loaded('memcache'))
{
return error(1, 'Class Memcache is not found');
}
if (empty($memcacheobj))
{
$_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE = $_W['config']['setting']['memcache'];
$memcacheobj = new Memcache();
if ($_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['pconnect'])
{
$_obfuscate_DQo1PDE_AR4PERMnPTw4BA8FP1wiGjI = $memcacheobj -> pconnect($_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['server'], $_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['port']);
}
else
{
$_obfuscate_DQo1PDE_AR4PERMnPTw4BA8FP1wiGjI = $memcacheobj -> connect($_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['server'], $_obfuscate_DRUSEjEvNQMLMioFTkMEjgoJR48CAE['port']);
}
if (!$_obfuscate_DQo1PDE_AR4PERMnPTw4BA8FP1wiGjI)
{
return error(-1, 'Memcache is not in work');
}
}
return $memcacheobj;
}
?>
如何判断是否需要修复? 可以通过搜索工具检索:&$GLOBALS 或者 &' 来判断.