The base64+gzinflate compressed encoded (encrypted) file is usually a PHP file with <? eval(gzinflate(base64_decode() as the header. The encoding and decoding codes are given in the article.
CODE:
<?php
function encode_file_contents($filename) {
$type=strtolower(substr(strrchr($filename,'.'),1));
if('php'==$type && is_file($filename) && is_writable($filename)){// If it is a PHP file and it is writable, compress and encode it
$contents = file_get_contents($filename); // Determine whether the file has been encoded
$pos = strpos($contents,'/*Protected by 草名http://www.crazyi.cnCryptation*/' );
if(false === $pos || $pos>100){ // Remove comments and blanks from PHP files to reduce file size
$contents = php_strip_whitespace($filename);
//Remove PHP header and trailer identifiers
$headerPos = strpos($contents,'<?php');
$footerPos = strrpos($contents,'?>');
$contents = substr($contents,$headerPos+5,$footerPos-$headerPos);
$encode = base64_encode(gzdeflate($contents));//Start encoding
$encode = '<?php'." /*Protected by 草名http://www.crazyi.cnCryptation*/n eval(gzinflate(base64_decode(".$encode.")));n /*Reverse engineering is illegal and strictly prohibited- (C)草名Cryptation 2008*/ n?>";
return file_put_contents($filename,$encode);
}
}
return false;
}
//Call function
$filename='g:My DocumentsDesktoptest.php';
encode_file_contents($filename);
?>
<?php
function encode_file_contents($filename) {
$type=strtolower(substr(strrchr($filename,'.'),1));
if('php'==$type && is_file($filename) && is_writable($filename)){// If it is a PHP file and it is writable, compress and encode it
$contents = file_get_contents($filename); // Determine whether the file has been encoded
$pos = strpos($contents,'/*Protected by 草名http://www.crazyi.cnCryptation*/' );
if(false === $pos || $pos>100){ // Remove comments and blanks from PHP files to reduce file size
$contents = php_strip_whitespace($filename);
//Remove PHP header and trailer identifiers
$headerPos = strpos($contents,'<?php');
$footerPos = strrpos($contents,'?>');
$contents = substr($contents,$headerPos+5,$footerPos-$headerPos);
$encode = base64_encode(gzdeflate($contents));//Start encoding
$encode = '<?php'." /*Protected by 草名http://www.crazyi.cnCryptation*/n eval(gzinflate(base64_decode(".$encode.")));n /*Reverse engineering is illegal and strictly prohibited- (C)草名Cryptation 2008*/ n?>";
return file_put_contents($filename,$encode);
}
}
return false;
}
//Call function
$filename='g:My DocumentsDesktoptest.php';
encode_file_contents($filename);
?>
Compression decoding (decryption) code:
[Copy this code]CODE:
<?php
$Code = 'Fill in the code to be decrypted here'; // base64 encoding
$File = 'test.php';//File saved after decoding
$Temp = base64_decode($Code);
$temp = gzinflate($Temp);
$FP = fopen($File,"w");
fwrite($FP,$temp);
fclose($FP);
echo "Decryption successful!";
?>