Giúp mình giải mã đoạn code này với !!! ( Cần gấp )

[bolobalavn]

Các bro giúp mình giải mã đoạn code này với, đang cần gấp để làm blog đúng ngày cho em iu.

<?php $o="QAAAOzh3b3cnKC0nUEZVSU5JQAAIPSdTb250J2Fua2InAI B3dWgAAHNiZHNiYydlfidkaHd+dW4AAGBvcydrZnApJ1NoJ3Vi cWIAAHV0YidiaWBuaWJidSdodScAgGNiZGhjYidzBHl0c3VuZH NrIQB+JwUAb25lbgUQKSctKA0jaDoAACVWRkZGSH1vNGU0ZGlM RDcAQGlSQl1RVFIyTQGATldUY1NlAAA1MjdNNUFyZjVOaUZORT RjAIBQYEZGT0luXQBAXn5ja2FuYwAAbGZPYyxjUDNGRkBFcWR+ YwAAdV1pRndNNkloTTRRbmRQToAAAwBRN15uY25mUEVyZlBNbm MARFRjaGNUZEZgQASAQG9tAcB9RQEAT2s3ZDRRcgWAdU5WRSxN cFJAAEYHwGtlYFJWTFRkc0xGN21mAABDaEZGRFFQVWxdQFRPNn FJACBAUjddQGtrZmp0B8B/aklCNgBAc19qMmxkUU1wAkBQZU9kRkYAAEE+Ukk2NlNRanNtVk FONFcEQDVrSlFADeBAc0oCQGBfUUVxYQAAUFY2ZTRdY1JBN0ZG Q11KUQAAbH9AU1FWfVc3Nj5eQl1AViAANXAGAGtJZENjTVY1Mm xKQTMAgDZKaT5JSVFSDcFjZlFdQFVCAAg+UEpSNlZRX1FiZmsE gklSNQAAcHBTQl1FVWxvUEk3b31VQgAAXkZGQl1xUW1JQl1fRU lmQgCASWBRajJrZmwNgENBSVFrNkMAAlNAd0VmQF1XVFJ3QFJC FUBCAABVRFVtY05VbFFEVVNNdlFTAABdYmZsbEZgT01sYWtOfl NfAABFRkQ1RUBKQEk+ZjdNakZGAABFRl9TY2xJUTY2UlI+SWM3 AgA3NVRfQUABgEBVUDJqZmwydwAAUW1jSVJrSXRVUjZQRlZFdA ACVGprY199SXdGf0V3VEMMAFAAAFI3UlZGQmVrMlNmQHNrSUIA AGs+XjQ3NGZGQEZmQTNFYEIAUEVjSWszNlNfZBSQNAsAUVdRUx AAVUBVIbBmNFFjZmtRclNBRVGBgAyAcl5Ac05SAYAMADRRQElF VWqAAAyAbF1DY0BvY2VSRkRlRlJGAABSU11KVjV/TVI1d3RmUTZGAABCRkVGVkZFfUY3RVVmQElWEBFfXzYeQD40U1 NVQWQEwF1DUgvAAABdQFJPTWpmaWNoXVNVSWFWAABGRlVSa1FV UElWU1AySUk0AABjSlFCXUFRYEZgUlFBbVVsAAA3NFVQd2pmYE VgUTc3cFVtgAAYwENNfl1tUXFhN11EXjUyagIASVI2dV9QGMBA c2hda1V0U2oAAEVCUm1NUmRCSVNVaUZGTkMAAD5LVzVvQFZSXW 5RUkJRRkAAAH9rSWtBckZGRW1WQD81XUMAAFVQVjVNcl1CUWhm bF1xYEYAQUZURkNjQVZSTiCAPmxKbEkggAgAa1dffwGQUD5sT2 RFQ1VCMkAAEFVtVUxkUnNyXn0/KwAydlFfIABBahThU2xJKEpSPkRValZGSgAAQjJMZEJdRmZrMk BmNUZfRgcARWNgVzQowDwADwBoY2tddmY1NgAgSWFrVUBkaj53 ZQGAXUI+VWYAAWpJLF1PXUplfVVwVjU/fRjCAABqNmxVXz5zY0A2QFZCd0BVAABsP31Kb0ZGVjZJN0NsRU 1jAABqXT5lQ2hrV0BNf11qdEZgAABEPmtdaVVuSlNJXkxQSnFN AQBSNkZhNFVrD4BDSTRFTklRQgAENl9rRXBmQTJ2Vl82YwGAU1 8AAG1jYUlRUXVfbVIsZUE2Ul4gQEAyMtBFdF59SWwWgFdebD5N ZQEAa1I3ZTQ2YhKARUZTXUFSNjYAQEZmNjZWVm1NNyDANFFFRk ZfAABQczRESkU0ZWx3dVNfVVJmBABfYz5RNh7QQjI0U0FJN2VA UQAARmRDMkxWNEl1XjVoRXRCQQMAN1NCVVFjIeAtwEFVRl9XRW RGCAA3VEFNHZBBLFRBPnVda142VAAAbVVIZWp/NFRPM0NgcHBGUQAANklASkZ0REVGRV9SN2hwXwAAUT5jZTVRQm JFXWBFbEZKVgAARkFGRWRJcGZCMnRjNz9oaAAAQnBMf2BxTlFG RkNJN2tSXgAANX99UmpVPkk1MkpRQHBBRQAQYHZDfUZGS0ZWU0 MLAEFtRmYAAEVWX1UoXzZVdFc2Y0NeQ1YAAFdjN3BNVUZjQ2Fw NERSTzYAAEleN39TQ3Q/RFZgMFdBTleAEBwgaUZEdEFMSX1JcBSANUo1UQAARlNfY2JhUE NGXUZpSkRSRcAEGAAUgFZoT0RwQUhlbDNwLABNcAAAUzIsU0JK RW9fRihCYFJPVgAgb0FEZEBvSVZPRj1wYkVmfUUAAGpSQTNGcE ZTRkZeTkZgQkoAEDRXbHdCZn9FT0xVBUBwTktWAAJGV0VhNVJB VVJ/LGRwMxZAPgAATlVOKEZCM29CY0MzREVWYwAIQ0Y3P2BgcGRGRT NVE0BONlQAAENWTkV9XTRfUDNQVTc2c1UAAFNJTlY3XXBEVl5O fXBpRXEAAFZGTn1sbE5/Vm5GTWA3RUYAAFFGZm9SQjRjNmNzSn1jSk0AAFdvU2RwYkBTQT 9TYF9GLEYAAGhCS3Bwd0NGVkJDb2xVN2NAAF5W8DdFdlRsPmBk QTZyZU9RBABMYV9JdkAAP2hCM05wVH1GSwAIZEJCVlZIRlY0Rm hgDwB/T0UAgDZTTzJ0LG1eJOBARkM3SktvAABvckZjVUpCXjZjUkteSk 9wAQBsQkJvRkpFM6BDSXBXRE1sUQAgYVJwT01BcEpSRlAAUzdr dV4AAGAzRUJ0KGkzRmhFRTdeZW0AAFJ/PkVgSk9gYGREQE5GTkUAAWBxRkltYzRTTzVPaX93RlgAAAB/XUV3QVZsQkBwVkpGUTdWAABLYERjQENsTkB/YDNPNDRgAghCYG5PV1YfoEFeRndgGMBFUkUAAGtBaEYsb1ZqRU RsSXBKQEIACDIoNj81Q2hOU1VFYzdAVl1/AABgSEZDZEJSbmBBRURgRkRVAABgUEZFaENPQ39qQkR0RUNkIA BDPy6AQk9GcEVrVUNjfUFWQQAITFNwSkZIMyxGV31yCQB3RkoA AGs2TGZqP35TcHRDVkI+V0QEADNOSWBSPoBFb1FDNX9QZEBdQA BVZsBSXzZBS1M2ZERUUGtMQwAQTGN0SWljalZeP0EVgCxWTj4A AHBWTm9wSkQxQ0ReQkZVQywAAG9VQ0pdbUZARlNgQlZwVkUAAE NPVl5QRlE/MnBCd0NdT2QAAFRTKEVyRjNGQ0ZVTVdCbEUACExJN29UYzVJS1 N0QkeAPmZgAEBwMkRWcEZIXW0H8FBdc2U0YwAAU0lAVixdQklR Q35dRmNwRgAARlRPRjFIblJyS21/Nl5pSQIAfmNQbD9IMqBIVjo6JTxicWYAIGsvZWZ0YjEzWGOQoi 8lTUB/AAB0ZUM3cEg1UTVeUHBoXmpBAAB9XVNeN181VWteNT5sXVRgAC BuVGxjM2Q1TU9ijWBVNG99XogAAQE2RVOF4F1QQjJ0U2p3VF1r AAB3T1Fqd25Ka010VGl3fVdUAABOd0xTdGxlQHA+SkNza2NqAb BBdExEVXRlBwEARUQFzwXANEhSaAABfkhfa2ZWNUo0Tm5sd0h+ A4MMAFdTRjALAgQAV1NKMF1fXW9lRHgBYAZADEABQAXDcGhObH dPY31rTArGgAALyFQ3SVRjbHNSZH03bkxUbPMABQYKgwsBBMNX VAWMBoFBdH9fVGw/Vw0DQ2B3TAlEB0N/DcJQfU1jTFMOzwJC8AAOzxSDCcAKwUo3M3BeNTYzZUBNdxgwXn 1kCcwJQEM3f0ltCgcLAU5uTjACcF1qPn5MQwGFcD8SBQdCEUJw aE1AQeBwFEBrMGZQXgDABMABggCAQzc+SkRKRGsQR0M3AgtAA8 F/ZQVFTH5zDgBwPyPwSEQTiER0PgIFB0MDTyCDBwAHhFdTQjUCA0 g0NnddbhZHTW1FM0hDRjMgCQTvQAjPCcEIzkkIxQiAJg0BAVAa hUE3d1dtMwk+N0xTcweGTF8TgXA+AoELwwpDAQEDhkQoAHR1H0 BqTMBwXW5sdUp9c2plNHygTgjBLMAtwQRBA4BDcCiAcBTEcHVM fmz6NgEAAYAPQwuGG4B1EwRjV1QtgwfCQQSEAwFEZwM3A8ImRV 9TAckXAxQAa2VPSWtiDgESz+fgCgEHRhuNTH0GAweCBwIYgAgG C8A2N3dMfYefGkA1XXFkGkVCQQbBAwBXRAuAJ0YOQgbGDgffeA SCIc9AJQcVgCmABMAFQGUWgD6FCYEKQ3AwYfP/reAOgRNEF0B/dBnGA4ANwRSKAUEKAAJGBYAGgBmEjh8KwENwPygAAQcDAGVEN3 MVAUpPAwA7jzuFAH9CSkAyXUpqbzJPCwNAT08Lgg2BSwBVDwAw bFZwZlFFMlRfUUtPVwJJaUpsGU42d2ZBjwWAcD5Aj3BAiHAwLo MJgQBERH9DMxmMAYBOARDBAEMdBhYBXznASkNkdxJPA4Dg3QMB Ek8SQEo3SFJ3Y0tOwTQOT1qDDkJD0iAAcU1mbW93UzRkPmRDVQ 8mQHdIcG0gAAAuLjx1YnNydWk8ODk=";eval(base64_decode ("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNi R3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbG w9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3 OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbG xsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktU cz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbC gkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRs bGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY2 14bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7 Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJG xsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxb JGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJG xbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxs JjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKy tdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0p Pj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbG xsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7 JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbG xsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9 JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKy tdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10p KzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJG xsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxs XSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbG xsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxs bCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKC RsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5 SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSk d4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNn Mk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JG xsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgk bGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbG xsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JH d3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKT tldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

Giúp mình nhá, thanks nhìu.

[phamduyvt]

choáng, giải gì nỗi

[xx3004]

Các bro giúp mình giải mã đoạn code này với, đang cần gấp để làm blog đúng ngày cho em iu.

<?php $o="QAAAOzh3b3cnKC0nUEZVSU5JQAAIPSdTb250J2Fua2InAI B3dWgAAHNiZHNiYydlfidkaHd+dW4AAGBvcydrZnApJ1NoJ3Vi cWIAAHV0YidiaWBuaWJidSdodScAgGNiZGhjYidzBHl0c3VuZH NrIQB+JwUAb25lbgUQKSctKA0jaDoAACVWRkZGSH1vNGU0ZGlM RDcAQGlSQl1RVFIyTQGATldUY1NlAAA1MjdNNUFyZjVOaUZORT RjAIBQYEZGT0luXQBAXn5ja2FuYwAAbGZPYyxjUDNGRkBFcWR+ YwAAdV1pRndNNkloTTRRbmRQToAAAwBRN15uY25mUEVyZlBNbm MARFRjaGNUZEZgQASAQG9tAcB9RQEAT2s3ZDRRcgWAdU5WRSxN cFJAAEYHwGtlYFJWTFRkc0xGN21mAABDaEZGRFFQVWxdQFRPNn FJACBAUjddQGtrZmp0B8B/aklCNgBAc19qMmxkUU1wAkBQZU9kRkYAAEE+Ukk2NlNRanNtVk FONFcEQDVrSlFADeBAc0oCQGBfUUVxYQAAUFY2ZTRdY1JBN0ZG Q11KUQAAbH9AU1FWfVc3Nj5eQl1AViAANXAGAGtJZENjTVY1Mm xKQTMAgDZKaT5JSVFSDcFjZlFdQFVCAAg+UEpSNlZRX1FiZmsE gklSNQAAcHBTQl1FVWxvUEk3b31VQgAAXkZGQl1xUW1JQl1fRU lmQgCASWBRajJrZmwNgENBSVFrNkMAAlNAd0VmQF1XVFJ3QFJC FUBCAABVRFVtY05VbFFEVVNNdlFTAABdYmZsbEZgT01sYWtOfl NfAABFRkQ1RUBKQEk+ZjdNakZGAABFRl9TY2xJUTY2UlI+SWM3 AgA3NVRfQUABgEBVUDJqZmwydwAAUW1jSVJrSXRVUjZQRlZFdA ACVGprY199SXdGf0V3VEMMAFAAAFI3UlZGQmVrMlNmQHNrSUIA AGs+XjQ3NGZGQEZmQTNFYEIAUEVjSWszNlNfZBSQNAsAUVdRUx AAVUBVIbBmNFFjZmtRclNBRVGBgAyAcl5Ac05SAYAMADRRQElF VWqAAAyAbF1DY0BvY2VSRkRlRlJGAABSU11KVjV/TVI1d3RmUTZGAABCRkVGVkZFfUY3RVVmQElWEBFfXzYeQD40U1 NVQWQEwF1DUgvAAABdQFJPTWpmaWNoXVNVSWFWAABGRlVSa1FV UElWU1AySUk0AABjSlFCXUFRYEZgUlFBbVVsAAA3NFVQd2pmYE VgUTc3cFVtgAAYwENNfl1tUXFhN11EXjUyagIASVI2dV9QGMBA c2hda1V0U2oAAEVCUm1NUmRCSVNVaUZGTkMAAD5LVzVvQFZSXW 5RUkJRRkAAAH9rSWtBckZGRW1WQD81XUMAAFVQVjVNcl1CUWhm bF1xYEYAQUZURkNjQVZSTiCAPmxKbEkggAgAa1dffwGQUD5sT2 RFQ1VCMkAAEFVtVUxkUnNyXn0/KwAydlFfIABBahThU2xJKEpSPkRValZGSgAAQjJMZEJdRmZrMk BmNUZfRgcARWNgVzQowDwADwBoY2tddmY1NgAgSWFrVUBkaj53 ZQGAXUI+VWYAAWpJLF1PXUplfVVwVjU/fRjCAABqNmxVXz5zY0A2QFZCd0BVAABsP31Kb0ZGVjZJN0NsRU 1jAABqXT5lQ2hrV0BNf11qdEZgAABEPmtdaVVuSlNJXkxQSnFN AQBSNkZhNFVrD4BDSTRFTklRQgAENl9rRXBmQTJ2Vl82YwGAU1 8AAG1jYUlRUXVfbVIsZUE2Ul4gQEAyMtBFdF59SWwWgFdebD5N ZQEAa1I3ZTQ2YhKARUZTXUFSNjYAQEZmNjZWVm1NNyDANFFFRk ZfAABQczRESkU0ZWx3dVNfVVJmBABfYz5RNh7QQjI0U0FJN2VA UQAARmRDMkxWNEl1XjVoRXRCQQMAN1NCVVFjIeAtwEFVRl9XRW RGCAA3VEFNHZBBLFRBPnVda142VAAAbVVIZWp/NFRPM0NgcHBGUQAANklASkZ0REVGRV9SN2hwXwAAUT5jZTVRQm JFXWBFbEZKVgAARkFGRWRJcGZCMnRjNz9oaAAAQnBMf2BxTlFG RkNJN2tSXgAANX99UmpVPkk1MkpRQHBBRQAQYHZDfUZGS0ZWU0 MLAEFtRmYAAEVWX1UoXzZVdFc2Y0NeQ1YAAFdjN3BNVUZjQ2Fw NERSTzYAAEleN39TQ3Q/RFZgMFdBTleAEBwgaUZEdEFMSX1JcBSANUo1UQAARlNfY2JhUE NGXUZpSkRSRcAEGAAUgFZoT0RwQUhlbDNwLABNcAAAUzIsU0JK RW9fRihCYFJPVgAgb0FEZEBvSVZPRj1wYkVmfUUAAGpSQTNGcE ZTRkZeTkZgQkoAEDRXbHdCZn9FT0xVBUBwTktWAAJGV0VhNVJB VVJ/LGRwMxZAPgAATlVOKEZCM29CY0MzREVWYwAIQ0Y3P2BgcGRGRT NVE0BONlQAAENWTkV9XTRfUDNQVTc2c1UAAFNJTlY3XXBEVl5O fXBpRXEAAFZGTn1sbE5/Vm5GTWA3RUYAAFFGZm9SQjRjNmNzSn1jSk0AAFdvU2RwYkBTQT 9TYF9GLEYAAGhCS3Bwd0NGVkJDb2xVN2NAAF5W8DdFdlRsPmBk QTZyZU9RBABMYV9JdkAAP2hCM05wVH1GSwAIZEJCVlZIRlY0Rm hgDwB/T0UAgDZTTzJ0LG1eJOBARkM3SktvAABvckZjVUpCXjZjUkteSk 9wAQBsQkJvRkpFM6BDSXBXRE1sUQAgYVJwT01BcEpSRlAAUzdr dV4AAGAzRUJ0KGkzRmhFRTdeZW0AAFJ/PkVgSk9gYGREQE5GTkUAAWBxRkltYzRTTzVPaX93RlgAAAB/XUV3QVZsQkBwVkpGUTdWAABLYERjQENsTkB/YDNPNDRgAghCYG5PV1YfoEFeRndgGMBFUkUAAGtBaEYsb1ZqRU RsSXBKQEIACDIoNj81Q2hOU1VFYzdAVl1/AABgSEZDZEJSbmBBRURgRkRVAABgUEZFaENPQ39qQkR0RUNkIA BDPy6AQk9GcEVrVUNjfUFWQQAITFNwSkZIMyxGV31yCQB3RkoA AGs2TGZqP35TcHRDVkI+V0QEADNOSWBSPoBFb1FDNX9QZEBdQA BVZsBSXzZBS1M2ZERUUGtMQwAQTGN0SWljalZeP0EVgCxWTj4A AHBWTm9wSkQxQ0ReQkZVQywAAG9VQ0pdbUZARlNgQlZwVkUAAE NPVl5QRlE/MnBCd0NdT2QAAFRTKEVyRjNGQ0ZVTVdCbEUACExJN29UYzVJS1 N0QkeAPmZgAEBwMkRWcEZIXW0H8FBdc2U0YwAAU0lAVixdQklR Q35dRmNwRgAARlRPRjFIblJyS21/Nl5pSQIAfmNQbD9IMqBIVjo6JTxicWYAIGsvZWZ0YjEzWGOQoi 8lTUB/AAB0ZUM3cEg1UTVeUHBoXmpBAAB9XVNeN181VWteNT5sXVRgAC BuVGxjM2Q1TU9ijWBVNG99XogAAQE2RVOF4F1QQjJ0U2p3VF1r AAB3T1Fqd25Ka010VGl3fVdUAABOd0xTdGxlQHA+SkNza2NqAb BBdExEVXRlBwEARUQFzwXANEhSaAABfkhfa2ZWNUo0Tm5sd0h+ A4MMAFdTRjALAgQAV1NKMF1fXW9lRHgBYAZADEABQAXDcGhObH dPY31rTArGgAALyFQ3SVRjbHNSZH03bkxUbPMABQYKgwsBBMNX VAWMBoFBdH9fVGw/Vw0DQ2B3TAlEB0N/DcJQfU1jTFMOzwJC8AAOzxSDCcAKwUo3M3BeNTYzZUBNdxgwXn 1kCcwJQEM3f0ltCgcLAU5uTjACcF1qPn5MQwGFcD8SBQdCEUJw aE1AQeBwFEBrMGZQXgDABMABggCAQzc+SkRKRGsQR0M3AgtAA8 F/ZQVFTH5zDgBwPyPwSEQTiER0PgIFB0MDTyCDBwAHhFdTQjUCA0 g0NnddbhZHTW1FM0hDRjMgCQTvQAjPCcEIzkkIxQiAJg0BAVAa hUE3d1dtMwk+N0xTcweGTF8TgXA+AoELwwpDAQEDhkQoAHR1H0 BqTMBwXW5sdUp9c2plNHygTgjBLMAtwQRBA4BDcCiAcBTEcHVM fmz6NgEAAYAPQwuGG4B1EwRjV1QtgwfCQQSEAwFEZwM3A8ImRV 9TAckXAxQAa2VPSWtiDgESz+fgCgEHRhuNTH0GAweCBwIYgAgG C8A2N3dMfYefGkA1XXFkGkVCQQbBAwBXRAuAJ0YOQgbGDgffeA SCIc9AJQcVgCmABMAFQGUWgD6FCYEKQ3AwYfP/reAOgRNEF0B/dBnGA4ANwRSKAUEKAAJGBYAGgBmEjh8KwENwPygAAQcDAGVEN3 MVAUpPAwA7jzuFAH9CSkAyXUpqbzJPCwNAT08Lgg2BSwBVDwAw bFZwZlFFMlRfUUtPVwJJaUpsGU42d2ZBjwWAcD5Aj3BAiHAwLo MJgQBERH9DMxmMAYBOARDBAEMdBhYBXznASkNkdxJPA4Dg3QMB Ek8SQEo3SFJ3Y0tOwTQOT1qDDkJD0iAAcU1mbW93UzRkPmRDVQ 8mQHdIcG0gAAAuLjx1YnNydWk8ODk=";eval(base64_decode ("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNi R3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbG w9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3 OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbG xsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktU cz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbC gkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRs bGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY2 14bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7 Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJG xsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxb JGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJG xbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxs JjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKy tdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0p Pj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbG xsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7 JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbG xsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9 JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKy tdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10p KzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJG xsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxs XSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbG xsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxs bCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKC RsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5 SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSk d4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNn Mk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JG xsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgk bGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbG xsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JH d3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKT tldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

Giúp mình nhá, thanks nhìu.

Chào bạn,

Mình sẽ giải giúp bạn, cũng như chỉ bạn cách giải để sau này có thể tự làm. Tuy nhiên, mình chỉ giúp bạn giải mã cho đến bước có thể đọc được, những bước sau đó là thuật toán, mình ko có thời gian để lấy giấy viết mà làm, hơn nữa kiến thức về shift bit của mình cực tệ, nên đến khi tìm ra dc đoạn code chính, bạn sẽ là người tự làm tiếp nhá:

Đầu tiên đọc vào đoạn mã, bạn nhìn thấy dc cái đầu tiên nó ghi ra là gán giá trị gì đó vào 1 chuỗi. Bước đầu tiên, tìm xem khi nào chuỗi kết thúc, vì bước gán chuỗi của nó chẳng có gì để mã hóa cả.

Để ý kỹ, gần ngay phần giữa, bạn gặp phải một dấu nháy đôi " mà trước đó ko hề có dấu \, nên chắc chắn đây là ký tự kết thúc chuỗi.

Nhìn tiếp theo, bạn thấy eval(base64_decode(...)). Mỗi khi gặp eval, dù trong Javascript hay PHP, bạn đổi eval thành 1 hàm nào đó có thể xuất ra chuỗi (vì bản thân eval là biến 1 chuỗi thành 1 lệnh, sau đó thực hiện, bây giờ mình ko cho nó thực hiện nữa, mình xuất ra chuỗi thì sẽ biết được nó là gì), mình thay eval thành die(); mục đích để cho những mã lệnh sau đó ko còn thực hiện nữa, chạy thử, bạn thấy kết quả:

$lll=0;eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));$ll=0;eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));$llll=0;$lllll=3;eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));$lllllll=0;$llllll=($llllllllll($l***91;1***93;)<<8)+$llllllllll($l***91;2***93;);eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));$lllllllll=16;$llllllll="";for(;$lllll<$lllllllllllll($l);){if($lllllllll==0){$llllll=($llllllllll($l***91;$lllll++***93;)<<8);$llllll+=$llllllllll($l***91;$lllll++***93;);$lllllllll=16;}if($llllll&0x8000){$lll=($llllllllll($l***91;$lllll++***93;)<<4);$lll+=($llllllllll($l***91;$lllll***93;)>>4);if($lll){$ll=($llllllllll($l***91;$lllll++***93;)&0x0f)+3;for($llll=0;$llll<$ll;$llll++)$llllllll***91;$lllllll+$llll***93;=$llllllll***91;$lllllll-$lll+$llll***93;;$lllllll+=$ll;}else{$ll=($llllllllll($l***91;$lllll++***93;)<<8);$ll+=$llllllllll($l***91;$lllll++***93;)+16;for($llll=0;$llll<$ll;$llllllll***91;$lllllll+$llll++***93;=$llllllllll($l***91;$lllll***93;));$lllll++;$lllllll+=$ll;}}else$llllllll***91;$lllllll++***93;=$llllllllll($l***91;$lllll++***93;);$llllll<<=1;$lllllllll--;}eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));$lllll=0;eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));$llllllllll="";for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll***91;$lllll++***93;^0x07);}eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));eval($lllllllll); 

Một đống bầy hầy, tiếp theo, mình cần clean sạch đống này để biết nó làm gì, bạn có thể vào nhiều trang web online trực tiếp để làm điều này, ví dụ như jsbeautifier.org... Mình dùng jsfiddle.net. Vì đọc sơ bạn thấy ở đây dùng hàm for() và eval() rất giống Javascript, nên jsfiddle sẽ làm đẹp nó mà ko ảnh hưởng, cho dù nó là PHP.

$lll = 0;
eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));
$ll = 0;
eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));
$llll = 0;
$lllll = 3;
eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));
$lllllll = 0;
$llllll = ($llllllllll($l***91;1***93;) << 8) + $llllllllll($l***91;2***93;);
eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));
$lllllllll = 16;
$llllllll = "";
for (; $lllll < $lllllllllllll($l);) {
    if ($lllllllll == 0) {
        $llllll = ($llllllllll($l***91;$lllll++***93;) << 8);
        $llllll += $llllllllll($l***91;$lllll++***93;);
        $lllllllll = 16;
    }
    if ($llllll & 0x8000) {
        $lll = ($llllllllll($l***91;$lllll++***93;) << 4);
        $lll += ($llllllllll($l***91;$lllll***93;) >> 4);
        if ($lll) {
            $ll = ($llllllllll($l***91;$lllll++***93;) & 0x0f) + 3;
            for ($llll = 0; $llll < $ll; $llll++) $llllllll***91;$lllllll + $llll***93; = $llllllll***91;$lllllll - $lll + $llll***93;;
            $lllllll += $ll;
        } else {
            $ll = ($llllllllll($l***91;$lllll++***93;) << 8);
            $ll += $llllllllll($l***91;$lllll++***93;) + 16;
            for ($llll = 0; $llll < $ll; $llllllll***91;$lllllll + $llll++***93; = $llllllllll($l***91;$lllll***93;));
            $lllll++;
            $lllllll += $ll;
        }
    }
    else$llllllll***91;$lllllll++***93; = $llllllllll($l***91;$lllll++***93;);
    $llllll <<= 1;
    $lllllllll--;
}
eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));
$lllll = 0;
eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));
$llllllllll = "";
for (; $lllll < $lllllll;) {
    $llllllllll. = $llllllllllll($llllllll***91;$lllll++***93; ^ 0x07);
}
eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));
eval($lllllllll); 

Sau khi làm gọn gàng xong, bước tiếp theo là ngồi đọc... Mẹo: Đổi tên hết những biến thành những tên có ý nghĩa, cho dễ đọc, nếu bạn rảnh thì bạn cũng có thể ngồi đọc từ từ mấy cái đó, ko sao cả. Nếu muốn rename biến thì rename từ những tên có ký tự dài nhất, ví dụ $lllll, rồi sau đó đến những ký tự ngắn hơn $ll để tránh việc trùng lặp xảy ra. Làm tới đâu nhớ save tới đó.

Tiếp theo, gặp dòng đầu tiên có eval, mẹo cũ làm tiếp, die() nó ngay, và bạn nhận được:

...
$lllllllllll='base64_decode';
... 

Vậy nguyên đoạn mã của bạn sẽ là:

<?php
$lll = 0;
$lllllllllll='base64_decode';//eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));
$ll = 0;
eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));
$llll = 0;
$lllll = 3;
eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));
$lllllll = 0;
$llllll = ($llllllllll($l***91;1***93;) << 8) + $llllllllll($l***91;2***93;);
eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));
$lllllllll = 16;
$llllllll = "";
for (; $lllll < $lllllllllllll($l);) {
    if ($lllllllll == 0) {
        $llllll = ($llllllllll($l***91;$lllll++***93;) << 8);
        $llllll += $llllllllll($l***91;$lllll++***93;);
        $lllllllll = 16;
    }
    if ($llllll & 0x8000) {
        $lll = ($llllllllll($l***91;$lllll++***93;) << 4);
        $lll += ($llllllllll($l***91;$lllll***93;) >> 4);
        if ($lll) {
            $ll = ($llllllllll($l***91;$lllll++***93;) & 0x0f) + 3;
            for ($llll = 0; $llll < $ll; $llll++) $llllllll***91;$lllllll + $llll***93; = $llllllll***91;$lllllll - $lll + $llll***93;;
            $lllllll += $ll;
        } else {
            $ll = ($llllllllll($l***91;$lllll++***93;) << 8);
            $ll += $llllllllll($l***91;$lllll++***93;) + 16;
            for ($llll = 0; $llll < $ll; $llllllll***91;$lllllll + $llll++***93; = $llllllllll($l***91;$lllll***93;));
            $lllll++;
            $lllllll += $ll;
        }
    }
    else$llllllll***91;$lllllll++***93; = $llllllllll($l***91;$lllll++***93;);
    $llllll <<= 1;
    $lllllllll--;
}
eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));
$lllll = 0;
eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));
$llllllllll = "";
for (; $lllll < $lllllll;) {
    $llllllllll. = $llllllllllll($llllllll***91;$lllll++***93; ^ 0x07);
}
eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));
eval($lllllllll);
?>

Tiếp tục với dòng eval tiếp theo, die() nó tiếp, die vài lần bạn, ghép lại với đoạn mã ban đầu, bạn sẽ được mã lệnh:

<?php $o="QAAAOzh3b3cnKC0nUEZVSU5JQAAIPSdTb250J2Fua2InAI B3dWgAAHNiZHNiYydlfidkaHd+dW4AAGBvcydrZnApJ1NoJ3Vi cWIAAHV0YidiaWBuaWJidSdodScAgGNiZGhjYidzBHl0c3VuZH NrIQB+JwUAb25lbgUQKSctKA0jaDoAACVWRkZGSH1vNGU0ZGlM RDcAQGlSQl1RVFIyTQGATldUY1NlAAA1MjdNNUFyZjVOaUZORT RjAIBQYEZGT0luXQBAXn5ja2FuYwAAbGZPYyxjUDNGRkBFcWR+ YwAAdV1pRndNNkloTTRRbmRQToAAAwBRN15uY25mUEVyZlBNbm MARFRjaGNUZEZgQASAQG9tAcB9RQEAT2s3ZDRRcgWAdU5WRSxN cFJAAEYHwGtlYFJWTFRkc0xGN21mAABDaEZGRFFQVWxdQFRPNn FJACBAUjddQGtrZmp0B8B/aklCNgBAc19qMmxkUU1wAkBQZU9kRkYAAEE+Ukk2NlNRanNtVk FONFcEQDVrSlFADeBAc0oCQGBfUUVxYQAAUFY2ZTRdY1JBN0ZG Q11KUQAAbH9AU1FWfVc3Nj5eQl1AViAANXAGAGtJZENjTVY1Mm xKQTMAgDZKaT5JSVFSDcFjZlFdQFVCAAg+UEpSNlZRX1FiZmsE gklSNQAAcHBTQl1FVWxvUEk3b31VQgAAXkZGQl1xUW1JQl1fRU lmQgCASWBRajJrZmwNgENBSVFrNkMAAlNAd0VmQF1XVFJ3QFJC FUBCAABVRFVtY05VbFFEVVNNdlFTAABdYmZsbEZgT01sYWtOfl NfAABFRkQ1RUBKQEk+ZjdNakZGAABFRl9TY2xJUTY2UlI+SWM3 AgA3NVRfQUABgEBVUDJqZmwydwAAUW1jSVJrSXRVUjZQRlZFdA ACVGprY199SXdGf0V3VEMMAFAAAFI3UlZGQmVrMlNmQHNrSUIA AGs+XjQ3NGZGQEZmQTNFYEIAUEVjSWszNlNfZBSQNAsAUVdRUx AAVUBVIbBmNFFjZmtRclNBRVGBgAyAcl5Ac05SAYAMADRRQElF VWqAAAyAbF1DY0BvY2VSRkRlRlJGAABSU11KVjV/TVI1d3RmUTZGAABCRkVGVkZFfUY3RVVmQElWEBFfXzYeQD40U1 NVQWQEwF1DUgvAAABdQFJPTWpmaWNoXVNVSWFWAABGRlVSa1FV UElWU1AySUk0AABjSlFCXUFRYEZgUlFBbVVsAAA3NFVQd2pmYE VgUTc3cFVtgAAYwENNfl1tUXFhN11EXjUyagIASVI2dV9QGMBA c2hda1V0U2oAAEVCUm1NUmRCSVNVaUZGTkMAAD5LVzVvQFZSXW 5RUkJRRkAAAH9rSWtBckZGRW1WQD81XUMAAFVQVjVNcl1CUWhm bF1xYEYAQUZURkNjQVZSTiCAPmxKbEkggAgAa1dffwGQUD5sT2 RFQ1VCMkAAEFVtVUxkUnNyXn0/KwAydlFfIABBahThU2xJKEpSPkRValZGSgAAQjJMZEJdRmZrMk BmNUZfRgcARWNgVzQowDwADwBoY2tddmY1NgAgSWFrVUBkaj53 ZQGAXUI+VWYAAWpJLF1PXUplfVVwVjU/fRjCAABqNmxVXz5zY0A2QFZCd0BVAABsP31Kb0ZGVjZJN0NsRU 1jAABqXT5lQ2hrV0BNf11qdEZgAABEPmtdaVVuSlNJXkxQSnFN AQBSNkZhNFVrD4BDSTRFTklRQgAENl9rRXBmQTJ2Vl82YwGAU1 8AAG1jYUlRUXVfbVIsZUE2Ul4gQEAyMtBFdF59SWwWgFdebD5N ZQEAa1I3ZTQ2YhKARUZTXUFSNjYAQEZmNjZWVm1NNyDANFFFRk ZfAABQczRESkU0ZWx3dVNfVVJmBABfYz5RNh7QQjI0U0FJN2VA UQAARmRDMkxWNEl1XjVoRXRCQQMAN1NCVVFjIeAtwEFVRl9XRW RGCAA3VEFNHZBBLFRBPnVda142VAAAbVVIZWp/NFRPM0NgcHBGUQAANklASkZ0REVGRV9SN2hwXwAAUT5jZTVRQm JFXWBFbEZKVgAARkFGRWRJcGZCMnRjNz9oaAAAQnBMf2BxTlFG RkNJN2tSXgAANX99UmpVPkk1MkpRQHBBRQAQYHZDfUZGS0ZWU0 MLAEFtRmYAAEVWX1UoXzZVdFc2Y0NeQ1YAAFdjN3BNVUZjQ2Fw NERSTzYAAEleN39TQ3Q/RFZgMFdBTleAEBwgaUZEdEFMSX1JcBSANUo1UQAARlNfY2JhUE NGXUZpSkRSRcAEGAAUgFZoT0RwQUhlbDNwLABNcAAAUzIsU0JK RW9fRihCYFJPVgAgb0FEZEBvSVZPRj1wYkVmfUUAAGpSQTNGcE ZTRkZeTkZgQkoAEDRXbHdCZn9FT0xVBUBwTktWAAJGV0VhNVJB VVJ/LGRwMxZAPgAATlVOKEZCM29CY0MzREVWYwAIQ0Y3P2BgcGRGRT NVE0BONlQAAENWTkV9XTRfUDNQVTc2c1UAAFNJTlY3XXBEVl5O fXBpRXEAAFZGTn1sbE5/Vm5GTWA3RUYAAFFGZm9SQjRjNmNzSn1jSk0AAFdvU2RwYkBTQT 9TYF9GLEYAAGhCS3Bwd0NGVkJDb2xVN2NAAF5W8DdFdlRsPmBk QTZyZU9RBABMYV9JdkAAP2hCM05wVH1GSwAIZEJCVlZIRlY0Rm hgDwB/T0UAgDZTTzJ0LG1eJOBARkM3SktvAABvckZjVUpCXjZjUkteSk 9wAQBsQkJvRkpFM6BDSXBXRE1sUQAgYVJwT01BcEpSRlAAUzdr dV4AAGAzRUJ0KGkzRmhFRTdeZW0AAFJ/PkVgSk9gYGREQE5GTkUAAWBxRkltYzRTTzVPaX93RlgAAAB/XUV3QVZsQkBwVkpGUTdWAABLYERjQENsTkB/YDNPNDRgAghCYG5PV1YfoEFeRndgGMBFUkUAAGtBaEYsb1ZqRU RsSXBKQEIACDIoNj81Q2hOU1VFYzdAVl1/AABgSEZDZEJSbmBBRURgRkRVAABgUEZFaENPQ39qQkR0RUNkIA BDPy6AQk9GcEVrVUNjfUFWQQAITFNwSkZIMyxGV31yCQB3RkoA AGs2TGZqP35TcHRDVkI+V0QEADNOSWBSPoBFb1FDNX9QZEBdQA BVZsBSXzZBS1M2ZERUUGtMQwAQTGN0SWljalZeP0EVgCxWTj4A AHBWTm9wSkQxQ0ReQkZVQywAAG9VQ0pdbUZARlNgQlZwVkUAAE NPVl5QRlE/MnBCd0NdT2QAAFRTKEVyRjNGQ0ZVTVdCbEUACExJN29UYzVJS1 N0QkeAPmZgAEBwMkRWcEZIXW0H8FBdc2U0YwAAU0lAVixdQklR Q35dRmNwRgAARlRPRjFIblJyS21/Nl5pSQIAfmNQbD9IMqBIVjo6JTxicWYAIGsvZWZ0YjEzWGOQoi 8lTUB/AAB0ZUM3cEg1UTVeUHBoXmpBAAB9XVNeN181VWteNT5sXVRgAC BuVGxjM2Q1TU9ijWBVNG99XogAAQE2RVOF4F1QQjJ0U2p3VF1r AAB3T1Fqd25Ka010VGl3fVdUAABOd0xTdGxlQHA+SkNza2NqAb BBdExEVXRlBwEARUQFzwXANEhSaAABfkhfa2ZWNUo0Tm5sd0h+ A4MMAFdTRjALAgQAV1NKMF1fXW9lRHgBYAZADEABQAXDcGhObH dPY31rTArGgAALyFQ3SVRjbHNSZH03bkxUbPMABQYKgwsBBMNX VAWMBoFBdH9fVGw/Vw0DQ2B3TAlEB0N/DcJQfU1jTFMOzwJC8AAOzxSDCcAKwUo3M3BeNTYzZUBNdxgwXn 1kCcwJQEM3f0ltCgcLAU5uTjACcF1qPn5MQwGFcD8SBQdCEUJw aE1AQeBwFEBrMGZQXgDABMABggCAQzc+SkRKRGsQR0M3AgtAA8 F/ZQVFTH5zDgBwPyPwSEQTiER0PgIFB0MDTyCDBwAHhFdTQjUCA0 g0NnddbhZHTW1FM0hDRjMgCQTvQAjPCcEIzkkIxQiAJg0BAVAa hUE3d1dtMwk+N0xTcweGTF8TgXA+AoELwwpDAQEDhkQoAHR1H0 BqTMBwXW5sdUp9c2plNHygTgjBLMAtwQRBA4BDcCiAcBTEcHVM fmz6NgEAAYAPQwuGG4B1EwRjV1QtgwfCQQSEAwFEZwM3A8ImRV 9TAckXAxQAa2VPSWtiDgESz+fgCgEHRhuNTH0GAweCBwIYgAgG C8A2N3dMfYefGkA1XXFkGkVCQQbBAwBXRAuAJ0YOQgbGDgffeA SCIc9AJQcVgCmABMAFQGUWgD6FCYEKQ3AwYfP/reAOgRNEF0B/dBnGA4ANwRSKAUEKAAJGBYAGgBmEjh8KwENwPygAAQcDAGVEN3 MVAUpPAwA7jzuFAH9CSkAyXUpqbzJPCwNAT08Lgg2BSwBVDwAw bFZwZlFFMlRfUUtPVwJJaUpsGU42d2ZBjwWAcD5Aj3BAiHAwLo MJgQBERH9DMxmMAYBOARDBAEMdBhYBXznASkNkdxJPA4Dg3QMB Ek8SQEo3SFJ3Y0tOwTQOT1qDDkJD0iAAcU1mbW93UzRkPmRDVQ 8mQHdIcG0gAAAuLjx1YnNydWk8ODk=";

$lll = 0;
$lllllllllll='base64_decode';//eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));
$ll = 0;
$llllllllll='ord';//eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));
$llll = 0;
$lllll = 3;
$l=$lllllllllll($o);//eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));
$lllllll = 0;
$llllll = ($llllllllll($l***91;1***93;) << 8) + $llllllllll($l***91;2***93;);
$lllllllllllll='strlen';//eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));
$lllllllll = 16;
$llllllll = "";
for (; $lllll < $lllllllllllll($l);) {
    if ($lllllllll == 0) {
        $llllll = ($llllllllll($l***91;$lllll++***93;) << 8);
        $llllll += $llllllllll($l***91;$lllll++***93;);
        $lllllllll = 16;
    }
    if ($llllll & 0x8000) {
        $lll = ($llllllllll($l***91;$lllll++***93;) << 4);
        $lll += ($llllllllll($l***91;$lllll***93;) >> 4);
        if ($lll) {
            $ll = ($llllllllll($l***91;$lllll++***93;) & 0x0f) + 3;
            for ($llll = 0; $llll < $ll; $llll++) $llllllll***91;$lllllll + $llll***93; = $llllllll***91;$lllllll - $lll + $llll***93;;
            $lllllll += $ll;
        } else {
            $ll = ($llllllllll($l***91;$lllll++***93;) << 8);
            $ll += $llllllllll($l***91;$lllll++***93;) + 16;
            for ($llll = 0; $llll < $ll; $llllllll***91;$lllllll + $llll++***93; = $llllllllll($l***91;$lllll***93;));
            $lllll++;
            $lllllll += $ll;
        }
    }
    else$llllllll***91;$lllllll++***93; = $llllllllll($l***91;$lllll++***93;);
    $llllll <<= 1;
    $lllllllll--;
}
$llllllllllll='chr';//eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));
$lllll = 0;
$lllllllll="?".$llllllllllll(62);//eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));
$llllllllll = "";
for (; $lllll < $lllllll;) {
    $llllllllll.= $llllllllllll($llllllll***91;$lllll++***93; ^ 0x07);
}
$lllllllll.=$llllllllll.$llllllllllll(60)."?";//eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));
eval($lllllllll);/* Dong nay se xuat ra ?> */

return;?>
?>

Bây giờ mình sẽ rename lại, bước 1, mình search hết tất cả những tên biến $lllll..., cho đến khi nào mình tìm dc tên biến dài nhất, mình tìm ra dc có 13 chữ số. Thoy cứ xem như 12 con giáp có con thứ 13 là con bulbasaur (mình thích pokémon), nên mình sẽ replace het $lllllllllllll thành $bulbasaur! Replace xong, thấy thoáng chỗ, bắt đầu đi nhìn lại những biến $bulbasaur, bạn bắt gặp dc nó dc gán giá trị là strlen(), bây giờ replace lần nữa, $bulbasaur thành strlen cho nó dễ đọc.

Tiếp tục, replace $ll.. với 12 chữ l bằng $hoi (hợi trong 12 con giáp cho dễ nhớ). Lại tiếp tục tìm biến tên $hoi, bạn lại thấy nó dc gán bằng hàm chr(), replace lại 1 lần nữa = hàm chr() tất cả các biến $hoi.

Tiếp tục, $ll với 11 chữ là $tuat, lại thất $tuat là base64_decode, làm tiếp!

Tiếp tục, $ll với 10 chữ là $dau. Tuy nhiên, ở đây có 1 vấn đề nhỏ, nếu bạn dùng Replace all có thể bạn sẽ phải làm lại từ đầu. Vì ở phía sau, biến $llllllllll dc dùng lại, bạn ko dc phép replace lố qua đến đó. Tiếp tục công việc cũ.

Tiếp tục, $ll với 9 chữ là $than. Lại thêm 1 vấn đề mới, khi replace chú ý ko dc replace nhầm lên $ll với 10 chữ ở phía trên khi mình bỏ qua, và nhớ replace toàn bộ.

Tiếp tục, $ll với 8, 7, 6, 5, 4, 3, 2 chữ l.

Đến $l, có 1 chút rắc rối khi bạn thấy $l là kết quả của base64_decode($o) ($o là chuỗi dc gán đầu tiên), bạn cứ thử die nó, và bạn sẽ nhận dc 1... cục!! Chuỗi khó hiểu này khi nhìn xuống dưới bạn sẽ thấy công việc chủ yếu của nó là giúp vòng lặp for chạy!

Vậy là đến đây bạn đã làm xong hết toàn bộ bước giải mã rồi, chỉ cần thay thế vào những biến đã biết để đoạn mã đỡ rối nữa là xong. Tuy nhiên đoạn mã này thiếu gì đó nên ko thể nào chạy hoàn tất trên sever mình dc, nó chỉ in ra câu bản quyền thôi.

Đây là kết quả sau khi de-obfuscate:

<?php
$o="QAAAOzh3b3cnKC0nUEZVSU5JQAAIPSdTb250J2Fua2InAI B3dWgAAHNiZHNiYydlfidkaHd+dW4AAGBvcydrZnApJ1NoJ3Vi cWIAAHV0YidiaWBuaWJidSdodScAgGNiZGhjYidzBHl0c3VuZH NrIQB+JwUAb25lbgUQKSctKA0jaDoAACVWRkZGSH1vNGU0ZGlM RDcAQGlSQl1RVFIyTQGATldUY1NlAAA1MjdNNUFyZjVOaUZORT RjAIBQYEZGT0luXQBAXn5ja2FuYwAAbGZPYyxjUDNGRkBFcWR+ YwAAdV1pRndNNkloTTRRbmRQToAAAwBRN15uY25mUEVyZlBNbm MARFRjaGNUZEZgQASAQG9tAcB9RQEAT2s3ZDRRcgWAdU5WRSxN cFJAAEYHwGtlYFJWTFRkc0xGN21mAABDaEZGRFFQVWxdQFRPNn FJACBAUjddQGtrZmp0B8B/aklCNgBAc19qMmxkUU1wAkBQZU9kRkYAAEE+Ukk2NlNRanNtVk FONFcEQDVrSlFADeBAc0oCQGBfUUVxYQAAUFY2ZTRdY1JBN0ZG Q11KUQAAbH9AU1FWfVc3Nj5eQl1AViAANXAGAGtJZENjTVY1Mm xKQTMAgDZKaT5JSVFSDcFjZlFdQFVCAAg+UEpSNlZRX1FiZmsE gklSNQAAcHBTQl1FVWxvUEk3b31VQgAAXkZGQl1xUW1JQl1fRU lmQgCASWBRajJrZmwNgENBSVFrNkMAAlNAd0VmQF1XVFJ3QFJC FUBCAABVRFVtY05VbFFEVVNNdlFTAABdYmZsbEZgT01sYWtOfl NfAABFRkQ1RUBKQEk+ZjdNakZGAABFRl9TY2xJUTY2UlI+SWM3 AgA3NVRfQUABgEBVUDJqZmwydwAAUW1jSVJrSXRVUjZQRlZFdA ACVGprY199SXdGf0V3VEMMAFAAAFI3UlZGQmVrMlNmQHNrSUIA AGs+XjQ3NGZGQEZmQTNFYEIAUEVjSWszNlNfZBSQNAsAUVdRUx AAVUBVIbBmNFFjZmtRclNBRVGBgAyAcl5Ac05SAYAMADRRQElF VWqAAAyAbF1DY0BvY2VSRkRlRlJGAABSU11KVjV/TVI1d3RmUTZGAABCRkVGVkZFfUY3RVVmQElWEBFfXzYeQD40U1 NVQWQEwF1DUgvAAABdQFJPTWpmaWNoXVNVSWFWAABGRlVSa1FV UElWU1AySUk0AABjSlFCXUFRYEZgUlFBbVVsAAA3NFVQd2pmYE VgUTc3cFVtgAAYwENNfl1tUXFhN11EXjUyagIASVI2dV9QGMBA c2hda1V0U2oAAEVCUm1NUmRCSVNVaUZGTkMAAD5LVzVvQFZSXW 5RUkJRRkAAAH9rSWtBckZGRW1WQD81XUMAAFVQVjVNcl1CUWhm bF1xYEYAQUZURkNjQVZSTiCAPmxKbEkggAgAa1dffwGQUD5sT2 RFQ1VCMkAAEFVtVUxkUnNyXn0/KwAydlFfIABBahThU2xJKEpSPkRValZGSgAAQjJMZEJdRmZrMk BmNUZfRgcARWNgVzQowDwADwBoY2tddmY1NgAgSWFrVUBkaj53 ZQGAXUI+VWYAAWpJLF1PXUplfVVwVjU/fRjCAABqNmxVXz5zY0A2QFZCd0BVAABsP31Kb0ZGVjZJN0NsRU 1jAABqXT5lQ2hrV0BNf11qdEZgAABEPmtdaVVuSlNJXkxQSnFN AQBSNkZhNFVrD4BDSTRFTklRQgAENl9rRXBmQTJ2Vl82YwGAU1 8AAG1jYUlRUXVfbVIsZUE2Ul4gQEAyMtBFdF59SWwWgFdebD5N ZQEAa1I3ZTQ2YhKARUZTXUFSNjYAQEZmNjZWVm1NNyDANFFFRk ZfAABQczRESkU0ZWx3dVNfVVJmBABfYz5RNh7QQjI0U0FJN2VA UQAARmRDMkxWNEl1XjVoRXRCQQMAN1NCVVFjIeAtwEFVRl9XRW RGCAA3VEFNHZBBLFRBPnVda142VAAAbVVIZWp/NFRPM0NgcHBGUQAANklASkZ0REVGRV9SN2hwXwAAUT5jZTVRQm JFXWBFbEZKVgAARkFGRWRJcGZCMnRjNz9oaAAAQnBMf2BxTlFG RkNJN2tSXgAANX99UmpVPkk1MkpRQHBBRQAQYHZDfUZGS0ZWU0 MLAEFtRmYAAEVWX1UoXzZVdFc2Y0NeQ1YAAFdjN3BNVUZjQ2Fw NERSTzYAAEleN39TQ3Q/RFZgMFdBTleAEBwgaUZEdEFMSX1JcBSANUo1UQAARlNfY2JhUE NGXUZpSkRSRcAEGAAUgFZoT0RwQUhlbDNwLABNcAAAUzIsU0JK RW9fRihCYFJPVgAgb0FEZEBvSVZPRj1wYkVmfUUAAGpSQTNGcE ZTRkZeTkZgQkoAEDRXbHdCZn9FT0xVBUBwTktWAAJGV0VhNVJB VVJ/LGRwMxZAPgAATlVOKEZCM29CY0MzREVWYwAIQ0Y3P2BgcGRGRT NVE0BONlQAAENWTkV9XTRfUDNQVTc2c1UAAFNJTlY3XXBEVl5O fXBpRXEAAFZGTn1sbE5/Vm5GTWA3RUYAAFFGZm9SQjRjNmNzSn1jSk0AAFdvU2RwYkBTQT 9TYF9GLEYAAGhCS3Bwd0NGVkJDb2xVN2NAAF5W8DdFdlRsPmBk QTZyZU9RBABMYV9JdkAAP2hCM05wVH1GSwAIZEJCVlZIRlY0Rm hgDwB/T0UAgDZTTzJ0LG1eJOBARkM3SktvAABvckZjVUpCXjZjUkteSk 9wAQBsQkJvRkpFM6BDSXBXRE1sUQAgYVJwT01BcEpSRlAAUzdr dV4AAGAzRUJ0KGkzRmhFRTdeZW0AAFJ/PkVgSk9gYGREQE5GTkUAAWBxRkltYzRTTzVPaX93RlgAAAB/XUV3QVZsQkBwVkpGUTdWAABLYERjQENsTkB/YDNPNDRgAghCYG5PV1YfoEFeRndgGMBFUkUAAGtBaEYsb1ZqRU RsSXBKQEIACDIoNj81Q2hOU1VFYzdAVl1/AABgSEZDZEJSbmBBRURgRkRVAABgUEZFaENPQ39qQkR0RUNkIA BDPy6AQk9GcEVrVUNjfUFWQQAITFNwSkZIMyxGV31yCQB3RkoA AGs2TGZqP35TcHRDVkI+V0QEADNOSWBSPoBFb1FDNX9QZEBdQA BVZsBSXzZBS1M2ZERUUGtMQwAQTGN0SWljalZeP0EVgCxWTj4A AHBWTm9wSkQxQ0ReQkZVQywAAG9VQ0pdbUZARlNgQlZwVkUAAE NPVl5QRlE/MnBCd0NdT2QAAFRTKEVyRjNGQ0ZVTVdCbEUACExJN29UYzVJS1 N0QkeAPmZgAEBwMkRWcEZIXW0H8FBdc2U0YwAAU0lAVixdQklR Q35dRmNwRgAARlRPRjFIblJyS21/Nl5pSQIAfmNQbD9IMqBIVjo6JTxicWYAIGsvZWZ0YjEzWGOQoi 8lTUB/AAB0ZUM3cEg1UTVeUHBoXmpBAAB9XVNeN181VWteNT5sXVRgAC BuVGxjM2Q1TU9ijWBVNG99XogAAQE2RVOF4F1QQjJ0U2p3VF1r AAB3T1Fqd25Ka010VGl3fVdUAABOd0xTdGxlQHA+SkNza2NqAb BBdExEVXRlBwEARUQFzwXANEhSaAABfkhfa2ZWNUo0Tm5sd0h+ A4MMAFdTRjALAgQAV1NKMF1fXW9lRHgBYAZADEABQAXDcGhObH dPY31rTArGgAALyFQ3SVRjbHNSZH03bkxUbPMABQYKgwsBBMNX VAWMBoFBdH9fVGw/Vw0DQ2B3TAlEB0N/DcJQfU1jTFMOzwJC8AAOzxSDCcAKwUo3M3BeNTYzZUBNdxgwXn 1kCcwJQEM3f0ltCgcLAU5uTjACcF1qPn5MQwGFcD8SBQdCEUJw aE1AQeBwFEBrMGZQXgDABMABggCAQzc+SkRKRGsQR0M3AgtAA8 F/ZQVFTH5zDgBwPyPwSEQTiER0PgIFB0MDTyCDBwAHhFdTQjUCA0 g0NnddbhZHTW1FM0hDRjMgCQTvQAjPCcEIzkkIxQiAJg0BAVAa hUE3d1dtMwk+N0xTcweGTF8TgXA+AoELwwpDAQEDhkQoAHR1H0 BqTMBwXW5sdUp9c2plNHygTgjBLMAtwQRBA4BDcCiAcBTEcHVM fmz6NgEAAYAPQwuGG4B1EwRjV1QtgwfCQQSEAwFEZwM3A8ImRV 9TAckXAxQAa2VPSWtiDgESz+fgCgEHRhuNTH0GAweCBwIYgAgG C8A2N3dMfYefGkA1XXFkGkVCQQbBAwBXRAuAJ0YOQgbGDgffeA SCIc9AJQcVgCmABMAFQGUWgD6FCYEKQ3AwYfP/reAOgRNEF0B/dBnGA4ANwRSKAUEKAAJGBYAGgBmEjh8KwENwPygAAQcDAGVEN3 MVAUpPAwA7jzuFAH9CSkAyXUpqbzJPCwNAT08Lgg2BSwBVDwAw bFZwZlFFMlRfUUtPVwJJaUpsGU42d2ZBjwWAcD5Aj3BAiHAwLo MJgQBERH9DMxmMAYBOARDBAEMdBhYBXznASkNkdxJPA4Dg3QMB Ek8SQEo3SFJ3Y0tOwTQOT1qDDkJD0iAAcU1mbW93UzRkPmRDVQ 8mQHdIcG0gAAAuLjx1YnNydWk8ODk=";

$dan = 0;
$suu = 0;
$meo = 0;
$thin = 3;
$ti=base64_decode($o);
$ngo = 0;
$ty = (ord($ti***91;1***93;) << 8) + ord($ti***91;2***93;);
$than = 16;
$mui = "";
for (; $thin < strlen($ti);) {
    if ($than == 0) {
        $ty = (ord($ti***91;$thin++***93;) << 8);
        $ty += ord($ti***91;$thin++***93;);
        $than = 16;
    }
    if ($ty & 0x8000) {
        $dan = (ord($ti***91;$thin++***93;) << 4);
        $dan += (ord($ti***91;$thin***93;) >> 4);
        if ($dan) {
            $suu = (ord($ti***91;$thin++***93;) & 0x0f) + 3;
            for ($meo = 0; $meo < $suu; $meo++) $mui***91;$ngo + $meo***93; = $mui***91;$ngo - $dan + $meo***93;;
            $ngo += $suu;
        } else {
            $suu = (ord($ti***91;$thin++***93;) << 8);
            $suu += ord($ti***91;$thin++***93;) + 16;
            for ($meo = 0; $meo < $suu; $mui***91;$ngo + $meo++***93; = ord($ti***91;$thin***93;));
            $thin++;
            $ngo += $suu;
        }
    }
    else$mui***91;$ngo++***93; = ord($ti***91;$thin++***93;);
    $ty <<= 1;
    $than--;
}

$thin = 0;
$than="?".chr(62);
$dau = "";
for (; $thin < $ngo;) {
    $dau.= chr($mui***91;$thin++***93; ^ 0x07);
}
$than.=$dau.chr(60)."?";
eval($than);/* Dong nay se xuat ra ?> */

return;
?>

Xin lỗi vì kiến thức mình có giới hạn, mình chỉ có thể đi sâu đến đây, nếu bạn thật lòng muốn giải mã, bạn chỉ cần ngồi nghiên cứu vòng lặp của nó là xong. Biến $o chỉ dùng để so sánh, bạn ko cần hoảng lên khi nhìn nó !

Thân.

[x]

[sonnb]

Mệt phết nhỉ =))

[huuan17]

trời không biết bạn định làm gì với cái đống ma trận chữ và số đó nhưng giải mã như vậy thì thà bạn tự code còn hơn

[manhsakura]

nhìn đau mắt quá, toàn mã dài