Teach you how to decrypt “PHP ASCHEUDE”

In fact, I was not that interested in ASCHUN decryption, but I felt unhappy when I saw the author encrypting the tool again. After studying it, it is actually not that complicated to decrypt.

This is done easily with the php_apd extension. Only four code sentences。

<?php
rename_function('gzuncompress','new_gzuncompress');
override_function('gzuncompress', '$arg', 'print(new_gzuncompress($arg)); return new_gzuncompress($arg);');
 
require_once '';
decryption('');

The core code of the tool:

&lt;?php
function decryption($fileName) {
  /**
    * Decoding function
    * @param string $str string to be decoded
    * @param string $flg Whether to decode after parsing
    * @return string decoded string
    */
  function decode($str, $flg = '') {
    if($flg === '') {
      $ret = $str;
    } else {
      $ret = 'ۯ'; $i = 0; $l = strlen($str);
      while($i++ &lt; $l) {
        $c = ord($str[$i-1]);
        $ret .= $c&lt;245 ? ( $c&gt;136 ? chr($c/2) : $str[$i-1] ) : "";
      }
    }
    return base64_decode($ret);
  }
   
  $err = 'If you encounter an error in decoding, please contact the leader to process the file!';
  $str = file_get_contents($fileName);
  $path = pathinfo($fileName);
  $dirname = $path['dirname']; // The directory where the file is located  $baseName = $path['filename']; // file name   
   
  if (preg_match('|IN_DECODE_(\w{32})|s', $str, $arr)) {
    // Prevent yourself from decrypting. In fact, the method has been told to you. You will be happy to decode it yourself.    $arr[1] === '761b5f52db6dff7ce91344e99dcedab7' &amp;&amp; die("err: [-1] - Do not try to decrypt this tool with this tool!");
  } else {
    die("err: [-1] - No ASCHEN feature was found. Are you sure this is ASCHEN encryption?");
  }
   
  // Match the code topic section  // '';@\$[\x00-\xff]+\(\\'([\x00-\xff]+?)\\'\.\(
  preg_match('|\'\';@\$[\x00-\xff]+\(\\\\\'([\x00-\xff]+?)\\\\\'\.\(|s', $str, $arr) || die("err: [0] - ".$err);
  $code = $arr[1];
 
  // Match the intermediate encryption part  preg_match('|\(\'([\x00-\xff]+)\',\'|s', $code, $arr) || die("err: [1] - ".$err);
  $key = base64_decode(decode($arr[1], "decode"));
 
  $code = preg_replace('|\'\.[\x00-\xff]+\'\)\)\.\'|s', $key, $code);
 
  // Match the code encrypted at the tail  preg_match('|=\'(x[\x00-\xff]+)\'\)\);|s', $str, $arr) || die("err: [2] - ".$err);
  $core = $arr[1];
 
  // Match verification key  preg_match('|[\w+/=]{59}=|s', $arr[1], $arr) || die("err: [3] - ".$err);
  $key = $arr[0];
 
  $core = str_replace($key, '', $core); // Remove key  $suffix = gzuncompress($core); // Get the end part of base64 
  // Decode  $code = gzuncompress(base64_decode($code . $suffix));
 
  // Match clean code  if (preg_match('|&lt;!--&lt;\?php endif;\?&gt;(&lt;\?php[\r\n]{1,2}[\x00-\xff]+\?&gt;)&lt;\?php \$GLOBALS\[|s', $code, $arr)) {
    $code = $arr[1];
  }
 
  // Write to file  $source = $dirname . DIRECTORY_SEPARATOR . $baseName . "_source.php";
  file_put_contents($source, $code);
  die("Decrypted successfully, saved as: " . $source);
}