两个文件
第一个文件：
<?$O00OO0=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$O00O0O=$O00OO0{3}.$O00OO0{6}.$O00OO0{33}.$O00OO0{30};$O0OO00=$O00OO0{33}.$O00OO0{10}.$O00OO0{24}.$O00OO0{10}.$O00OO0{24};$OO0O00=$O0OO00{0}.$O00OO0{18}.$O00OO0{3}.$O0OO00{0}.$O0OO00{1}.$O00OO0{24};$OO0000=$O00OO0{7}.$O00OO0{13};$O00O0O.=$O00OO0{22}.$O00OO0{36}.$O00OO0{29}.$O00OO0{26}.$O00OO0{30}.$O00OO0{32}.$O00OO0{35}.$O00OO0{26}.$O00OO0{30};eval($O00O0O("JE8wTzAwMD0idHZyZGxnT3BHVnVoZk1KaVJuRXNtVVBRYWtlWENISXFLU0JXY3hqRkxib1pOekFEeVRZd0pjcERhT1luemd5QU52WGJVS01WamZ0aGR1VEhtSUJyUnhXa3N3TGlRcVBGQ0Vsb1plR1N0bzlTZElsQ21qVWFGamF5RmtoUFgwYVlIMFVpZjFVdGUwNEtSeFdjc2JXYVR6YTBSbURXRzJDYXMzdk9Vemd5ZGtndVhadTdvaFBjUmJQQ21iUE81UXlhNVFiUTVHZGk1ZDY1NlIrMzVHeS81USt5NW54NW9oUHJRUzBSWHppMUR6QWNzamE2R0hVbnEyNXVxMjFBZGs0OUdIWFpHSHVQQmpBQUdrRFpkeDVMcTIwYlFtWDNEM3N5ZHppQUYzWG5RakNjcXhCVkJMTVpDWjRTUUxseXZ4Qm5ZUzBSZGtHUEJrYXlIMmlac2ppNVJtVU5mMGd4Z3VneGtaREJnaVVoSDBBdGYxaEtIeFN1R0hnMGR6OVpkSG5BRHphY3FqVWNxa2lucWJ1bkZIQW5EbU9LNUYrTjVGbUM1cFJBNW5aWDZHbWQ2UStJNVA2QjVuMm9ReWJjSitiV2FZVEV5MWlVQ29Nd3Zvc3dDRXV3WFp1N29obm5GYk91VWlVTmh1OWZSeFd1ZElVMHNtTzB2b3ZuWVMwUlhpOUFzamdBZGtVRUJvME9YWnM3b2hQdUgyaVpGa2luRm1sOUJ6aVpzamk1Um11N29obm5GYk91VWlVcVgyQ25ESXVLSHh1T1RTMFJteFVXZnVnV0J6OVpCbVVXZnVnV0JvME9HMmlMZHpnTnNqZ0FGbU9LR0hYYUd4NVNkSWxLUmVWQ21PYW5GYk91SDJpbkZtdU9UUzBSbWh1dUgyaVpGa2luRkl2T3R4bHVoZ1hpaGdWdUgyaW5GaTFxWDJDUGRrd3VYMTBPdFpsdWhnWGloZ1Z1SDJpbkZpMXFYMmlac2pDUGRrd3Vka2hLSHhsNkJtVU5Ha2F1WVMwUm1odXVIMmlaRmtpbkZtbDlCemc0c3p3Y0Z6ZlBYWlNLUW1sdUgyaVpGa2luRkl2bllTMFJtSDBDbUswT0Zrd0VGeFc3b2hQWFhpOUFka2hPdG1sd0J6OVpCelVBcXpnWkRtT0s1N1k3NTd5TjVuWnI1cVpsNUZtYzVHYno1NnlGNUdyTjZCWTk3N1p2NVBSUDU1ck01R2J6NTZ5RjU2NkE1NW16NXFiaDVHKzM1bnJtNVFiQzVHK2M1NXhQWFpTT1hNMXRVaWd2VWdWWkhnVktxemF5ZDNnWnFtRERRYkRWcTJEY0RIaHlzekFTWFp1N29objlvaG5aRkhpMWRIWGFCTVVmSDFYdGUxaHlYWjlBRnoxbnFiOUtxejliR2tTeUZLZ3lHWjVTZElsS1lTMFJzamd3RGthWkZ4V01naTl4ZTA5ZlFic2NkazVMcUlndUZ4OVNxM0MwUWpGMXFqdnlzekFTWEVWQ21LWGFzSGduc2pnTnEyNUxGeFdNZ2k5eGUwOWZRYnNjZGs1THFJZ3VGeDlMR2tDUEZ4NWpEazVMUUtXUHNtczdvaG5uczNDYURtT3VGamFWRnh1T3EzQk9YekZucXpmT3R4bEtkazV1RkhPS1lTMFJYSUNhRzNYYUR6SmFUeGw5Qm1EQUZ6MW5xYThLUUtDMHNLVWNxejkzRkhCUHMzZ2JzM1VaUk1VZkgwSmlreFNPUWVHblJlVkNtamFqUm1Vb1V1RHFYMmkxRHpBQUZ6MW5xYkREQm8wOUJtRExxMjlwZGtmS1J4VzdvaFBYWGk5dUZIQzBxMjl5SDJpdXFrYXlCbzBPRjJnMEgyQ2NxMkpuRnhPdXMyZ0xzamcwZDJnNVJlVkNtT3V1SDJVYXMzVWNxMjVOR2tVSmRrNE90eGx1SDJVYXMzVWNxMjVOR2tVSmRrNE90WlducUtVMkdrU1BYaTl1RkhDMHEyOXlIMml1cWtheVJ4bDZCb2w3b2huOUJ6Z1ZzMmZPVFMwUm14VUVGSENFZGs5eUJvME9xamczQnpVRUZIQ0Vkazl5Um11N29oUFhYaTl1RkhDMHEyOXlIMml1cWtheUJvME9kSENFRkhoUFhpOWVVZ0NleGY5WWtaVUVGa0NaRkhVcEZIYURSeGwvQnpheURJRkFxbU91SDFDaWYxQ1hlMDVxWElDYUczWGFEekphVGcwbkJvUE92b1ZDbUswQ21iVU5GajkxcWpVYXNibDlCbVVvVXVEcVgyRmNEazV1RkhYbkZtRERCbzA5Qm1VTkRIQ2FzamF1Qm84T1hpOTFzMmdaZGtoT1libFNZUzBSWGk5TEdIVW5GSXZPdHhsdUgyQ1Bka3d1c1psOUJtc0tZUzBSWGk5TEdIVW5GbWw5Qm1VTkcyQW5xemhPdHhXQXNLWEFUeE9uWVMwUmRrR1BYTVVma1pEQUZ6MW5xYTlWcTJzS0h4bGpYYmx1R2tDMGRrOXlCbU05Qm1EbnFIV2NzS2hLUnhXQUZ6MW5xYTlWcTJzUFJlVkNtamFqUm1VTWdpVktHa1VKZGs1TnEyNVZkazVhWDEwbkJ6aXVxa2F5SDI5eXF6YXlGeE9uWVMwUlhJRG5GekRhRG1sOUJ6YUVzMmcwUm1VM2RrVUtGSGhuQm84T2RrNTBEamlWUm1VM2RrVUtGSGhuQm9QT3ZvVkNtYlVTczJhNkZ4bDlCemFFczJnMFJtVVNzMmE2Rnh1T3RaV25xS1UyR2tTUFhJV0VkSG5hUnhsNkJvbDdvaG5uRmJPdXNJQ25UamZPdGJsU0JtR2pCbVVTczJhNkZ4bEF0eGx1c3ppS0ZIQ25UamZuQklWQ21PdXVzemlLRkhDblRqZk90eGx1c0lDblRqZjdvaFBYWHo5akZLQ2FEbWw5Qm1PdXN6aUtGeDB3UnhQdXN6aUtGSENuVGpmN29objlvaG5uRmJPdXFrOXVEa3dhQm8wOUJtRHVGSEMwcTI5eVhadU9UUzBSbXhBbnFqQ1ZEa1VhQk1VZkgxWHRlMWh5WFo5QUZ6MW5xYjhLUWJVamRrd2FRYnN5ZGs1TFFLV1BzbXNuQno5WkJ6MUVGWk9uWVMwUk54V2FxSUNhQklWQ21PYW5xakNWRGtVYUJNVWZIMVh0ZTFoeVhaOUpxMlUxcXpmY1haNHVxazl1RGt3YVFic2NHMjlKcWs5eVFqYXlHWjVTZElsS1lTMFJteEFucWpDVkRrVWFCTTFNSDFYdGUxaHlYWjlBRnoxbnFiOEtRYlVqZGt3YVFic3lkazVMUUtXUHNtc25CejlaQnoxRUZaT25ZUzBSTmgwUnRFND0iO2V2YWwoJz8+Jy4kTzAwTzBPKCRPME9PMDAoJE9PME8wMCgkTzBPMDAwLCRPTzAwMDAqMiksJE9PME8wMCgkTzBPMDAwLCRPTzAwMDAsJE9PMDAwMCksJE9PME8wMCgkTzBPMDAwLDAsJE9PMDAwMCkpKSk7")); ?> 第二个文件
太大了，代码传布上来 教我方法吧！万分感谢
这个没有加密。
$O00OO0 这个用urlde解出来就是一个字符串。。
逐次把 eval 替换成 echo 后运行
defined('IN_DESTOON') or exit('Access Denied');/*** 以下内容请勿修改*/$authorizationdomain=array("haagri.com","www.haagri.com","127.0.0.1");if(!in_array($_SERVER['HTTP_HOST'],$authorizationdomain))exit('域名没有通过授权.请联系QQxxxxxx');if($DT_BOT) dhttp(403);$_areaids = '';$_areaid = array();if($DT['city']) { $AREA or $AREA = cache_read('area.php'); if($_aid) { $_areaids = $AREA[$_aid]['child'] ? $AREA[$_aid]['arrchildid'] : $_aid; $_areaid = explode(',', $_areaids); }} else { $_aid < 1 or dalert('系统未开启分站功能，您的分站管理帐号暂不可用', $MODULE[2]['linkurl'].'logout.php');}require DT_ROOT.'/admin/global.func.php';require DT_ROOT.'/include/post.func.php';require_once DT_ROOT.'/include/cache.func.php';isset($file) or $file = 'index';$secretkey = 'admin_'.strtolower(substr(DT_KEY, -6));if($CFG['authadmin'] == 'cookie') { $_destoon_admin = get_cookie($secretkey); $_destoon_admin = $_destoon_admin ? intval($_destoon_admin) : 0;} else { $session = new dsession(); $_destoon_admin = isset($_SESSION[$secretkey]) ? intval($_SESSION[$secretkey]) : 0;}$_founder = $CFG['founderid'] == $_userid ? $_userid : 0;$_catids = $_childs = '';$_catid = $_child = array();if($DT['admin_log'] && $action != 'import') admin_log();if($DT['admin_online']) admin_online();$widget = isset($widget) ? intval($widget) : 0;$psize = isset($psize) ? intval($psize) : 0;if($psize > 0 && $psize != $pagesize) { $pagesize = $psize; $offset = ($page-1)*$pagesize;}if($module == 'destoon') { (include DT_ROOT.'/admin/'.$file.'.inc.php') or msg();} else { include DT_ROOT.'/module/'.$module.'/common.inc.php'; (include MD_ROOT.'/admin/'.$file.'.inc.php') or msg();}这也是比较简单的加密，方法和楼上说的一样 就是echo
