PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php global $pcastdir; global $DS; ht_subtitle($subno,""); switch ($subno) { case "9909": $filepath = pathinfo($val); $ext = $filepath['extension']; if ($ext == "log" || $ext == "txt" || $ext == "dat") { $fl = $val; ht_textedit($fl,0,0); } else if ($ext == "mp3" || $ext == "m4a") { $fl = $val; h...

Obfuscated php code

<?php
 global $pcastdir; global $DS; ht_subtitle($subno,""); switch ($subno) { case "9909": $filepath = pathinfo($val); $ext = $filepath['extension']; if ($ext == "log" || $ext == "txt" || $ext == "dat") { $fl = $val; ht_textedit($fl,0,0); } else if ($ext == "mp3" || $ext == "m4a") { $fl = $val; ht_pgm_disp($fl); ht_webaudio($fl,""); } break; default: ht_development($subno,$val,2); break; }

Decoded(de-Obfuscated) php code

<?php

global $pcastdir;
global $DS;
ht_subtitle($subno, "");
switch ($subno) {
    case "9909":
        $filepath = pathinfo($val);
        $ext = $filepath['extension'];
        if ($ext == "log" || $ext == "txt" || $ext == "dat") {
            $fl = $val;
            ht_textedit($fl, 0, 0);
        } else {
            if ($ext == "mp3" || $ext == "m4a") {
                $fl = $val;
                ht_pgm_disp($fl);
                ht_webaudio($fl, "");
            }
        }
        break;
    default:
        ht_development($subno, $val, 2);
        break;
}

Malware detection & removal plugin for WordPress