PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $ex_type = $ex_timefree; $ht_jump_addr = "menu_s.html"; switch ($sno) { case "s01": ht_subtitle("0301",""); $ht_jump_btn1_label = "選択"; if (rf_tf30_check() === true) { $ht_jump_btn2 = 1; $ht_jump_btn2_label = "選択30"; } $ch = rfmenu_rec_ch($ex_type); break; case "s02": ht_subtitle("0302","")...

Obfuscated php code

<?php
 $ex_type = $ex_timefree; $ht_jump_addr = "menu_s.html"; switch ($sno) { case "s01": ht_subtitle("0301",""); $ht_jump_btn1_label = "選択"; if (rf_tf30_check() === true) { $ht_jump_btn2 = 1; $ht_jump_btn2_label = "選択30"; } $ch = rfmenu_rec_ch($ex_type); break; case "s02": ht_subtitle("0302",""); rfmenu_rec_kwsrc($ex_type); break; case "s03": ht_subtitle("0303",""); echo_msg(2,"キーワードをもとにタイムフリー番組の一括録音を行います。"); if (rf_tf30_check() === true) { } echo_msg(2,""); $ht_jump_btn1_label = "選択"; $ht_jump_btn2 = 1; $ht_jump_btn2_label = "全選択"; rfmenu_rec_kwdat($ex_type); break; case "s04": ht_subtitle("0304",""); $ht_jump_btn1_label = "再生"; $ht_jump_btn2 = 1; $ht_jump_btn2_label = "再生(サーバ)"; rf_menu_play($ex_type); break; default: break; }

Decoded(de-Obfuscated) php code

<?php

$ex_type = $ex_timefree;
$ht_jump_addr = "menu_s.html";
switch ($sno) {
    case "s01":
        ht_subtitle("0301", "");
        $ht_jump_btn1_label = "選択";
        if (rf_tf30_check() === true) {
            $ht_jump_btn2 = 1;
            $ht_jump_btn2_label = "選択30";
        }
        $ch = rfmenu_rec_ch($ex_type);
        break;
    case "s02":
        ht_subtitle("0302", "");
        rfmenu_rec_kwsrc($ex_type);
        break;
    case "s03":
        ht_subtitle("0303", "");
        echo_msg(2, "キーワードをもとにタイムフリー番組の一括録音を行います。");
        if (rf_tf30_check() === true) {
        }
        echo_msg(2, "");
        $ht_jump_btn1_label = "選択";
        $ht_jump_btn2 = 1;
        $ht_jump_btn2_label = "全選択";
        rfmenu_rec_kwdat($ex_type);
        break;
    case "s04":
        ht_subtitle("0304", "");
        $ht_jump_btn1_label = "再生";
        $ht_jump_btn2 = 1;
        $ht_jump_btn2_label = "再生(サーバ)";
        rf_menu_play($ex_type);
        break;
    default:
        break;
}

Malware detection & removal plugin for WordPress