Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php function jdate($format,$timestamp='',$none='',$time_zone='Asia/Tehran',$tr_num='en'){ $T_sec=0;/* <= رفع خطاي زمان سرور ، با اعداد '+' و '-' بر حسب ثانيه */ if($time_zone!='local')date_default_timezone_set(($time_zone==='')?'Asia/Tehran':$time_zone); $ts=$T_sec+(($timestamp==='')?time():...



Obfuscated php code

<?php function jdate($format,$timestamp='',$none='',$time_zone='Asia/Tehran',$tr_num='en'){

 $T_sec=0;/* <= رفع خطاي زمان سرور ، با اعداد '+' و '-' بر حسب ثانيه */

 if($time_zone!='local')date_default_timezone_set(($time_zone==='')?'Asia/Tehran':$time_zone);
 $ts=$T_sec+(($timestamp==='')?time():tr_num($timestamp));
 $date=explode('_',date('H_i_j_n_O_P_s_w_Y',$ts));
 list($j_y,$j_m,$j_d)=gregorian_to_jalali($date[8],$date[3],$date[2]);
 $doy=($j_m<7)?(($j_m-1)*31)+$j_d-1:(($j_m-7)*30)+$j_d+185;
 $kab=(((($j_y%33)%4)-1)==((int)(($j_y%33)*0.05)))?1:0;
 $sl=strlen($format);
 $out='';
 for($i=0; $i<$sl; $i++){
  $sub=substr($format,$i,1);
  if($sub=='\\'){
	$out.=substr($format,++$i,1);
	continue;
  }
  switch($sub){

	case'E':case'R':case'x':case'X':
	$out.='http://jdf.scr.ir';
	break;

	case'B':case'e':case'g':
	case'G':case'h':case'I':
	case'T':case'u':case'Z':
	$out.=date($sub,$ts);
	break;

	case'a':
	$out.=($date[0]<12)?'ق.ظ':'ب.ظ';
	break;

	case'A':
	$out.=($date[0]<12)?'قبل از ظهر':'بعد از ظهر';
	break;

	case'b':
	$out.=(int)($j_m/3.1)+1;
	break;

	case'c':
	$out.=$j_y.'/'.$j_m.'/'.$j_d.' ،'.$date[0].':'.$date[1].':'.$date[6].' '.$date[5];
	break;

	case'C':
	$out.=(int)(($j_y+99)/100);
	break;

	case'd':
	$out.=($j_d<10)?'0'.$j_d:$j_d;
	break;

	case'D':
	$out.=jdate_words(array('kh'=>$date[7]),' ');
	break;

	case'f':
	$out.=jdate_words(array('ff'=>$j_m),' ');
	break;

	case'F':
	$out.=jdate_words(array('mm'=>$j_m),' ');
	break;

	case'H':
	$out.=$date[0];
	break;

	case'i':
	$out.=$date[1];
	break;

	case'j':
	$out.=$j_d;
	break;

	case'J':
	$out.=jdate_words(array('rr'=>$j_d),' ');
	break;

	case'k';
	$out.=tr_num(100-(int)($doy/($kab+365)*1000)/10,$tr_num);
	break;

	case'K':
	$out.=tr_num((int)($doy/($kab+365)*1000)/10,$tr_num);
	break;

	case'l':
	$out.=jdate_words(array('rh'=>$date[7]),' ');
	break;

	case'L':
	$out.=$kab;
	break;

	case'm':
	$out.=($j_m>9)?$j_m:'0'.$j_m;
	break;

	case'M':
	$out.=jdate_words(array('km'=>$j_m),' ');
	break;

	case'n':
	$out.=$j_m;
	break;

	case'N':
	$out.=$date[7]+1;
	break;

	case'o':
	$jdw=($date[7]==6)?0:$date[7]+1;
	$dny=364+$kab-$doy;
	$out.=($jdw>($doy+3) and $doy<3)?$j_y-1:(((3-$dny)>$jdw and $dny<3)?$j_y+1:$j_y);
	break;

	case'O':
	$out.=$date[4];
	break;

	case'p':
	$out.=jdate_words(array('mb'=>$j_m),' ');
	break;

	case'P':
	$out.=$date[5];
	break;

	case'q':
	$out.=jdate_words(array('sh'=>$j_y),' ');
	break;

	case'Q':
	$out.=$kab+364-$doy;
	break;

	case'r':
	$key=jdate_words(array('rh'=>$date[7],'mm'=>$j_m));
	$out.=$date[0].':'.$date[1].':'.$date[6].' '.$date[4].' '.$key['rh'].'، '.$j_d.' '.$key['mm'].' '.$j_y;
	break;

	case's':
	$out.=$date[6];
	break;

	case'S':
	$out.='ام';
	break;

	case't':
	$out.=($j_m!=12)?(31-(int)($j_m/6.5)):($kab+29);
	break;

	case'U':
	$out.=$ts;
	break;

	case'v':
	 $out.=jdate_words(array('ss'=>($j_y%100)),' ');
	break;

	case'V':
	$out.=jdate_words(array('ss'=>$j_y),' ');
	break;

	case'w':
	$out.=($date[7]==6)?0:$date[7]+1;
	break;

	case'W':
	$avs=(($date[7]==6)?0:$date[7]+1)-($doy%7);
	if($avs<0)$avs+=7;
	$num=(int)(($doy+$avs)/7);
	if($avs<4){
	 $num++;
	}elseif($num<1){
	 $num=($avs==4 or $avs==((((($j_y%33)%4)-2)==((int)(($j_y%33)*0.05)))?5:4))?53:52;
	}
	$aks=$avs+$kab;
	if($aks==7)$aks=0;
	$out.=(($kab+363-$doy)<$aks and $aks<3)?'01':(($num<10)?'0'.$num:$num);
	break;

	case'y':
	$out.=substr($j_y,2,2);
	break;

	case'Y':
	$out.=$j_y;
	break;

	case'z':
	$out.=$doy;
	break;

	default:$out.=$sub;
  }
 }
 return($tr_num!='en')?tr_num($out,'fa','.'):$out;
}

Decoded(de-Obfuscated) php code

<?php

function jdate($format, $timestamp = '', $none = '', $time_zone = 'Asia/Tehran', $tr_num = 'en')
{
    $T_sec = 0;
    /* <= رفع خطاي زمان سرور ، با اعداد '+' و '-' بر حسب ثانيه */
    if ($time_zone != 'local') {
        date_default_timezone_set($time_zone === '' ? 'Asia/Tehran' : $time_zone);
    }
    $ts = $T_sec + ($timestamp === '' ? time() : tr_num($timestamp));
    $date = explode('_', date('H_i_j_n_O_P_s_w_Y', $ts));
    list($j_y, $j_m, $j_d) = gregorian_to_jalali($date[8], $date[3], $date[2]);
    $doy = $j_m < 7 ? ($j_m - 1) * 31 + $j_d - 1 : ($j_m - 7) * 30 + $j_d + 185;
    $kab = $j_y % 33 % 4 - 1 == (int) ($j_y % 33 * 0.05) ? 1 : 0;
    $sl = strlen($format);
    $out = '';
    for ($i = 0; $i < $sl; $i++) {
        $sub = substr($format, $i, 1);
        if ($sub == '\\') {
            $out .= substr($format, ++$i, 1);
            continue;
        }
        switch ($sub) {
            case 'E':
            case 'R':
            case 'x':
            case 'X':
                $out .= 'http://jdf.scr.ir';
                break;
            case 'B':
            case 'e':
            case 'g':
            case 'G':
            case 'h':
            case 'I':
            case 'T':
            case 'u':
            case 'Z':
                $out .= date($sub, $ts);
                break;
            case 'a':
                $out .= $date[0] < 12 ? 'ق.ظ' : 'ب.ظ';
                break;
            case 'A':
                $out .= $date[0] < 12 ? 'قبل از ظهر' : 'بعد از ظهر';
                break;
            case 'b':
                $out .= (int) ($j_m / 3.1) + 1;
                break;
            case 'c':
                $out .= $j_y . '/' . $j_m . '/' . $j_d . ' ،' . $date[0] . ':' . $date[1] . ':' . $date[6] . ' ' . $date[5];
                break;
            case 'C':
                $out .= (int) (($j_y + 99) / 100);
                break;
            case 'd':
                $out .= $j_d < 10 ? '0' . $j_d : $j_d;
                break;
            case 'D':
                $out .= jdate_words(array('kh' => $date[7]), ' ');
                break;
            case 'f':
                $out .= jdate_words(array('ff' => $j_m), ' ');
                break;
            case 'F':
                $out .= jdate_words(array('mm' => $j_m), ' ');
                break;
            case 'H':
                $out .= $date[0];
                break;
            case 'i':
                $out .= $date[1];
                break;
            case 'j':
                $out .= $j_d;
                break;
            case 'J':
                $out .= jdate_words(array('rr' => $j_d), ' ');
                break;
            case 'k':
                $out .= tr_num(100 - (int) ($doy / ($kab + 365) * 1000) / 10, $tr_num);
                break;
            case 'K':
                $out .= tr_num((int) ($doy / ($kab + 365) * 1000) / 10, $tr_num);
                break;
            case 'l':
                $out .= jdate_words(array('rh' => $date[7]), ' ');
                break;
            case 'L':
                $out .= $kab;
                break;
            case 'm':
                $out .= $j_m > 9 ? $j_m : '0' . $j_m;
                break;
            case 'M':
                $out .= jdate_words(array('km' => $j_m), ' ');
                break;
            case 'n':
                $out .= $j_m;
                break;
            case 'N':
                $out .= $date[7] + 1;
                break;
            case 'o':
                $jdw = $date[7] == 6 ? 0 : $date[7] + 1;
                $dny = 364 + $kab - $doy;
                $out .= ($jdw > $doy + 3 and $doy < 3) ? $j_y - 1 : ((3 - $dny > $jdw and $dny < 3) ? $j_y + 1 : $j_y);
                break;
            case 'O':
                $out .= $date[4];
                break;
            case 'p':
                $out .= jdate_words(array('mb' => $j_m), ' ');
                break;
            case 'P':
                $out .= $date[5];
                break;
            case 'q':
                $out .= jdate_words(array('sh' => $j_y), ' ');
                break;
            case 'Q':
                $out .= $kab + 364 - $doy;
                break;
            case 'r':
                $key = jdate_words(array('rh' => $date[7], 'mm' => $j_m));
                $out .= $date[0] . ':' . $date[1] . ':' . $date[6] . ' ' . $date[4] . ' ' . $key['rh'] . '، ' . $j_d . ' ' . $key['mm'] . ' ' . $j_y;
                break;
            case 's':
                $out .= $date[6];
                break;
            case 'S':
                $out .= 'ام';
                break;
            case 't':
                $out .= $j_m != 12 ? 31 - (int) ($j_m / 6.5) : $kab + 29;
                break;
            case 'U':
                $out .= $ts;
                break;
            case 'v':
                $out .= jdate_words(array('ss' => $j_y % 100), ' ');
                break;
            case 'V':
                $out .= jdate_words(array('ss' => $j_y), ' ');
                break;
            case 'w':
                $out .= $date[7] == 6 ? 0 : $date[7] + 1;
                break;
            case 'W':
                $avs = ($date[7] == 6 ? 0 : $date[7] + 1) - $doy % 7;
                if ($avs < 0) {
                    $avs += 7;
                }
                $num = (int) (($doy + $avs) / 7);
                if ($avs < 4) {
                    $num++;
                } elseif ($num < 1) {
                    $num = ($avs == 4 or $avs == ($j_y % 33 % 4 - 2 == (int) ($j_y % 33 * 0.05) ? 5 : 4)) ? 53 : 52;
                }
                $aks = $avs + $kab;
                if ($aks == 7) {
                    $aks = 0;
                }
                $out .= ($kab + 363 - $doy < $aks and $aks < 3) ? '01' : ($num < 10 ? '0' . $num : $num);
                break;
            case 'y':
                $out .= substr($j_y, 2, 2);
                break;
            case 'Y':
                $out .= $j_y;
                break;
            case 'z':
                $out .= $doy;
                break;
            default:
                $out .= $sub;
        }
    }
    return $tr_num != 'en' ? tr_num($out, 'fa', '.') : $out;
}


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.