PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php switch ($sno) { case "01": $para = get_para($val, $ex_radiko); $ch = substr($para[6],0,2); if ($ch == 'r1' || $ch == 'r2' || $ch == 'r3') { $ex_type = $ex_radiru; ht_subtitle("0408",""); } else { $ex_type = $ex_radiko; ht_subtitle("0208",""); } if ($sel == 1) { ht_live($val,$ex_type); } els...

Obfuscated php code

<?php
 switch ($sno) { case "01": $para = get_para($val, $ex_radiko); $ch = substr($para[6],0,2); if ($ch == 'r1' || $ch == 'r2' || $ch == 'r3') { $ex_type = $ex_radiru; ht_subtitle("0408",""); } else { $ex_type = $ex_radiko; ht_subtitle("0208",""); } if ($sel == 1) { ht_live($val,$ex_type); } else if ($sel == 2) { ht_live_server($val,$ex_type); } break; default; break; }

Decoded(de-Obfuscated) php code

<?php

switch ($sno) {
    case "01":
        $para = get_para($val, $ex_radiko);
        $ch = substr($para[6], 0, 2);
        if ($ch == 'r1' || $ch == 'r2' || $ch == 'r3') {
            $ex_type = $ex_radiru;
            ht_subtitle("0408", "");
        } else {
            $ex_type = $ex_radiko;
            ht_subtitle("0208", "");
        }
        if ($sel == 1) {
            ht_live($val, $ex_type);
        } else {
            if ($sel == 2) {
                ht_live_server($val, $ex_type);
            }
        }
        break;
    default:
        break;
}

Malware detection & removal plugin for WordPress