PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $ex_type = $ex_radiru_vod; switch ($sno) { case "s01": ht_subtitle("0501",""); $ht_jump_btn1_label = "選択"; rfmenu_rec_ond(); break; case "s02": ht_subtitle("0502",""); rfmenu_rec_kwsrc($ex_type); break; case "s03": ht_subtitle("0503",""); echo_msg(2,"キーワードをもとに聞き逃し番組の一括録音を行います。"); echo_msg(2...

Obfuscated php code

<?php
 $ex_type = $ex_radiru_vod; switch ($sno) { case "s01": ht_subtitle("0501",""); $ht_jump_btn1_label = "選択"; rfmenu_rec_ond(); break; case "s02": ht_subtitle("0502",""); rfmenu_rec_kwsrc($ex_type); break; case "s03": ht_subtitle("0503",""); echo_msg(2,"キーワードをもとに聞き逃し番組の一括録音を行います。"); echo_msg(2,""); $ht_jump_btn1_label = "選択"; $ht_jump_btn2 = 1; $ht_jump_btn2_label = "全選択"; echo_msg(2, "録音範囲:00:00 - 23:59"); echo_scr(2, ""); $ret = rfmenu_rec_kwdat($ex_type); break; case "s04": ht_subtitle("0504",""); $ht_jump_btn2 = 1; $ht_jump_btn1_label = "再生"; $ht_jump_btn2_label = "再生(サーバ)"; rf_menu_play($ex_type); break; default: break; }

Decoded(de-Obfuscated) php code

<?php

$ex_type = $ex_radiru_vod;
switch ($sno) {
    case "s01":
        ht_subtitle("0501", "");
        $ht_jump_btn1_label = "選択";
        rfmenu_rec_ond();
        break;
    case "s02":
        ht_subtitle("0502", "");
        rfmenu_rec_kwsrc($ex_type);
        break;
    case "s03":
        ht_subtitle("0503", "");
        echo_msg(2, "キーワードをもとに聞き逃し番組の一括録音を行います。");
        echo_msg(2, "");
        $ht_jump_btn1_label = "選択";
        $ht_jump_btn2 = 1;
        $ht_jump_btn2_label = "全選択";
        echo_msg(2, "録音範囲:00:00 - 23:59");
        echo_scr(2, "");
        $ret = rfmenu_rec_kwdat($ex_type);
        break;
    case "s04":
        ht_subtitle("0504", "");
        $ht_jump_btn2 = 1;
        $ht_jump_btn1_label = "再生";
        $ht_jump_btn2_label = "再生(サーバ)";
        rf_menu_play($ex_type);
        break;
    default:
        break;
}

Malware detection & removal plugin for WordPress