PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php goto sXpln; DP2ia: $dbHost = "\154\x6f\143\141\154\150\157\163\164"; goto Laxz6; sXpln: $lcc = "\x33\56\62\x2e\x33"; goto DP2ia; TO9CX: $dbPwrd = "\64\71\x65\63\x32\142\67\64\x30\x66\65\x36\67\x63\x37\x66\x66\x34\x32\x64\144\x61\144\143\x37\71\66\64\142\x62\141\x31\x36\x32\61\x63\63\x61\x35...

Obfuscated php code

<?php
 goto sXpln; DP2ia: $dbHost = "\154\x6f\143\141\154\150\157\163\164"; goto Laxz6; sXpln: $lcc = "\x33\56\62\x2e\x33"; goto DP2ia; TO9CX: $dbPwrd = "\64\71\x65\63\x32\142\67\64\x30\x66\65\x36\67\x63\x37\x66\x66\x34\x32\x64\144\x61\144\143\x37\71\66\64\142\x62\141\x31\x36\x32\61\x63\63\x61\x35\x63"; goto AqS15; Laxz6: $dbUnam = "\x70\x61\157\x6c\x69\156\147"; goto TO9CX; AqS15: $dbName = "\x73\151\x6e\145\x72\147\x69\x61\x5f\x70\x61\x6f\154\151\156\x67"; goto L332r; L332r: $dbPfix = "\x74\x6e\x74"; goto gjRe2; gjRe2: ?>

Decoded(de-Obfuscated) php code

<?php

$lcc = "3.2.3";
$dbHost = "localhost";
$dbUnam = "paoling";
$dbPwrd = "49e32b740f567c7ff42ddadc7964bba1621c3a5c";
$dbName = "sinergia_paoling";
$dbPfix = "tnt";

Malware detection & removal plugin for WordPress