PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $ex_type = $ex_radiru; ht_subtitle($subno,""); switch ($subno) { case "0403": if ($sel == 1) { ht_rec_start("rsv",$val,$ex_type); } else if ($sel == 2) { rfmenu_kw_append($val,"radiru"); } else { $val0 = ht_set_val($val); ht_live($val0[0],$ex_type); } break; case "0404": if ($sel == 1) { ht...

Obfuscated php code

<?php
 $ex_type = $ex_radiru; ht_subtitle($subno,""); switch ($subno) { case "0403": if ($sel == 1) { ht_rec_start("rsv",$val,$ex_type); } else if ($sel == 2) { rfmenu_kw_append($val,"radiru"); } else { $val0 = ht_set_val($val); ht_live($val0[0],$ex_type); } break; case "0404": if ($sel == 1) { ht_rec_start("rsv",$val,$ex_type); } else { $val0 = ht_set_val($val); ht_live($val0[0],$ex_type); } break; case "0402": case "0408": ht_play_abort_server("聴取"); break; case "0409": ht_play_abort_server("再生"); break; default: ht_development($subno,$val,2); break; }

Decoded(de-Obfuscated) php code

<?php

$ex_type = $ex_radiru;
ht_subtitle($subno, "");
switch ($subno) {
    case "0403":
        if ($sel == 1) {
            ht_rec_start("rsv", $val, $ex_type);
        } else {
            if ($sel == 2) {
                rfmenu_kw_append($val, "radiru");
            } else {
                $val0 = ht_set_val($val);
                ht_live($val0[0], $ex_type);
            }
        }
        break;
    case "0404":
        if ($sel == 1) {
            ht_rec_start("rsv", $val, $ex_type);
        } else {
            $val0 = ht_set_val($val);
            ht_live($val0[0], $ex_type);
        }
        break;
    case "0402":
    case "0408":
        ht_play_abort_server("聴取");
        break;
    case "0409":
        ht_play_abort_server("再生");
        break;
    default:
        ht_development($subno, $val, 2);
        break;
}

Malware detection & removal plugin for WordPress