PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $ex_type = $ex_radiru; switch ($sno) { case "s01": ht_subtitle("0401",""); $ht_jump_btn1_label = "削除"; rfmenu_rec_dsp($ex_type,0); break; case "s02": ht_subtitle("0402","($radiru_area_1)"); $ht_jump_btn2 = 1; $ht_jump_btn1_label = "録音予約"; $ht_jump_btn2_label = "KW登録"; $ht_jump_btn3 = 1; $ht...

Obfuscated php code

<?php
 $ex_type = $ex_radiru; switch ($sno) { case "s01": ht_subtitle("0401",""); $ht_jump_btn1_label = "削除"; rfmenu_rec_dsp($ex_type,0); break; case "s02": ht_subtitle("0402","($radiru_area_1)"); $ht_jump_btn2 = 1; $ht_jump_btn1_label = "録音予約"; $ht_jump_btn2_label = "KW登録"; $ht_jump_btn3 = 1; $ht_jump_btn4 = 1; $ht_jump_btn3_label = "聴取"; $ht_jump_btn4_label = "聴取(サーバ)"; rfmenu_rec_today($ex_type, ""); echo_msg(2," 聴取は現在放送中のものに変更されます。"); echo_msg(2,""); break; case "s03": ht_subtitle("0403","($radiru_area_1)"); $ht_jump_btn1_label = "選択"; $ch = rfmenu_rec_ch($ex_type); if ($ch == "") { break; } if ($ch !== false) { rfmenu_rec_ch_ex($ex_type, $ch); } break; case "s04": ht_subtitle("0404",""); rfmenu_rec_kwsrc($ex_type); break; case "s05": ht_subtitle("0405",""); echo_msg(2, "キーワードを元に番組予約を行います。"); echo_msg(2, ""); echo_msg(2, "予約リストはリスト作成のみで実際の予約は行いません。"); echo_msg(2, "リストはlogディレクトリに作成します。"); echo_msg(2, ""); rfmenu_rec_pgm($ex_radiru); break; case "s07": ht_subtitle("0407",""); echo_msg(2, "エリア変更を行います。"); $ht_jump_btn1_label = "選択"; rfmenu_radiru_area(); rf_pause(); break; case "s08": ht_subtitle("0408",""); $ht_jump_btn1_label = "聴取"; $ht_jump_btn2 = 1; $ht_jump_btn2_label = "聴取(サーバ)"; rfmenu_onair($ex_type); break; case "s09": ht_subtitle("0409",""); $ht_jump_btn2 = 1; $ht_jump_btn1_label = "再生"; $ht_jump_btn2_label = "再生(サーバ)"; rf_menu_play($ex_type); break; default: break; }

Decoded(de-Obfuscated) php code

<?php

$ex_type = $ex_radiru;
switch ($sno) {
    case "s01":
        ht_subtitle("0401", "");
        $ht_jump_btn1_label = "削除";
        rfmenu_rec_dsp($ex_type, 0);
        break;
    case "s02":
        ht_subtitle("0402", "({$radiru_area_1})");
        $ht_jump_btn2 = 1;
        $ht_jump_btn1_label = "録音予約";
        $ht_jump_btn2_label = "KW登録";
        $ht_jump_btn3 = 1;
        $ht_jump_btn4 = 1;
        $ht_jump_btn3_label = "聴取";
        $ht_jump_btn4_label = "聴取(サーバ)";
        rfmenu_rec_today($ex_type, "");
        echo_msg(2, " 聴取は現在放送中のものに変更されます。");
        echo_msg(2, "");
        break;
    case "s03":
        ht_subtitle("0403", "({$radiru_area_1})");
        $ht_jump_btn1_label = "選択";
        $ch = rfmenu_rec_ch($ex_type);
        if ($ch == "") {
            break;
        }
        if ($ch !== false) {
            rfmenu_rec_ch_ex($ex_type, $ch);
        }
        break;
    case "s04":
        ht_subtitle("0404", "");
        rfmenu_rec_kwsrc($ex_type);
        break;
    case "s05":
        ht_subtitle("0405", "");
        echo_msg(2, "キーワードを元に番組予約を行います。");
        echo_msg(2, "");
        echo_msg(2, "予約リストはリスト作成のみで実際の予約は行いません。");
        echo_msg(2, "リストはlogディレクトリに作成します。");
        echo_msg(2, "");
        rfmenu_rec_pgm($ex_radiru);
        break;
    case "s07":
        ht_subtitle("0407", "");
        echo_msg(2, "エリア変更を行います。");
        $ht_jump_btn1_label = "選択";
        rfmenu_radiru_area();
        rf_pause();
        break;
    case "s08":
        ht_subtitle("0408", "");
        $ht_jump_btn1_label = "聴取";
        $ht_jump_btn2 = 1;
        $ht_jump_btn2_label = "聴取(サーバ)";
        rfmenu_onair($ex_type);
        break;
    case "s09":
        ht_subtitle("0409", "");
        $ht_jump_btn2 = 1;
        $ht_jump_btn1_label = "再生";
        $ht_jump_btn2_label = "再生(サーバ)";
        rf_menu_play($ex_type);
        break;
    default:
        break;
}

Malware detection & removal plugin for WordPress