PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $ex_type = ""; ht_subtitle($subno,""); switch ($subno) { case "0801": case "0802": case "080301": case "080302": case "080303": case "080401": case "080402": case "080403": case "080404": case "0805": case "0806": ht_writefl($val); break; case "080701": rfmenu_kw_manage_ex_s(1,$val); break;...

Obfuscated php code

<?php
 $ex_type = ""; ht_subtitle($subno,""); switch ($subno) { case "0801": case "0802": case "080301": case "080302": case "080303": case "080401": case "080402": case "080403": case "080404": case "0805": case "0806": ht_writefl($val); break; case "080701": rfmenu_kw_manage_ex_s(1,$val); break; case "080702":; $files = ht_val_check($val); rfmenu_kw_manage_ex_s(2,$files[0]); echo_msg(2, ""); echo_msg(2, "キーワードの復元を行いました。"); break; case "080703": $files = ht_val_check($val); rf_menu_kw_multi($files); break; case "080704": foreach($keyword as $kn => $kw) { $n = count_73($kw); ht_print_r($kw,"----- [".$kn."(".$n.")]"); } break; default: ht_development($subno,$val,2); break; }

Decoded(de-Obfuscated) php code

<?php

$ex_type = "";
ht_subtitle($subno, "");
switch ($subno) {
    case "0801":
    case "0802":
    case "080301":
    case "080302":
    case "080303":
    case "080401":
    case "080402":
    case "080403":
    case "080404":
    case "0805":
    case "0806":
        ht_writefl($val);
        break;
    case "080701":
        rfmenu_kw_manage_ex_s(1, $val);
        break;
    case "080702":
        $files = ht_val_check($val);
        rfmenu_kw_manage_ex_s(2, $files[0]);
        echo_msg(2, "");
        echo_msg(2, "キーワードの復元を行いました。");
        break;
    case "080703":
        $files = ht_val_check($val);
        rf_menu_kw_multi($files);
        break;
    case "080704":
        foreach ($keyword as $kn => $kw) {
            $n = count_73($kw);
            ht_print_r($kw, "----- [" . $kn . "(" . $n . ")]");
        }
        break;
    default:
        ht_development($subno, $val, 2);
        break;
}

Malware detection & removal plugin for WordPress