PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php function getFileList($dir) { global $DS; $files = glob(rtrim($dir, $DS) . $DS.'*'); $list = array(); foreach ($files as $file) { if (is_file($file)) { $list[] = $file; } if (is_dir($file)) { $list = array_merge($list, getFileList($file)); } } return $list; } ht_subtitle($subno,""); switch (...

Obfuscated php code

<?php
 function getFileList($dir) { global $DS; $files = glob(rtrim($dir, $DS) . $DS.'*'); $list = array(); foreach ($files as $file) { if (is_file($file)) { $list[] = $file; } if (is_dir($file)) { $list = array_merge($list, getFileList($file)); } } return $list; } ht_subtitle($subno,""); switch ($subno) { case "9909": break; default: ht_development($subno,$val,2); break; }

Decoded(de-Obfuscated) php code

<?php

function getFileList($dir)
{
    global $DS;
    $files = glob(rtrim($dir, $DS) . $DS . '*');
    $list = array();
    foreach ($files as $file) {
        if (is_file($file)) {
            $list[] = $file;
        }
        if (is_dir($file)) {
            $list = array_merge($list, getFileList($file));
        }
    }
    return $list;
}
ht_subtitle($subno, "");
switch ($subno) {
    case "9909":
        break;
    default:
        ht_development($subno, $val, 2);
        break;
}

Malware detection & removal plugin for WordPress