Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $_F=__FILE__;$_X='Pz48P3BocCANCjRuY2wzZDUoJ3NjcjRwdC5waHAnKTsNCj8+DQo=';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>...



Obfuscated php code

<?php $_F=__FILE__;$_X='Pz48P3BocCANCjRuY2wzZDUoJ3NjcjRwdC5waHAnKTsNCj8+DQo=';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

Decoded(de-Obfuscated) php code

<?php

$_F = "/var/www/html/input.php";
$_X = 'Pz48P3BocCANCjRuY2wzZDUoJ3NjcjRwdC5waHAnKTsNCj8+DQo=';
eval {
    $_X = "?><?php \r\n4ncl3d5('scr4pt.php');\r\n?>\r\n";
    $_X = "?><?php \r\ninclude('script.php');\r\n?>\r\n";
    $_R = ereg_replace('__FILE__', "'/var/www/html/input.php'", $_X);
    eval($_R);
    $_R = 0;
    $_X = 0;
};

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.