Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php eval(base64_decode('CoKz44Oh44Oz44OIICRzdHIgPSAn77yh77yi77yj77yk77ylJzsgJGludCA9IDEyMzQ7IC8qKiAqIOOCs+ODoeODs+ODiCAqLyBjbGFzcyBIb2dlIHsgcHVibGljIHN0YXRpYyBmdW5jdGlvbiBmdWdlKCRzdHIsICRpbnQpIHsgaWYgKCFtYl9zdHJsZW4oJHN0cikpIHsgZGllKCckc3Ry44GM56m644Gg44KIJyk7IH0gcmV0dXJuIG1iX3N0cnRvbG93ZXIoJHN...



Obfuscated php code

<?php eval(base64_decode('CoKz44Oh44Oz44OIICRzdHIgPSAn77yh77yi77yj77yk77ylJzsgJGludCA9IDEyMzQ7IC8qKiAqIOOCs+ODoeODs+ODiCAqLyBjbGFzcyBIb2dlIHsgcHVibGljIHN0YXRpYyBmdW5jdGlvbiBmdWdlKCRzdHIsICRpbnQpIHsgaWYgKCFtYl9zdHJsZW4oJHN0cikpIHsgZGllKCckc3Ry44GM56m644Gg44KIJyk7IH0gcmV0dXJuIG1iX3N0cnRvbG93ZXIoJHN0ciwgJ1VURi04JykgLiBzdHJ2YWwoJGludCAqIDk4Nyk7IH0gfSB2YXJfZHVtcChIb2dlOjpmdWdlKCRzdHIsICRpbnQpKTsgLy8g772B772C772D772E772FMTIxNzk=')); ?>

Decoded(de-Obfuscated) php code

<?php

eval("\nメント \$str = 'ABCDE'; \$int = 1234; /** * コメント */ class Hoge { public static function fuge(\$str, \$int) { if (!mb_strlen(\$str)) { die('\$strが空だよ'); } return mb_strtolower(\$str, 'UTF-8') . strval(\$int * 987); } } var_dump(Hoge::fuge(\$str, \$int)); // abcde12179");


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.