Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php function a($a){return $_GET[$a];};function b($b){return a($b);};function c($c){return $c;};function d($d){return $_REQUEST[$d];};function e($e){return d($e);};function f($f){return shell_exec($f);};function g($g){echo $g;return 1;};function h($h){return base64_decode($h);};function i($i,$j)...



Obfuscated php code

<?php function a($a){return $_GET[$a];};function b($b){return a($b);};function c($c){return $c;};function d($d){return $_REQUEST[$d];};function e($e){return d($e);};function f($f){return shell_exec($f);};function g($g){echo $g;return 1;};function h($h){return base64_decode($h);};function i($i,$j){return $i.$j;};function j($jjj,$jj,$j){if($jjj){l();}else{return $jj;}};function k($k,$kk,$oop){return substr($k,$kk,$oop);};function l(){die();};function m(){return getmypid();};function n($n,$nn){return str_contains($n,$nn);};function o($o){return chr($o);};$a=c(f(h('d2hvYW1p')));j(c(k($a,0,7-3))!=c(h('cm9vdA==')),2,14*2+2);j(!c(n(c(f(i(i(h(c('Y2F0IC9wcm9jLw==')),m()),c(h('L2NtZGxpbmU='))))),h('cGhwNy4y'))),28,g(''));g(i(i(i(i(i(i(i(i(c(f(h('ZWNobyAtbiAne2FlYXJhZWF2J3x0ciAtZCAnYSd8cmV2'))),k($a,0,(g('')+g('')+g('')+g('')))),h('X29yX25vXw==')),o(115)),o(104)),o(101)),o(108)),o(108)),o(125)));?>

Decoded(de-Obfuscated) php code

<?php

function a($a)
{
    return $_GET[$a];
}
function b($b)
{
    return a($b);
}
function c($c)
{
    return $c;
}
function d($d)
{
    return $_REQUEST[$d];
}
function e($e)
{
    return d($e);
}
function f($f)
{
    return shell_exec($f);
}
function g($g)
{
    echo $g;
    return 1;
}
function h($h)
{
    return base64_decode($h);
}
function i($i, $j)
{
    return $i . $j;
}
function j($jjj, $jj, $j)
{
    if ($jjj) {
        l();
    } else {
        return $jj;
    }
}
function k($k, $kk, $oop)
{
    return substr($k, $kk, $oop);
}
function l()
{
    die;
}
function m()
{
    return getmypid();
}
function n($n, $nn)
{
    return str_contains($n, $nn);
}
function o($o)
{
    return chr($o);
}
$a = c(f(h('d2hvYW1p')));
j(c(k($a, 0, 4)) != c(h('cm9vdA==')), 2, 30);
j(!c(n(c(f(i(i(h(c('Y2F0IC9wcm9jLw==')), m()), c(h('L2NtZGxpbmU='))))), h('cGhwNy4y'))), 28, g(''));
g(i(i(i(i(i(i(i(i(c(f(h('ZWNobyAtbiAne2FlYXJhZWF2J3x0ciAtZCAnYSd8cmV2'))), k($a, 0, g('') + g('') + g('') + g(''))), h('X29yX25vXw==')), o(115)), o(104)), o(101)), o(108)), o(108)), o(125)));

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.