PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $ex_type = $ex_radiru_vod; ht_subtitle($subno,""); switch ($subno) { case "0501": $ht_jump_btn2 = 1; $ht_jump_btn3 = 1; $ht_jump_btn1_label = "録音"; $ht_jump_btn2_label = "聴取"; $ht_jump_btn3_label = "聴取(サーバ)"; $nm = explode(",",$val); $nm2 = ond_corner_no2key($nm); $ond2 = ond_detail_new($nm...

Obfuscated php code

<?php
 $ex_type = $ex_radiru_vod; ht_subtitle($subno,""); switch ($subno) { case "0501": $ht_jump_btn2 = 1; $ht_jump_btn3 = 1; $ht_jump_btn1_label = "録音"; $ht_jump_btn2_label = "聴取"; $ht_jump_btn3_label = "聴取(サーバ)"; $nm = explode(",",$val); $nm2 = ond_corner_no2key($nm); $ond2 = ond_detail_new($nm2); ond_select_detail_new($nm2,$ond2); break; case "0502": $val0 = ht_set_val($val); $wdat = $val0[0]; if ($sel == 1) { ht_rec_start("rec",$val,$ex_type); } else if ($sel == 2) { ht_live_radiru_vod($wdat,$ex_type); } else if ($sel == 3) { ht_live_server($wdat,$ex_type); } break; case "0504": ht_play_abort_server("再生"); break; default: ht_development($subno,$val,2); break; }

Decoded(de-Obfuscated) php code

<?php

$ex_type = $ex_radiru_vod;
ht_subtitle($subno, "");
switch ($subno) {
    case "0501":
        $ht_jump_btn2 = 1;
        $ht_jump_btn3 = 1;
        $ht_jump_btn1_label = "録音";
        $ht_jump_btn2_label = "聴取";
        $ht_jump_btn3_label = "聴取(サーバ)";
        $nm = explode(",", $val);
        $nm2 = ond_corner_no2key($nm);
        $ond2 = ond_detail_new($nm2);
        ond_select_detail_new($nm2, $ond2);
        break;
    case "0502":
        $val0 = ht_set_val($val);
        $wdat = $val0[0];
        if ($sel == 1) {
            ht_rec_start("rec", $val, $ex_type);
        } else {
            if ($sel == 2) {
                ht_live_radiru_vod($wdat, $ex_type);
            } else {
                if ($sel == 3) {
                    ht_live_server($wdat, $ex_type);
                }
            }
        }
        break;
    case "0504":
        ht_play_abort_server("再生");
        break;
    default:
        ht_development($subno, $val, 2);
        break;
}

Malware detection & removal plugin for WordPress