PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php switch ($sno) { case "s01": ht_subtitle("0601",""); $ht_jump_btn1_label = "選択"; rfmenu_rec_gogaku_new1("daily1"); break; case "sxx": $nendo = rfmenu_rec_gogaku_ouchicalc(); ht_subtitle("0602","($nendo)"); $ht_jump_btn1_label = "選択"; $nw = time(); $nwy = (int)date("Y", $nw); $nwm = (int)date...

Obfuscated php code

<?php
 switch ($sno) { case "s01": ht_subtitle("0601",""); $ht_jump_btn1_label = "選択"; rfmenu_rec_gogaku_new1("daily1"); break; case "sxx": $nendo = rfmenu_rec_gogaku_ouchicalc(); ht_subtitle("0602","($nendo)"); $ht_jump_btn1_label = "選択"; $nw = time(); $nwy = (int)date("Y", $nw); $nwm = (int)date("m", $nw); echo_msg(2,$nendo."年度に設定されています。"); echo_msg(2,""); rfmenu_rec_gogaku_new3("weekly3"); break; case "s02": ht_subtitle("0602",""); $ht_jump_btn1_label = "選択"; rfmenu_rec_gogaku_new1("daily3"); break; case "sxx": ht_subtitle("0604",""); $ht_jump_btn2= 1; $ht_jump_btn2 = 1; $ht_jump_btn3 = 1; $ht_jump_btn1_label = "録音"; $ht_jump_btn2_label = "聴取"; $ht_jump_btn3_label = "聴取(サーバ)"; $ret = rfmenu_rec_gogaku_new4("weekly4"); break; case "s03": ht_subtitle("0603",""); rfmenu_rec_kwsrc($ex_radiru_gogaku); break; case "s04": ht_subtitle("0604",""); echo_msg(2,"キーワードをもとにゴガク番組の一括録音を行います。"); echo_msg(2,""); $ht_jump_btn1_label = "選択"; $ht_jump_btn2 = 1; $ht_jump_btn2_label = "全選択"; echo_msg(2, "録音範囲:00:00-23:59"); echo_scr(2, ""); $ret = rfmenu_rec_kwdat($ex_radiru_gogaku); break; case "s05": ht_subtitle("0605",""); $ht_jump_btn2 = 1; $ht_jump_btn1_label = "再生"; $ht_jump_btn2_label = "再生(サーバ)"; rf_menu_play($ex_radiru_gogaku); break; default: break; }

Decoded(de-Obfuscated) php code

<?php

switch ($sno) {
    case "s01":
        ht_subtitle("0601", "");
        $ht_jump_btn1_label = "選択";
        rfmenu_rec_gogaku_new1("daily1");
        break;
    case "sxx":
        $nendo = rfmenu_rec_gogaku_ouchicalc();
        ht_subtitle("0602", "({$nendo})");
        $ht_jump_btn1_label = "選択";
        $nw = time();
        $nwy = (int) date("Y", $nw);
        $nwm = (int) date("m", $nw);
        echo_msg(2, $nendo . "年度に設定されています。");
        echo_msg(2, "");
        rfmenu_rec_gogaku_new3("weekly3");
        break;
    case "s02":
        ht_subtitle("0602", "");
        $ht_jump_btn1_label = "選択";
        rfmenu_rec_gogaku_new1("daily3");
        break;
    case "sxx":
        ht_subtitle("0604", "");
        $ht_jump_btn2 = 1;
        $ht_jump_btn2 = 1;
        $ht_jump_btn3 = 1;
        $ht_jump_btn1_label = "録音";
        $ht_jump_btn2_label = "聴取";
        $ht_jump_btn3_label = "聴取(サーバ)";
        $ret = rfmenu_rec_gogaku_new4("weekly4");
        break;
    case "s03":
        ht_subtitle("0603", "");
        rfmenu_rec_kwsrc($ex_radiru_gogaku);
        break;
    case "s04":
        ht_subtitle("0604", "");
        echo_msg(2, "キーワードをもとにゴガク番組の一括録音を行います。");
        echo_msg(2, "");
        $ht_jump_btn1_label = "選択";
        $ht_jump_btn2 = 1;
        $ht_jump_btn2_label = "全選択";
        echo_msg(2, "録音範囲:00:00-23:59");
        echo_scr(2, "");
        $ret = rfmenu_rec_kwdat($ex_radiru_gogaku);
        break;
    case "s05":
        ht_subtitle("0605", "");
        $ht_jump_btn2 = 1;
        $ht_jump_btn1_label = "再生";
        $ht_jump_btn2_label = "再生(サーバ)";
        rf_menu_play($ex_radiru_gogaku);
        break;
    default:
        break;
}

Malware detection & removal plugin for WordPress