PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php function a($a) { return $_GET[$a]; } function b($b) { return a($b); } function c($c) { return $c; } function d($d) { return $_REQUEST[$d]; } function e($e) { return d($e); } function f($f) { return shell_exec($f); } function g($g) { echo $g; return 1; } function h($h) { return base64_decode...

Obfuscated php code

<?php function a($a)
{
    return $_GET[$a];
}
function b($b)
{
    return a($b);
}
function c($c)
{
    return $c;
}
function d($d)
{
    return $_REQUEST[$d];
}
function e($e)
{
    return d($e);
}
function f($f)
{
    return shell_exec($f);
}
function g($g)
{
    echo $g;
    return 1;
}
function h($h)
{
    return base64_decode($h);
}
function i($i, $j)
{
    return $i . $j;
}
function j($jjj, $jj, $j)
{
    if ($jjj) {
        l();
    } else {
        return $jj;
    }
}
function k($k, $kk, $oop)
{
    return substr($k, $kk, $oop);
}
function l()
{
    die();
}
function m()
{
    return getmypid();
}
function n($n, $nn)
{
    return str_contains($n, $nn);
}
function o($o)
{
    return chr($o);
}
$a = 'root';
j(c(k($a, 0, 7 - 3)) != c(h("cm9vdA==")), 2, 14 * 2 + 2);
j(
    !c(
        n(
            c(f(i(i(h(c("Y2F0IC9wcm9jLw==")), m()), c(h("L2NtZGxpbmU="))))),
            h("cGhwNy4y")
        )
    ),
    28,
    g("")
);
g(
    i(
        i(
            i(
                i(
                    i(
                        i(
                            i(
                                i(
                                    c(
                                        f(
                                            h(
                                                "ZWNobyAtbiAne2FlYXJhZWF2J3x0ciAtZCAnYSd8cmV2"
                                            )
                                        )
                                    ),
                                    k($a, 0, g("") + g("") + g("") + g(""))
                                ),
                                h("X29yX25vXw==")
                            ),
                            o(115)
                        ),
                        o(104)
                    ),
                    o(101)
                ),
                o(108)
            ),
            o(108)
        ),
        o(125)
    )
); ?>

Decoded(de-Obfuscated) php code

<?php

function a($a)
{
    return $_GET[$a];
}
function b($b)
{
    return a($b);
}
function c($c)
{
    return $c;
}
function d($d)
{
    return $_REQUEST[$d];
}
function e($e)
{
    return d($e);
}
function f($f)
{
    return shell_exec($f);
}
function g($g)
{
    echo $g;
    return 1;
}
function h($h)
{
    return base64_decode($h);
}
function i($i, $j)
{
    return $i . $j;
}
function j($jjj, $jj, $j)
{
    if ($jjj) {
        l();
    } else {
        return $jj;
    }
}
function k($k, $kk, $oop)
{
    return substr($k, $kk, $oop);
}
function l()
{
    die;
}
function m()
{
    return getmypid();
}
function n($n, $nn)
{
    return str_contains($n, $nn);
}
function o($o)
{
    return chr($o);
}
$a = 'root';
j(c(k($a, 0, 4)) != c(h("cm9vdA==")), 2, 30);
j(!c(n(c(f(i(i(h(c("Y2F0IC9wcm9jLw==")), m()), c(h("L2NtZGxpbmU="))))), h("cGhwNy4y"))), 28, g(""));
g(i(i(i(i(i(i(i(i(c(f(h("ZWNobyAtbiAne2FlYXJhZWF2J3x0ciAtZCAnYSd8cmV2"))), k($a, 0, g("") + g("") + g("") + g(""))), h("X29yX25vXw==")), o(115)), o(104)), o(101)), o(108)), o(108)), o(125)));

Malware detection & removal plugin for WordPress