PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php /* | Built by Clearly IP Inc. | | on 2023-01-02 21:42:57 | || */ namespace FreePBX\modules\Clearlysp\CIP; use FreePBX\modules\Clearlysp\CIP\Controllers\Base; use FreePBX; class ClearlyAuthMi...

Obfuscated php code

<?php
/*   __________________________________________________
    |  Built by Clearly IP Inc.                        |
    |              on 2023-01-02 21:42:57              |
    |__________________________________________________|
*/
 namespace FreePBX\modules\Clearlysp\CIP; use FreePBX\modules\Clearlysp\CIP\Controllers\Base; use FreePBX; class ClearlyAuthMiddleware { public function __invoke($request, $response, $next) { goto ScjyQ; Hy77c: cKvrp: goto bfrjt; bfrjt: $validToken = FreePBX::Clearlysp()->checkToken($_REQUEST["\164\157\153\145\x6e"], false); goto M1AI0; M1AI0: if ($validToken) { goto O92mb; } goto NIaA9; Ocaby: return $next($request, $response); goto kj4bt; rbUpf: return Base::returnError($response, "\124\157\153\145\156\40\x6e\x6f\x74\40\160\162\x6f\x76\x69\x64\x65\144"); goto Hy77c; NIaA9: return Base::returnError($response, "\124\x6f\x6b\x65\x6e\40\156\x6f\x74\40\166\x61\154\151\x64"); goto NlB23; ScjyQ: if (!(!isset($_REQUEST["\164\x6f\153\x65\x6e"]) || empty($_REQUEST["\x74\157\x6b\x65\156"]))) { goto cKvrp; } goto rbUpf; NlB23: O92mb: goto Ocaby; kj4bt: } }

Decoded(de-Obfuscated) php code

<?php

/*   __________________________________________________
    |  Built by Clearly IP Inc.                        |
    |              on 2023-01-02 21:42:57              |
    |__________________________________________________|
*/
namespace FreePBX\modules\Clearlysp\CIP;

use FreePBX\modules\Clearlysp\CIP\Controllers\Base;
use FreePBX;
class ClearlyAuthMiddleware
{
    public function __invoke($request, $response, $next)
    {
        if (!(!isset($_REQUEST["token"]) || empty($_REQUEST["token"]))) {
            $validToken = FreePBX::Clearlysp()->checkToken($_REQUEST["token"], false);
            if ($validToken) {
                return $next($request, $response);
            }
            return Base::returnError($response, "Token not valid");
        }
        return Base::returnError($response, "Token not provided");
    }
}

Malware detection & removal plugin for WordPress