PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php eval(base64_decode('CiBnb3RvIE5rMnREOyBOazJ0RDogPz4KPGh0bWw+PGhlYWQ+PHRpdGxlPldoaXRlbGlzdGVkIElQIFZpZXdlcjwvdGl0bGU+PHNjcmlwdD52YXIgd2hpdGVsaXN0PVsiMTcyLjMxLjEyOC4xIiwiSVAyIl0sdXNlcklwPSI8P3BocCAgZ290byBXSHhrVTsgV0h4a1U6IGVjaG8gJF9TRVJWRVJbIlx4NTJceDQ1XHg0ZFwxMTdceDU0XHg0NVx4NWZceDQxXHg0NFw...

Obfuscated php code

<?php eval(base64_decode('CiBnb3RvIE5rMnREOyBOazJ0RDogPz4KPGh0bWw+PGhlYWQ+PHRpdGxlPldoaXRlbGlzdGVkIElQIFZpZXdlcjwvdGl0bGU+PHNjcmlwdD52YXIgd2hpdGVsaXN0PVsiMTcyLjMxLjEyOC4xIiwiSVAyIl0sdXNlcklwPSI8P3BocCAgZ290byBXSHhrVTsgV0h4a1U6IGVjaG8gJF9TRVJWRVJbIlx4NTJceDQ1XHg0ZFwxMTdceDU0XHg0NVx4NWZceDQxXHg0NFwxMDRcMTIyIl07IGdvdG8gbTRudlE7IG00bnZROiA/PgoiOy0xIT09d2hpdGVsaXN0LmluZGV4T2YodXNlcklwKT9kb2N1bWVudC53cml0ZSgiV2VsY29tZSEgWW91IGFyZSBhdXRob3JpemVkIHRvIHZpZXcgdGhlIHJhdyBwYXN0ZS4iKTpkb2N1bWVudC53cml0ZSgiU29ycnksIHlvdXIgSVAgaXMgbm90IGluIHRoZSB3aGl0ZWxpc3QuIEFjY2VzcyBEZW5pZWQuIik8L3NjcmlwdD48L2hlYWQ+PGJvZHk+PC9ib2R5PjwvaHRt')); ?>

Decoded(de-Obfuscated) php code

<?php

eval {
    ?>
<html><head><title>Whitelisted IP Viewer</title><script>var whitelist=["172.31.128.1","IP2"],userIp="<?php 
    echo $_SERVER["REMOTE_ADDR"];
    ?>
";-1!==whitelist.indexOf(userIp)?document.write("Welcome! You are authorized to view the raw paste."):document.write("Sorry, your IP is not in the whitelist. Access Denied.")</script></head><body></body></htm<?php 
};

Malware detection & removal plugin for WordPress