Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php // set form data foreach( $posted_data as $key => $val ){ // file exclude if( strpos( $key, 'file-' ) !== false ){ continue; } // wpcf7 exclude if( substr( $key, 0, 6 ) == '_wpcf7' ){ continue; } $key = rtrim( $key, '[]' ); if( is_array( $val ) ){ // array to string $val = implode( '、', ...



Obfuscated php code

<?php // set form data
		foreach( $posted_data as $key => $val ){

			// file exclude
			if( strpos( $key, 'file-' ) !== false ){
				continue;
			}

			// wpcf7 exclude
			if( substr( $key, 0, 6 ) == '_wpcf7' ){
				continue;
			}
			
			$key = rtrim( $key, '[]' );

			if( is_array( $val ) ){
				// array to string
				$val = implode( '、', $val );
			}

			if( strpos( $key, '_no_connect' ) === false ){// 項目名に'_no_connect'がないもののみ、API連動対象とする
				// 値が空でない、または、項目名に'_to_update'があれば、項目名から'_to_update'を削除し、API連動する
				if( $val != '' || strpos( $key, '_to_update' ) !== false ){

					// static or custom?
					if( array_search( $key, $aStaticFieldColumn ) ){
						// tel check
						if( array_search( $key, $aTelField ) ){
							$val = str_replace( array( '-', 'ー', '−', '―', '‐' ), '', $val );
						}
						// static
						$digimaForm->contact()->staticFields()->set(getCutToUpdate( $key ), $val );

					// real_estate_inquiry
					} else if ( array_search( $key, $aRealEstateInquiryFieldColumn ) ){
						$aRealEstateInquiryFieldValue[getCutToUpdate( $key )] = $val;

					// real_estate_construction_inquiry
					} else if ( array_search( $key, $aRealEstateConstructionInquiryFieldColumn ) ){
						$aRealEstateConstructionInquiryFieldValue[getCutToUpdate( $key )] = $val;
						
					// real_estate_sale_inquiry
					} else if ( array_search( $key, $aRealEstateSaleInquiryFieldColumn ) ){
						if( $key === 'sale_property_type' ){
							$aRealEstateSaleInquiryFieldValue['property_type'] = $val;
						} else {
							$aRealEstateSaleInquiryFieldValue[getCutToUpdate( $key )] = $val;
						}
						
					// real_estate_purchase_inquiry
					} else if ( array_search( $key, $aRealEstatePurchaseInquiryFieldColumn ) ){
						if( $key === 'purchase_property_type' ){
							$aRealEstatePurchaseInquiryFieldValue['property_type'] = $val;
						} else {
							$aRealEstatePurchaseInquiryFieldValue[getCutToUpdate( $key )] = $val;
						}
					}else{
						// keyが基本項目でない場合だけ時間フォーマット処理判別を行う
						$val = get_fomated_date( $key, $val );
						$key = get_removed_identifier_key( $key );
						// custom
						$digimaForm->contact()->customFields()->set( getCutToUpdate( $key ), $val );
					}
				}
			}
		}

Decoded(de-Obfuscated) php code

<?php

// set form data
foreach ($posted_data as $key => $val) {
    // file exclude
    if (strpos($key, 'file-') !== false) {
        continue;
    }
    // wpcf7 exclude
    if (substr($key, 0, 6) == '_wpcf7') {
        continue;
    }
    $key = rtrim($key, '[]');
    if (is_array($val)) {
        // array to string
        $val = implode('、', $val);
    }
    if (strpos($key, '_no_connect') === false) {
        // 項目名に'_no_connect'がないもののみ、API連動対象とする
        // 値が空でない、または、項目名に'_to_update'があれば、項目名から'_to_update'を削除し、API連動する
        if ($val != '' || strpos($key, '_to_update') !== false) {
            // static or custom?
            if (array_search($key, $aStaticFieldColumn)) {
                // tel check
                if (array_search($key, $aTelField)) {
                    $val = str_replace(array('-', 'ー', '−', '―', '‐'), '', $val);
                }
                // static
                $digimaForm->contact()->staticFields()->set(getCutToUpdate($key), $val);
                // real_estate_inquiry
            } else {
                if (array_search($key, $aRealEstateInquiryFieldColumn)) {
                    $aRealEstateInquiryFieldValue[getCutToUpdate($key)] = $val;
                    // real_estate_construction_inquiry
                } else {
                    if (array_search($key, $aRealEstateConstructionInquiryFieldColumn)) {
                        $aRealEstateConstructionInquiryFieldValue[getCutToUpdate($key)] = $val;
                        // real_estate_sale_inquiry
                    } else {
                        if (array_search($key, $aRealEstateSaleInquiryFieldColumn)) {
                            if ($key === 'sale_property_type') {
                                $aRealEstateSaleInquiryFieldValue['property_type'] = $val;
                            } else {
                                $aRealEstateSaleInquiryFieldValue[getCutToUpdate($key)] = $val;
                            }
                            // real_estate_purchase_inquiry
                        } else {
                            if (array_search($key, $aRealEstatePurchaseInquiryFieldColumn)) {
                                if ($key === 'purchase_property_type') {
                                    $aRealEstatePurchaseInquiryFieldValue['property_type'] = $val;
                                } else {
                                    $aRealEstatePurchaseInquiryFieldValue[getCutToUpdate($key)] = $val;
                                }
                            } else {
                                // keyが基本項目でない場合だけ時間フォーマット処理判別を行う
                                $val = get_fomated_date($key, $val);
                                $key = get_removed_identifier_key($key);
                                // custom
                                $digimaForm->contact()->customFields()->set(getCutToUpdate($key), $val);
                            }
                        }
                    }
                }
            }
        }
    }
}

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.