Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $z677b20357cea0=file(__FILE__);eval(base64_decode('JGI2NzdiMjAzNTdjZWEyPWZ1bmN0aW9uKCRhLCYkYil7aWYoY291bnQoJGEpPT00KSB7JHg9ZXhwbG9kZSgneDY3N2IyMDM1N2NlOWQnLHN1YnN0cigkYVszXSwyKSk7ICRiPSR4WzBdOyByZXR1cm4gYmFzZTY0X2RlY29kZSgkeFsxXSk7fWVsc2V7IGVjaG8gJ0JhZCBDb2RlISc7IGV4aXQ7fX07'));eval($b677b2...



Obfuscated php code

<?php
$z677b20357cea0=file(__FILE__);eval(base64_decode('JGI2NzdiMjAzNTdjZWEyPWZ1bmN0aW9uKCRhLCYkYil7aWYoY291bnQoJGEpPT00KSB7JHg9ZXhwbG9kZSgneDY3N2IyMDM1N2NlOWQnLHN1YnN0cigkYVszXSwyKSk7ICRiPSR4WzBdOyByZXR1cm4gYmFzZTY0X2RlY29kZSgkeFsxXSk7fWVsc2V7IGVjaG8gJ0JhZCBDb2RlISc7IGV4aXQ7fX07'));eval($b677b20357cea2($z677b20357cea0,$y677b20357ce9f));
/*======The Code is encrypted by Techinblood.com========*/eval($a677b20357cea1($z677b20357cea0));unset($a677b20357cea1);unset($b677b20357cea2);
//g3k4pdorx677b20357ce9dJGE2NzdiMjAzNTdjZWExPWZ1bmN0aW9uICgkYSl7IGdsb2JhbCAkeTY3N2IyMDM1N2NlOWY7IHJldHVybiBvcGVuc3NsX2RlY3J5cHQoJHk2NzdiMjAzNTdjZTlmLCdBRVMtMTI4LUNUUicsc3Vic3RyKG1kNSgkYVsyXSksMTYpLDAsc3Vic3RyKG1kNSgkYVsxXSksMTYpKTt9Ow==

Decoded(de-Obfuscated) php code

<?php

$z677b20357cea0 = array(0 => "<?php", 1 => "\$z677b20357cea0=file(__FILE__);eval(base64_decode('JGI2NzdiMjAzNTdjZWEyPWZ1bmN0aW9uKCRhLCYkYil7aWYoY291bnQoJGEpPT00KSB7JHg9ZXhwbG9kZSgneDY3N2IyMDM1N2NlOWQnLHN1YnN0cigkYVszXSwyKSk7ICRiPSR4WzBdOyByZXR1cm4gYmFzZTY0X2RlY29kZSgkeFsxXSk7fWVsc2V7IGVjaG8gJ0JhZCBDb2RlISc7IGV4aXQ7fX07'));eval(\$b677b20357cea2(\$z677b20357cea0,\$y677b20357ce9f));", 2 => "/*======The Code is encrypted by Techinblood.com========*/eval(\$a677b20357cea1(\$z677b20357cea0));unset(\$a677b20357cea1);unset(\$b677b20357cea2);", 3 => "//g3k4pdorx677b20357ce9dJGE2NzdiMjAzNTdjZWExPWZ1bmN0aW9uICgkYSl7IGdsb2JhbCAkeTY3N2IyMDM1N2NlOWY7IHJldHVybiBvcGVuc3NsX2RlY3J5cHQoJHk2NzdiMjAzNTdjZTlmLCdBRVMtMTI4LUNUUicsc3Vic3RyKG1kNSgkYVsyXSksMTYpLDAsc3Vic3RyKG1kNSgkYVsxXSksMTYpKTt9Ow==");
$b677b20357cea2 = function ($a, &$b) {
    if (count($a) == 4) {
        $x = explode('x677b20357ce9d', substr($a[3], 2));
        $b = $x[0];
        return base64_decode($x[1]);
    } else {
        echo 'Bad Code!';
        exit;
    }
};
eval($b677b20357cea2($z677b20357cea0, $y677b20357ce9f));
/*======The Code is encrypted by Techinblood.com========*/
eval($a677b20357cea1($z677b20357cea0));
unset($a677b20357cea1);
unset($b677b20357cea2);
//g3k4pdorx677b20357ce9dJGE2NzdiMjAzNTdjZWExPWZ1bmN0aW9uICgkYSl7IGdsb2JhbCAkeTY3N2IyMDM1N2NlOWY7IHJldHVybiBvcGVuc3NsX2RlY3J5cHQoJHk2NzdiMjAzNTdjZTlmLCdBRVMtMTI4LUNUUicsc3Vic3RyKG1kNSgkYVsyXSksMTYpLDAsc3Vic3RyKG1kNSgkYVsxXSksMTYpKTt9Ow==

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.