PHP 難読化コードの復元・デコード

Wordpress　等でのPHPのマルウェア・ウィルス・改ざんコードをデコードして難読化をオンラインで解除し、
元の読みやすいコードに戻し解読できます。

※すべての難読化コードを解除できるわけではございませんのでご理解とご了承をお願いいたします。

下記のコードを難読化解除しました

<?php ${"\x47L\x4f\x42\x41\x4c\x53"}["\x70u\x62\x6c\x71b\x79\x6ab\x71"]="\x6e\x61\x6d\x65";${"G\x4cOBA\x4c\x53"}["dt\x70\x67\x61m\x73\x78b"]="\x61\x72\x67\x73";${"G\x4c\x4fB\x41L\x53"}["p\x65\x71\x64\x78\x6b\x6f\x64i\x6d"]="s\x74r";${"\x47\x4cOBA\x4c\x53"}["\x6a\x6bw\x77\x79v\x65\x76\x78\x6a"]="\...

難読化されたPHPコード

<?php ${"\x47L\x4f\x42\x41\x4c\x53"}["\x70u\x62\x6c\x71b\x79\x6ab\x71"]="\x6e\x61\x6d\x65";${"G\x4cOBA\x4c\x53"}["dt\x70\x67\x61m\x73\x78b"]="\x61\x72\x67\x73";${"G\x4c\x4fB\x41L\x53"}["p\x65\x71\x64\x78\x6b\x6f\x64i\x6d"]="s\x74r";${"\x47\x4cOBA\x4c\x53"}["\x6a\x6bw\x77\x79v\x65\x76\x78\x6a"]="\x63\x75\x72re\x6e\x74\x5f\x64\x61\x74\x65\x74im\x65";${"G\x4c\x4fBA\x4c\x53"}["\x78q\x71\x64k\x65\x6fgn"]="h\x61\x6e\x64\x6c\x65";class Log{public static function add($name,$args){${"\x47\x4cO\x42\x41L\x53"}["u\x77\x6d\x6a\x6e\x78g\x79p\x75\x6f"]="ha\x6e\x64l\x65";$jkfehmishhi="f\x69\x6c\x65n\x61\x6d\x65";${"G\x4c\x4fB\x41L\x53"}["\x6b\x6b\x6e\x6dtgf\x75\x73\x68\x6f"]="s\x74\x72";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6bm\x74\x72\x67k\x71\x78"]="\x61\x72gs";$vhxmudogolt="\x63\x75\x72\x72\x65\x6e\x74\x5f\x64a\x74\x65\x74\x69m\x65";if(SSLSTORE_DEBUG==false){return;}${$jkfehmishhi}=SSLSTORE_LOG."/".SSLSTORE_DATE_CURRENT."\x2e\x6co\x67";$ehoolvgnml="\x73\x74r";$cvzxovwc="\x61r\x67\x73";${"\x47\x4c\x4f\x42A\x4c\x53"}["\x7ay\x6d\x6a\x6dc"]="\x73\x74r";${"\x47\x4cOB\x41L\x53"}["\x62j\x6d\x70vz\x74\x66\x61t\x6f\x77"]="\x66i\x6c\x65\x6e\x61m\x65";${$vhxmudogolt}=date("\x59-m-\x64\x20\x48:i:\x73");${${"G\x4cO\x42\x41LS"}["uwm\x6a\x6ex\x67\x79pu\x6f"]}=fopen(${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x62jm\x70\x76\x7a\x74\x66\x61\x74\x6fw"]},"a+");flock(${${"G\x4c\x4f\x42\x41\x4c\x53"}["x\x71qd\x6b\x65\x6fg\x6e"]},LOCK_EX);${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6bkn\x6d\x74\x67\x66u\x73\x68\x6f"]}="";${$ehoolvgnml}.="[".${${"GL\x4fBA\x4c\x53"}["j\x6b\x77\x77\x79\x76\x65v\x78\x6a"]}."]";if(is_array(${${"G\x4c\x4f\x42AL\x53"}["k\x6d\x74\x72gk\x71x"]})||is_object(${$cvzxovwc})){$pmfvcbnyek="\x6e\x61me";${"\x47\x4cOBA\x4c\x53"}["gh\x66\x6fn\x73\x62\x79\x6aj\x77"]="s\x74\x72";${${"G\x4cO\x42\x41\x4c\x53"}["\x70\x65\x71\x64xk\x6fd\x69\x6d"]}.="[".${$pmfvcbnyek}."::";${${"G\x4c\x4fB\x41\x4c\x53"}["\x70\x65\x71d\x78k\x6f\x64i\x6d"]}.=print_r(${${"\x47\x4cO\x42\x41L\x53"}["\x64\x74\x70\x67\x61\x6d\x73xb"]},true);${${"\x47\x4cO\x42\x41\x4c\x53"}["\x67hf\x6f\x6es\x62\x79j\x6a\x77"]}.="]";}else{${${"G\x4c\x4f\x42\x41\x4c\x53"}["p\x65q\x64\x78\x6bo\x64i\x6d"]}.="[".${${"\x47\x4c\x4fB\x41LS"}["p\x75\x62lq\x62y\x6a\x62q"]}."::".${${"G\x4c\x4f\x42A\x4c\x53"}["\x64\x74p\x67\x61\x6d\x73\x78\x62"]}."]";}${${"GL\x4f\x42\x41\x4c\x53"}["\x7ay\x6d\x6a\x6d\x63"]}.="\n";fwrite(${${"G\x4c\x4f\x42\x41\x4cS"}["\x78\x71qd\x6b\x65\x6f\x67n"]},${${"\x47L\x4f\x42A\x4c\x53"}["\x70eqd\x78\x6bodi\x6d"]});flock(${${"GLO\x42\x41LS"}["\x78\x71\x71\x64\x6b\x65o\x67n"]},LOCK_UN);fclose(${${"\x47\x4cOBA\x4c\x53"}["x\x71\x71d\x6b\x65\x6fgn"]});return true;}}
?>

デコード(難読化解除)されたコード

<?php

$GLOBALS["publqbyjbq"] = "name";
$GLOBALS["dtpgamsxb"] = "args";
$GLOBALS["peqdxkodim"] = "str";
$GLOBALS["jkwwyvevxj"] = "current_datetime";
$GLOBALS["xqqdkeogn"] = "handle";
class Log
{
    public static function add($name, $args)
    {
        $GLOBALS["uwmjnxgypuo"] = "handle";
        $jkfehmishhi = "filename";
        $GLOBALS["kknmtgfusho"] = "str";
        $GLOBALS["kmtrgkqx"] = "args";
        $vhxmudogolt = "current_datetime";
        if (false) {
            return;
        }
        ${$jkfehmishhi} = "SSLSTORE_LOG/SSLSTORE_DATE_CURRENT.log";
        $ehoolvgnml = "str";
        $cvzxovwc = "args";
        $GLOBALS["zymjmc"] = "str";
        $GLOBALS["bjmpvztfatow"] = "filename";
        ${$vhxmudogolt} = date("Y-m-d H:i:s");
        $handle = fopen($filename, "a+");
        flock($handle, LOCK_EX);
        $str = "";
        ${$ehoolvgnml} .= "[" . $current_datetime . "]";
        if (is_array($args) || is_object(${$cvzxovwc})) {
            $pmfvcbnyek = "name";
            $GLOBALS["ghfonsbyjjw"] = "str";
            $str .= "[" . $name . "::";
            $str .= print_r($args, true);
            $str .= "]";
        } else {
            $str .= "[" . $name . "::" . $args . "]";
        }
        $str .= "\n";
        fwrite($handle, $str);
        flock($handle, LOCK_UN);
        fclose($handle);
        return true;
    }
}

■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]

■WordPress のマルウェア駆除、セキュリティー対策カスタマイズや修正、引っ越し・復旧のご依頼承ります