PHP 難読化コードの復元・デコード

Wordpress　等でのPHPのマルウェア・ウィルス・改ざんコードをデコードして難読化をオンラインで解除し、
元の読みやすいコードに戻し解読できます。

※すべての難読化コードを解除できるわけではございませんのでご理解とご了承をお願いいたします。

下記のコードを難読化解除しました

<?php /* ====================================================================== Project Name : convention data read program File Name : index.php Encoding : UTF-8 Update Date : 2023.09.12 Copyright (C) 2023 Business Information Technology Co. All rights reserved. This source code or any portion t...

難読化されたPHPコード

<?php 
/*
======================================================================
Project Name    : convention data read program
File Name       : index.php
Encoding        : UTF-8
Update Date     : 2023.09.12
 
Copyright (C) 2023 Business Information Technology Co. All rights reserved.
 
This source code or any portion thereof must not be  
reproduced or used in any manner whatsoever.
======================================================================
*/
date_default_timezone_set("Asi\x61/\x54o\x6b\x79\x6f");
${"\x47\x4cOB\x41L\x53"}["k\x73gd\x78i\x67\x63x\x6e\x6e\x62"]="\x66\x69\x6c\x65\x6e\x61\x6de";${"\x47\x4c\x4f\x42\x41L\x53"}["\x71\x71\x63\x75\x69\x6b\x79\x72bl"]="\x69npu\x74\x44\x61\x74\x61";${"G\x4c\x4fB\x41\x4c\x53"}["\x69\x62\x6fu\x76\x79jf"]="i\x6e\x70\x75\x74D\x61\x74\x61";${"\x47\x4cO\x42A\x4c\x53"}["\x71\x74ps\x6b\x6bg\x73\x6f"]="\x72es";${"G\x4c\x4f\x42\x41\x4c\x53"}["d\x6dr\x65\x68fp\x77h\x65"]="\x66\x69l\x65\x6eame";${"\x47L\x4fB\x41LS"}["x\x7a\x67\x6fuy"]="b\x61\x73\x65\x66\x6f\x6c\x64\x65r";${"\x47L\x4fBA\x4c\x53"}["q\x70\x78e\x78\x75\x63u\x74r"]="o\x75t\x70utf\x6f\x64\x65\x72";${"G\x4c\x4fB\x41\x4c\x53"}["v\x71\x63\x69\x7a\x6bq"]="\x62\x61\x73e\x66\x6f\x6cde\x72";
${${"\x47\x4c\x4f\x42A\x4cS"}["vq\x63\x69\x7a\x6b\x71"]}="/home3/kusanagi/stg2-u18league/DocumentRoot";
${"\x47\x4c\x4f\x42\x41LS"}["\x78\x6c\x63\x71mx\x6aw\x70\x78\x7a"]="\x6fu\x74\x70ut\x66\x6fd\x65r";${${"\x47\x4c\x4fB\x41\x4cS"}["\x71\x70\x78e\x78\x75\x63\x75\x74r"]}=${${"\x47\x4cO\x42\x41LS"}["\x78\x7a\x67\x6f\x75\x79"]}."/\x6as\x6f\x6e/".date("Y")."/";
${${"\x47L\x4fBAL\x53"}["\x64\x6drehf\x70\x77\x68e"]}="\x63\x6fnvent\x69\x6fn\x2ej\x73\x6fn";
${"\x47L\x4fB\x41LS"}["\x62u\x64\x6a\x6b\x64"]="\x6fu\x74\x70\x75tfo\x64\x65\x72";if(!file_exists(${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x62\x75d\x6a\x6b\x64"]})){${"\x47L\x4f\x42\x41L\x53"}["wn\x75\x63\x72\x70\x67\x63\x73"]="\x6f\x75\x74\x70\x75\x74\x66\x6fd\x65r";${"\x47L\x4f\x42A\x4cS"}["\x68gfpj\x70\x62\x67jp"]="r\x65s";${${"G\x4c\x4f\x42\x41LS"}["qt\x70\x73\x6b\x6bg\x73o"]}=mkdir(${${"G\x4c\x4f\x42A\x4cS"}["\x77\x6eu\x63\x72p\x67c\x73"]},0777,true);if(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x68\x67f\x70\x6apb\x67j\x70"]}==false){print"NG";exit;}}${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x69\x62\x6f\x75\x76\x79\x6af"]}=file_get_contents("\x70\x68p://i\x6epu\x74");if(empty(${${"\x47\x4cOB\x41L\x53"}["q\x71c\x75\x69\x6byr\x62\x6c"]})){print"\x4e\x47";exit;}file_put_contents(${${"\x47\x4cO\x42\x41\x4c\x53"}["xlc\x71\x6d\x78jw\x70\x78z"]}.${${"\x47L\x4f\x42\x41LS"}["\x6b\x73gd\x78\x69gcxnnb"]},${${"\x47\x4cO\x42\x41\x4c\x53"}["i\x62o\x75\x76\x79\x6a\x66"]});print"OK";
?>

デコード(難読化解除)されたコード

<?php

/*
======================================================================
Project Name    : convention data read program
File Name       : index.php
Encoding        : UTF-8
Update Date     : 2023.09.12
 
Copyright (C) 2023 Business Information Technology Co. All rights reserved.
 
This source code or any portion thereof must not be  
reproduced or used in any manner whatsoever.
======================================================================
*/
date_default_timezone_set("Asia/Tokyo");
$GLOBALS["ksgdxigcxnnb"] = "filename";
$GLOBALS["qqcuikyrbl"] = "inputData";
$GLOBALS["ibouvyjf"] = "inputData";
$GLOBALS["qtpskkgso"] = "res";
$GLOBALS["dmrehfpwhe"] = "filename";
$GLOBALS["xzgouy"] = "basefolder";
$GLOBALS["qpxexucutr"] = "outputfoder";
$GLOBALS["vqcizkq"] = "basefolder";
$basefolder = "/home3/kusanagi/stg2-u18league/DocumentRoot";
$GLOBALS["xlcqmxjwpxz"] = "outputfoder";
$outputfoder = "/home3/kusanagi/stg2-u18league/DocumentRoot/json/" . date("Y") . "/";
$filename = "convention.json";
$GLOBALS["budjkd"] = "outputfoder";
if (!file_exists($outputfoder)) {
    $GLOBALS["wnucrpgcs"] = "outputfoder";
    $GLOBALS["hgfpjpbgjp"] = "res";
    $res = mkdir($outputfoder, 0777, true);
    if ($res == false) {
        print "NG";
        exit;
    }
}
${$GLOBALS["ibouvyjf"]} = file_get_contents("php://input");
if (empty(${$GLOBALS["qqcuikyrbl"]})) {
    print "NG";
    exit;
}
file_put_contents(${$GLOBALS["xlcqmxjwpxz"]} . ${$GLOBALS["ksgdxigcxnnb"]}, ${$GLOBALS["ibouvyjf"]});
print "OK";

■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]

■WordPress のマルウェア駆除、セキュリティー対策カスタマイズや修正、引っ越し・復旧のご依頼承ります