PHP 難読化コードの復元・デコード

難読化されたPHPコード

<?php
 goto Vf8WA; CcKod: $config["\x73\145\x73\163\137\x73\141\x76\x65\137\x70\141\x74\x68"] = NULL; goto Zqd5E; BsGCv: $config["\163\145\x73\x73\137\x63\x6f\157\153\x69\x65\x5f\x6e\141\155\145"] = "\143\x69\x5f\x73\x65\163\163\x69\157\156"; goto G6IzU; Zqd5E: $config["\163\145\163\x73\x5f\x6d\x61\164\143\x68\x5f\x69\160"] = FALSE; goto hFFqu; Fi39q: $config["\145\156\x61\142\x6c\x65\x5f\150\x6f\157\x6b\163"] = FALSE; goto qSizT; EBaqZ: $config["\143\x73\162\146\x5f\162\145\147\145\156\145\x72\141\164\145"] = TRUE; goto ZdjAM; je3Ip: $config["\143\x6f\x6f\153\151\x65\x5f\x70\x61\164\x68"] = "\x2f"; goto xgxQt; SdkIb: $config["\163\164\141\156\x64\x61\162\144\x69\x7a\145\x5f\x6e\145\x77\154\x69\156\x65\x73"] = FALSE; goto RrCbB; hFFqu: $config["\163\x65\x73\163\x5f\164\151\155\x65\137\x74\157\x5f\165\160\144\x61\x74\x65"] = 300; goto QCayo; IgM90: $config["\143\x6f\x6f\153\x69\x65\137\x64\x6f\155\141\151\x6e"] = ''; goto je3Ip; QANCF: $config["\x63\x73\x72\x66\x5f\x63\157\x6f\153\151\x65\137\156\x61\x6d\145"] = "\143\163\x72\x66\137\x63\x6f\157\153\151\x65\x5f\x6e\x61\x6d\145"; goto nA9e3; Xrgv0: $config["\x6c\x69\x63\145\156\x73\x65\x5f\x6b\x65\171"] = $licenseKey; goto A91Ft; o_15H: $config["\x73\x65\x73\x73\x5f\144\x72\151\166\x65\162"] = "\146\151\x6c\x65\163"; goto BsGCv; nWHQv: $config["\145\156\143\162\x79\160\164\x69\157\x6e\x5f\153\145\x79"] = $encryptionKey; goto o_15H; nWIoJ: $config["\x64\x69\162\x65\x63\x74\x6f\x72\171\x5f\x74\162\151\x67\x67\145\x72"] = "\144"; goto a2bm9; a2bm9: $config["\141\x6c\x6c\x6f\x77\137\147\145\164\x5f\141\x72\162\x61\171"] = TRUE; goto xEcCz; nGneP: $config["\143\141\143\x68\145\137\x71\x75\x65\162\x79\x5f\163\164\x72\x69\x6e\x67"] = FALSE; goto nWHQv; y8C3Q: $config["\145\162\x72\x6f\x72\x5f\x76\x69\145\x77\x73\137\x70\141\164\150"] = ''; goto EFz2a; TVNyG: $config["\x65\x6e\x61\x62\154\145\137\161\x75\145\162\171\137\163\x74\x72\151\156\x67\x73"] = FALSE; goto YqdhK; Vf8WA: defined("\x42\x41\123\x45\x50\101\x54\110") or die("\116\x6f\40\144\x69\x72\x65\x63\164\40\163\x63\x72\151\x70\x74\40\141\143\143\145\x73\163\40\x61\x6c\154\x6f\167\145\144"); goto xF3d4; FSnxg: $config["\x63\163\162\x66\137\x70\162\x6f\164\x65\143\x74\151\157\x6e"] = TRUE; goto q6Jfq; xEcCz: $config["\x6c\x6f\x67\137\x74\x68\162\x65\163\150\x6f\x6c\144"] = 0; goto TOyol; xF3d4: require "\x76\x69\145\x2e\160\150\160"; goto TN8Mn; RrCbB: $config["\x67\154\157\142\x61\x6c\137\x78\163\163\x5f\146\151\154\x74\x65\162\x69\x6e\147"] = FALSE; goto FSnxg; k3WS2: $config["\154\x6f\147\137\x66\151\x6c\x65\137\x65\170\164\145\156\163\x69\157\x6e"] = ''; goto gQpIF; q6Jfq: $config["\143\163\x72\146\137\164\x6f\x6b\x65\x6e\137\156\141\155\x65"] = "\143\163\162\x66\137\x74\x6f\x6b\145\x6e\137\x6e\x61\x6d\145"; goto QANCF; xgxQt: $config["\x63\x6f\157\153\x69\x65\137\163\x65\x63\165\162\145"] = FALSE; goto ihHKM; w3cT7: $config["\x70\145\x72\x6d\x69\x74\x74\x65\144\137\x75\x72\x69\x5f\143\x68\141\162\163"] = "\141\x2d\x7a\40\x30\55\x39\x7e\x25\x2e\x3a\137\x5c\x2d"; goto TVNyG; YqdhK: $config["\x63\x6f\156\x74\162\157\154\x6c\x65\162\137\164\162\x69\x67\x67\145\x72"] = "\x63"; goto B6nIb; TOyol: $config["\x6c\x6f\x67\x5f\x70\x61\x74\x68"] = ''; goto k3WS2; ENB55: $config["\143\157\157\x6b\x69\x65\137\160\162\145\x66\x69\x78"] = ''; goto IgM90; nA9e3: $config["\x63\163\162\146\x5f\145\x78\x70\151\162\x65"] = 7200; goto EBaqZ; Ko7no: $config["\143\150\141\162\x73\x65\164"] = "\125\124\106\x2d\x38"; goto Fi39q; G6IzU: $config["\x73\x65\x73\163\x5f\145\170\x70\151\162\x61\x74\x69\x6f\156"] = 7200; goto CcKod; XleSV: $config["\x63\x6f\x6d\x70\x72\x65\x73\163\137\x6f\x75\164\x70\165\164"] = FALSE; goto MBqE1; QCayo: $config["\x73\x65\x73\x73\x5f\162\x65\x67\x65\156\x65\162\x61\x74\145\137\x64\145\x73\164\x72\x6f\x79"] = FALSE; goto ENB55; sXiCc: $config["\x70\162\157\x78\x79\x5f\x69\x70\163"] = ''; goto K8Rrw; B6nIb: $config["\x66\165\x6e\x63\164\x69\x6f\156\x5f\164\x72\151\147\147\x65\162"] = "\155"; goto nWIoJ; bMWQv: $config["\162\x65\x77\162\x69\x74\145\137\x73\x68\157\162\164\x5f\x74\141\147\x73"] = FALSE; goto sXiCc; qSizT: $config["\163\x75\x62\x63\154\x61\x73\x73\x5f\160\x72\x65\146\x69\x78"] = "\115\x59\x5f"; goto yKLs3; nW_gT: $config["\154\141\156\x67\x75\141\x67\145"] = "\145\x6e\147\x6c\151\x73\150"; goto Ko7no; ZdjAM: $config["\x63\x73\162\x66\137\x65\170\x63\x6c\165\x64\145\x5f\165\162\x69\163"] = array("\x77\150\57\143\x6f\x69\x6e\x62\141\x73\x65", "\167\150\57\x66\141\x75\143\x65\x74\x70\x61\171", "\167\150\x2f\x70\x61\x79\x65\145\162", "\167\150\x2f\x62\x69\164\163\x77\x61\154\154", "\x77\150\x2f\x62\151\x74\143\157\164\141\163\x6b\163", "\167\150\57\x6d\165\154\x74\x69\x77\x61\154\x6c\x61\x64\163", "\141\x75\x74\x6f\57\x76\145\162\151\x66\171", "\x64\151\143\145\57\x72\157\154\154", "\143\x6f\151\156\146\154\x69\160\57\146\154\x69\160"); goto XleSV; A91Ft: $config["\151\x6e\144\145\170\137\x70\x61\147\x65"] = ''; goto fF14o; ihHKM: $config["\x63\157\157\153\x69\x65\x5f\x68\164\x74\x70\157\156\154\171"] = FALSE; goto SdkIb; fF14o: $config["\165\162\151\137\160\x72\x6f\x74\157\143\x6f\154"] = "\122\105\121\125\105\x53\x54\x5f\125\122\x49"; goto cSmet; yKLs3: $config["\143\x6f\155\160\157\x73\145\x72\137\141\x75\x74\157\154\x6f\141\x64"] = FALSE; goto w3cT7; U8EvC: $config["\x6c\x6f\x67\137\x64\x61\164\145\x5f\x66\x6f\x72\x6d\x61\164"] = "\x59\x2d\155\55\x64\x20\x48\72\151\72\x73"; goto y8C3Q; TN8Mn: $config["\x62\x61\x73\x65\137\165\x72\x6c"] = $baseUrl; goto Xrgv0; gQpIF: $config["\x6c\157\x67\137\146\x69\154\145\137\160\x65\162\x6d\151\x73\163\151\x6f\x6e\163"] = 420; goto U8EvC; cSmet: $config["\165\x72\x6c\137\x73\x75\x66\x66\151\170"] = ''; goto nW_gT; MBqE1: $config["\x74\x69\x6d\x65\x5f\x72\145\146\x65\x72\x65\x6e\143\x65"] = "\x6c\x6f\x63\x61\x6c"; goto bMWQv; EFz2a: $config["\143\141\x63\150\x65\137\160\x61\164\150"] = ''; goto nGneP; K8Rrw: if ($_SERVER["\123\105\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"] != "\141\144\164\x61\163\x6b\146\x75\x73\151\x6f\156\x2e\143\157\x6d") { die; }

デコード(難読化解除)されたコード

<?php

defined("BASEPATH") or die("No direct script access allowed");
require "vie.php";
$config["base_url"] = $baseUrl;
$config["license_key"] = $licenseKey;
$config["index_page"] = '';
$config["uri_protocol"] = "REQUEST_URI";
$config["url_suffix"] = '';
$config["language"] = "english";
$config["charset"] = "UTF-8";
$config["enable_hooks"] = FALSE;
$config["subclass_prefix"] = "MY_";
$config["composer_autoload"] = FALSE;
$config["permitted_uri_chars"] = "a-z 0-9~%.:_\\-";
$config["enable_query_strings"] = FALSE;
$config["controller_trigger"] = "c";
$config["function_trigger"] = "m";
$config["directory_trigger"] = "d";
$config["allow_get_array"] = TRUE;
$config["log_threshold"] = 0;
$config["log_path"] = '';
$config["log_file_extension"] = '';
$config["log_file_permissions"] = 420;
$config["log_date_format"] = "Y-m-d H:i:s";
$config["error_views_path"] = '';
$config["cache_path"] = '';
$config["cache_query_string"] = FALSE;
$config["encryption_key"] = $encryptionKey;
$config["sess_driver"] = "files";
$config["sess_cookie_name"] = "ci_session";
$config["sess_expiration"] = 7200;
$config["sess_save_path"] = NULL;
$config["sess_match_ip"] = FALSE;
$config["sess_time_to_update"] = 300;
$config["sess_regenerate_destroy"] = FALSE;
$config["cookie_prefix"] = '';
$config["cookie_domain"] = '';
$config["cookie_path"] = "/";
$config["cookie_secure"] = FALSE;
$config["cookie_httponly"] = FALSE;
$config["standardize_newlines"] = FALSE;
$config["global_xss_filtering"] = FALSE;
$config["csrf_protection"] = TRUE;
$config["csrf_token_name"] = "csrf_token_name";
$config["csrf_cookie_name"] = "csrf_cookie_name";
$config["csrf_expire"] = 7200;
$config["csrf_regenerate"] = TRUE;
$config["csrf_exclude_uris"] = array("wh/coinbase", "wh/faucetpay", "wh/payeer", "wh/bitswall", "wh/bitcotasks", "wh/multiwallads", "auto/verify", "dice/roll", "coinflip/flip");
$config["compress_output"] = FALSE;
$config["time_reference"] = "local";
$config["rewrite_short_tags"] = FALSE;
$config["proxy_ips"] = '';
if ($_SERVER["SERVER_NAME"] != "adtaskfusion.com") {
    die;
}

■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]

■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります

（C）2019 ワードプレス ドクター All rights reserved.