PHP Deobfuscator

Upload the obfuscated file to get the plain code.

Use the chatbox on your right to leave your comments.

Supported Obfuscation:

Truebug

The tool can deobfuscate/decode Truebug encoded script. The script will have the following format:

<?php $o="some encoded string";eval(base64_decode("another encoded string")); return; ?>

Here is the sample that can be deobfuscate by the first option:

<?php
$o="QAAADg47Y25xJ2RrZnR0OiVkawEMYmZ1JTk7KAFAOQoNDgAwAMM7JgAMKionKCRqZm5pJyoqAbUCYCdu  AOJjOiVhaGhzYgOAAvAAMA47dwUGaAEAd351bmBvcwVAOHdvdydYYi8iACBEAVUgK3ADkG9iamJ0Ljwn  OAgAOSchZAGwPCc7ZidvdWJhOiVAADsDQmVraGBuaWFoLyBydWsggOwCoiUnc25za2ICLwFyAkQ5A/0B2DsoEApmOScCA2Jkb2gnY2ZzCaBeA6MpwQABpArRRmtrJ1UMIXQnVWJ0YnVxEcJiYykLjTsodxEhEu  EPyXViY24PmkYAACd3dWhyYydqYmplYnUnaGEMACdzb2IE3Q/nb3Nzdz0oKHBwcAAAKXBodWNlZmlsZmN0KWRoagEAKGEqZip2KBBmb2J1YiU5dGI4HmInAKENyAwhYWZ  qbmt+Bn0LShyBIC9x8h4NVSA6HsMgUwoNAbpkaGlzIhANsCIyAexlcUhgA1UBkB2ScHdYBOMvHVIKDQG  VbmEnAAAvJyNAS0hFRktUXCBzcG5zgCAmAFhwbmNgYnNYchhwaWZqYiAGAFonLid8I4ADcHRkdW53cyd  zfkAQdyFQc2J/cyhtZnFmAWMlJ3R1HkBkOiUU9ATUFHICR3QoJmFgYnUpbXS34SrAKAOjEBA7AKMFrwcBBa8KcAWidHNm  cwqAIAN0KABQdVhzbmpia25pYignKA3/4AEN/jFBCQBoaThkZmtrZWZkbDoL5EADRAEENSFmanc8ZGhyaXM6Bc8TvwHUa25qbnMgWgWRDmsZAnoUzyUUz  TknAFBEcmFoaSlpaHAbYTsSqChlaGNAAH4TMShvc2prOQ==";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpi  MlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hz  S0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214  bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytd  KTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRs  bGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxs  bGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxs  bGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxs  bGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTsk  bGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxs  bGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1D a3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return; ?>

Mix base64_decode

Mix base64_decode support the following:

  • eval(gzinflate(str_rot13(base64_decode(
  • eval(gzinflate(base64_decode(
  • gzinflate(base64_decode(base64_decode(str_rot13(
  • eval(gzinflate(base64_decode(str_rot13(
  • eval(base64_decode(

Byterun

This tool also can deobfuscate/decode Byterun encoded script. The script will have the following format:

$_F=__FILE__;$_X='some encoded string';

Here is the sample that can be deobfuscate by the third option:
<?php
$_F=__FILE__;$_X='P2tOP1dGVw0ueHg9MDd1TT0wKCdSLUZKV0ZXJyk7DS4NLnh4RmJael9GMEIvMD0oKTsNLj9rDS5OCmhrfT0wQmIweDA+V009Qmd6MHhMNT1NV2JMTmwKaGsNLg0uTntbY1lUeGpNL2JGcSJHMzMieEJ6TVNYcSI1MFhiMD0ieGdQPS8wPXEiMyJrDS5OezRrTntueExib3owcSJiMD5iLUJ6TVNYOnh6MFJiImsNLkNQdXg1Qlh4TDBieDA+V009QmJNUFh4L0JiMHhSUD14TDU9TVdiTCx4Vz1QZU0vTVhTeC8wWlB4UlA9eG9QdT14NXVMYlBaMD1MSk5jNGtOYzRrDS4NLk5se25rTmx7NGsNLk5se1tjWVRrDS5OP1dGV3gNLnh4RmJael9SUFBiMD0oKTsNLj9reA==';$_D=strrev('edoced_46esab');eval($_D('aWYodGltZSgpPjEyMDc3NTY0Mjgpe2VjaG8oJzxIMz5UaGlzIHNjcmlwdCBpcyBleHBpcmVkLjwvSDM+Jyk7cmV0dXJuO307JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcwe2pQfURnVG5pMTx5SEl1YWVDUUdvVU1ZWFc+TDRWQjk2MnJbaGZFd1p6M2tOdkE3SnBTT3QuIG1ieGM1XWxLOC89cUZkUgpzJywnZVR3b0NGYkVENmtPNU56dVp2WTE0eUtpTG5weHNSVWE4M3tTQTJNVlFtbDA+PElKcS59Z1hQCjdddCBCY1cvW0dkcj1oOWZIaicpOyRfUj1lcmVnX3JlcGxhY2UoJ19fRklMRV9fJywiJyIuJF9GLiInIiwkX1gpO2V2YWwoJF9SKTskX1I9MDskX1g9MDtpZihoZWFkZXJzX3NlbnQoKSllY2hvKGJhc2U2NF9kZWNvZGUoJ1BGTkRVa2xRVkQ0TkNuWmhjaUJpY2w5bGJHMHNZbkpmWlhnc1luSmZaWGtzWW5KZmJYZ3NZbkpmYlhrc1luSmZiVzA3Wm5WdVkzUnBiMjRnWW5KZlpXeGxiV1Z1ZENobEtYdDNhR2xzWlNBb1pTNTBZV2RPWVcxbElUMG5SRWxXSnlrZ1pUMWxMbkJoY21WdWRFVnNaVzFsYm5RN0lISmxkSFZ5YmlCbE8zMDdablZ1WTNScGIyNGdZbkpmWkhKaFp5Z3BlMkp5WDJWc2JTNXpkSGxzWlM1c1pXWjBQV0p5WDJWNEsyVjJaVzUwTG1Oc2FXVnVkRmd0WW5KZmJYZzdZbkpmWld4dExuTjBlV3hsTG5SdmNEMWljbDlsZVN0bGRtVnVkQzVqYkdsbGJuUlpMV0p5WDIxNU8zSmxkSFZ5YmlCbVlXeHpaVHQ5TzJaMWJtTjBhVzl1SUdKeVgzTjBZWEowS0dWc2JTeGxkbVZ1ZENsN1luSmZaV3h0UFdKeVgyVnNaVzFsYm5Rb1pXeHRLVHRpY2w5dGVEMWxkbVZ1ZEM1amJHbGxiblJZTzJKeVgyMTVQV1YyWlc1MExtTnNhV1Z1ZEZrN1luSmZaWGc5Y0dGeWMyVkpiblFvWW5KZlpXeHRMbk4wZVd4bExteGxablFwTzJKeVgyVjVQWEJoY25ObFNXNTBLR0p5WDJWc2JTNXpkSGxzWlM1MGIzQXBPMkp5WDIxdFBXUnZZM1Z0Wlc1MExtOXViVzkxYzJWdGIzWmxPMlJ2WTNWdFpXNTBMbTl1Ylc5MWMyVnRiM1psUFdKeVgyUnlZV2M3ZlRzTkNqd3ZVME5TU1ZCVVBqeEVTVllnYzNSNWJHVTlKM0J2YzJsMGFXOXVPbUZpYzI5c2RYUmxPeUJzWldaME9qSXdjSGc3SUhSdmNEbzRNSEI0T3lCaVlXTnJaM0p2ZFc1a0xXTnZiRzl5T2s1aGRua25QanhVUVVKTVJTQmliM0prWlhJOUp6QW5JR05sYkd4emNHRmphVzVuUFNjekp5QmpaV3hzY0dGa1pHbHVaejBuTUNjK1BGUlNJSE4wZVd4bFBTZG1iMjUwTFdaaGJXbHNlVHBVWVdodmJXRTdJR1p2Ym5RdGMybDZaVG94TUhCME95QmpiMnh2Y2pwWGFHbDBaVHNnWTNWeWMyOXlPbWhoYm1RN0lIUmxlSFF0WVd4cFoyNDlZMlZ1ZEdWeUp6NDhWRVFnZDJsa2RHZzlKelV3TUNjZ2IyNVRaV3hsWTNSVGRHRnlkRDBuY21WMGRYSnVJR1poYkhObEp5QnZiazF2ZFhObFQzWmxjajBpWW5KZlpXeGxiV1Z1ZENoMGFHbHpLUzV6ZEhsc1pTNWlZV05yWjNKdmRXNWtRMjlzYjNJOUp5TXdNRFkyT1RrbkltOXVUVzkxYzJWUGRYUTlJbUp5WDJWc1pXMWxiblFvZEdocGN5a3VjM1I1YkdVdVltRmphMmR5YjNWdVpFTnZiRzl5UFNkT1lYWjVKeUp2YmsxdmRYTmxSRzkzYmowaWRHaHBjeTV6ZEhsc1pTNWpiMnh2Y2owblFteGhZMnNuTzJKeVgzTjBZWEowS0hSb2FYTXNaWFpsYm5RcEltOXVUVzkxYzJWVmNEMGlkR2hwY3k1emRIbHNaUzVqYjJ4dmNqMG5WMmhwZEdVbk8yUnZZM1Z0Wlc1MExtOXViVzkxYzJWdGIzWmxQV0p5WDIxdElqNDhRajVYWVhKdWFXNW5QQzlDUGp3dlZFUStQRlJFSUc5dVEyeHBZMnM5SW1KeVgyVnNaVzFsYm5Rb2RHaHBjeWt1YzNSNWJHVXVkbWx6YVdKcGJHbDBlVDBuYUdsa1pHVnVKenR5WlhSMWNtNGdabUZzYzJVaVBsdGpiRzl6WlYwOEwxUkVQand2VkVRK1BGUlNQanhVVWlCaVoyTnZiRzl5UFNkWlpXeHNiM2NuUGp4VVJDQmpiMnh6Y0dGdVBTY3lKeUJ6ZEhsc1pUMG5abTl1ZEMxbVlXMXBiSGs2VkdGb2IyMWhPeUJtYjI1MExYTnBlbVU2TVRCd2REc2dZMjlzYjNJNlFteGhZMnM3SUhCaFpHUnBibWM2Tm5CNEp6NVVhR2x6SUhOamNtbHdkQ0IzWVhNZ2NISnZkR1ZqZEdWa0lHSjVJR1JsYlc4Z2RtVnljMmx2YmlCdlpqeENVajRnSUNBOFFqNDhRU0JJVWtWR1BTZG9kSFJ3T2k4dmQzZDNMbUo1ZEdWeWRXNHVZMjl0THo5c1pISTlaRzF2Sno1Q2VYUmxVblZ1SUZCeWIzUmxZM1J2Y2lCbWIzSWdVRWhRUEM5QlBqd3ZRajR1UEVsTlJ5QlRVa005SjJoMGRIQTZMeTkzZDNjdVlubDBaWEoxYmk1amIyMHZhVzFuTDJSbGJXOHVaMmxtSno0OEwxUkVQand2VkZJK1BDOVVRVUpNUlQ0OEwwUkpWajQ9JykpOw==')); ?>

PHPLockit

Here is the sample code that been obfuscated by PHPLockit:
<?php
// This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=924;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJzNzYWZaakc1NEhGcU1kTEFPZzl3Ykl6UFIvcGxLOCs3ZVVjeFFCV21ZMXVTNk5Ycmh2RENudDBFMlRvSmtWaXk9JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
HZVAMfsAMfsAMftBKWImPEHBKGvUR0bYHtV7gQBMgIV7HDhcHD4XHZVAwCsAMZkhMa2cHD46FGHUK0b0djVQ/zdr/GbYKEgD854Y/mHBRzOYHZkhMfsAMZkhMahQwnkhMZkhMf3hF9hmMEdU/B1ugCbn9Z/vwzgMObVmLP8c9P1ObcVhlZ62FC8BIzd2bbHPlIQv8IM0wBUDp5/ZO0TnMZbDIGVFpt/1+wnmqa8sOQdZgb/59ZBF9nvdwQVObIHwIjIzItU/zWjcR0gB/W8Ypz1SlGtXlEsvKmdn8P/E+5BoMfZDMCOtdxK2L96rHDQ1F9QJ/Wd6lEdBFagAMf3hwCsAMf31L0I0RzhYHZVAMfsAMfsAMaQJ/zdYlD3mfOYk49nN4jdnRPHn4Z/rlEgBKc3Nqw2daeQk/GB04GBQA9HWl0Vn/P4cAenFaOnFaOQk49nN4jdnRPHn4Z/rlEgBKcsM/z/n4anNAenFaOQk/GB04Gd6RPdCA9HWl0Vn/P4c4GBQA9HWl0Vn/PH7lGIW8a4ifOYH4a3HA53iO0Vh+PH1/0Un4a/xlEsTLD3mLDsBR0Ur4GgU8GbY4BQcFw6eL0IxpGkeHD3WlzBQ/GVnLD3kR9sYKWIWA94mLDsclGVmpzTWlDem8PH6HDQJ4fNBR0Ur4aKcAcKJ4GH6l081lW/rFa8XRztBHDQJ4fNBR0Ur4aKkq0ZiqasslGhebWBmp5gC4jHBK0ID8WIQqc3ebGVE/PHB/asc+93kR9sYKWIWA9HY85ghLckr8E8EqW/D/zbNK5HBlzBtl9tElEHQK5HBKEMN8GUBlzICqWdrl94eKWI6A9HQl0/rlGvr8D4igmHB/9sOKWINpPIN4j8rKWghKWICKDsbpGIN/PMkq0ZiAaVhAxhr/GB0AenFaOQk49nN4ZIX/asGl0Vn/P4ewGIW8a3Nqw2daeQdaeQkq0g18x2daeQk49nN4ZIX/asGl0Vn/P4eq9nifOYdaxhr/GB0AenFAaZNq9sjlWOeIEHUK5sBKc3Nqw2daenFA5dxKWBh8asn+PsBA9Hn/PUnq01U8WjCREH1K5OcAcsf8z/rlcTXlEKYFw6eAaVCREH1K5OifOYHawhUq9neHC6e/zdYlDsm/Pg7lmINPEjt/PH1/PMYFw6eL0IxpGkeHDsv8zIDpzICqc3mLDsnpztBKBVC8GVhFfZ1LD3J/zdYlD3m45dBR0VX/5MX4anNAenFaOQmLDsEKjVWl0Vn/P4YFw6eL0IxpGkeHChrRWVQ+w2daxhrp5gNlf2dacKJ
Another variation of this obfuscation:
<?php
$OOO0O0O00=__FILE__;$OOO000000=urldecode('%61%68%36%73%62%65%68%71%6c%61%34%63%6f%5f%73%61%64');$OO00O0000=244;$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$O0O0000O0='OOO0000O0';eval(($$O0O0000O0('aWYoITApJE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO2ZnZXRzKCRPMDAwTzBPMDAsMTAyNCk7ZmdldHMoJE8wMDBPME8wMCw0MDk2KTskT08wME8wME8wPShiYXNlNjRfZGVjb2RlKHN0cnRyKGZyZWFkKCRPMDAwTzBPMDAsMzcyKSwnZm9PRkFhQmJDY0RkRWVHZ0hoSWlKaktrTGxNbU5uUHBRcVJyU3NUdFV1VnZXd1h4WXlaejAxMjM0NTY3ODkrLz0nLCdBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OSsvJykpKTtldmFsKCRPTzAwTzAwTzApOw==')));return;?>
cA9gEFogEFogEF1sNTjtk3csNByqL2JUc19phSsEhj9pcZYRcZCXcA9gizogEA8YEO4RcZCWDBcqN2J2ea9SlKexlBJUN3hZnbCUltcsLKHUcA8YEFogEA8YEOYSi08YEA8YEFfYDIYtlT9ghSaqHTcFL0hShKjbl0qUIKsDMSwviByemJ5XJbohNjcZJ3eJnaj1jtlkn1q4KksMPrfyErE0eiL3GFSvdz0tdOnoHSeAhJlbIAsDI0yeiS9HJjcijajKj1qlKTaRL2hslTnUMKuvmB1Xm3oyNte0nkl3Pbs6EFAZEzH1erN4GIWxcZSuDIS7lTeWm3esDOhgEFfYizogEFfuG2j2LKYUcA9gEFogEFogEOS7OTl1mTe0MK9XCBcumrcYMBazMOQSlBa0LISeOtWeOTlxNRQSMi0YGZhugbe0NTysmRQSlBa0LIS7cBSvDZSeOtWeORhRLZf9Cbe1Lte0NRQSlBa0LIYSMIYyDiWeORhUlOfXgIoznbcpNTjYlKa0DONYcZYZdke0NTysmRqSlKeUlkQUm3cSDOhRLZSuDISXlBjrMBj4DB9ZlOQSLTEuDiWeOt0eOtcsnbjZmRQSMBHuGY0DpH0D

Please take note that the variable name for __FILE__ and __LINE__ and etc. might be slightly different then yours but still the combination of O and 0

johnburn [at] putera [dot] com


ShoutMix chat widget
[close]