-
Notifications
You must be signed in to change notification settings - Fork 3
Expand file tree
/
Copy pathunobfuscate.php
More file actions
27 lines (22 loc) · 763 Bytes
/
unobfuscate.php
File metadata and controls
27 lines (22 loc) · 763 Bytes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
<?php
function lame_decode($content) {
$instructions = explode(";", $content);
$step_3 = str_replace("eval(", "", $instructions[3]);
$step_3 = str_replace("))", ");", $step_3);
$step_3 = str_replace("\$_D", "return base64_decode", $step_3);
$result = eval($step_3);
$result = str_replace("\$_R=str_replace('__FILE__',\"'\".\$_F.\"'\",\$_X);eval(\$_R);\$_R=0;\$_X=0;", "return \$_X;", $result);
$result = "$instructions[1];$result";
return $result;
}
$filename = $argv[1];
$file_content = file_get_contents($filename);
$result = lame_decode($file_content);
$code = eval($result);
// support for recursive encoding
while (strpos($code, "edoced_46esab") !== false) {
$result = lame_decode($code);
$code = eval($result);
}
echo "$code\n";
?>