Skip to content

Instantly share code, notes, and snippets.

@sh4dowb sh4dowb/untitled.php

Created Jun 29, 2020
Embed
What would you like to do?
deobfuscator for "<?php /* İoncube Copyright © */ "
<?php
$file = 'file.php';
// this script deobfuscates php files that start like this:
// <?php /* İoncube Copyright © */ eval(base64_decode(...
// overrides "hash check" function before including the script, so we can modify the code
// then last "eval" is modified with another function with same length, "eeer", which writes the result to a file
// function name has to be same length because it parses the obfuscated code with substring
//
// to use, edit $file variable and run this script. it will output file.php.deobfuscated.php
$code = file_get_contents($file);
file_put_contents($file.'.temp.php', str_replace(')));eval(', ')));eeer(', $code));
function Il1IIlI11I($a, $b, $c) {
$d = implode($c);
$d = preg_replace("/__halt_compiler.*/", "", $d);
return (gzinflate(base64_decode($a)));
}
function eeer($val){
global $file;
file_put_contents($file.'.deobfuscated.php', $val);
}
include($file.'.temp.php');
unlink($file.'.temp.php');
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.