Decode obfuscated PHP source code

Question

How can I rewrite each file into readable code?

For example in the source code there's variables like this:

${"\x47\x4c\x4f\x42\x41\x4cS"}["y\x61\x72\x64s\x70\x71"]="va\x6cu\x65";

How can I convert that into readable code such as:

$somevariable = "somevalue";

Answer 1

That's not UTF8, that's just some obfuscation someone thought of to make the script less readable. You can convert every string to its character representation. For instance \\x41 means 'captial A'.

You don't have to convert these values yourself. When you echo the string, it will show its actual value.

The accolades are just a way to use a string value for a variable name, so ${'foo'} = 10; will set the variable $foo to 10.

In your case, you got a script that's messing with your globals.

<pre><?php

//${"\x47\x4c\x4f\x42\x41\x4cS"}["y\x61\x72\x64s\x70\x71"]="va\x6cu\x65";

echo
  'It means: ' .
  '${"' . "\x47\x4c\x4f\x42\x41\x4cS" .
  '"}["' . "y\x61\x72\x64s\x70\x71" . '"]="' .
  "va\x6cu\x65" . '";<br>';

// = $GLOBALS['yardspq'] = 'value';

var_dump(${"\x47\x4c\x4f\x42\x41\x4cS"});

?>

Answer 2

Just replace all occurrences of \\xNN with chr(NN) . For example:

$source = file_get_contents('obfuscated_source.php');
if (preg_match_all('/\\x(..)/', $source, $matches)) {
    for ($i = 0, $len = count($matches[0]); $i < $len; ++$i) {
        $source = str_replace($matches[0][$i], chr(hexdec($matches[1][$i])), $source);
    }
}
file_put_contents('source.php', $source);

Answer 3

Simply make it print out the plain strings, like:

<pre><?php
    //${"\x47\x4c\x4f\x42\x41\x4cS"}["y\x61\x72\x64s\x70\x71"]="va\x6cu\x65";
    print_r(
        array(
            "\x47\x4c\x4f\x42\x41\x4cS",
            "y\x61\x72\x64s\x70\x71",
            "va\x6cu\x65",
        )
    );
?></pre>

To me, it resulted in:

$GLOBALS["yardspq"]="value";

See it working...

Answer 4

I would use PHP de-obfuscators (reverse PHP encoding processors)...

Searching for "PHP deobfuscator" you may find many, the list grows as it is becoming common to find such in injected files from hacked websites.

Such injections are usually mass processed, so it may be possible to find solutions by experts for most cases.

Answer 5

I don't think there is any script that "clean" an obfuscated code.

For your commnent, that line is "equal" to something like

$array["key"] = 'value';