Another little gem I found on the web. I’ve come across a few files that show up as base64_decode files when you look at them, but after php has had it’s way, they output text. Come to find out, it’s a not so clever way to obfuscate code. Other folks have had need to view these files too and have posted handy little tools to aid in that effort. Here’s one of them. Just create files called decode.php, decoded.txt and coded.txt . Put the obfuscated code in coded.txt, put this program code into decode.php and run it. The output will show up in decoded.txt . Note that this is a PHP program and requires PHP to run.
<?php
echo “\nDECODE nested eval(gzinflate()) by DEBO Jurgen <jurgen@person.be>\n\n”;
echo “1. Reading coded.txt\n”;
$fp1 = fopen (“coded.txt”, “r”);
$contents = fread ($fp1, filesize (“coded.txt”));
fclose($fp1);
echo “2. Decoding\n”;
while (preg_match(“/eval\(gzinflate/”,$contents)) {
$contents=preg_replace(“/<\?|\?>/”, “”, $contents); eval(preg_replace(“/eval/”, “\$contents=”, $contents)); } echo “3. Writing decoded.txt\n”; $fp2 = fopen(“decoded.txt”,”w”); fwrite($fp2, trim($contents)); fclose($fp2);
?>