[APΣX]

No, there nothing more going on, what randomising variables? Base64? Wow, very initiative features. Suggestions, why not make it open source? White space? Junk code? Nested functions? Split evals? Split hex/octal values? High Ascii Characters? Poor effort.

Hey, this is a free tool which he's giving out. Give the man a break.

If you think you can do better make your own and share it for free.

Thanks for the release OP continue to develop your PHP skills and improve the project, I'm sure some people will find some use out of this!  👍

[Carbanak]

Hey, this is a free tool which he's giving out. Give the man a break.

If you think you can do better make your own and share it for free.

Thanks for the release OP continue to develop your PHP skills and improve the project, I'm sure some people will find some use out of this!  👍

I'd contribute my ideas if the project use source control, its just needs improvement.

Lol I know what eval does. I'm hoping "eval looping" somehow makes it an infinite loop. Don't have the time to figure it out

No there is no eval looping (whatever that means), it's just one eval function.

[Anxuein]

I'd contribute my ideas if the project use source control, its just needs improvement.


No there is no eval looping (whatever that means), it's just one eval function.

Hold up, so you're saying there is no eval looping, but don't know what it means? Great logic.

Would be cool if somehow it was able to loop endlessly when you're manually decrypting it. Some intersting use of halt compiler.. Let's try it? Shouldn't be too hard 🎉

I had a message from someone with similar code to this to decode it, if this is the site that was used then there are multiple eval() within eachother to decode. I just wrote a Python script to automatically do it.
Will double check if this was something similar (or was) the obfuscater used.

EDIT: Yes, I believe it to be the same one.

Code I got from site (cut down):

PHP Code


<?php error_reporting(0); $WQquwdfiDL = "\142\x61\x73\x65\x36\x34\x5f\144\x65\x63\x6f\x64\x65";
        $yQEkcDtRQc = "\x67\172\151\x6e\146\154\141\x74\x65";
        eval($WQquwdfiDL($yQEkcDtRQc("\125\275\115\223\253\270\26\xb5\xf9\x97\20\x9 


Reversing that a few times:

PHP Code


<?php 
iVsPulxCfr = "\142\141\163\x65\66\x34\137\x64\145\143\x6f\144\x65";

                $hMxpygqobR = "\147\x7a\151\x6e\146\x6c\x61\x74\145";

                $NUpAyiueJY = "\163\164\x72\x5f\162\157\x74\61\63";

                eval($hMxpygqobR($iVsPulxCfr($NUpAyiueJY("GMmUwdGtgzoU3IX/j9KEUqjJN7kGdjq4ojVCBuAZ4Y2Uc+/V0+6zIXdfINQOm977Jlfe4A8GnLweYIKm8q/+57/94583tsjGkhO 


Notice how there's more evals()? That's eval looping. Eventually after reversing you'll get the code you want, but it is a lot of times IIRC.

[Carbanak]

Hold up, so you're saying there is no eval looping, but don't know what it means? Great logic.


I had a message from someone with similar code to this to decode it, if this is the site that was used then there are multiple eval() within eachother to decode. I just wrote a Python script to automatically do it.
Will double check if this was something similar (or was) the obfuscater used.

EDIT: Yes, I believe it to be the same one.

Code I got from site (cut down):

PHP Code


<?php error_reporting(0); $WQquwdfiDL = "\142\x61\x73\x65\x36\x34\x5f\144\x65\x63\x6f\x64\x65";
        $yQEkcDtRQc = "\x67\172\151\x6e\146\154\141\x74\x65";
        eval($WQquwdfiDL($yQEkcDtRQc("\125\275\115\223\253\270\26\xb5\xf9\x97\20\x9 


Reversing that a few times:

PHP Code


<?php 
iVsPulxCfr = "\142\141\163\x65\66\x34\137\x64\145\143\x6f\144\x65";

                $hMxpygqobR = "\147\x7a\151\x6e\146\x6c\x61\x74\145";

                $NUpAyiueJY = "\163\164\x72\x5f\162\157\x74\61\63";

                eval($hMxpygqobR($iVsPulxCfr($NUpAyiueJY("GMmUwdGtgzoU3IX/j9KEUqjJN7kGdjq4ojVCBuAZ4Y2Uc+/V0+6zIXdfINQOm977Jlfe4A8GnLweYIKm8q/+57/94583tsjGkhO 


Notice how there's more evals()? That's eval looping. Eventually after reversing you'll get the code you want, but it is a lot of times IIRC.

There is no loop, are you brain dead? Its just one eval function, no nested functions.
Regarding your code it's not the code from the website.