owencutajar: I’ve seen this one before. It’s doing an eval. Here’s the code simplified a bit:
$_F=__FILE__;
$_X='big_base_64_string';
eval(base64_decode('another_big_string'));?>
The second big string produces this when decoded:
$_X=base64_decode($_X);
$_X=strtr($_X,'123456aouie','aouie123456');
$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);
eval($_R);
$_R=0;
$_X=0;
When that is eval’d, it does the following:
1. base64 decodes the first big string
2. Swaps the vowels with numbers and numbers with vowels (simple but primitive obfuscation technique).
3. Eval’s the string.
If you were to decode that first string, you’d get something like this (bits removed for size):
?>
<d4v cl1ss="cl51r"></d4v>
</d4v>
</d4v>
<d4v cl1ss="f22t5r">
D5s4gn by <1 hr5f="https://www.w5baf55l.c2m">J4ns2n1</1>
...
</b2dy>
</html>
Note the initial ?> bit in that code. When you eval a string, you’re executing the string as if it’s PHP code. When the string contains the PHP closing ?> like that, then this causes it to produce simple output, just as if you had echo’d it. That’s the main output section.
In short, the first string is the actual content, the second one is the decoder and the output function.
Note that the ereg_replace and the reference to __FILE__ are designed to make any __FILE__ calls in the obfuscated code continue to function even through the eval, where they would normally break. Even though this is not used here. This indicates that the author used a generic PHP code obfuscator of some sort.
Trick to decoding these:
Throw the chunk of code into a file all by itself, like “temp.php”. Run that code only. The output it produces can replace the original code. And then you can modify it all you like.
