Decode obfuscated PHP source code

Question

How can I rewrite each file into readable code?

For example in the source code there's variables like this:

${"\x47\x4c\x4f\x42\x41\x4cS"}["y\x61\x72\x64s\x70\x71"]="va\x6cu\x65";

How can I convert that into readable code such as:

$somevariable = "somevalue";

Answer 1

That's not UTF8, that's just some obfuscation someone thought of to make the script less readable. You can convert every string to its character representation. For instance \x41 means 'captial A'.

You don't have to convert these values yourself. When you echo the string, it will show its actual value.

The accolades are just a way to use a string value for a variable name, so ${'foo'} = 10; will set the variable $foo to 10.

In your case, you got a script that's messing with your globals.

<pre><?php

//${"\x47\x4c\x4f\x42\x41\x4cS"}["y\x61\x72\x64s\x70\x71"]="va\x6cu\x65";

echo
  'It means: ' .
  '${"' . "\x47\x4c\x4f\x42\x41\x4cS" .
  '"}["' . "y\x61\x72\x64s\x70\x71" . '"]="' .
  "va\x6cu\x65" . '";<br>';

// = $GLOBALS['yardspq'] = 'value';

var_dump(${"\x47\x4c\x4f\x42\x41\x4cS"});

?>