I recently ran across a freeware web application written in PHP that utilized the following method to encrypt its source code: <?php eval(gzinflate(base64_decode('encoded text'))); ?> Fortunately, I was able to decode it with this PHP snippet:
PHP:
-
<?php
-
/*
-
Taken from http://www.php.net/manual/de/function.eval.php#59862
-
Directions:
-
1. Save this snippet as decrypt.php
-
2. Save encoded PHP code in coded.txt
-
3. Create a blank file called decoded.txt (from shell do CHMOD 0666 decoded.txt)
-
4. Execute this script (visit decrypt.php in a web browser or do php decrypt.php in the shell)
-
5. Open decoded.txt, the PHP should be decrypted if not post the code on http://www.ariadoss.com/forums/web-development/lamp
-
*/
-
echo "\nDECODE nested eval(gzinflate()) by DEBO Jurgen <jurgen@person.be>\n\n";
-
echo "1. Reading coded.txt\n";
-
echo "2. Decoding\n";
-
$contents=preg_replace("/<\?|\?>/", "", $contents); eval(preg_replace("/eval/", "\$contents=", $contents)); } echo "3. Writing decoded.txt\n"; $fp2 = fopen("decoded.txt","w"); fwrite($fp2, trim($contents)); fclose($fp2);
-
?>
Upon decrypting the source code I realized that the freeware application downloaded spyware onto visitors' computers as well as periodically initiated pop-ups that contained obvious spam. I posted this article in order for others to be able to examine the actual source of these applications in order to prevent them from inadvertently running malicious code on their websites. I hope this helped some of you and I will endeavor to continue to post useful and insightful entries from now on.
How should anyone implement How should anyone implement this code? Add it to a encrypted php file, ???
Eval 2 echo Changing 'eval' to 'echo' in the script simply prints the script and you can see it by checking the page's source.
Not if they have encrypted Not if they have encrypted it multiple times or are using various methods to obfuscate the original code, which is often the case. Though it is a good place to start, and works in many cases.
Directions to use the snippet:
1.) Save the code you wish to decode in coded.txt
2.) Save the above PHP snippet in file like decrypt.php
3.) Create an empty text file called decoded.txt and it CHMOD it to 0666.
4.) Run decrypt.php and open up decoded.txt to view the source code.
error i got following error
Parse error: syntax error, unexpected '<' in /home/web123/public_html/decrypt.php(8) : eval()'d code on line
recursive gzinflate base64_decode and str_rot13 i code a small function that handels recursive decryption with eval(gzinflate(base64_decode('FZ3HjuvQlUV...xyz'))); and eval(gzinflate(str_rot13(base64_decode('FZ3HjuvQlUV...xyz'))));
http://macosbrain.ath.cx/wordpress/2006/08/17/decode-function-eval-gzinflate-base64_decode-str_rot13/
Great Utility - thank you! I used it to decrypt one PHP hitcounter with some ad string attached to the results (and repleaced english comments with my native language ones).
Once again thanks!
How to decode after following the above method i recieved another encrypted file. how to decodes files which are encoded by
eval(gzinflate(str_rot13(base64_decode('FZ.........9Hw=='))));
Please email me the method on jainritesh007@gmail.com
Thanking You,
Ritesh Jain
Name & Shame Hey Danilo,
Why not name the freeware snippet so you can shame it?
At least, for those of us without the time to code?
I would, but I'm sure it would be in violation of the author's intellectual property rights.
How to encrypt the php code encrpyted by PHPLOCKIT How to encrypt the php code encrypted by PHPLOCKIT?
They are also using eval((base64_decode()
Hi!
I tried to decode shell that some hackers left on my website. It's important for me to decode it.
I have this error on localhost and my web host:
=========================
DECODE nested eval(gzinflate()) by DEBO Jurgen 1. Reading coded.txt 2. Decoding
Parse error: parse error, unexpected T_VARIABLE in z:\home\localhost\www\dec\decrypt.php(18) : eval()'d code on line 3
=========================
Best regards,
timsky
Great little tool saved me make a script worked first time changed the txt to php just so i don't have to keep changing the extention to read the code.
hey i need help here please!! someone knows how to decode a php file that has been coded with a software name SOURCECOP? i really need help please! any comment will be welcome!!
Thanks a lot for this info. I was trying to install this image script but then it wouldn't work so I googled and came to your site as first listing in order to find a way to decrypt it. Thanks!
Hai
I want to decript the PHP code HOw to do it
Can some one let me know how to do chmod 0666 in IIS on windows. Thanks in advance.
SourceCop decoder can be found here:
http://www.region59.net/unlockit/decoder.php
please help me i want to decode my php file are someone have full step by step to get started and how can i decode zend..?? anyone will help me..?? i really apreciate it god bless u all
send to my mail at sima_carl998@yahoo.com.my please also source code ok
hello smart-guy can u give me full code source to decoded source corp please i will wait here at azli_bdr008@yahoocom please help me ok you will be the best here...thanks a lot
I tried this script and it only copied the coded.txt to decoded.txt has anyone else had this problem if so what was the fix?
Thanks
awesome. thanks!
blogit - that was happening when I first tried but I think it was because I only placed the encryped string into coded.txt. I then placed the code as it appears into coded.txt:
eval(gzinflate(decode_base64('encrypted string')));
Then it worked.
I know it is too late but it might help someone else in the future
Thanks for the snippet!
TNX SO MUCH MAN THİS REALLY WORKED
Only getting this when trying to run the file
Server error!
The server encountered an internal error and was unable to complete your request.
Error message:
Premature end of script headers: decrypt.php
hi i wanted to decode a texx that is eval(gzinflate(base64_decode please if someone could help me I will be so greatfull. Thanks!! Mi mail is matt@clinf.net
You rock. Worked like a charm. Just put the whole eval statement including the "eval(gzinflate(base64_decode(" and all the jibberish into the coded.text file. Run the decrypt and bam. Thanks for the great little script.
Hi,
Thanks so much for the info..
It worked!..
The script did not work for the first time. Then i deleted the decoded.txt file and uploaded a fresh one. It worked..
Try uploading to the server and work on it directly instead of doing it locally. Might work
Great script. Thanks once again
i am getting this:
Parse error: syntax error, unexpected T_DNUMBER in /home/livemkco/feastyourbuds/decript.php on line 12
It's really work, thank you.
hey I got it to work
Hey, I tried to use your decoder, but It seems to me that I'm getting exactly the same code back in the decoded.txt file as I put in with the coded.txt file.
Could you help me out here?
The code used is:
(By the way, this is a code belonging to gbook, - it is not my intension to wipe away the link of the maker, I just want to be able to style it the way I want.)
Thanks! It worked like a charm!
This works, only put starting with the eval( and leave off the beginning
MFS
I need help decoding this
thanks for the snippet it worked great
decode code pls help me sent pls email me ozelguvenlikler@gmail.com
Thx for the awesome script! worked like a charm.
Men U´R Great. . . . thanks, i could understand the code, was very easy, but i was close on other stuff.
chiers DinR
Snippet, Schimpet....
Just go to ...
http://www.3dmobility.com/decrypt2.php
Enter/paste your encrypted stuff in the upper textbox
Press 'Decode'
Copy your decoded results from the bottom textbox.
Yo!
Mac
wow it works.. whil eother post doesnt...
whil eother post doesnt... , thanks it workss
wow!... this really works!
Helpful code but I'd recommend against calling eval() on what you get back. People could stick whatever they want in there and you'll happily execute it.
I made a couple tweaks, basically doing
$contents= preg_replace("/eval\(gzinflate\(base64_decode/", "", $contents);
then
$contents= gzinflate(base64_decode($contents));
So that it's not necessary to rely on the gzinflate and base64_decode being the only function calls in the code.
I can send you my complete changes (I doubt it'd paste in here cleanly) if you'd like, just email me.
Thanks again.
Wow, exactly what I was looking for! Works great and I was able to get rid of these annoying texts. Thanks!!!
It worked fine for me
Tanks a lot ! 
Can anyone can decode this?
great call keyser - that was exactly the problem. thanks all!
I made a couple tweaks, basically doing
$contents= preg_replace("/eval\(gzinflate\(base64_decode/", "", $contents);
then
$contents= gzinflate(base64_decode($contents));
Never mind delete my previous comment. Got it to work via another decoding application. Thanks for bringing this to my attention.
Can anyone can decode this?
I Dont Understand S:
Worked a treat! - Thank you!!!!
salamat pare hehe. this solved my problem.
Dude! that rocked the heck out of that garbage text! Thanks a million!!!
hello there.
can anyone decode the following code. I am not able to do it. i was able to decode before this, buit now i keep getting error even though i have not changed anuthing in my decrypt.php. i have also checked and double checked that my decrypt file is correct.
error message
DECODE nested val(gzinflate()) by DEBO Jurgen
1. Reading coded.txt 2. Decoding
Parse error: syntax error, unexpected T_VARIABLE in my_decrypt_file_location/decrypt.php(18) : eval()'d code on line 1
coded.txt
when i try to do this in another domain of mine. there is no parse eror but i only get to see
DECODE nested eval(gzinflate()) by DEBO Jurgen
1. Reading coded.txt 2. Decoding[/code]
which is strange because the decrypt file is same in both the places.
thanks
Hey guys, i figured out anither easy way to decode footers. just replace the eval word with echo. now instead of giving the decoded code it will print it out. Now check your page source it will be there.
If you have a footer which does not have a eval function and have some thing starting like $o="QAAA...... " or $__F=__FILE__;$__C # then just run the php file as it is on server and them check page source!
but there are custom encryption where i can not help
More information:
http://www.karananand.co.cc/blog/2008/07/the-easiest-way-to-decode-decrypt-eval-gzinflate-str_rot13-base64_decode-or-__f__file____c/
Thanks a LOOOOOOOOT!!!!!!!!!!! Works GREAT!!!!!!!!!!!!!!!!!!
Thanks mac that link worked perfect, You rock.
and also thanks to Tangental.
All those links are belong to me
This works perfectly! Thanks for publishing this great script.