Read obfuscated PHP.
Paste a file you found on a server. The deobfuscator peels off every layer of eval, base64, gzinflate and goto, and shows the code that would really run. Nothing is executed.
A limit was reached on this file: some parts may still be encoded.
What it unpacks
Built from thousands of real samples caught by Pyxsoft Anti Malware on hosting servers.
eval onions
eval, assert, create_function and preg_replace /e, layer after layer, each one shown where it ran.
Encodings
base64, gzinflate, gzuncompress, str_rot13, strrev, hex and octal escapes, urldecode, XOR keys.
Built names
Function names assembled from character tables, $GLOBALS arrays, variable variables and chr() chains.
goto mazes
Code shuffled with goto put back in the order it runs, as if, while and break.
Custom decoders
The obfuscator’s own decoding functions run on their arguments, without running the file.
Hidden payloads
Data after __halt_compiler or exit, code read from the file itself, AES keys taken from the User-Agent.
One file tells you what happened. The scanner finds where else.
Pyxsoft Anti Malware reads obfuscated code the same way this tool does, so a new wrapper around an old web shell does not hide it. 3 of 4 threats Pyxsoft Anti Malware caught in the last 30 days were unknown to VirusTotal.