Home/ Questions/Q 9201635
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-17T23:03:43+00:00

I’m playing with some PHP obfuscation/encoding tool that works without any server-side loader, and

  • 0

I’m playing with some PHP obfuscation/encoding tool that works without any server-side loader, and I surprisingly found out solution that I cannot decode.

I consider myself generally well informed about different solutions for ‘protecting’ php code by encoding and obfuscation, and I know 2 fundamental rules:

  • if PHP can read and understand your code, no matter how much obfuscated and encoded, you also can

  • encoding solutions based on usage of eval() language construct are breakable trough outputting code that is to be passed as argument in eval construct (replacing eval with echo or print)

Well, that principles worked perfectly until I found this tool, encoded exactly this code

<?php
echo "Hello World!";
?>

and got this:

<?php $_F=__FILE__;$_C0='cl92S3IqSnY0aVlwKWFwNTVwYVl8fEtyKkp2NDlZcClhb2EodWFZNDdySnYnOXNpV0xyOCA4fU9yPksgTFY4IHNKSg0gSjo+ck9KNz05dHNpOXNPIHRpU31Pcj5LOCA+T0lLSn1LSjcgYzhyDQAgS0xKICxqLCBrY1ZPNyBXT3JWJiBuSk84ckkNIFZPSiBdViZyNyBfSU8gbyggTEljTzggSQ0mQj0nNEc/aTk/Pkw+MCFKfUxJICJqSiYmSSAySU8mN0UiRzAhP2k5Pz5MPiByX3ZMSlY3Sk84pzhKDUt2NDRKfUxJdnNWOEpGKKc3Sn1JN0p2JyxrWD43cjNtN2omOHFXJQ19a2FtVi1YPnNvKEZRMmhtc286WTdrYHU3byZaN2sARk5kYlR9agB1c2tuKjdkSVkuI2B1N2thVDYrZlR9agB1czK0QnFvJmMKMjomcQ1iRgpXZlkuajMoNnAzTHFrWD5zKn1GNmozKDZwM0xxa1g+cyp9S3Nrbio3ZEklNi0zKDZvaF19KlgmfStJOn1qAAB9b2E4VjJiAGZtWik2V0tyUTJOT3FwaF03MilaNnJOKnErWgA3LWg4Z2tMJTdqQUYKQmFwN3B9Y31rTFRxcG5MfSpiY3MqbiUKcE4rfSomVDcjWgBzKjVLfSpuVHEytCVmZGZvfWoAAE5wMyg2b3Fdcw1iS3EqtEtWMjopNiZxJn0qWExzKk04WG9uY3EtcUwKak5Mcw0uS31vbkJWMlF1cSphYzcjWW1WLT4mNitNQn1qAHVRb2E4c3BmRmZtUW9OKzgNZmthY1FvOj5RbzhhaHBYSVYtLmN9cFgpc2tgY3FrJm19azpMSlclcnMqYWNxU2Z1aG0pYFZrJm1mak4rfSomVDcjM3BRLS4AfWpoXTdrbis3a25aZmpubVYyKQ1malhJcVNBNVFTM0l9Km4qLFM3STdqWFQ2cjVdN3A3cAoNM0l9azdZUS1oWgoqKSY3I30AfXBYKXNrYGFob05dc2thQjZyLlROKi51N2tuKDcjWVpxMk5dfSq0JVYyYWM2DW5jcWtuQnNrJmNxV0sqc28pJQotNyZWMjdJN2Q+cnNvOlpoQjMlUS1oDXEtYmFoWWFyc2u0Y1ZCfWVgTUxiZk03WVEtaFosI2FMLHIzYH0qJkxzIzMycS1obVYyYWMKK1RdcWsmbywAUCc0NEc/aQ=';$_D=strrev('edoced_46esab');eval($_D('JF9DMD1iYXNlNjRfZGVjb2RlKCRfQzApOyRfQzA9c3RydHIoJF9DMCwnKEEuZ1B0TzZyDVF+p1khLHszTHcwOkhxKVpXSjFkbURYbioKOGBoZkktZbQjNENOUzJhNXZbb2lda007X3hianNsY0IAdSY3eXpVVCtwOT4lRy9GCVZLPX1SRTwnLCc0QU1LPS9yT2luWbRfMQpQfkJoOg14Jlo1a1RlKkR6XVJWbUxzVUpJb1grRkMpYE5TVzk4KH0yPnZHRSVmLVFIYlt1eWc3bGRxpyx3ajM8cDA7IzZ7YXQuYwkhACcpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfQzApO2V2YWwoJF9SKTskX1I9MDskX0MwPTA7'));?>

There is really nothing special about given code except one thing I cannot explain:

when I output code that is to be passed in eval() as argument, that code generates parse error.

Naturally, PHP would not accept this:

$_C0=base64_decode($_C0);$_C0=strtr($_C0,'(A.gPtO6r
Q~§Y!,{3Lw0:Hq)ZWJ1dmDXn*
8`hfI-e´#4CNS2a5v[oi]kM;_xbjslcBu&7yzUT+p9>%G/F VK=}RE<','4AMK=/rOinY´_1
P~Bh:
x&Z5kTe*Dz]RVmLsUJIoX+FC)`NSW98(}2>vGE%f-QHb[uyg7ldq§,wj3

but that is that very code that is passed in eval() construct in encoded script above. And everything works fine.
How can that be? Eval construct is nothing more – as much as I know – then interpreting string as regular PHP code, and if that string contains something that will be incorrect for PHP in eval() -it sure will be same if that would be passed directly to script without eval.

What is the mistery here?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The result of base64_decode that you are printing contains some control characters that are tricking the console into hiding some parts of the code. The actual result is this:

    $_C0=base64_decode($_C0);$_C0=strtr($_C0,'(A.gPtO6r^MQ~§Y!,{3Lw0:Hq)ZWJ1dmDXn*
8`hfI-e´#4CNS2a5v[oi]kM;_xbjslcB^@u&7yzUT+p9>%G/F   VK=}RE<','4AMK=/rOinY´_1
P~Bh:^Mx&Z5kTe*Dz]RVmLsUJIoX+FC)`NSW98(}2>vGE%f-QHb[uyg7ldq§,wj3<p0;#6{at.c !^@');$_R=str_replace('__FILE__',"'".$_F."'",$_C0);eval($_R);$_R=0;$_C0=0;

    Which decodes into this:

    if(time()>1359388391||time()<1359294791)die('<b>This script has been expired.</b><br />Scripts protected using the PHP Guard Trial Version are valid for 24 hours only.');?><?php
echo "Hello World!";
?><?php if(headers_sent())echo(base64_decode('PGRpdiBzdHlsZT0ncG9zaXRpb246YWJzb2x1dGU7d2lkdGg6NDQwcHg7bGVmdDo1MCU7dG9wOjIwcHg7bWFyZ2luLWxlZnQ6LTI1MHB4O3BhZGRpbmc6OHB4O3BhZGRpbmctbGVmdDo0OXB4O2JvcmRlcjoxcHggc29saWQgIzk5OTtiYWNrZ3JvdW5kOiNmZjkgdXJsKGh0dHA6Ly93d3cucGhwZ3VhcmQubmV0L3NjcmlwdCkgbm8tcmVwZWF0IDI2cHggN3B4O2ZvbnQtZmFtaWx5OlZlcmRhbmEsR2VuZXZhLHNhbnMtc2VyaWY7Zm9udC1zaXplOjEycHg7Y29sb3I6IzY2NjsnIG9uY2xpY2s9J3RoaXMuc3R5bGUuZGlzcGxheT0ibm9uZSI7Jz5UaGlzIHNjcmlwdCB3YXMgcHJvdGVjdGVkIHVzaW5nIHRoZSA8YSBocmVmPSdodHRwOi8vd3d3LnBocGd1YXJkLm5ldCcgc3R5bGU9J2NvbG9yOiMwNmM7dGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTtmb250LXdlaWdodDpib2xkJyB0YXJnZXQ9J19ibGFuayc+UEhQIEd1YXJkPC9hPiBUcmlhbCBWZXJzaW9uLjwvZGl2Pg='));?>

    Which decodes into this:

    <div style='position:absolute;width:440px;left:50%;top:20px;margin-left:-250px;padding:8px;padding-left:49px;border:1px solid #999;background:#ff9 url(http://www.phpguard.net/script) no-repeat 26px 7px;font-family:Verdana,Geneva,sans-serif;font-size:12px;color:#666;' onclick='this.style.display="none";'>This script was protected using the <a href='http://www.phpguard.net' style='color:#06c;text-decoration:underline;font-weight:bold' target='_blank'>PHP Guard</a> Trial Version.</div>
    • 0