NAME

php_decode

SYNOPSIS

   To decode an obfuscated php script:
   > php_decode <php-file>

   To show warnings regarding partial execution:
   > php_decode -w <php-file>

DESCRIPTION

The php_decode tool parses php code files and tries to apply all possible static transformations for php variables and values defined in the script. The decoded file is formatted and printed to stdout. It includes a '$STDOUT' variable for any script output from echo or print statements.

The decoder uses a custom php parser which does not depend on a special php version. It supports most php syntax of interpreters from php5 to php8.

The tool was mainly written for for php malware analysis. It does not implement php functions with any kind of side-effect.

SEE ALSO

Requires the PHP::Decode Module.

AUTHORS

Barnim Dzwillo @ Strato AG