Sasith Maduranga Sasith Maduranga - 2 months ago 24
PHP Question

how to reverse php obfuscated code?

I decode some of my ionCube encoded PHP pages but it contain code with obfuscated PHP function names:

Example :

_obfuscate_DRYWMSUQDzIXCSohIQMqCz0NJiIUBSI├┐("Location: error.php");


this is the code for header function.

header("Location: error.php");


can you anyone please explain me how to this deobfuscate this code ?

Answer

Obfuscation is designed to be irreversible - if there was a method to easily reverse the obfuscation then using obfuscation would be pointless. Think of it as hashing the function name -- although it may be possible to bruteforce the original names, you'll have to put some serious effort into it, including:

  • Find out which hashing algorithm is used
  • Get the used obfuscation key (which was specified during the encoding)
  • Bruteforce every single function name, starting from a() to my_function_name_that_does_something()

As indicated in the comments, your only realistic chance at retrieving the original source code is to contact the original developer. You wouldn't expect to gain the original source code from a binary file compiled from C code, would you?

Comments