Sasith Maduranga Sasith Maduranga - 1 month ago 7x
PHP Question

how to reverse php obfuscated code?

I decode some of my ionCube encoded PHP pages but it contain code with obfuscated PHP function names:

Example :

_obfuscate_DRYWMSUQDzIXCSohIQMqCz0NJiIUBSI├┐("Location: error.php");

this is the code for header function.

header("Location: error.php");

can you anyone please explain me how to this deobfuscate this code ?


Obfuscation is designed to be irreversible - if there was a method to easily reverse the obfuscation then using obfuscation would be pointless. Think of it as hashing the function name -- although it may be possible to bruteforce the original names, you'll have to put some serious effort into it, including:

  • Find out which hashing algorithm is used
  • Get the used obfuscation key (which was specified during the encoding)
  • Bruteforce every single function name, starting from a() to my_function_name_that_does_something()

As indicated in the comments, your only realistic chance at retrieving the original source code is to contact the original developer. You wouldn't expect to gain the original source code from a binary file compiled from C code, would you?