Tag Archives: php obfuscation

Deobfuscating a Wicked-Looking Script

Posted on March 3, 2015 by darryl

Bart Blaze, one of my security researcher friends passed along this PHP script to me. Let’s have a look. It looks like PHP ate some Perl and barfed it out. First thing I asked myself is, “does this even run?” … Continue reading →

Posted in Malscript | Tagged , , | Comments Off on Deobfuscating a Wicked-Looking Script

Reversing a PHP Script Dynamically and Statically

Posted on July 11, 2014 by darryl

A reader sent me two PHP scripts because the PHP Converter program I wrote wasn’t able to handle it. They are both similar so I’ll just work on one of them in this post. Here’s what it looks like: And … Continue reading →

Posted in Malscript, Tools | Tagged , , | Comments Off on Reversing a PHP Script Dynamically and Statically

Deobfuscating PHP Scripts

Posted on June 1, 2014 by darryl

Occasionally people send me PHP scripts to help them analyze it. Most of the time, it’s simply unescaping the script and finding the right variable to echo. I got two tricky ones within the past couple of months and finally … Continue reading →

Posted in Malscript, Tools | Tagged , | Comments Off on Deobfuscating PHP Scripts