PHP Encoding and Decode - php

Question

I have a slice of php encoded code but I don't know how it encoded i mean by which why they encoded this code when i use unphp.net successfully it decode the code and get the real code
simple of encoded code define("\x53\x54\117\103\113\x5f\103\x48\105\x43\113", false) my question is how i can encode another code to be like this and it by which why is encoded please anyone have a knowledge about tell me or know any tool to suggest

Answer 1

I would need more information for me to be able to discern what obfuscator was actually used to encode this, but for this specific string, it appears to be a mix of hex- and octal- encoded letters
"\x53\x54\117\103\113\x5f\103\x48\105\x43\113"
\xFF - Hex
\000 - Octal
The sequence above is encoded as follows (where x is hex and 8 is octal): xx888x8x8x8
This sequence may be random or intentional. Assuming it's random, the following function may be used to encode any string in like manner using random_int() for selecting encoding method at random.
<?php
function hex_octal_rand_encode($s) {
$result = '';
foreach (str_split($s) as $c) {
$d = ord($c);
// select encoding method at random (0 = hex, 1 = oct)
$result .= (random_int(0, 1) === 0)
? '\\x' . dechex($d)
: '\\' . decoct($d);
}
return $result;
}
// Test
$input = "STOCK_CHECK";
$encoded = hex_octal_rand_encode($input);
echo sprintf("Encoded: %s\n", $encoded);
$cmd = sprintf('return "%s";', $encoded);
echo sprintf("Decoded: %s\n", eval($cmd));
?>
Sample outputs (notice the encoded value changes):
Encoded: \x53\x54\117\103\x4b\137\x43\x48\x45\x43\x4b
Decoded: STOCK_CHECK
Encoded: \x53\124\x4f\x43\113\x5f\x43\110\x45\x43\x4b
Decoded: STOCK_CHECK
Encoded: \123\124\x4f\x43\113\137\x43\x48\105\x43\113
Decoded: STOCK_CHECK