Decoding gzinflate base64_decode

Some themes add a copyright notice using a technique also seen in hack scripts. They take the PHP code, and the base64 encode it, and gzip it. (Hack scripts also eval the code.) Below is a snippet of code that will decode the encoded data, and then save it out as 'some-script.php'.

To use it, first find the code that looks like "eval(gzinflate(base64_decode('ponbZ2smNT3Fy6.....W+ebF')));", and replace the eval with "$script = (gzinflate" and so on. Then, you run this code on $script.

while(preg_match('/^eval\(gzinflate\(base64_decode\(/', $script)) {
    echo '*bingo*';
    $s = substr($script, 30);
    $s = substr($s, 0, -5);
    $script = gzinflate(base64_decode($s));
}
file_put_contents('some-script.php', $script);

.