UnPHP

What it does

Automatically decodes PHP files that use common obfuscation techniques like eval, base64_decode, gzinflate, and str_rot13 combinations.

When to use it

• Quick analysis of PHP malware
• When you suspect nested encoding
• First-pass decode before manual review

When not to use it

• Non-PHP code
• Custom or unusual obfuscation
• When you need to understand the decode steps

Limitations

• Only handles common patterns
• May not fully decode custom obfuscation
• No offline option