ionCube 7-15
Headers, licences, obfuscated names and Dynamic Keys, encoders 7 to 15, PHP 5.0 to 8.5.
PHP source recovery · PHP 5.0 → 8.5
Decode ionCube & SourceGuardian PHP files
Recover readable PHP source from protected files, including complex dynamic-key cases. One engine for ionCube, SourceGuardian, Zend Guard and PHP-goto.
- 7-15ionCube versions
- 5.0 → 8.5PHP targets
- IC · SG · ZG · gotoprotectors
<?php //00363
if (extension_loaded('ionCube Loader')) { ... }
?>
HR+cPntfYPVvDdBOW5mSj5n5oZYiJdWjbjvFKkihsyZGkwUMbBbnoPpXQuC+6YfrYUi3Vsv1as
ibXHW/BJ0lAA08/QeNB7hgBV5LNkx6RIRtyN8UH4W9EtCIYUXwBYZDFz8n9sHOB7kaxhG5chb7
3nj379jGJfUri7v4Nqo3RnQMtvv7h9rW0Ws2G5+4vz11FnEQbAg3tpGA46Skk8jG+/GbmfuKKL ...<?php
function check_license($key, $domain)
{
$parts = explode('-', strtoupper(trim($key)));
if (count($parts) !== 4) {
return false;
}
$sum = 0;
foreach ($parts as $i => $part) {
$sum += crc32($part) * ($i + 1);
}
...<?php
if (!function_exists('sg_load')) { ... }
return sg_load('32590254C7C4F689AAQAAAAiAAAABKgAAACABAAAAAAAAAD/KwQzQjn7D3zkPeT0mKM/7spXJd
LABUAwu+1ygF986erFfRuN9in4KsLSY/QQHybnx1EKylor/BgN9TS9TxBb5nOYtP9vnebRAOR1
df6RU+h+sI90651P3UL4LSI/G6FpZfYs/XDxxH03roJbjF98iDCNVUrd018BgJjkrqjOThCgmO ...');<?php
function cart_total(array $lines, $vatRate = 20)
{
$net = 0;
foreach ($lines as $line) {
$price = $line['price'] * $line['qty'];
if (isset($line['discount'])) {
$price -= $price * $line['discount'] / 100;
}
$net += $price;
}
...<?php @Zend;
3074;
/* This is not a text file! */
.exit();.__halt_compiler();.?>...2004072203..65543..899..2522.x...2.uX;OTA
...c.^..i.Ph..<.01...0.ln.K.....%..X..Xkc./.V...{.Ct.<.\.....|[email protected]..
.i.ez\..Yp...".Q>cT.\.n(f ..O..;.x.{.).>.....!.....^}...!..k.G...-.l...%ey ...<?php
function route_request($path, array $routes)
{
$path = '/' . trim(parse_url($path, PHP_URL_PATH), '/');
foreach ($routes as $pattern => $handler) {
$regex = '#^' . preg_replace('/\\{\\w+\\}/', '([^/]+)', $pattern) . '$#';
if (preg_match($regex, $path, $m)) {
array_shift($m);
return [
$handler,
$m
];
...function drain_queue(array $jobs, $maxRetries = 3) { goto LqmoU; l2H8p:
goto r5OcL; goto Kz63N; gH0nx: goto V5pF1; goto l_kdE; Z2U0N: if (!$jobs)
{ goto nOoZ9; } goto qmsqV; SrlLo: if ($job["\x73\x74\x61\164\x65"] ===
"\x72\145\x61\x64\171") { goto ICtZ4; } goto i5nG7; i5nG7:
$job["\x74\162\151\145\x73"]++; goto rEXHY; jYq2e: N_3iB: goto SrlLo;
LqmoU: $done = 0; goto PhFFI; Kz63N: nOoZ9: goto kzrD1; PhFFI: r5OcL: goto ...<?php
function drain_queue(array $jobs, $maxRetries = 3)
{
$done = 0;
while ($jobs) {
$job = array_shift($jobs);
if ($job['tries'] >= $maxRetries) {
continue;
}
if ($job['state'] === 'ready') {
$done++;
}
...Try it free
Upload a protected PHP file and get a free preview of about 20% of the recovered source, before you pay.
What we decode
SourceGuardian
Bytecode of versions 5.0 to 8.5, with the loader's own quirks reproduced.
Zend Guard
The @Zend container of PHP 5.0 to 5.6: classes, traits, closures and obfuscated names.
PHP-goto
Source an obfuscator flattened into goto, put back into loops and branches.
Three steps to your source
- 01
Upload
Drop your ionCube or SourceGuardian PHP file.
- 02
Preview
See decoded structure and any dynamic-key context needed.
- 03
Recover
Download the full source, or add the key context to finish.
Simple pricing · pay with crypto
A batch of files that never expires and only counts the files we actually decode. Pay with crypto.
150 files
€10
150 files, no time limit
1200 files
€36
1,200 files, no time limit
2600 files
€58
2,600 files, no time limit
Accepted today
BitcoinBTC
DogecoinDOGE
LitecoinLTC
Pay from any wallet or exchange. The receiving address comes with your order, and access opens by itself once the payment is confirmed.
Frequently asked questions
Which protectors and PHP versions do you support?
ionCube 7-15, SourceGuardian, Zend Guard and PHP-goto, for PHP 5.0 to 8.5.
Is there a free preview?
Yes, you get a free preview of about 20% of the recovered source before paying.
What can I send, and how much at once?
Loose .php files or a single .zip archive. Up to 5 MB per loose file, 200 of them in one go and 100 MB in total, and anything bigger travels inside the zip. You get one report and one archive back, whichever way the files came.
My file has obfuscated names (obf_...). Can you get the real ones back?
ionCube can replace every class, function and variable name with a one-way hash, which cannot be reversed. The decoder hashes candidate names instead and keeps the ones that match, so a name is either proven or left alone. Our list holds about 900,000 names, your account can store its own on top of it, and a decode can collect the names your files already show in clear and add them to your list, which is the quickest way to fill it.
Do you support ionCube dynamic keys (callback keys)?
Yes. A body locked by a dynamic key needs the value the original code computed at runtime. The decoder works out every value it can on its own and reports each wall it could not pass, with the source of the resolver behind it. From that report an editor opens where you supply the value or the missing PHP, and the next pass runs on the pack we already hold, so nothing is uploaded again.
What if a file cannot be fully decoded?
The report names every file, what came back and what is still missing, so you know exactly what to provide next rather than guessing. On a batch of files, nothing is taken from your balance until you accept the result: a pack whose bodies stay locked by Dynamic Keys is paid for when you press "I'm done" in the editor, and never before.
How long do you keep my files?
Decoded results stay on the storage for 6 months, then they are removed. You can also delete any of them yourself from your dashboard, at any time.
How do I pay?
With cryptocurrency. A batch of files has no deadline: it sits on your balance, a new batch adds to what is left, and a pack is only charged when you accept the result, for the files we actually decoded. The ones we merely copied over, and the ones we failed on, are free.
Can resellers use an API?
Yes. A reseller account gets a USER and KEY pair, shown in its own dashboard and replaceable at any time, and posts files to our API, which answers with a job id to poll and a link to the finished archive. Only a reseller account has that section, and the API stops answering once the files on the account behind the keys run out.