Regex Editor & Tester

Matches PHP code that executes a base64-decoded payload via eval(), specifically targeting an obfuscated shell with a known encoded string. It allows leading control characters, whitespace, or a GIF89a header to bypass basic signatures, and ends with a closing PHP tag. Useful for identifying malicious web shells in logs or file scans.