Regex Tester & Validator

Detects a PHP backdoor masquerading as a BuddyPress plugin, often hidden in a file with a GIF89 image header (polyglot technique). It matches binary/non-printable prefix bytes, the fake 'Plugin Name: BuddyPres' header, obfuscated functions like mainfuncworker1329 and receiveinfofunc52432 that fetch remote content via file_get_contents, drop payloads with file_put_contents, and register a WordPress 'init' hook triggered via $_REQUEST. Used by malware scanners and web security tooling to identify this dropper signature.