How the IonCube decoder works

1. Upload & isolation

Your file is received over HTTPS and queued for processing. Every decode runs inside an ephemeral Firecracker microVM — an isolated sandbox with its own kernel, memory, and filesystem. Nothing from one decode persists to the next.

2. Version detection

The file header is inspected to detect the IonCube version (10 through 15) and target PHP version (7.1 through 8.4). The matching PHP runtime with the correct IonCube loader is loaded inside the VM.

3. Bytecode lifting

The IonCube bytecode is extracted and lifted back into Zend opcodes. A custom decompiler walks the opcode stream and reconstructs PHP source — functions, classes, control flow, and literals — with formatting that closely mirrors the original.

4. Key recovery (for protected files)

IonCube's XERROR callback-key mechanism leaves some function bodies encrypted behind runtime-generated keys. The full-decode pipeline attempts three rounds of recovery:

1. Static scan for key variables assigned in the source
2. Live execution of key-generation functions inside the sandbox
3. LLM-assisted analysis of obfuscated key routines as a fallback

5. Preview vs. full decode

The web preview returns the first 20 decoded lines, rendered server-side with syntax highlighting. The full decoded file is delivered via the Telegram bot (@ioncubedecode_bot) after a 1-credit charge in USDT-TRC20.