WordPress.org

Ready to get started?Download WordPress

Forums

[closed] Encrypted Theme? Here's how to decode it. (195 posts)

  1. jerickoo
    Member
    Posted 4 years ago #

    amazing work Otto!

    I have a file that doesn't seem to want to decode. I've tried several decoders, but I can't find the right one.
    The file is footer.php and is uploaded here: http://wordpress.pastebin.com/PsJ44nJy

    Could you please help me?

  2. ClaytonJames
    Member
    Posted 4 years ago #

    So which version of "Techified" are you trying to decode? You will find the matching function (F5b936250) in functions.php - nasty looking file - however I doubt that it will do any good if you are after the footer links. Last time I looked, footer links and content was being called into the footer by added code in the themes .js files.

    My rambling is of course, all dependent on the fact that you actually did pull that from a version of the Techified theme. If not - then in the immortal words of Emily Litella ;

    "Nevermind."

    :-)

  3. amberwaves
    Member
    Posted 4 years ago #

    Is this the room I take a baseball bat to the computer? ;-p

    I too have this issue, but haven't seen one so far that mirrors my situation exactly and I'm not code savvy enough to know anyway.

    I have a specific freebie with what seems to be a simple base64 decode but it's run from the theme functions php and 80% of this file is that way. I don't have a huge issue with leaving in credits but this is ridiculous these people need to be so obnoxious and force people to display irrelevant or harmful links - that's not "free", sorry.

    I decoded it fine with the base64 one, but soon as I replace that code, it screws up the whole thing, gives a warning message and I have to upload a fresh copy to get back to square one. In a couple cases, there is an "unexpected t string" parsing error which I have no clue what that is or what it means.

    The footer code itself isn't encrypted, just the functions file.

    All I want to do is decrypt all of this mess and get rid of the crap links. I'm half tempted to leave in the credits with an additional comment on the insanely retarded bs nonsense they tend to use in forcing people to display these bs links so beware when using any of their "free" themes! ;-p

    (well hey, least I leave in the credit)

    How or where can I supply the functions file to be "unobfuscated"?

    Thanks!

  4. amberwaves
    Member
    Posted 4 years ago #

    PS Update

    K, I found the paste bin thing. This is the link to the above, aptly titled ;-p

    http://obnoxiouscode.pastebin.com/yPHWX5dS

  5. jerickko
    Member
    Posted 4 years ago #

    ClaytonJames,

    I am indeed after the footer links, and moving the "most recent comments" to the sidebar.

    It also seems like the theme makes the blog go blank if its name is chnaged (via ftp and in the css file).

    I don't know how to check the version. But in the css, it says 2009. I've downloaded it from techtricks website.

    Thank you.

  6. amberwaves
    Member
    Posted 4 years ago #

    Just out of mortal curiosity, if all this really amounts to are pieces of code for "if X, then Y" instead of going to the trouble to decode and decrypt, is there a way to just delete all of the offending code itself, and then replace it with normal code?

    If all of this is just for function, so to speak, it seems to me that just removing the specific function code across the board and whatever other relevant pointers would be easier? Without wrecking the layout that is.

    Is there a Plan B that doesn't have to involve all this sort of thing?

  7. ClaytonJames
    Member
    Posted 4 years ago #

    @amberwaves

    Is there a Plan B that doesn't have to involve all this sort of thing?

    Yes. The only safe one. Don't use themes that contain this sort of thing.

    @jerickko

    I spent some time with that theme. I don't think I could honestly recommend its use unless it becomes available in an unadulterated form.

  8. ClaytonJames
    Member
    Posted 4 years ago #

    @amberwaves

    Here is what all that coded crap in your file says - pastebin link

  9. perawima
    Member
    Posted 4 years ago #

    i have the the bsocial...
    if i decode it can i modify some words in the templates like :
    Latest Post o search button ?

    sorry for my question may be this decoding is something different ..

  10. amberwaves
    Member
    Posted 4 years ago #

    @Clayton

    Yes I am aware of the protest against using them, but now it's become the principle of the thing and I am determined to not be forced out of it on account of code. ;-p

    With mine, I've already decrypted it, I've scanned all the files and unless it's completely obscure, it looks legit overall. The decryption in my case is credit link and then some sponsors forcing me to just leave them in there which I am not going to do because those are not MY links. The functions page is encrypted, the footer is fine. But again, there's some issue with changing things after it's decrypted, something I'm not doing right.

    When I replace the code (and could be how I do that?) I get string or parsing errors and then the lock out thing. Depends on which one I am tinkering with. I've checked to be sure I didn't accidentally delete anything or something and I've not done it. I decrypted the whole page to normal and replaced the functions page that way and it won't work, it'll butcher the whole format. If I leave most of the stuff encrypted and only change the links stuff, it won't work.

    When I switch out the bad code for the plaintext, do I just replace what's inside the '' marks inside the () or do I delete the whole eval base64 stuff too? I've been just replacing the code inside the '' only and that's not working. I tried deleting the whole eval part too and leaving in the plaintext but that doesn't work. I've studied the main two pages that seem to be triggered, header and footer but can't find the "trigger" code because I don't know what to look for.

    So I'm messing up somewhere. Please help!

  11. amberwaves
    Member
    Posted 4 years ago #

    Basically, the gist is, now that it's decrypted, what needs changing/fixing and where about so that I can get rid of that stuff and get on with the rest of the customization? Thanks!

  12. ClaytonJames
    Member
    Posted 4 years ago #

    Basically, the gist is, now that it's decrypted, what needs changing/fixing

    The theme hasn't been decrypted. (although you may have already done that yourself.)

    'footer.php', 'sidebar.php' and 'functions.php' all contain functions that are probably "encrypted". I only printed the messages located in functions.php that will display if you alter any of those files. The theme is built to prevent you from taking control over it.

    Look in sidebar.php and footer.php. I would also not be surprised if this type of theme may also be "calling home" at some point to verify your compliance. The bottom line is, the creator of this theme wants to control some of what is visible on your sites footer, and more bluntly, prevent you from changing it. And then there is the "license" "This theme is licensed under CC3.0". It does not appear to be GPL. Which means, encryption or not, you may not have the "right" to alter certain parts (creative attribution/links etc...) of it without the author/ distributors express permission.

    I really,really discourage you from using any theme that employs this method of "license enforcement" unless you have the knowledge to make sure it's harmless, or trust the source implicitly.

  13. jerickko
    Member
    Posted 4 years ago #

    ClaytonJames,

    can I ask you what theme you went for as an alternative?

    I've spent 2 full days searching for a theme that was the closest to my needs until I found techified.
    I probably should have spent 3 days.

  14. ClaytonJames
    Member
    Posted 4 years ago #

    In that case I ended up trying iNove and a featured content slider, but Mystique turned out to be the final choice. - I know, they're not even close to similar themes! :-)

    Good luck in the hunt!

  15. jerickko
    Member
    Posted 4 years ago #

    Thanks Clayton

    Edit: maybe I can suggest you maimpok for future reference. it has a similar layout as techified

  16. Chukwudi Emmanuel Udegbunam
    Member
    Posted 4 years ago #

    Please i need help with this footer code: http://wordpress.pastebin.com/WrnLs0pk.
    Thanks in advance.

  17. ClaytonJames
    Member
    Posted 4 years ago #

    @jerickko
    I'll give it a look, thank you!!

    @strictlyonlinebiz

    As near as I can tell, I think this is correct.

    http://wordpress.pastebin.com/tU2EzAwp

  18. Chukwudi Emmanuel Udegbunam
    Member
    Posted 4 years ago #

    @ClaytonJames: Thanks a million. It worked ;-)

  19. redcouch
    Member
    Posted 4 years ago #

    After hours of searching, here is an online base64 coder http://www.motobit.com/util/base64-decoder-encoder.asp

  20. ClaytonJames
    Member
    Posted 4 years ago #

    There are links to reliable decoders in the very first post in this thread if you need them, and in almost every other topic about base64 on this forum as well.

  21. Twitter
    Member
    Posted 4 years ago #

    Dear All

    I really need your help to decode this footer.php file. This encryption drives me totally crazy...

    The encrypt file : http://wordpress.pastebin.com/Khfm8hrk

    Btw, i tried everyting I can to decode this one, including using the following service, but can't do it :(

    http://ottodestruct.com/decoder.php
    http://www.tareeinternet.com/scripts/byterun.php
    http://www.tareeinternet.com/scripts/decrypt.php
    http://cyko.decodethe.net/

    Thanks for your help

  22. 314media
    Member
    Posted 4 years ago #

    Those decoders never freaking work... or they work for a day and then stop.

    Typically I just view source, then copy and paste from whatever is encoded and paste it in (the footer usually)...

    Typically this only works with HTML footers and stuff, ... encoded theme options and such don't work well with this method.. Just thought everyone who was looking to change links could work with this option..

  23. ClaytonJames
    Member
    Posted 4 years ago #

    Actually, it seems that when they don't work, it's usually because the encoding scheme is not the same as that of the decoder being used, or is of a more complicated or commercial nature.

    Typically this only works with HTML footers and stuff,

    I think you are probably right. you can simply paste the html from source, but you lose the dynamic properties of the php code. Fortunately, it's (the php) usually not very hard to replace.

  24. cynthiawinters
    Member
    Posted 4 years ago #

    I just noticed my coding: php eval doesn't say "eval(gzinflate"
    so that's why I think it didn't work.

    I also heard something on a different forum that if you replace the <?php eval with echo or whatever it'd work.. (I'm probally not making any sense here - I don't know anything about PHP so please excuse me)

    Is there any decoders for this string of code?:
    <?php eval(base64_decode('Pz4gCTxkaXYgaWQ9ImZvb3RlciI+DQoJDQo8ZGl2IGlkPSJmb290ZXJfYm94Ij4NCgkJPGRpdiBjbGFzcz0icmVjZW50Ij4NCgkJPGgzPlJlY2VudCBQb3N0czwvaDM+DQoJCQk8dWw+DQoJCQk8P3BocCBpZiAoZnVuY3Rpb25fZXhpc3RzKCdnZXRfcmVjZW50X3Bvc3RzJykpIGdldF9yZWNlbnRfcG9zdHMoJG5vX3Bvc3RzID0gMTApOyA/Pg0KCQkJPC91bD4NCgkJPC9kaXY+DQoJCTxkaXYgY2xhc3M9InItY29tbWVudHMiPg0KCQk8aDM+UmVjZW50IENvbW1lbnRzPC9oMz4NCgkJPHVsPg0KCQk8P3BocCBpZiAoZnVuY3Rpb25fZXhpc3RzKCdnZXRfcmVjZW50X2NvbW1lbnRzJykpIGdldF9yZWNlbnRfY29tbWVudHMoJG5vX2NvbW1lbnRzID0gNSwkYmVmb3JlID0gJzxsaT4rICcsICRhZnRlciA9ICc8L2xpPicpOyA/Pg0KCQk8L3VsPg0KCQk8L2Rpdj4NCgkJPGRpdiBjbGFzcz0iYXV0aG9yLWkiPiANCgkJPGgzPkF1dGhvciBJbmZvPC9oMz4NCgkJPHA+DQoJCVB1dCBzb21ldGhpbmcgYWJvdXQgeW91ciBwZXJzb25hbCBpbmZvcm1hdGlvbiBvciB0aGUgYmxvZydzIGluZm9ybWF0aW9uIGhlcmUgdG8gc2hvdyB5b3VyIHJlYWRlcnMgbW9yZSBjbGVhciBvZiB0aGUgc2l0ZSBQZXJoYXBzIHRoYXQgd291bGQgYmUgeW91ciBlbWFpbCAmIE1zbi48L3A+DQoJCTwvZGl2Pg0KCQk8YnIgY2xhc3M9ImNsZWFyIiAvPg0KCTwvZGl2Pg0KCQ0KCTwvZGl2PjwhLS0gI2Zvb3RlciAtLT4NCg0KPC9kaXY+PCEtLSAjd3JhcHBlciAuaGZlZWQgLS0+DQoNCg0KDQo8ZGl2IGlkPSJiLWIiPg0KPHA+DQomY29weTsgQ29weXJpZ2h0IDw/cGhwIGJsb2dpbmZvKCduYW1lJykgPz4uICA8P3BocCBpZihpc19ob21lKCkpIDogPz48YSBocmVmPSJodHRwOi8vbWVnYWNoZWFwaG9zdGluZy5jb20vIiB0aXRsZT0iQmVzdCB3ZWIgaG9zdGluZyI+QmVzdCB3ZWIgaG9zdGluZzwvYT48P3BocCBlbmRpZjsgPz4NCjwvcD4NCjw/cGhwIHdwX2Zvb3RlcigpID8+DQo8L2Rpdj4NCg0KDQo8L2JvZHk+DQo8L2h0bWw+IDw/'));?>

  25. cynthiawinters
    Member
    Posted 4 years ago #

    Okay, just want to let everyone know I resolved this issue. For those of you who have a code with base64 in it and there is not gzinflate in the beggining of the code, try using this decoder:

  26. cynthiawinters
    Member
    Posted 4 years ago #

    Here is the link again, sorry about that: (those with no gzflate code)

    http://www.tareeinternet.com/scripts/base.html

  27. pasticcio
    Member
    Posted 4 years ago #

    i need your help.
    http://wordpress.pastebin.com/nfhYdphz
    Thanks for your help

  28. Twitter
    Member
    Posted 4 years ago #

    @ All

    It's done by a guy @ sharemafia.com :D ...thanks a million mate :D

  29. kevinbanet
    Member
    Posted 4 years ago #

    @pasticcio

    Decoded code: http://wordpress.pastebin.com/B6NHXWvm

  30. pasticcio
    Member
    Posted 4 years ago #

    @kevinbanet
    thank you very much...

Topic Closed

This topic has been closed to new replies.

About this Topic