WordPress.org

Ready to get started?Download WordPress

Forums

124

[closed] Posts requests for theme decoding in here (111 posts)

  1. mrmist
    Forum Janitor
    Posted 4 years ago #

    First read using this information.

    If you can't decode your own encrypted themes using this information and still want to use one rather than pick from the thousands of themes that don't have obfuscated code in them, please post your request for decryption in here, and maybe someone will help you out.

    Note

    • Code should be place into a pastebin, not into this thread.
    • Decoding the theme does not guarantee safety from malicious code.
    • Seperate decoding threads will be closed.
    • Best practice is to avoid such websites that distribute malicious code in themes (most of them just provide ripped knockoff themes, why trust these people?)
  2. originalconcept
    Member
    Posted 4 years ago #

    I, I couldnt do it, please help me:

    http://wordpress.pastebin.ca/1863373

    thanks

  3. z2
    Member
    Posted 4 years ago #

    After alot of research and looking around I can't find a way to decode this BASE64 footer. I think it's double encoded, can anyone help out:

    [link moderated] As the opening post says, use a pastebin.

    Thanks for any help you guys can offer

  4. marksweb
    Member
    Posted 4 years ago #

    Hi,

    Theres an encoded functions file in this theme I've got;
    http://pastebin.com/pZPLZeEm

    Its a superb theme but I want to wigitize it and edit the custom settings page that the functions add to the admin panel.

    If someone could decrypt it I'd be most appreciative, I tried to decrypt it but couldn't get the entire file :(

    thanks

  5. mailcatala
    Member
    Posted 4 years ago #

    Looks like WordPress itself is now posting themes with encrypted code.

    If that's not the case, I would appreciate if someone can decrypt functions.php from veryplaintxt before the guy from the theme starts stealing Paypal passwords from everybody who runs the theme.

  6. kevinbanet
    Member
    Posted 4 years ago #

    @originalconcept:

    Your theme was obfuscated. In decoded form it can be seen at http://wordpress.pastebin.ca/1869595

  7. kevinbanet
    Member
    Posted 4 years ago #

  8. kevinbanet
    Member
    Posted 4 years ago #

    @marksweb:

    Decoded: http://pastebin.com/3Jt0Us9v

  9. kevinbanet
    Member
    Posted 4 years ago #

    @mailcatala

    Post the file on pastebin and I'll help you in decoding it.

  10. marksweb
    Member
    Posted 4 years ago #

    @Kevin

    you sir, are a legend. Thank You! much appreciated :)

  11. i1100a
    Member
    Posted 4 years ago #

    Hi guys, first thanks for your instructions and time. I've tried different way to decode this footer but it is clearly over my head now. If somebody could help me out with this one, I'd highly appreciate it, thanks in advance

    http://wordpress.pastebin.com/djsJP3M6

  12. ooklathemok
    Member
    Posted 4 years ago #

    I've seen Kevin decode one of these before, so I am crossing my fingers and hoping he can tackle another templatelite template.php-

    http://wordpress.pastebin.com/1WdNkhNf

  13. kevinbanet
    Member
    Posted 3 years ago #

    @i1000a

    The file has been tampered with. It is a variation of PHPLockIt which can be easily decoded. Make sure you are providing the un-tampered file.

  14. kevinbanet
    Member
    Posted 3 years ago #

    @ooklathemok

    Decoded file: http://wordpress.pastebin.com/YSr4mXqF

  15. mailcatala
    Member
    Posted 3 years ago #

    @kevin

    http://pastebin.com/JidG0W0N

    That's the encoded part, let me know if you need the full file

    Thanks!!

  16. kevinbanet
    Member
    Posted 3 years ago #

    @mailcatala

    That's not PHP encoded. It seems to be something related to form. PKCS7 is used to sign and/or encrypt messages under a PKI. It can also be used for certificate dissemination. Maybe the site using this is ensuring that the page hasn't been tampered with.

  17. ClaytonJames
    Member
    Posted 3 years ago #

    @mailcatala

    I'm only guessing, but that looks like legitimate code used to protect ones paypal account information when embedding a paypal donation button in a script.

    Just a guess, mind you.

  18. ooklathemok
    Member
    Posted 3 years ago #

    @kevinbanet

    Thank you so very much.

    You rock!

  19. mailcatala
    Member
    Posted 3 years ago #

    Please, decode http://pastebin.com/S9tSTFL3

    Thanks!

  20. thehipcola
    Member
    Posted 3 years ago #

    Hi everyone,

    I'm ripping (whats left) of my hair out. I've learned alot in the last hour, even deleted some code that TAC found, but two entries remain that I cannot find, and after finding my way here, trying to decode but no success... I ask for help! :)

    two files if possible...

    http://pastebin.com/JCKQPY5V
    and
    http://pastebin.com/V5SfKD4a

    they both seem to be involved in this ridiculous encryption, spam link generation. This theme has been in use for years! Only now have I seen the links... ugh.

    Thanks for any help you can provide...

    Rob

  21. kevinbanet
    Member
    Posted 3 years ago #

    @mailcatala

    Decoded: http://pastebin.com/Ux4c10Uc

  22. kevinbanet
    Member
    Posted 3 years ago #

    @thehipcola, please search first before posting. This one has already been decoded by myself around 1 month ago. See this link for the details:

    http://wordpress.org/support/topic/382202

  23. atul1280
    Member
    Posted 3 years ago #

    @thehipcola, the decoded string for second part is here: http://pastebin.com/c2jy0bhh

  24. thehipcola
    Member
    Posted 3 years ago #

    Thanks Kevin and Atul1280,

    In fact, the link you provided was the first article I started with here in support. From there I went to another article that listed all kinds of decoders, tried them all with no luck, and on through many other support articles. It didn't occur to me to try to search for the coded string of characters... I assumed that coded character sets would be unique. Thanks very much for both of your help!

    Cheers!

    Rob

  25. dwellydesigns.com
    Member
    Posted 3 years ago #

    Hi there. I am really embarrassed to ask this, but can you please help me decode this file: [link removed] - I tried all of the trouble shooting steps and I guess I don;t know where to START the cut and paste and where to STOP as far as the syntax is concerned.

    I greatly appreciate any help. And I did try to past the file at http://wordpress.pastebin.ca/ - but all I got was a solid white page.

    thanks!!!! - Erik

  26. dwellydesigns.com
    Member
    Posted 3 years ago #

    Never mind - I got it figured out. I kept starting the code with the $o=" - once I removed it, it was able to decode with out issue.

  27. larssonk22
    Member
    Posted 3 years ago #

    ^ thanks thats what I was doing wrong too

  28. khuzemav201
    Member
    Posted 3 years ago #

    hi there am not able to post my code at http://wordpress.pastebin.ca/. can you please decode this file for me [link removed] i tried all the give tools but no luck..

    kv

  29. atul1280
    Member
    Posted 3 years ago #

    @khuzemav201

    Decoded: http://pastebin.com/HyV4apZ9

  30. khuzemav201
    Member
    Posted 3 years ago #

    @atul1280

    thanx a lot.

124

Topic Closed

This topic has been closed to new replies.

About this Topic

Tags