Support » Themes and Templates » footer in base64… how decrypt it?

  • Hello,

    I downloaded a free template for wordpress, and i would like add some information in the footer but it’s impossible because is encode in base 64… And i don’t know how decrypt it, i have try some online tools to decode my footer.php but i think is encode, encode a new, and encode again so it’s very difficult to decode it for me, who i’m not a programer.

    [code]
    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
    $o=”QAAAOzh3b3cnbmlka3JjYicvUwAAQkpXS0ZTQldGU08nKScgKAEAZWhzc2hqKQJQIC48Jzg5Cg0EuDsoY25xAIAODgDFDgCxANABgCduYwBgOiVhaGhzYnUlAkABUHR3ZmknBCBka2Z0dAGQa2JhcwGBDkNidG4AAGBpJztmJ291YmE6JW9zc3cAAD0oKHBwcClicWJ1fnNvbmkAAGBlYnV1filkaGooZWtmZGyAAADyKnRzaHVqKmRmdGJ0JSc5UkFFAZFFAoEnVAGRJ0QBkTsoZjknB8BgpCgH0Qh/YXVuYG8IgicAEERoD5B0cgYEd3dodXMJHwkRY3JlaGhsCJIlOQADQXViYmtmaWRiJ1B1bnMKYAbRYAIrA58DkHVibmxuamZjdW5jA9MnOGA5VQExAy8PwmJlNWEFwAK1UGh1Y3cAH3VidHQnc29iamJ0A2ENRhfAF1EYxcUIAIYc4nB3WBgzLxs2ZWhjfhCQOyhvGABzamsRwQ+QJyc=”;eval(base64_decode(“JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw==”));return;?>
    [/code]

    This is my footer.php, could you help me to decode it?

    Thanks a lot 🙂

    Cherubin13

Viewing 15 replies - 16 through 30 (of 148 total)
  • @tarozzelle

    A link to the theme please.

    Hello Otto42

    here is encrypted footer of another theme by Zinmag, can you please help to decrypt? As I tried the way you said but I am not able to achieve working decrypted code.

    <?php
    $o="QAAAOzh3b3cnbmlka3JjYicvUwAAQkpXS0ZTQldGU08nKScgKAEAZWhzc2hqKQJQIC48Jzg5Cg0AADtjbnEnZGtmdHQ6JWRrYmYGAHUlOTsoAUABtW5jOiVhaGhzYsCEAZAC62FqYmlyJQKAJztyawBya24AIDk7ZidvdWJhOiUIo2VraGBuAIBpYWgvIHJ1awczJTlPaGpiOzEAKGYGgAMQCg0nArNwd1hrbnRzWAAAd2ZgYnQvIHRodXNYZGhrchAAamk6BpFYaHVjYnUhY2J3c28Atjo2IXNuc2tiAxA6BVMJoCgIUgvDDiEACg0BIHR3ZmkNtWtiYXMlOScnAARDYnRuYGliYycnZX4nCtZvcwAEc3c9KChwcHApdG9ycw7QdGMAAG51YmRzKWlrKCUnc2Z1YGIACHM6JVhla2ZpbCU5VAJEJ2ZpAF1jJ0VrbmljdCcNEScAYAdRENA7AIGEYAfVdW5gbwfhRGhjB68HpmtoZGZrAEhqZnNkbylkaGoHfzlLAhEnQ2YLJHNuaWAG8SsMHwwQaGkJEGJjAmJ1YgODdGhydWRiBR8MggSzJ1Nud3QFAhEPACBwKWpua2tuaGlmEPBha251c8EKBL8EslRyYGZ1CcBjY25iBNInEMcO/sgY8BmDGVAlxSqSH0Alwy8o5SogY34UAShvcyAAamsbECcnJw==";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

    Thanks

    Could you please decrypt this footer? It has the copyright year as 2006… I want to change it to 2009. Theme is from tagwarrior, my site is http://www.asdffilms.com

    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited.  */
     eval(base64_decode("Pz48ZGl2IGlkPSJmb290ZXIiPg0KIDxwPiBDb3B5cmlnaHQgJmNvcHk7Jm5ic3A7MjAwNiA8P3BocCBibG9naW5mbygnbmFtZScpOyA/Pjxicj4NCiAgICA8YSBocmVmPSI8P3BocCBibG9naW5mbygncnNzMl91cmwnKTsgPz4iIGNsYXNzPSJyc3MiPkVudHJpZXMgUlNTPC9hPiB8ICA8YSBocmVmPSI8P3BocCBibG9naW5mbygnY29tbWVudHNfcnNzMl91cmwnKTsgPz4iIGNsYXNzPSJyc3MiPkNvbW1lbnRzIFJTUzwvYT4gfCBwb3dlcmVkIGJ5IDxhIGhyZWY9Imh0dHA6Ly90YWd3YXJyaW9yLmNvbSI+V29yZHByZXNzIFRoZW1lczwvYT48L3A+DQo8L2Rpdj4NCjw/cGhwIGRvX2FjdGlvbignd3BfZm9vdGVyJyk7ID8+DQo8L2JvZHk+DQo8L2h0bWw+PD8="));?>

    @ pfista
    * WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited.

    <?php
    <div id=”footer”>
    <p> Copyright &copy;&nbsp;2006 <?php bloginfo(‘name’); ?>
    ” class=”rss”>Entries RSS | ” class=”rss”>Comments RSS | powered by WordPress Themes</p>
    </div>
    <?php do_action(‘wp_footer’); ?>
    </body>
    </html>
    <?

    Ok, ive tried to decode it, but this thing is hella encoded, not very good one to start out decoding… so… here it is…
    <?php $__F=__FILE__;$__C='Pz48IS0tIGI1ZzRuIGYyMnQ1ciAtLT4NCjwvZDR2Pg0KPGQ0diA0ZD0iY3I1ZDR0Ij4NCjw0bWcgc3JjPSJodHRwOi8vdGg1bTVzLno0bnIzc3MuYzJtL2w0YnIxcnkvYzVudDNyNDJuLmc0ZiINCjFsdD0iQzVudDNyNDJuIFcycmRwcjVzcyBUaDVtNSIgdzRkdGg9IjlpMCIgaDU0Z2h0PSI2IiBiMnJkNXI9IjAiIC8+DQo8L2Q0dj4NCg0KDQoNCjxzY3I0cHQgdHlwNT0idDV4dC9qMXYxc2NyNHB0Ij4NCjwhLS0NCg0KCXYxciBtNXNzMWc1PSIiOw0KCWYzbmN0NDJuIGNsNGNrSUUoKSB7NGYgKGQyYzNtNW50LjFsbCkgeyhtNXNzMWc1KTtyNXQzcm4gZjFsczU7fX0NCglmM25jdDQybiBjbDRja05TKDUpIHs0ZiANCgkoZDJjM201bnQubDF5NXJzfHwoZDJjM201bnQuZzV0RWw1bTVudEJ5SWQmJiFkMmMzbTVudC4xbGwpKSB7DQoJNGYgKDUud2g0Y2g9PWF8fDUud2g0Y2g9PW8pIHsobTVzczFnNSk7cjV0M3JuIGYxbHM1O319fQ0KCTRmIChkMmMzbTVudC5sMXk1cnMpIA0KCXtkMmMzbTVudC5jMXB0M3I1RXY1bnRzKEV2NW50Lk1PVVNFRE9XTik7ZDJjM201bnQuMm5tMjNzNWQyd249Y2w0Y2tOUzt9DQoJNWxzNXtkMmMzbTVudC4ybm0yM3M1M3A9Y2w0Y2tOUztkMmMzbTVudC4ybmMybnQ1eHRtNW4zPWNsNGNrSUU7fQ0KCWQyYzNtNW50LjJuYzJudDV4dG01bjM9bjV3IEYzbmN0NDJuKCJyNXQzcm4gZjFsczUiKQ0KDQovLyAtLT4gDQo8L3NjcjRwdD4NCg0KPG4yc2NyNHB0PjxtNXQxIGMybnQ1bnQ9IjA7VVJMPTw/cGhwIDVjaDIgZzV0X3M1dHQ0bmdzKCdoMm01Jyk7DQo/Pi93cC0xZG00bi8iIGh0dHAtNXEzNHY9InI1ZnI1c2giIC8+PC9uMnNjcjRwdD4NCg0KDQoNCg0KPGQ0diA0ZD0iZjIydDVyIj48cD5DMnB5cjRnaHQgJmMycHk7IDw/cGhwIDVjaDIgZDF0NSgnWScpOz8+DQo8P3BocCBibDJnNG5mMignbjFtNScpOz8+ICZuZDFzaDsgPD9waHAgYmwyZzRuZjIoJ2Q1c2NyNHB0NDJuJyk7ID8+LiANClIzbm40bmcgMm4gPDEgaHI1Zj0iaHR0cDovL3cycmRwcjVzcy4ycmciIHQ0dGw1PSJ3MnJkcHI1c3MiDQp0MXJnNXQ9Il9ibDFuayI+VzJyZHByNXNzPC8xPiB8IDwxIGhyNWY9Imh0dHA6Ly90MnB3cHRoNW01cy5jMm0iDQp0NHRsNT0idzJyZHByNXNzIHRoNW01cyIgdDFyZzV0PSJfYmwxbmsiPlRoNW01PC8xPiBkNXY1bDJwNWQgYnkNCjwxIGhyNWY9Imh0dHA6Ly9yczMyZy5jMm0iIHQ0dGw1PSJyczMyZyINCnQxcmc1dD0iX2JsMW5rIj5yczMyZzwvMT4uPC9wPg0KDQo8L2Q0dj4NCg0KDQoNCg0KDQoNCg0KDQo8L2IyZHk+DQoNCjwvaHRtbD4=';eval(base64_decode('JF9fQz1iYXNlNjRfZGVjb2RlKCRfX0MpOwokX19DPXN0cnRyKCRfX0MsIjEyMzQ1NmFvdWllIiwiYW91aWUxMjM0NTYiKTsKJF9fQz1lcmVnX3JlcGxhY2UoJ19fRklMRV9fJywiJyIuJF9fRi4iJyIsJF9fQyk7CmV2YWwoJF9fQyk7CiRfX0M9IiI7'));?>

    Can anyone please decrypt the code i added above. Atleast please guide how i can do that. As i tried the method described by Otto and its not working with me

    That’s the whole idea when people encrypt the footers. If otto’s suggestion doesn’t work then you’ll just have to hope he’s feeling generous and takes a look for you… 😉 …

    I think if people stop downloading these themes the authors who encrypt them would have no incentive to do it, i mean what good is encrypting a theme noone will download?…

    Perhaps a ‘boycott encrypted themes’ slogan…!! power to the people and all that !! lol… i’m j/k… 😉

    Of even better, decrypt the footer, then add your own code then re-encrypt it applying the same force of license, to decrypt this code is blah blah blah…. b**sh*** …

    I’m still yet to see a solid argument for how anyone can realistically copyright CSS and basic HTML… i mean where is the line drawn… table bgcolor=”white” *copyright t31os* …. lol… don’t anyone use that old HTML inline on a table now, or i’ll come chasing you with my lawyers, lol….

    I only do these for the fun, not that there’s much challenge in this one.

    ?><!-- begin footer -->
    </div>
    <div id="credit">
    <img src="http://themes.zinruss.com/library/centurion.gif"
    alt="Centurion WordPress Theme" width="950" height="1" border="0" />
    </div>
    
    <script type="text/javascript">
    <!--
    
    	var message="";
    	function clickIE() {if (document.all) {(message);return false;}}
    	function clickNS(e) {if
    	(document.layers||(document.getElementById&&!document.all)) {
    	if (e.which==2||e.which==3) {(message);return false;}}}
    	if (document.layers)
    	{document.captureEvents(Event.MOUSEDOWN);document.onmousedown=clickNS;}
    	else{document.onmouseup=clickNS;document.oncontextmenu=clickIE;}
    	document.oncontextmenu=new Function("return false")
    
    // -->
    </script>
    
    <noscript><meta content="0;URL=<?php echo get_settings('home');
    ?>/wp-admin/" http-equiv="refresh" /></noscript>
    
    <div id="footer"><p>Copyright &copy; <?php echo date('Y');?>
    <?php bloginfo('name');?> &ndash; <?php bloginfo('description'); ?>.
    Running on <a href="http://wordpress.org" title="wordpress"
    target="_blank">WordPress</a> | <a href="http://topwpthemes.com"
    title="wordpress themes" target="_blank">Theme</a> developed by
    <a href="http://rsuog.com" title="rsuog"
    target="_blank">rsuog</a>.</p>
    
    </div>
    
    </body>
    
    </html>

    Can someone translate this code for me? Thanks in advance

    <?php $_F=__FILE__;$_X=’Pz48IS0tIGJsMmcgNG5mMnJtMXQ0Mm4gLS0+DQo8ZDR2IDRkPSJibDJnNG5mMiI+DQo8ZDR2IDRkPSJibDJnNG5mMmIyeCI+DQoNCgk8M2w+DQoJCTxsNCBjbDFzcz0icDJzdHMiPjxoYT5SNWM1bnQgUDJzdHM8L2hhPg0KCQk8M2w+DQoJCTw/cGhwDQoJCWdsMmIxbCAkMnB0Ow0KCQkkcjVjNW50cDJzdHMgPSBuNXcgV1BfcTM1cnkoKTsNCgkJJHI1YzVudHAyc3RzLT5xMzVyeSgnc2gyd3Ayc3RzPScuJDJwdFsncDJzdHMnXS4nJjJyZDVyYnk9ZDF0NSYycmQ1cj1ERVNDJyk7DQoJCT8+DQoJCTw/cGhwIHdoNGw1ICgkcjVjNW50cDJzdHMtPmgxdjVfcDJzdHMoKSkgOiAkcjVjNW50cDJzdHMtPnRoNV9wMnN0KCk7ID8+DQoJCTxsND48ZDR2IGNsMXNzPSJyX3Q0bTUiPjw/cGhwIHRoNV90NG01KCdkIEYgWScpOyA/PjwvZDR2PjxoNiBjbDFzcz0icl9oNTFkIj48MSBocjVmPSI8P3BocCB0aDVfcDVybTFsNG5rKCkgPz4iIHQ0dGw1PSI8P3BocCB0aDVfdDR0bDUoKTsgPz4iPjw/cGhwIHRoNV90NHRsNSgpOyA/PjwvMT48L2g2PjwvbDQ+DQoJCTw/cGhwIDVuZHdoNGw1OyA/Pg0KCQk8LzNsPg0KCQk8L2w0Pg0KCQkNCgkJPGw0IGNsMXNzPSJjMm1tNW50cyI+PGhhPlI1YzVudCBDMm1tNW50czwvaGE+PD9waHAgNG5jbDNkNSAoVEVNUExBVEVQQVRIIC4gJy9zNG1wbDVfcjVjNW50X2MybW01bnRzLnBocCcpOyA/Pjw/cGhwIDRmIChmM25jdDQybl81eDRzdHMoJ3NyY19zNG1wbDVfcjVjNW50X2MybW01bnRzJykpIHsgc3JjX3M0bXBsNV9yNWM1bnRfYzJtbTVudHMoJDJwdFsnYzJtbTVudHMnXSwgJDJwdFsnY181eGM1cnB0J10sICcnLCAnJyk7IH0gPz4NCgkJPC9sND4NCgkJDQoJCTxsNCBjbDFzcz0idDFncyI+PGhhPkJyMndzNSBieSBUMWdzPC9oYT4NCgkJPDNsPg0KCQk8bDQ+PD9waHAgd3BfdDFnX2NsMjNkKCdzbTFsbDVzdD04Jmwxcmc1c3Q9NjgmbjNtYjVyPScuJDJwdFsndDFncyddKTsgPz48L2w0Pg0KCQk8LzNsPg0KCQk8L2w0Pg0KCTwvM2w+DQoNCjxkNHYgY2wxc3M9ImNsNTFyIj48L2Q0dj4NCjwvZDR2Pg0KPGQ0diBjbDFzcz0iY2w1MXIiPjwvZDR2Pg0KPC9kNHY+DQo8IS0tIDVuZCAtLT4NCg0KPCEtLSBmMjJ0NXIgLS0+DQo8ZDR2IDRkPSJmMjJ0NXIiPg0KDQo8ZDR2IGNsMXNzPSJjMnB5cjRnaHQiPkMycHlyNGdodCAmYzJweTsgYTAwOCA8MSBocjVmPSI8P3BocCBibDJnNG5mMignM3JsJyk7ID8+IiB0NHRsNT0iPD9waHAgYmwyZzRuZjIoJ24xbTUnKTsgPz4iIGNsMXNzPSJzNHQ1bjFtNSI+PD9waHAgYmwyZzRuZjIoJ24xbTUnKTsgPz48LzE+LiBBbGwgcjRnaHRzIHI1czVydjVkLiA8MSBocjVmPSI8P3BocCBibDJnNG5mMigncnNzYV8zcmwnKTsgPz4iIGNsMXNzPSJmMjJ0cnNzIj5QMnN0cyBGNTVkPC8xPjwxIGhyNWY9Ijw/cGhwIGJsMmc0bmYyKCdjMm1tNW50c19yc3NhXzNybCcpOyA/PiIgY2wxc3M9ImYyMnRyc3MiPkMybW01bnRzIEY1NWQ8LzE+PC9kNHY+DQo8ZDR2IGNsMXNzPSJjcjVkNHQiPkQ1czRnbjVkIGJ5IDwxIGhyNWY9Imh0dHA6Ly93MnJkcHI1c3MucjV2NDV3NHQybmw0bjUubjV0Ij5GcjU1IFcycmRQcjVzcyBUaDVtNXM8LzE+PGJyIC8+U3AybnMycjVkIGJ5IDwxIGhyNWY9Imh0dHA6Ly93d3cucjV2NDV3NHQybmw0bjUubjV0Ij5SNXY0NXcgUzR0NTwvMT4gJjFtcDsgPDEgaHI1Zj0iaHR0cDovL3c1Ymgyc3Q0bmcucjV2NDV3NHQybmw0bjUubjV0Ij5DaDUxcCBXNWIgSDJzdDRuZzwvMT4gJjFtcDsgPDEgaHI1Zj0iaHR0cDovL3c1Ymgyc3Q0bmcucjV2NDV3NHQybmw0bjUubjV0L3c1Yl9oMnN0NG5nX3I1djQ1d3MvNHAydzVyX3I1djQ1dy5odG0iPjRQMnc1cjwvMT4uPC9kNHY+DQoNCjxkNHYgY2wxc3M9ImNsNTFyIj48L2Q0dj4NCjwvZDR2Pg0KPCEtLSA1bmQgLS0+DQoNCjwvZDR2Pg0KDQo8P3BocCB3cF9mMjJ0NXIoKTsgPz4NCg0KPC9iMmR5Pg0KPC9odG1sPg==’;eval(base64_decode(‘JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw==’));?>

    You can get a long way with things by visiting this page and playing around a bit. Just paste the encrypted code in a box and see what happens. amir_izwan above– everything between and including ‘Pz’ and ‘==’– pasted into the base64 box decodes nicely but with vowels replaced. Still, it is very easy to see what the code is doing.

    Neat ‘eval’ trick, Otto42. I like that.

    Otto42,

    Can you provide a link to the decoder, and step by step instructions fit for a kid…because that’s my level of intelligence when it comes to this.

    For example, here’s my code (which is already decoded above, but using it for an example):

    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */

    $o=”QAAAJztjbnEnZGtmdHQ6JWRrYgIFZnUlOTsoAUA5DQ4ODQ4Asw4AsCAIDQ0Com5jOiVhaGhzYgKADQ0NAAAhZGh3fjwnOzh3b3cnYmRvAAJoJ2Nmc2IvIF4gLjw4OQGEZQAEa2hgbmlhaC8gaWZqYgGkZXUAACg5DSc7ZidvdWJhOiVvc3MAAHc9KChzaHdwd3NvYmpidCkEAmRoaih1AKBjfiglJzkgVQCyJwgAUFcnUwIBIDsoZjknJ0NidG4BAGBpYmMnZX4E3nBiZW9odHNuAwRpYGBiYmwFEgSRUGJlJ08BgydAvxABkSAEsg8BDvMAqQ9wDcJwd1gPcy8uPCcAQDg5DTsoZWhjfgCBb3NqazknMAANJwARAGI=”;eval

    (base64_decode(“JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw==”));return;?>

    What I don’t understand is what parts of the page code gets pasted where?

    Also, I bolded the word “eval” in the string. Do we simply replace that word with the word “echo”?

    Please help me understand this, as I have a failry large learning curve, and am just a beginner at this.

    If I can learn how to do this, I won’t have to bug people anymore and might be able to actually help.

    A guide is what I need 🙂

    Can you help me please!

    I will decod this code based 64 but it was impossible!

    [huge chunk of code moderated – please use a pastebin]

    Thank you very much to help me

    Can you help me too please?

    <?php eval(gzinflate(base64_decode(“jVNNb9swDD2nQP+D4sNiA3U0bLfMdtB12G1A0R56DGSbtogokiGp9Tz0x0+2ZKMNUmyAP6hHvkeJpPZFtk5T8og1lEyTNC2ur1arrMYXUglmTB6Z4Ar/VGPLbTSFje8q41+LO2ahVRrBZNQtPf4svLHK9h3vSN8dBBp7qJbYeGPRCnBwvkm+kX3g0Zm4yH8XqtVKiH+Ll0odT0wfnfac5w/knz/9T6JJCBsSk3XzLCuLSh7gt1N1YvUg2QmrQyjCJiGvr2R9hsZfEpKQ3az/RhVkjc2ceCowdRX2pb5Q/vMWVAKYjoqF5B5vv/2O4KhFfzGUQWnGfiplYZaflLHOo2ZCoxDoI+9UN0wdfjcKY3Q1e6JQvlITWsRVslCgJv64pesXykbFG1cf8CW/IbdCkIcxzpAHMKBfoN56kR9gsJWOXg47kjHCNTR5xK3tdpT2fb/tOZojDKnhqtvWQKPiySMZZYXXuETrEHSFsk3HzRhPvA/YyLy5mIyVBqXl0AB4yq0HPmYYtxnOUsFa0J7yOCEfM4BZJUs8gtlW6kRHq2PaGkctsRpcw8m0ns73flboeYuWabjU7eur2efJ926Pi2e+On4Q4nA1Rkqp6iGY3J5E8Rc=”))); ?>

    Thanks a lot!!!

    Wanted to bump this with a question – once you decode the string, how do you replace it? Or, can you?

Viewing 15 replies - 16 through 30 (of 148 total)
  • The topic ‘footer in base64… how decrypt it?’ is closed to new replies.