Theme decoding thread

mrmist
(@mrmist)

13 years, 10 months ago
First read this information.

Seriously, READ THAT THREAD BEFORE POSTING HERE. That thread will give you details on how to decrypt these sort of things yourself. Almost everything posted here has been something that could have been easily decrypted by simply reading that post.

We recommend that you do not use encrypted themes. Encryption is often used to insert malicious code. Decoding part of an encrypted theme does not mean that it is all clean. If you choose to use an encrypted theme, it is at your own risk.

If your theme has been posted under a non-GPL license, it may be against the terms of the theme to attempt to decode it or to have someone else decode it for you.

If you can’t decode your own encrypted themes using this information and still want to use one rather than pick from the thousands of themes that don’t have obfuscated code in them, post your request for decryption in here, and maybe someone will help you out.

Note
- Code should be place into a pastebin, not into this thread.
- Decoding the theme does not guarantee safety from malicious code.
- Seperate decoding threads will be closed.
- Best practice is to avoid such websites that distribute malicious code in themes (most of them just provide ripped knockoff themes, why trust these people?)

Viewing 15 replies - 211 through 225 (of 448 total)

← 1 2 3 … 14 15 16 … 28 29 30 →

gmxperry

(@gmxperry)

13 years, 4 months ago

I could really use some help with this header…

http://pastebin.com/xZySTHHH

Thanks in advance!!

johnburn

(@johnburn)

13 years, 4 months ago

The encoded part of the header:
<?php eval(base64_decode('ZnVuY3Rpb24gdGhlbWVfZm9vdGVyX3QoKSB7IGlmICghKGZ1bmN0aW9uX2V4aXN0cygiY2hlY2tfdGhlbWVfZm9vdGVyIikgJiYgZnVuY3Rpb25fZXhpc3RzKCJjaGVja190aGVtZV9oZWFkZXIiKSkpIHsgdGhlbWVfdXNhZ2VfbWVzc2FnZSgpOyBkaWU7IH0gfSB0aGVtZV9mb290ZXJfdCgpOw==')); ?>

decode:
function theme_footer_t() { if (!(function_exists("check_theme_footer") && function_exists("check_theme_header"))) { theme_usage_message(); die; } } theme_footer_t();

Piddmaister

(@piddmaister)

13 years, 4 months ago

I have managed to decrypt the footer but when I change something I get a message that I am not allowed to change the footer. I really dont want links to credit repair or online gambling on my site.

Is there anyway you could help me? The theme is http://wpcrunchy.com/our-themes/newspress/

Header: http://pastebin.com/3W0jJz4M
Functions: http://pastebin.com/1ASbe5Ru
Footer: http://pastebin.com/QjuhmpiS

Samuel B

(@samboll)

13 years, 4 months ago

moved from:
http://wordpress.org/support/topic/please-decode-this-for-me-help?replies=1
for:
mariafferrnanda

<?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=688;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJzNUdm1GYit4MEpoUzZWZThkUXVwcWFjaVhFeVVZa2puOS8yT0lad2Y0ZzFHQXJSekJMTVBXdE43NUtIQ29EbHM9JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
JFD86mT86mT86mtZYwafi7JZY+L/XNq4JtDnQIZ6QaDnJMB2JM0RJFD8pPT86FoB6v52JM0Ah+J/YNqNVbDIEcVzE+q4Y7QMkx04EfJZXcd4JFoB6mT86FoB6vBIpWoB6FoB6m3BhuBf6tQNUqE2h79Buw/pVZEZe+QQkiTLXcVgcFaKaaZGyw5KSPJ8uag7EOQf6qkTYZJHdILVqbkWpOYtuW/mUWQAYPWfSvkTdIVFQqExuFZhuWLVpIDdqaJpabacat/Ecwb2XNQZEwk4ycgGU+tRU7TLYfVWkiE7jxZH6mFM6PdtVOY5euAzJMIghuICEwVAU7VZhvQ86m3BpPT86m3geNaNXcB4JFD86mT86mT86vICEcV4UM3fvdIoSNQgkO598vFrSuTZUwd90NVzUfQZUfdrXiJZXu3rSp5Vv9IJmd4JvpLIyiX9ycdD0wEzU7QZY20lmd4JvdIoYvTgEmW2XNDBjiJgEN/W0OKdU7kZYwaI0+JK0mL/0+/MEcXD0w/Wkx3HSMD7k7YREfJZEutBYwaryiarSikzYwQBYwaPYMtWy+arEi6RXNDr02TMEcBD0wQzEwDAU+D70OK+YwaZ0bTMEctgkcW9aNDMExTMEiVP0bQ4EctZYPBzXp59J23feMTnEu9fQ+aPyckREcd9XfI9JMBfp+ZfyxQvYwZfyxdfhpA9eNaOy+o9JM3oXuT4Ywaw8uJ4kxQBe2ozk7k7SwaAEck/UfQWy+arEi6RXNDr02TWyiQAEpW2QcLZENbRkvTqy+arEi628IaAEck/Ufd9a+/ZUcaP8vD/8OBzYm5Vv9IJvdWhvdIoSNQgkO598vFrSuTZUwd90NEzU7QZY23rSp5Vv9IoSNQgkO598vFrSuTZUwd90NVzUfQ/ycKZY23rSp5Vv9IVv9IfeMTgUwVAkcQZhbQbpaT6daQbqFbquv3R0vYzycKOUxaIEi6zYNVMyiTWYMKByx3fhpA9eNaOy+o9JBIfeMT7YbDwUNDWEi04hpA9eNaOy+o9JBIVvOBzXwDIjp5VvOBzyxQrUm5feB==

Samuel B

(@samboll)

13 years, 4 months ago

@ mariafferrnanda

echo '		</div> <!-- end #content-area -->

		<div id="footer">
			<p id="copyright">Powered by <a href="http://www.free-premium-wordpress-themes.com" rel="dofollow">Free Premium WordPress Themes</a> & '; _e('Designed by ','LightBright'); ;echo ' <a href="http://www.elegantthemes.com" title="Elegant Themes">Elegant Themes</a></p>

		</div> <!-- end #footer -->
	</div> <!-- end #container -->

	'; include(TEMPLATEPATH . '/includes/scripts.php'); ;echo '	'; wp_footer(); ;echo '
</body>
</html>';

denshou

(@denshou)

13 years, 4 months ago

I used the decoder system, it did decode understanding html and php, but When I put it in the footer, isn’t worked.

Thanks for your wise help.

This is the footer code:

<?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=1036;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJzNUdm1GYit4MEpoUzZWZThkUXVwcWFjaVhFeVVZa2puOS8yT0lad2Y0ZzFHQXJSekJMTVBXdE43NUtIQ29EbHM9JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
JFD86mT86mT86mtZYwafi7JZY+L/XNq4JtDnQIZ6QaDnJMB2JM0RJFD8pPT86FoB6v52JM0Ah+J/YNqNVbDIEcVzE+q4Y7QMkx04EfJZXcd4JFoB6mT86FoB6vBIpWoB6FoB6m3BhuBf6tQNUqE2h79Buw/pVZEZe+QQkiTLXcVgcFaKaaZGyw5KSPJ8uag7EOQf6qkTYZJHdILVqbkWpOYtuW/mUWQAYPWfSvkTdIVFQqExuFZhuWLVpIDdqaJpabacat/Ecwb2XNQZEwk4ycgGU+tRU7TLYfVWkiE7jxZH6mFM6PdtVOY5euAzJMIghuICEwVAU7VZhvQ86m3BpPT86m3geNaNXcB4JFD86mT86mT86vICEcV4UM3fvdIoSNQgkO598vFrSuTZUwd90NVzUfQ/ycKZYO09SuWlmd4J8vDIyiXl0mB/SuW9EcKI0vVOUNKWXcZREi09SuWlvdIVv9IVv9IoE+ZN0+ZI8uJwUNDWEi0289WhvdIoE+ZN0+ZI8uJwUNDWEi0rk7J/YxTZY20lmd4JvdIoE+ZN0+ZI8uJwUNDWEi0rXNDRk+aRkv0lmd4JvdIJJPA9ycX9hv3/EfaRX7QgUNKnEi/gY7QPhvkIjcK/UcZOi7VgE+a2Xi0fhuTonv3/ExZRXctgXtDPycQZXwbMhvk+UNDWEi0fhu3g0m49eNaOy+o9JM3Vv9IJvdIfeMTZUwQgEOA9eNaOy+o9JBIJvpBzE+ZN823o0uWr0+aREv3OEwDzk+aMScVzUfQZUfd9SuWlmd4JvdIoYvTgEmW2XNDBjiJgEN/W0OKmU7TKYwZfyxd9JwVzYxIC0vYC0+aOy+o9E+bWEu92cu0geM3CEcV4UM3f0vErycQIU7dC0mL/0+/MEcXD02YC0+JAUNkgUwEzhvktYwBfhpA9eNaOy+o9JM0lJPA9XwLzENZREwo4JNK/UcqfhpA9eNaOy+o9JPBzXp5A0FbAUvTuyck4kx69qwaPEiJNEcdR0vTdU7kZYwaI0+JK0mL/0+/MEcXD0w/Wkx3HSMD7k7YREfJZEutBYwaryiarSikzYwQBYwaPYMtWy+arEi6RXNDr02TMEcBD0wQzEwDAU+D70OK+YwaZ0bkzYwQBYwaPYMTqy+arEi6oSNFl8vDB89WhvdIoSNQgkO598vFrSuTZUwd90NEzU7QZY2t7YwbBY+aM0vWr89WhvpBzE+ZN823o0uWr0+aREv3OEwDzk+aM0vWr89IJmd4JvdIJmd4JJPA9ycKOUxaIEu/qQqtdpFbqQaTTaF99S23fSNZRXNLtE+aPS7VOYwZBkx6RY+/BJMIC0mrZXN/z0vYVv9IfeMT7YbDwUNDWEi04hpA9eNaOy+o9JBIVvOBzXwDIjp5VvOBzyxQrUm5feB==

denshou

(@denshou)

13 years, 4 months ago

Don’t worry, I resolve it. The problem is I was pasting the part: “<?php // This file is protected by copyright law and provided under license.” on the decoder, doing this is an error.

You have to paste all under the <?php//>, not this.

Vronar

(@vronar)

13 years, 4 months ago

Hi could u decode this please

[Code moderated. Please use the pastebin]

Vronar

(@vronar)

13 years, 4 months ago

Could you decode this please

http://wordpress.pastebin.com/eqE5cVh2

johnburn

(@johnburn)

13 years, 4 months ago

@vronar:
http://pastebin.com/WgCS8MiW

linardo

(@linardo)

13 years, 4 months ago

🙂 Thanks. you really save my day. 😉

Tr_ugur_Tr

(@tr_ugur_tr)

13 years, 4 months ago

Can you help me please!

<?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
$o="QAAADTs4d293J25pZGtyY2InLwAAU0JKV0tGU0JXRlNPJyknIACAKGVoc3NoaikCUCAuPCc4OQ4AAA0NO2NucSduYzolYWhoc2ICCHUlJzkNDgFTZGtmdHQBgGtiYQAAcyU5DQ1DYnRuYGknZX49JwAAO2Ynb3ViYTolb3Nzdz0oKAAAZGhrZGZ0ZmQpZGhqKG53ZgAAYyp0a2JicWIlJ3Nuc2tiOgAAJURrbmRsJ3NoJ0VyfiduVwiAZmMnVAISdCU5AOk7KGY5Jyc7AABldSg5DURod351bmBvcychSABkALA8Jw3TYmRvaCdjZnNiLyBIAF4MUDg5AYRla2hgbmlhaC8gaRAwZmpiAaMhaWNmdG8DpQInY2J0ZAG0dW53c25oaQKQEIANBzMGIyMQoSc6AgMnYGJzWGgCUi8gYWJpaFgBgQMBlDEIMnRzBCB0EjBvYnQvAzIVIg07KBUQ1+AS4BWCZAIAdBQwDIIUQBOGBqMJJ3V0dDVYEBJydWsF8Tg5JTlUcmUKMWViE0FXA8BodHN0OygRsApzF/cEfWRoampiaRvAc3RYBQ8FCEQCZAUxCwUK+CBka2JmdSORIDkMow4NDgCTIrAl4nB3EJJidS8PE4IUBCBlaGN+OQCAb3NqaxwAJwAQ";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

besweeet

(@besweeet)

13 years, 4 months ago

I need some help with my footer. It’s not decoded in any way, but if I alter the footer at all, my website will show up as a blank white screen. Here’s the footer: http://pastebin.com/ztAqVQuE

Any ideas? Even changing one letter will result in my website showing a blank white screen… I’m not sure what that would be related to, nor do I have any idea of how it would work.