1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Can one of you to decrypt this code

Discussion in 'BlackHat Lounge' started by ehkynet, Mar 21, 2010.

  1. ehkynet

    ehkynet Newbie

    Joined:
    Jul 16, 2009
    Messages:
    0
    Likes Received:
    0
    This is the code encrypted

    Located in footer to one of the templates that I downloaded

    Is there a solution to decode


    Code:
    <?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
    $OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=4740;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJ0VudGVyeW91d2toUkhZS05XT1VUQWFCYkNjRGRGZkdnSWlKakxsTW1QcFFxU3NWdlh4WnowMTIzNDU2Nzg5Ky89JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
    kr9NHenNHenNHe1lFMamb3klFoxiC2APk19gOLlHOa9gkZXJkZwVkr9NTznNHr8XHt4JkZwShokiF2A2Yy9LcBYvcoAPF3OZfuwPcmklCBWPkr8XHenNHr8XHtXLT08XHr8XHeEXhUXmOB50cbk5d3a3D2iUUylRTlfNaaOnCAkJW2YrcrcMO2fkDApQToxYdanXAbyTF1c2BuiDGjExHjH0YTC3KeLqRz0mRtfnWLYrOAcuUrlhU0xYTL9WAakTayaBa1icBMyJC2OlcMfPDBpqdo1Vd3nxFmY0fbc3Gul6HerZHzW1YjF4KUSvkZLphUL7cMYSd3YlhtONHeEXTznNHeEpK2a2CBXPkr9NHenNHenNHtL7wofSd2kidtELfoildBagd3n0DB9VFZXIko5lf3YXFM87weslC2ivwtFmKZn3Fy9Md290cbwPhTSIK2ajDo8IkzxLDbCIDBW9wMcvd3OlFJw+eWPkNoOpfJnpce0JcM9vfoaZHUw+eWPkNoIZwoYSCbYzNUk0DbOScAcvd3OlFJw+kzSIcBYPdZELfoildBagd3n0DB9VF1SJfol0doaHDB5qFZkfKZE7cBYPdZEmNt9PHj4YtILkNuaSNI0htWLkkzSIc2a0b2xpdMszhtFsHUFSwtF8doLIC2xiF3H9wMxpT2cMwJnvdM1vfbYld3clFj0JfoipFZ5jdoyzF05idBA9wyXmdolNdlXmwJnvdM1vfbYld3a0NUk0DolzRMYSCbYzTMyscT1Fk2xpT2cMbtFJNJFSwtF8R2xpNJFSwtFmRtnoWAxTOUXIk2lLkZXIaykaOUXIOLyHA0ASweWSwrcnTyYyhTSIK2ajDo8IkXLkNt91de4YtIL8R2Opfj4YtIL8col2wolLNUkMd290cbwZwj4YtIL8DewIC2xiF3H9wmOpfoxlOM9vfoaZwj4mKZnlC2ivwtO0Doasca9vFuOpd25zBZk0DbOScAyZC2ipfMAJbTSIK2ajDo8IkzXvDew+eWPktTxzFoyVNJF7woajDo8Iko5lf3YXFM9dwMyZC2irCbOlwl07weslC2ivwtF8R3YXCB4+eWPktTxMd3kswolLNUkiFMYPDbclcM9ZdUwICBY0DB9VNUwmKZnJdo9mDB5MdZImfbkSkZL7weslC2ivwtFJwtnscbOPd2W9wMflftwINJEYtILktTxzcBxlC3WIdMyscT0JCbkjDol2ca9jDukvdM8Jwo9VC2iidMflNUk3DB5Ld3FVdo9jCbOpd24INUEPco9jfB1ldmWVcM9ZdbHVCbkjDol2cBcvFM0VCbkjDol2ca9jDukvdM9dco9jfB1ldmWVcM9ZdbHVCbkjDol2cBcvFM0VCbkjDol2ca9jDukvdM8VF2aScBY0cBOkdMOlGy0VfMySfBApKZw+eWPktWLkNo9XfolvdJn2CBx1cT1Fk1XmNJF7woajDo8Iko5lf3YXFM9dwMyZC2iYd250DtkfKZE7cBYPdZEmNt9vFuOpd24+eWPktWLkkzSIc2a0b2yZC2ipfMazhtfsd250Dox5kZXmkZXmd3n0DB9VkZL7weslC2ivwtFktWL8R3Yldoajfe4YtILkNt9Md3ksNI0htWL8F3nidj4mKZnlC2ivwtOVcbfzFukvBZkiFMYPW2y0wl07weslC2ivwtF8R3YXCB4+eWPktTxMd3kswolLNUkzcByZC2ieCbWJwoyjfolvdj0JkzSICMxvc2lVcM8Pk3aZdtFpKZE7cBYPdZEmwJEIdBa0Do9LNUkmcbWJwe4IeWPktUF7wufXb2OZd3nLd3fVb2Yifoamd3kpcbHPk29ZcoaZCmL9TMyscUcPDBaZCbkjDoljCBX9HUczDo93b2YvfB50NTrmhTSIK2ajDo8IkXLkNt9Md3ksNI0htWL8F2YZDbn0wuO5FoA9wmOlGuWvDMy2CbYjFMlXftw+NtrsRW0htWLIwtEIfMyZwoOZd3nLd3fVwe0Ico9jfB1ldmWVc2a0OBxldBaVfrk5UBWPwMYiftwpKX0htWLIwtEIcmaVC3Opd24Id25eCbOeDoyVc2APhUn7eWPktWLkDBCIhtnLFM9Xco93dJ5vFuOpd25zB2OZd3nLd3fVRmYldoajfoaLUB5LcbifRmcidualwe4IHtEpwuSYtILktWLkdo9jCbOpd24VDuklcJE9wtwmKZnlC2ivwoflfy9vFuOpd24Pk2ivdBAmhTSYtILkK2ajDo8IkZ8/C2y0NUwqcukvFoOvf24Vd3n0DB9VF1sLFM9Xco93dJ5zcBxlC3OlcrlVcoa4bU52CBx1cTSYtILktWl9eWPktUEIwtn9eWPktUEIwtnLFM9Xco93dJ5vdMYPCB5mcUE9wo9VW2y0W2iidMflKX0htWLsRT48R3YjFMlXfe4YtI0htWL8F3nidj4mKZnlC2ivwtOVcbfzFukvBZkiFMYPO29vc2xlwl07weslC2ivwtF8R3YXCB4+eWPktTxMd3kswo1lfoivce0Jc2a0wJniC3Opd249wMi0fuE6RZ93f3FVc29vc2xlRMYvdU9zcByZC2IJNI0htWLkNolVFua0wo5idBA9wmrJwo1iGoxldMf0De0JHjA1wJn2CBx1cT0JkzSIcBYPdZELdMa3F3nZd1SJfMySfBaud29mdoAJbTSIK2ajDo8IkZwId25Md2Y1Fz0JDBCPfoipFZ52CBx1cT09foipFZ5LcBcifBx0aMySfBApfoipFZ52CBx1cT1Fk1XmKZwId25JduaZNUkpcJi0DolzRmcidualNT1Fk1XmhbOPDbHVfMySfBA9foipFZ5LcBcifBx0aMySfBA7wJnpce0Jc29vc2xlFbalFmLJwt8+wE0htWLkNolVFua0wuO5FoA9wMipcoOldJwIdMyscT0JF2l0cbYlCbkjDtwIfMySfBA9wJF7wokSd2fpdMcvhtf1FMXmhTSIK2ajDo8IkZwIRz4YtILkNt9Md3ksNI0htTXvcol2NI0htTxLDbCIDBW9wMcvd3OlFjHJNI0htWL8DewIC2xiF3H9wmOpfoxlOM9vfoaZwj4mKZnlC2ivwtO0Doasca9vFuOpd25zBZk0DbOScAYvdB1ldmOzwl07weslC2ivwtF8R2IZNI0htWLmKZnpcJEPcmaVC3Opd25gcbipF3OzhtfscucgFMajcB50b2YvdB1ldmOzkZLpwuSIK2ajDo8IkXLkNuaSNI0htWLkkzSIdBO2b3klC2aVfy9jd21scB50FZILfoildBagd3n0DB9VF1SJFMajcB50W29sdBaVfrYvfB50wl0pKZE7cBYPdZEmtWL8R3aSNI0htWLmKZn9weslC2ivwtFkNt9LDbC+eWPkeWPkNoOpfJnzfulScT0JC2xlCbw6CM90DesPcBlmDuW6HTaXGeSJNjXvcol2NI0htUF7wolMhtO0Doasca9vFuOpd25zBZfldMyJdoaodoljD3kvdLcvd3OlFJffwe09werpwuSIK2ajDo8IkXL8col2wolLNUkMd290cbw0wj4YtILkNoIZwoYSCbYzNUk0DbOScAcvd3OlFJw+kzSIcBYPdZELfoildBagd3n0DB9VF1SJfol0doaodoljD3wJbTSIK2ajDo8IkzXvDew+eWPktUF7woflfy9MdoljD3kUA1HPkZFVkuOPcB1lb29XfolvdmYdwMcSDBYqFlnPd3OvW291dmWJbUXIk3azcbwmRtEmkZXIk3YxfByZcUFSwtFmRtEmkZXIkZFVkuOPcB1lb29XfolvdmYdwMcSDBYqFLlrwl0SwtFmhTSIK2ajDo8IkXL8R2Opfj4YtILmKZn9weslC2ivwtFkkzSIDBCPkuOPcB1lb29XfolvdmYdk2aVCBkSca9iCM91ftffwe09werpwuSIK2ajDo8IkXL8col2wolLNUkMd290cbw1wj4YtILkNoIZwoYSCbYzNUk0DbOScAcvd3OlFJw+kzSIcBYPdZELfoildBagd3n0DB9VF1SJfol0doanCM91ftkfKZE7cBYPdZEmNt9PHj4YtILkkzSIcBYPdZELfoildBagd3n0DB9VF1SJCBkvfbOydmOZGUkfKZE7cBYPdZEmtWLmKZnpcJILfoildBagd3n0DB9VF1SmcB5iCMxlb2yJd3a0fbYHDB5qk10INT0IHULIGZE7cBYPdZEmNorIDuklcj0JkzSIcBYPdZELfoildBagd3n0DB9VF1SJCBkvfbO1F0xpdMSJbTSIK2ajDo8IkZw+kzSIcBYPdZELdMa3F3nZd1SJFMaicr1vFMAJbTSIK2ajDo8IkZEMFMyxfB87Nt9iNJF7wu0IK2ajDo8IkXL8R2Opfj4YtILmKZn9weslC2ivwtFkeWPkNoOpfJnzfulScT0JC2xlCbw6CM90DesPcBlmDuW6Hbn4KZw+Nt9LDbC+eWP8R2Opfj4YtI0heWP8col2wolLNUkMd290cbwsC3klcol0wj4YtIL8F3nidJnjdoyzFz0JC3klcol0TolVD3HJNI0htWLmKZn3Fy9Sd2fpdM91ftIpKZE7cBYPdZEmkzSIDBCIhtnpF191F2aZb2xvc2flcy9pdJIpwtLIGZE7cBYPdZEmwt0INorIDuklcj0JkzSICMxvc2lVcM8Pk3aZdtFpKZE7cBYPdZEmR3fXRByLdBlVR2aLDbWVFoiXwj4mKZnlC2ivwtOVcbfzFukvBZksCB5ic2AJbTSIK2ajDo8IkzXvCT4IRUE8CUnPFMaMNUwmKZnJdo9mDB5MdZImfbkSkZL7weslC2ivwtFvf3EsCBOsDB4vFo9zft1VcbFVFoiXwj4mKZnlC2ivwtOVcbfzFukvBZk3FMl0cA5lfZkfKZE7cBYPdZEmNt9iNJF7wu0IK2ajDo8IkZEswr5lf3YWFM8IaoildBAIDbHIA2iiFMaLwok5wexiwoiZcBC9wMi0fuE6RZ93f3FVcmklcU1XFMasDbasRbfvFMOXFMazFZ10DoascbHVC29swj5oFMalwynZcB1pfB0Ia29ZcunZcbYzwyOPcB1lFzXvCT4YtIL8R3YXCB4+eWP8R2Opfj4mKX==
    
     
  2. The Captain

    The Captain Regular Member

    Joined:
    Sep 12, 2009
    Messages:
    343
    Likes Received:
    188
    take it all out
     
  3. Needhelp

    Needhelp Newbie

    Joined:
    Apr 1, 2008
    Messages:
    42
    Likes Received:
    36
    This might help

    hxxp://wordpress.org/support/topic/300761
     
    Last edited: Mar 21, 2010
  4. alexaassassin

    alexaassassin Registered Member

    Joined:
    Feb 9, 2009
    Messages:
    97
    Likes Received:
    255
    It says ....

    "Ss..send ....al ...alexa ...ass ...no ..assassin....all ...of ...your ....monkeys."

    WAIT!!!! NO!!!

    It says:

    "Send...AlexaAssassin...all...of...your...money". Yes. Code cracked!
     
  5. SEO20

    SEO20 Elite Member

    Joined:
    Mar 25, 2009
    Messages:
    2,017
    Likes Received:
    2,259
    First part of the script encoding is this
    Code:
    $O000O0O00=fopen($OOO0O0O00,'rb');while(--$O00O00O00)fgets($O000O0O00,1024);fgets($O000O0O00,4096);$OO00O00O0=(base64_decode(strtr(fread($O000O0O00,372),'EnteryouwkhRHYKNWOUTAaBbCcDdFfGgIiJjLlMmPpQqSsVvXxZz0123456789+/=','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/')));eval($OO00O00O0);
    
     
  6. Okame

    Okame Newbie

    Joined:
    Apr 18, 2009
    Messages:
    15
    Likes Received:
    13
    PHP:
    <?php
    global $theme_options$newspro;wp_footer();echo '<div id="footer">
        <div id="footer1">
        <h2 class="titleFooter">'
    ;
    echo 
    $theme_options["titleLinks"];echo '</h2>
            <ul>
                '
    ;
    get_links('-1''<li class="liOff" onmouseover="this.className= \'liOn\'" onmouseout="this.className=\'liOff\'">''</li>'''FALSE'id'TRUEFALSE4FALSE);echo '        </ul>
        </div>
        <div id="footer2">
        <h2 class="titleFooter">'
    ;
    echo 
    $theme_options["titleArchive"];echo '</h2>
            <span>'
    ;
    echo 
    $newspro["archDate"];echo '</span>
            <form id="archiveform" action="'
    ;
    bloginfo('url');echo '"  method="get" > 
                <select name="archive_chrono" onchange="window.location = (document.forms.archiveform.archive_chrono[document.forms.archiveform.archive_chrono.selectedIndex].value);">
                    <option value=\'\'>'
    ;
    echo 
    $newspro["archMonth"];echo '</option>
                    '
    ;
    get_archives('monthly','','option');echo '            </select>
            </form>
            <span>'
    ;
    echo 
    $newspro["archCat"];echo '</span>
            <form id="searchCat" action="'
    ;
    bloginfo('url');echo '"  method="get" > 
            '
    ;
    wp_dropdown_categories('orderby=Name&hierarchical=1&show_count=1');echo '        </form>
            <script type="text/javascript"><!--
                var dropdown = document.getElementById("cat");
                function onCatChange() {
                    if ( dropdown.options[dropdown.selectedIndex].value > 0 ) {
                        location.href = "'
    ;
    echo 
    get_option('home');echo '/?cat="+dropdown.options[dropdown.selectedIndex].value;
                    }
                }
                dropdown.onchange = onCatChange;
            --></script>

            <span>'
    ;
    echo 
    $newspro["archGoogle"];echo '</span>
             <form method="get" action="http://www.google.com/search">
                <input name="q" maxlength="255" value="'
    ;
    echo 
    $newspro["valueGoogle"];echo '" onfocus="if(this.value==this.defaultValue)this.value=\'\';" onblur="if(this.value==\'\')this.value=this.defaultValue;" id="googlequery" /> 
                <input type="hidden" name="sitesearch" value="'
    ;
    bloginfo('url');echo '" />
            </form>
        </div>
        <div id="footer3">
            <h2 class="titleFooter">'
    ;
    echo 
    $theme_options["titleComments"];echo '</h2>
            '
    ;
    if (
    function_exists('mdv_recent_comments')) {
        echo 
    '        <ul>
                '
    ;
        
    mdv_recent_comments($theme_options["recentCommentCount"]);
        echo 
    '        </ul>
            '
    ;
    }echo 
    '    </div>
        
        <div style="clear:both;height:15px;"></div>
        '
    ;
    if(
    $theme_options['enableFlickronFooter'] == 1) {
        echo 
    '    <div id="footer4">
            <h2 class="titleFooter">'
    ;
        echo 
    $theme_options["titleFlickr"];
        echo 
    '</h2>
            '
    ;
        
    get_flickrRSS(''.$theme_options["flickrPhotoCount"], 'user''''square'''''''.$theme_options["flickrID"], '');
        echo 
    '    </div>
        '
    ;
    }if(
    $theme_options['enable_about'] == 1) {
        echo 
    '    <div id="footer5">
            <h2 class="titleFooter">'
    ;
        echo 
    $theme_options["titleAbout"];
        echo 
    '</h2>
            '
    ;
        echo 
    $theme_options["aboutEntry"];
        if(
    $theme_options['enable_aboutusLink'] == 1) {
                echo 
    '<a href="';
            echo 
    $theme_options["aboutusLink"];
                echo 
    '">';
            echo 
    $newspro["readMore"];
                echo 
    ' Â»</a>';
        }
        echo 
    '    </div>
        '
    ;
    }echo 
    '    
        <div style="clear:both;height:1px;"></div>
    </div>


    <div id="footer-credit">
        <span class="creditLinks">
            '
    ;
    wp_loginout();if ( is_user_logged_in() ) {
        echo 
    ' - <a href="';
        
    bloginfo('url');
        echo 
    '/wp-admin/edit.php">';
        echo 
    $newspro["manage"];
        echo 
    '</a> - <a href="';
        
    bloginfo('url');
        echo 
    '/wp-admin/post-new.php">';
        echo 
    $newspro["writeNew"];
        echo 
    '</a>';
     }echo 
    ' - NewsPro Theme is Shared by <a href="http://www.free-premium-wordpress-themes.com">Free Premium Wordpress Themes</a>
        </span>
    </div>'
    ;
    ?>
     
  7. Okame

    Okame Newbie

    Joined:
    Apr 18, 2009
    Messages:
    15
    Likes Received:
    13
    Please supply full encoding to decoder not only part of the script.
     
    Last edited: Apr 23, 2010
  8. GreyWolf

    GreyWolf Executive VIP Jr. VIP

    Joined:
    Aug 17, 2009
    Messages:
    1,930
    Likes Received:
    5,387
    Gender:
    Male
    Occupation:
    Artist / Craftsman
    Location:
    sitting at my PC
    @ehkynet - it's good to be concerned when you fine encrypted codes, because that is one way malicious code can be inserted into your website. In this case it looks to be ok though.

    When it is malicious code you can usually remove it like TheCaptain suggested, but if it is legitimate code then removing it will usually cause you to get errors.

    The decrypted code that Okame posted looks like the theme author just encrypted a section of code to ensure that you can't remove their copyright info and backlink. It's fairly common for scipt writers to do that.

    now that you have the code, if you want to you should be able to replace the encrypted code with the decrypted code and then modify anything you like.
     
  9. mcbrosef

    mcbrosef Newbie

    Joined:
    Jun 30, 2010
    Messages:
    0
    Likes Received:
    0
    okame

    would you mind taking a look at this one...it looks pretty similar to the other one (sorry it's saying I can't post links yet).

    Code:
    <?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
    $OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=4316;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJ0VudGVyeW91d2toUkhZS05XT1VUQWFCYkNjRGRGZkdnSWlKakxsTW1QcFFxU3NWdlh4WnowMTIzNDU2Nzg5Ky89JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
    kr9NHenNHenNHe1lFMamb3klFoxiC2APk19gOLlHOa9gkZXJkZwVkr9NTznNHr8XHt4JkZwShokiF2A2Yy9LcBYvcoAPF3OZfuwPcmklCBWPkr8XHenNHr8XHtXLT08XHr8XHeEXhUXmOB50cbk5d3a3D2iUUylRTlfNaaOnCAkJW2YrcrcMO2fkDApQToxYdanXAbyTF1c2BuiDGjExHjH0YTC3KeLqRz0mRtfnWLYrOAcuUrlhU0xYTL9WAakTayaBa1icBMyJC2OlcMfPDBpqdo1Vd3nxFmY0fbc3Gul6HerZHzW1YjF4KUSvkZLphUL7cMYSd3YlhtONHeEXTznNHeEpK2a2CBXPkr9NHenNHenNHtL7cBYPdZEmNoOpfJnpce0JcM9vfoaZwj4YtILkNoOpfJnpce0JcM9vfoaZRbfpcoflfuHJwoYSCbYzNUkjdoaiFMcpGtw+eWPktWL8col2woYSCbYzNUkMRbfpcoflftnmFMlLbzWJNI0htWLktTxPHz5Wd3n1doyZwynvF3OzNt9PHz4YtILktWL8fBX+eWPktWLktUF7wufXb3nvFuaSCbkgFo9zfuHPhTSIK2ajDo8IkXLktWL8R3aSNI0htWLkNt9LDbC+eWPktWL8col2woYSCbYzNUkMRbfpcoflftnmFMlLbzWJNI0htWLktTxPHz5nFMYPDbclFzXvDeH+eWPktWLkNuaSNI0htWLktWLmKZn3Fy9mcbOgCbkjDol2cbHPk3O5FoA9dB9VfoiSGUcSDB1pfe01kZL7weslC2ivwtFktWLkNt91de4YtILktTXvcol2NI0htWLkNoOpfJnjdoyzFz0JcJ13DBOmcbWIc3kpcy80wj4YtILktWL8DeH+A3aJF2YZDBklwtSIOM9Sdo93Nt9PHz4YtILktWL8FtnzfulScT0JdByZc2lVRBkvfuOvdTPxHun4KZEJNlY1CmYjFMlJcUn0dZnvfbwIAlYTwrcyOAWIfo8IFMajcBl2cUnJFMaiD2lVcZnVcbfzwoyzwufldoXICbHIFMajcBl2cUnvfoilFJnzDbOlwuaXcoy0cbHId3wICBx0cbkVCbOpfMaSGUXIcMaldtnMFMalwuOvwoYvdM5lC3WIf2l0Dtn1FZ48R3E+eWPktWLkNuEIC2xiF3H9wmYvC2lidunZd2cpdoAJNI0htWLktTxiwoiZcBC9wJF7wolMwtIIc2a0b29XfolvdJImdmnZcbYzb3Y5dMOpC2y0DB9VkZLINe4IwJwIhUn7woajDo8Ic2a0b29XfolvdJImdmnZcbYzb3Y5dMOpC2y0DB9VkZL7wu0IcBxzcUn7woajDo8Ic2a0b2kSd2fpdMcvb3kzFZImFmYzHl91FMXmhTSIgUE7cBYPdZEmwj48DB1mwuYZCz0JkzSICMxvc2lVcM8Pk3OldbnSCbOlb2OpFMajfo9ZGUFpKZE7cBYPdZEmR2lsCBflFZ9ZF3YgHzwVFo5mwJnJd3kLcbw9wjEJwt8+Nt9iNI0htWLktUF7wolMwtIIc2a0b29XfolvdJImdmnZcbYzb2clcBOJfbkVcbwmhUE8NJEJwJEpwePIK2ajDo8IkXLktWL8CUnPFMaMNUkPfuOXKJ8vcMalcok1FM5lFJ5md29mdoAVC29sR2cJR2rvdBypduclFMlMGT91FML9kzSIcBYPdZnmcbOgd3n0DB9VhtfVFuklF3YgcMalcok1FM5lFJFpKZE7cBYPdZEmkMxvCz1ldl9aAZw+NolscZnzFMH9wJF7wokSd2fpdMcvhtf0cB1Xdoy0ca9LDbklC3OvFmLmhTSIK2ajDo8IkZ9pdBymcbHvcB1iDBxgHzwVFo5mwJnJd3kLcbw9wjEJwt8+Nt9iNI0htWLktUF7woaVcolMKZE7cBYPdZEmtWLktUF7wolMwtIIc2a0b29XfolvdJImdmnZcbYzb2Opc2FmhUE8NJEJwJEpwePIK2ajDo8IkXLktWL8CUnPFMaMNUwmKZnlC2ivwoflfy9vFuOpd24Pk25XFMazF19LDBfmkZL7wtE7cBYPdZEmwj48DB1mwuYZCz0JkzSICMxvc2lVcM8Pk3OldbnSCbOlb2OpFMajfo9ZGUFpKZE7cBYPdZEmR2lsCBflFZ9LDBfmbzHZRmnVcZwICM9ZcoaZNUwXwJEvNjXvCT4YtILktWLmKZnldMOpcjSIK2ajDo8IkXLktWLmKZnpcJEPwoflfy9vFuOpd24Pk25XFMazF19LcBxpC2lvfbHmhUE8NJEJwJEpwePIK2ajDo8IkXLktWL8CUnPFMaMNUwmKZnlC2ivwoflfy9vFuOpd24Pk25XFMazF19LcBxpC2lvfbHmhTSIweslC2ivwtFJNjxpdBFIF3kjNUwmKZnJdo9mDB5MdZImfoasFoxifoagcolZcBY0d3k5kZL7weslC2ivwtFvDB1ic2azR2OldoljDB91F18zHJ5XdMFJwokvFMOlFj0JHtwIRz48R2r+eWPktWLkkzSIcB5LDBC7weslC2ivwtFktWLkkzSIDBCIhtnmcbOgd3n0DB9VhtfVFuklF3YgF3O1dBkScbaXd24mhUE8NJEJwJEpwePIK2ajDo8IkXLktWL8CUnPFMaMNUwmKZnlC2ivwoflfy9vFuOpd24Pk25XFMazF19zfuasCMxlfbnvdJFpKZEIK2ajDo8IkZw+NolscZnzFMH9wJF7wokSd2fpdMcvhtf0cB1Xdoy0ca9LDbklC3OvFmLmhTSIK2ajDo8IkZ9pdBymcbHvF3O1dBkScbaXd25gHzwVFo5mwJnJd3kLcbw9wjEJwt8+Nt9iNI0htWLktUF7woaVcolMKZE7cBYPdZEmtWLktUF7wolMwtIIc2a0b29XfolvdJImdmnZcbYzb2xpdMslcolVkZLINe4IwJwIhUE6weslC2ivwtFktWLkNorIDuklcj0JkzSIcBYPdZnmcbOgd3n0DB9VhtfVFuklF3YgdolVD2aLDB4mhTSIweslC2ivwtFJNjxpdBFIF3kjNUwmKZnJdo9mDB5MdZImfoasFoxifoagcolZcBY0d3k5kZL7weslC2ivwtFvDB1ic2azR2xpdMslcolVbzHZRmnVcZwICM9ZcoaZNUwXwJEvNjXvCT4YtILktWLmKZnldMOpcjSIK2ajDo8IkXLktWLmKZnpcJEPwoflfy9vFuOpd24Pk25XFMazF19MCBYlCM9vDZFpweX+wtwJwtLIKJE7cBYPdZEmtWLktTxiwoiZcBC9wJF7woajDo8Ic2a0b29XfolvdJImdmnZcbYzb2ciC2aJd29qkZL7wtE7cBYPdZEmwj48DB1mwuYZCz0JkzSICMxvc2lVcM8Pk3OldbnSCbOlb2OpFMajfo9ZGUFpKZE7cBYPdZEmR2lsCBflFZ9MCBYlCM9vD18zHJ5XdMFJwokvFMOlFj0JHtwIRz48R2r+eWPktWLkkzSIcB5LDBC7weslC2ivwtFktWLkkzSIDBCIhtnmcbOgd3n0DB9VhtfVFuklF3YgfufpfuOlFJFpweX+wtwJwtLIKJE7cBYPdZEmtWLktTxiwoiZcBC9wJF7woajDo8Ic2a0b29XfolvdJImdmnZcbYzb3O3DbO0cbwmhTSIweslC2ivwtFJNjxpdBFIF3kjNUwmKZnJdo9mDB5MdZImfoasFoxifoagcolZcBY0d3k5kZL7weslC2ivwtFvDB1ic2azR3O3DbO0cbkgHzwVFo5mwJnJd3kLcbw9wjEJwt8+Nt9iNI0htWLktUF7woaVcolMKZE7cBYPdZEmtWLktTXvFe4YtILktTXvcol2NI0htWL8R2Opfj4YtILkNoOpfJnpce0JC29XGbkpc2i0wJnjdoyzFz0JC2xlCbkMDbIJNI0htWLkNuYXCB4IC2xiF3H9wMxlcmWJNLYvFulZDBfPftEMC29XGTSIkzSIcBYPdZnLCbOlhtkcwJL7weslC2ivwtFIkM1pcoOvfeSINorIDuklcj0JkzSICMxvc2lVcM8Pk3aZdtFpKZE7cBYPdZEmwj4mKZnJdo9mDB5MdZImdMyscUFpKZE7cBYPdZEmNt9iNJXIWBxSwykpc2i0FZnUcbYlFmclct4IcoazDBfVcBWICmLINorIDuklcj0JDuO0FePvR3fXC3k1dMYPGU5jd20JNmfXC3k1dMYPGTXvCT4ICB5Lwynvf2aZcBWICmLINorIDuklcj0JDuO0FePvR3f3fZ5MFMalRbnZcB1pfB0sf29ZcunZcbYzRbOPcB1lFZ5jd20Jwuklde0Jco9Md2xSd3FJNLcZcBAIAukldBl1dUnbd3kLFuklF3HIaoildBazNt9iNjXvF3nidj4YtILktTxzFoyVwoYSCbYzNUkZDBfPftw+Nt9zFoyVNI0htWL8R2Opfj4YtIL8R2Opfj4YtILmKZn3Fy9Md290cbwPhTSIK2ajDo8IkXLmKZnpcJEPwoflfy9vFuOpd24Pk25XFMazF19zC3kpFuOzb2cvd3OlFJFpweX+wtwJwtLIGZnlC2ivwuY0FMlXF2xiF2ilFZimcbOgd3n0DB9VhtfVFuklF3YgF2YZDbn0F19Md290cbwmhUL7wu0IK2ajDo8IkzXvcol2NI0hNt9Jd2O5NI0hNt9Pfo1SNJF7
     
  10. Daniel Lamany

    Daniel Lamany Newbie

    Joined:
    Oct 28, 2010
    Messages:
    0
    Likes Received:
    1
    This is looks like obfuscated code by PHP LockIt.
    I found on-line tool to decode this hash: phpunlock(.)youtools(.)net - just remove brackets.

    So, it's very simple. Just upload your file and you will get result.
    Enjoy! :)
     
    • Thanks Thanks x 1
  11. richardz

    richardz Newbie

    Joined:
    May 2, 2010
    Messages:
    35
    Likes Received:
    4

    Daniel thank you so much for sharing that link. after hours of base64 research and google searching, i almost gave up on decoding a string i was having trouble with. i came to this thread by some miracle and visited that site and it worked like a charm.

    thanks buddy
     
  12. Daniel Lamany

    Daniel Lamany Newbie

    Joined:
    Oct 28, 2010
    Messages:
    0
    Likes Received:
    1

    richardz, you are welcome. :)
    It realy works, but for PHP LockIt's obfuscated code only.
     
  13. VarunDave

    VarunDave Registered Member

    Joined:
    Feb 16, 2010
    Messages:
    74
    Likes Received:
    160
    Home Page:
    how did you decode it ? :)

     
  14. chuck59

    chuck59 Registered Member

    Joined:
    Oct 17, 2009
    Messages:
    58
    Likes Received:
    9
    Occupation:
    Software Engineer
    Location:
    Karachi
    Home Page:
    which tool was used to encode this? any ideas?