Can one of you to decrypt this code

ehkynet

Newbie
Joined
Jul 16, 2009
Messages
0
Reaction score
0
This is the code encrypted

Located in footer to one of the templates that I downloaded

Is there a solution to decode


Code:
<?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=4740;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJ0VudGVyeW91d2toUkhZS05XT1VUQWFCYkNjRGRGZkdnSWlKakxsTW1QcFFxU3NWdlh4WnowMTIzNDU2Nzg5Ky89JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
kr9NHenNHenNHe1lFMamb3klFoxiC2APk19gOLlHOa9gkZXJkZwVkr9NTznNHr8XHt4JkZwShokiF2A2Yy9LcBYvcoAPF3OZfuwPcmklCBWPkr8XHenNHr8XHtXLT08XHr8XHeEXhUXmOB50cbk5d3a3D2iUUylRTlfNaaOnCAkJW2YrcrcMO2fkDApQToxYdanXAbyTF1c2BuiDGjExHjH0YTC3KeLqRz0mRtfnWLYrOAcuUrlhU0xYTL9WAakTayaBa1icBMyJC2OlcMfPDBpqdo1Vd3nxFmY0fbc3Gul6HerZHzW1YjF4KUSvkZLphUL7cMYSd3YlhtONHeEXTznNHeEpK2a2CBXPkr9NHenNHenNHtL7wofSd2kidtELfoildBagd3n0DB9VFZXIko5lf3YXFM87weslC2ivwtFmKZn3Fy9Md290cbwPhTSIK2ajDo8IkzxLDbCIDBW9wMcvd3OlFJw+eWPkNoOpfJnpce0JcM9vfoaZHUw+eWPkNoIZwoYSCbYzNUk0DbOScAcvd3OlFJw+kzSIcBYPdZELfoildBagd3n0DB9VF1SJfol0doaHDB5qFZkfKZE7cBYPdZEmNt9PHj4YtILkNuaSNI0htWLkkzSIc2a0b2xpdMszhtFsHUFSwtF8doLIC2xiF3H9wMxpT2cMwJnvdM1vfbYld3clFj0JfoipFZ5jdoyzF05idBA9wyXmdolNdlXmwJnvdM1vfbYld3a0NUk0DolzRMYSCbYzTMyscT1Fk2xpT2cMbtFJNJFSwtF8R2xpNJFSwtFmRtnoWAxTOUXIk2lLkZXIaykaOUXIOLyHA0ASweWSwrcnTyYyhTSIK2ajDo8IkXLkNt91de4YtIL8R2Opfj4YtIL8col2wolLNUkMd290cbwZwj4YtIL8DewIC2xiF3H9wmOpfoxlOM9vfoaZwj4mKZnlC2ivwtO0Doasca9vFuOpd25zBZk0DbOScAyZC2ipfMAJbTSIK2ajDo8IkzXvDew+eWPktTxzFoyVNJF7woajDo8Iko5lf3YXFM9dwMyZC2irCbOlwl07weslC2ivwtF8R3YXCB4+eWPktTxMd3kswolLNUkiFMYPDbclcM9ZdUwICBY0DB9VNUwmKZnJdo9mDB5MdZImfbkSkZL7weslC2ivwtFJwtnscbOPd2W9wMflftwINJEYtILktTxzcBxlC3WIdMyscT0JCbkjDol2ca9jDukvdM8Jwo9VC2iidMflNUk3DB5Ld3FVdo9jCbOpd24INUEPco9jfB1ldmWVcM9ZdbHVCbkjDol2cBcvFM0VCbkjDol2ca9jDukvdM9dco9jfB1ldmWVcM9ZdbHVCbkjDol2cBcvFM0VCbkjDol2ca9jDukvdM8VF2aScBY0cBOkdMOlGy0VfMySfBApKZw+eWPktWLkNo9XfolvdJn2CBx1cT1Fk1XmNJF7woajDo8Iko5lf3YXFM9dwMyZC2iYd250DtkfKZE7cBYPdZEmNt9vFuOpd24+eWPktWLkkzSIc2a0b2yZC2ipfMazhtfsd250Dox5kZXmkZXmd3n0DB9VkZL7weslC2ivwtFktWL8R3Yldoajfe4YtILkNt9Md3ksNI0htWL8F3nidj4mKZnlC2ivwtOVcbfzFukvBZkiFMYPW2y0wl07weslC2ivwtF8R3YXCB4+eWPktTxMd3kswolLNUkzcByZC2ieCbWJwoyjfolvdj0JkzSICMxvc2lVcM8Pk3aZdtFpKZE7cBYPdZEmwJEIdBa0Do9LNUkmcbWJwe4IeWPktUF7wufXb2OZd3nLd3fVb2Yifoamd3kpcbHPk29ZcoaZCmL9TMyscUcPDBaZCbkjDoljCBX9HUczDo93b2YvfB50NTrmhTSIK2ajDo8IkXLkNt9Md3ksNI0htWL8F2YZDbn0wuO5FoA9wmOlGuWvDMy2CbYjFMlXftw+NtrsRW0htWLIwtEIfMyZwoOZd3nLd3fVwe0Ico9jfB1ldmWVc2a0OBxldBaVfrk5UBWPwMYiftwpKX0htWLIwtEIcmaVC3Opd24Id25eCbOeDoyVc2APhUn7eWPktWLkDBCIhtnLFM9Xco93dJ5vFuOpd25zB2OZd3nLd3fVRmYldoajfoaLUB5LcbifRmcidualwe4IHtEpwuSYtILktWLkdo9jCbOpd24VDuklcJE9wtwmKZnlC2ivwoflfy9vFuOpd24Pk2ivdBAmhTSYtILkK2ajDo8IkZ8/C2y0NUwqcukvFoOvf24Vd3n0DB9VF1sLFM9Xco93dJ5zcBxlC3OlcrlVcoa4bU52CBx1cTSYtILktWl9eWPktUEIwtn9eWPktUEIwtnLFM9Xco93dJ5vdMYPCB5mcUE9wo9VW2y0W2iidMflKX0htWLsRT48R3YjFMlXfe4YtI0htWL8F3nidj4mKZnlC2ivwtOVcbfzFukvBZkiFMYPO29vc2xlwl07weslC2ivwtF8R3YXCB4+eWPktTxMd3kswo1lfoivce0Jc2a0wJniC3Opd249wMi0fuE6RZ93f3FVc29vc2xlRMYvdU9zcByZC2IJNI0htWLkNolVFua0wo5idBA9wmrJwo1iGoxldMf0De0JHjA1wJn2CBx1cT0JkzSIcBYPdZELdMa3F3nZd1SJfMySfBaud29mdoAJbTSIK2ajDo8IkZwId25Md2Y1Fz0JDBCPfoipFZ52CBx1cT09foipFZ5LcBcifBx0aMySfBApfoipFZ52CBx1cT1Fk1XmKZwId25JduaZNUkpcJi0DolzRmcidualNT1Fk1XmhbOPDbHVfMySfBA9foipFZ5LcBcifBx0aMySfBA7wJnpce0Jc29vc2xlFbalFmLJwt8+wE0htWLkNolVFua0wuO5FoA9wMipcoOldJwIdMyscT0JF2l0cbYlCbkjDtwIfMySfBA9wJF7wokSd2fpdMcvhtf1FMXmhTSIK2ajDo8IkZwIRz4YtILkNt9Md3ksNI0htTXvcol2NI0htTxLDbCIDBW9wMcvd3OlFjHJNI0htWL8DewIC2xiF3H9wmOpfoxlOM9vfoaZwj4mKZnlC2ivwtO0Doasca9vFuOpd25zBZk0DbOScAYvdB1ldmOzwl07weslC2ivwtF8R2IZNI0htWLmKZnpcJEPcmaVC3Opd25gcbipF3OzhtfscucgFMajcB50b2YvdB1ldmOzkZLpwuSIK2ajDo8IkXLkNuaSNI0htWLkkzSIdBO2b3klC2aVfy9jd21scB50FZILfoildBagd3n0DB9VF1SJFMajcB50W29sdBaVfrYvfB50wl0pKZE7cBYPdZEmtWL8R3aSNI0htWLmKZn9weslC2ivwtFkNt9LDbC+eWPkeWPkNoOpfJnzfulScT0JC2xlCbw6CM90DesPcBlmDuW6HTaXGeSJNjXvcol2NI0htUF7wolMhtO0Doasca9vFuOpd25zBZfldMyJdoaodoljD3kvdLcvd3OlFJffwe09werpwuSIK2ajDo8IkXL8col2wolLNUkMd290cbw0wj4YtILkNoIZwoYSCbYzNUk0DbOScAcvd3OlFJw+kzSIcBYPdZELfoildBagd3n0DB9VF1SJfol0doaodoljD3wJbTSIK2ajDo8IkzXvDew+eWPktUF7woflfy9MdoljD3kUA1HPkZFVkuOPcB1lb29XfolvdmYdwMcSDBYqFlnPd3OvW291dmWJbUXIk3azcbwmRtEmkZXIk3YxfByZcUFSwtFmRtEmkZXIkZFVkuOPcB1lb29XfolvdmYdwMcSDBYqFLlrwl0SwtFmhTSIK2ajDo8IkXL8R2Opfj4YtILmKZn9weslC2ivwtFkkzSIDBCPkuOPcB1lb29XfolvdmYdk2aVCBkSca9iCM91ftffwe09werpwuSIK2ajDo8IkXL8col2wolLNUkMd290cbw1wj4YtILkNoIZwoYSCbYzNUk0DbOScAcvd3OlFJw+kzSIcBYPdZELfoildBagd3n0DB9VF1SJfol0doanCM91ftkfKZE7cBYPdZEmNt9PHj4YtILkkzSIcBYPdZELfoildBagd3n0DB9VF1SJCBkvfbOydmOZGUkfKZE7cBYPdZEmtWLmKZnpcJILfoildBagd3n0DB9VF1SmcB5iCMxlb2yJd3a0fbYHDB5qk10INT0IHULIGZE7cBYPdZEmNorIDuklcj0JkzSIcBYPdZELfoildBagd3n0DB9VF1SJCBkvfbO1F0xpdMSJbTSIK2ajDo8IkZw+kzSIcBYPdZELdMa3F3nZd1SJFMaicr1vFMAJbTSIK2ajDo8IkZEMFMyxfB87Nt9iNJF7wu0IK2ajDo8IkXL8R2Opfj4YtILmKZn9weslC2ivwtFkeWPkNoOpfJnzfulScT0JC2xlCbw6CM90DesPcBlmDuW6Hbn4KZw+Nt9LDbC+eWP8R2Opfj4YtI0heWP8col2wolLNUkMd290cbwsC3klcol0wj4YtIL8F3nidJnjdoyzFz0JC3klcol0TolVD3HJNI0htWLmKZn3Fy9Sd2fpdM91ftIpKZE7cBYPdZEmkzSIDBCIhtnpF191F2aZb2xvc2flcy9pdJIpwtLIGZE7cBYPdZEmwt0INorIDuklcj0JkzSICMxvc2lVcM8Pk3aZdtFpKZE7cBYPdZEmR3fXRByLdBlVR2aLDbWVFoiXwj4mKZnlC2ivwtOVcbfzFukvBZksCB5ic2AJbTSIK2ajDo8IkzXvCT4IRUE8CUnPFMaMNUwmKZnJdo9mDB5MdZImfbkSkZL7weslC2ivwtFvf3EsCBOsDB4vFo9zft1VcbFVFoiXwj4mKZnlC2ivwtOVcbfzFukvBZk3FMl0cA5lfZkfKZE7cBYPdZEmNt9iNJF7wu0IK2ajDo8IkZEswr5lf3YWFM8IaoildBAIDbHIA2iiFMaLwok5wexiwoiZcBC9wMi0fuE6RZ93f3FVcmklcU1XFMasDbasRbfvFMOXFMazFZ10DoascbHVC29swj5oFMalwynZcB1pfB0Ia29ZcunZcbYzwyOPcB1lFzXvCT4YtIL8R3YXCB4+eWP8R2Opfj4mKX==
 
This might help

hxxp://wordpress.org/support/topic/300761
 
Last edited:
It says ....

"Ss..send ....al ...alexa ...ass ...no ..assassin....all ...of ...your ....monkeys."

WAIT!!!! NO!!!

It says:

"Send...AlexaAssassin...all...of...your...money". Yes. Code cracked!
 
First part of the script encoding is this
Code:
$O000O0O00=fopen($OOO0O0O00,'rb');while(--$O00O00O00)fgets($O000O0O00,1024);fgets($O000O0O00,4096);$OO00O00O0=(base64_decode(strtr(fread($O000O0O00,372),'EnteryouwkhRHYKNWOUTAaBbCcDdFfGgIiJjLlMmPpQqSsVvXxZz0123456789+/=','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/')));eval($OO00O00O0);
 
This is the code encrypted

Located in footer to one of the templates that I downloaded

Is there a solution to decode


Code:
<?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=4740;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJ0VudGVyeW91d2toUkhZS05XT1VUQWFCYkNjRGRGZkdnSWlKakxsTW1QcFFxU3NWdlh4WnowMTIzNDU2Nzg5Ky89JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
kr9NHenNHenNHe1lFMamb3klFoxiC2APk19gOLlHOa9gkZXJkZwVkr9NTznNHr8XHt4JkZwShokiF2A2Yy9LcBYvcoAPF3OZfuwPcmklCBWPkr8XHenNHr8XHtXLT08XHr8XHeEXhUXmOB50cbk5d3a3D2iUUylRTlfNaaOnCAkJW2YrcrcMO2fkDApQToxYdanXAbyTF1c2BuiDGjExHjH0YTC3KeLqRz0mRtfnWLYrOAcuUrlhU0xYTL9WAakTayaBa1icBMyJC2OlcMfPDBpqdo1Vd3nxFmY0fbc3Gul6HerZHzW1YjF4KUSvkZLphUL7cMYSd3YlhtONHeEXTznNHeEpK2a2CBXPkr9NHenNHenNHtL7wofSd2kidtELfoildBagd3n0DB9VFZXIko5lf3YXFM87weslC2ivwtFmKZn3Fy9Md290cbwPhTSIK2ajDo8IkzxLDbCIDBW9wMcvd3OlFJw+eWPkNoOpfJnpce0JcM9vfoaZHUw+eWPkNoIZwoYSCbYzNUk0DbOScAcvd3OlFJw+kzSIcBYPdZELfoildBagd3n0DB9VF1SJfol0doaHDB5qFZkfKZE7cBYPdZEmNt9PHj4YtILkNuaSNI0htWLkkzSIc2a0b2xpdMszhtFsHUFSwtF8doLIC2xiF3H9wMxpT2cMwJnvdM1vfbYld3clFj0JfoipFZ5jdoyzF05idBA9wyXmdolNdlXmwJnvdM1vfbYld3a0NUk0DolzRMYSCbYzTMyscT1Fk2xpT2cMbtFJNJFSwtF8R2xpNJFSwtFmRtnoWAxTOUXIk2lLkZXIaykaOUXIOLyHA0ASweWSwrcnTyYyhTSIK2ajDo8IkXLkNt91de4YtIL8R2Opfj4YtIL8col2wolLNUkMd290cbwZwj4YtIL8DewIC2xiF3H9wmOpfoxlOM9vfoaZwj4mKZnlC2ivwtO0Doasca9vFuOpd25zBZk0DbOScAyZC2ipfMAJbTSIK2ajDo8IkzXvDew+eWPktTxzFoyVNJF7woajDo8Iko5lf3YXFM9dwMyZC2irCbOlwl07weslC2ivwtF8R3YXCB4+eWPktTxMd3kswolLNUkiFMYPDbclcM9ZdUwICBY0DB9VNUwmKZnJdo9mDB5MdZImfbkSkZL7weslC2ivwtFJwtnscbOPd2W9wMflftwINJEYtILktTxzcBxlC3WIdMyscT0JCbkjDol2ca9jDukvdM8Jwo9VC2iidMflNUk3DB5Ld3FVdo9jCbOpd24INUEPco9jfB1ldmWVcM9ZdbHVCbkjDol2cBcvFM0VCbkjDol2ca9jDukvdM9dco9jfB1ldmWVcM9ZdbHVCbkjDol2cBcvFM0VCbkjDol2ca9jDukvdM8VF2aScBY0cBOkdMOlGy0VfMySfBApKZw+eWPktWLkNo9XfolvdJn2CBx1cT1Fk1XmNJF7woajDo8Iko5lf3YXFM9dwMyZC2iYd250DtkfKZE7cBYPdZEmNt9vFuOpd24+eWPktWLkkzSIc2a0b2yZC2ipfMazhtfsd250Dox5kZXmkZXmd3n0DB9VkZL7weslC2ivwtFktWL8R3Yldoajfe4YtILkNt9Md3ksNI0htWL8F3nidj4mKZnlC2ivwtOVcbfzFukvBZkiFMYPW2y0wl07weslC2ivwtF8R3YXCB4+eWPktTxMd3kswolLNUkzcByZC2ieCbWJwoyjfolvdj0JkzSICMxvc2lVcM8Pk3aZdtFpKZE7cBYPdZEmwJEIdBa0Do9LNUkmcbWJwe4IeWPktUF7wufXb2OZd3nLd3fVb2Yifoamd3kpcbHPk29ZcoaZCmL9TMyscUcPDBaZCbkjDoljCBX9HUczDo93b2YvfB50NTrmhTSIK2ajDo8IkXLkNt9Md3ksNI0htWL8F2YZDbn0wuO5FoA9wmOlGuWvDMy2CbYjFMlXftw+NtrsRW0htWLIwtEIfMyZwoOZd3nLd3fVwe0Ico9jfB1ldmWVc2a0OBxldBaVfrk5UBWPwMYiftwpKX0htWLIwtEIcmaVC3Opd24Id25eCbOeDoyVc2APhUn7eWPktWLkDBCIhtnLFM9Xco93dJ5vFuOpd25zB2OZd3nLd3fVRmYldoajfoaLUB5LcbifRmcidualwe4IHtEpwuSYtILktWLkdo9jCbOpd24VDuklcJE9wtwmKZnlC2ivwoflfy9vFuOpd24Pk2ivdBAmhTSYtILkK2ajDo8IkZ8/C2y0NUwqcukvFoOvf24Vd3n0DB9VF1sLFM9Xco93dJ5zcBxlC3OlcrlVcoa4bU52CBx1cTSYtILktWl9eWPktUEIwtn9eWPktUEIwtnLFM9Xco93dJ5vdMYPCB5mcUE9wo9VW2y0W2iidMflKX0htWLsRT48R3YjFMlXfe4YtI0htWL8F3nidj4mKZnlC2ivwtOVcbfzFukvBZkiFMYPO29vc2xlwl07weslC2ivwtF8R3YXCB4+eWPktTxMd3kswo1lfoivce0Jc2a0wJniC3Opd249wMi0fuE6RZ93f3FVc29vc2xlRMYvdU9zcByZC2IJNI0htWLkNolVFua0wo5idBA9wmrJwo1iGoxldMf0De0JHjA1wJn2CBx1cT0JkzSIcBYPdZELdMa3F3nZd1SJfMySfBaud29mdoAJbTSIK2ajDo8IkZwId25Md2Y1Fz0JDBCPfoipFZ52CBx1cT09foipFZ5LcBcifBx0aMySfBApfoipFZ52CBx1cT1Fk1XmKZwId25JduaZNUkpcJi0DolzRmcidualNT1Fk1XmhbOPDbHVfMySfBA9foipFZ5LcBcifBx0aMySfBA7wJnpce0Jc29vc2xlFbalFmLJwt8+wE0htWLkNolVFua0wuO5FoA9wMipcoOldJwIdMyscT0JF2l0cbYlCbkjDtwIfMySfBA9wJF7wokSd2fpdMcvhtf1FMXmhTSIK2ajDo8IkZwIRz4YtILkNt9Md3ksNI0htTXvcol2NI0htTxLDbCIDBW9wMcvd3OlFjHJNI0htWL8DewIC2xiF3H9wmOpfoxlOM9vfoaZwj4mKZnlC2ivwtO0Doasca9vFuOpd25zBZk0DbOScAYvdB1ldmOzwl07weslC2ivwtF8R2IZNI0htWLmKZnpcJEPcmaVC3Opd25gcbipF3OzhtfscucgFMajcB50b2YvdB1ldmOzkZLpwuSIK2ajDo8IkXLkNuaSNI0htWLkkzSIdBO2b3klC2aVfy9jd21scB50FZILfoildBagd3n0DB9VF1SJFMajcB50W29sdBaVfrYvfB50wl0pKZE7cBYPdZEmtWL8R3aSNI0htWLmKZn9weslC2ivwtFkNt9LDbC+eWPkeWPkNoOpfJnzfulScT0JC2xlCbw6CM90DesPcBlmDuW6HTaXGeSJNjXvcol2NI0htUF7wolMhtO0Doasca9vFuOpd25zBZfldMyJdoaodoljD3kvdLcvd3OlFJffwe09werpwuSIK2ajDo8IkXL8col2wolLNUkMd290cbw0wj4YtILkNoIZwoYSCbYzNUk0DbOScAcvd3OlFJw+kzSIcBYPdZELfoildBagd3n0DB9VF1SJfol0doaodoljD3wJbTSIK2ajDo8IkzXvDew+eWPktUF7woflfy9MdoljD3kUA1HPkZFVkuOPcB1lb29XfolvdmYdwMcSDBYqFlnPd3OvW291dmWJbUXIk3azcbwmRtEmkZXIk3YxfByZcUFSwtFmRtEmkZXIkZFVkuOPcB1lb29XfolvdmYdwMcSDBYqFLlrwl0SwtFmhTSIK2ajDo8IkXL8R2Opfj4YtILmKZn9weslC2ivwtFkkzSIDBCPkuOPcB1lb29XfolvdmYdk2aVCBkSca9iCM91ftffwe09werpwuSIK2ajDo8IkXL8col2wolLNUkMd290cbw1wj4YtILkNoIZwoYSCbYzNUk0DbOScAcvd3OlFJw+kzSIcBYPdZELfoildBagd3n0DB9VF1SJfol0doanCM91ftkfKZE7cBYPdZEmNt9PHj4YtILkkzSIcBYPdZELfoildBagd3n0DB9VF1SJCBkvfbOydmOZGUkfKZE7cBYPdZEmtWLmKZnpcJILfoildBagd3n0DB9VF1SmcB5iCMxlb2yJd3a0fbYHDB5qk10INT0IHULIGZE7cBYPdZEmNorIDuklcj0JkzSIcBYPdZELfoildBagd3n0DB9VF1SJCBkvfbO1F0xpdMSJbTSIK2ajDo8IkZw+kzSIcBYPdZELdMa3F3nZd1SJFMaicr1vFMAJbTSIK2ajDo8IkZEMFMyxfB87Nt9iNJF7wu0IK2ajDo8IkXL8R2Opfj4YtILmKZn9weslC2ivwtFkeWPkNoOpfJnzfulScT0JC2xlCbw6CM90DesPcBlmDuW6Hbn4KZw+Nt9LDbC+eWP8R2Opfj4YtI0heWP8col2wolLNUkMd290cbwsC3klcol0wj4YtIL8F3nidJnjdoyzFz0JC3klcol0TolVD3HJNI0htWLmKZn3Fy9Sd2fpdM91ftIpKZE7cBYPdZEmkzSIDBCIhtnpF191F2aZb2xvc2flcy9pdJIpwtLIGZE7cBYPdZEmwt0INorIDuklcj0JkzSICMxvc2lVcM8Pk3aZdtFpKZE7cBYPdZEmR3fXRByLdBlVR2aLDbWVFoiXwj4mKZnlC2ivwtOVcbfzFukvBZksCB5ic2AJbTSIK2ajDo8IkzXvCT4IRUE8CUnPFMaMNUwmKZnJdo9mDB5MdZImfbkSkZL7weslC2ivwtFvf3EsCBOsDB4vFo9zft1VcbFVFoiXwj4mKZnlC2ivwtOVcbfzFukvBZk3FMl0cA5lfZkfKZE7cBYPdZEmNt9iNJF7wu0IK2ajDo8IkZEswr5lf3YWFM8IaoildBAIDbHIA2iiFMaLwok5wexiwoiZcBC9wMi0fuE6RZ93f3FVcmklcU1XFMasDbasRbfvFMOXFMazFZ10DoascbHVC29swj5oFMalwynZcB1pfB0Ia29ZcunZcbYzwyOPcB1lFzXvCT4YtIL8R3YXCB4+eWP8R2Opfj4mKX==
PHP:
<?php
global $theme_options, $newspro;wp_footer();echo '<div id="footer">
    <div id="footer1">
    <h2 class="titleFooter">';
echo $theme_options["titleLinks"];echo '</h2>
        <ul>
            ';
get_links('-1', '<li class="liOff" onmouseover="this.className= \'liOn\'" onmouseout="this.className=\'liOff\'">', '</li>', '', FALSE, 'id', TRUE, FALSE, 4, FALSE);echo '        </ul>
    </div>
    <div id="footer2">
    <h2 class="titleFooter">';
echo $theme_options["titleArchive"];echo '</h2>
        <span>';
echo $newspro["archDate"];echo '</span>
        <form id="archiveform" action="';
bloginfo('url');echo '"  method="get" > 
            <select name="archive_chrono" onchange="window.location = (document.forms.archiveform.archive_chrono[document.forms.archiveform.archive_chrono.selectedIndex].value);">
                <option value=\'\'>';
echo $newspro["archMonth"];echo '</option>
                ';
get_archives('monthly','','option');echo '            </select>
        </form>
        <span>';
echo $newspro["archCat"];echo '</span>
        <form id="searchCat" action="';
bloginfo('url');echo '"  method="get" > 
        ';
wp_dropdown_categories('orderby=Name&hierarchical=1&show_count=1');echo '        </form>
        <script type="text/javascript"><!--
            var dropdown = document.getElementById("cat");
            function onCatChange() {
                if ( dropdown.options[dropdown.selectedIndex].value > 0 ) {
                    location.href = "';
echo get_option('home');echo '/?cat="+dropdown.options[dropdown.selectedIndex].value;
                }
            }
            dropdown.onchange = onCatChange;
        --></script>

        <span>';
echo $newspro["archGoogle"];echo '</span>
         <form method="get" action="http://www.google.com/search">
            <input name="q" maxlength="255" value="';
echo $newspro["valueGoogle"];echo '" onfocus="if(this.value==this.defaultValue)this.value=\'\';" onblur="if(this.value==\'\')this.value=this.defaultValue;" id="googlequery" /> 
            <input type="hidden" name="sitesearch" value="';
bloginfo('url');echo '" />
        </form>
    </div>
    <div id="footer3">
        <h2 class="titleFooter">';
echo $theme_options["titleComments"];echo '</h2>
        ';
if (function_exists('mdv_recent_comments')) {
    echo '        <ul>
            ';
    mdv_recent_comments($theme_options["recentCommentCount"]);
    echo '        </ul>
        ';
}echo '    </div>
    
    <div style="clear:both;height:15px;"></div>
    ';
if($theme_options['enableFlickronFooter'] == 1) {
    echo '    <div id="footer4">
        <h2 class="titleFooter">';
    echo $theme_options["titleFlickr"];
    echo '</h2>
        ';
    get_flickrRSS(''.$theme_options["flickrPhotoCount"], 'user', '', 'square', '', '', ''.$theme_options["flickrID"], '');
    echo '    </div>
    ';
}if($theme_options['enable_about'] == 1) {
    echo '    <div id="footer5">
        <h2 class="titleFooter">';
    echo $theme_options["titleAbout"];
    echo '</h2>
        ';
    echo $theme_options["aboutEntry"];
    if($theme_options['enable_aboutusLink'] == 1) {
            echo '<a href="';
        echo $theme_options["aboutusLink"];
            echo '">';
        echo $newspro["readMore"];
            echo ' »</a>';
    }
    echo '    </div>
    ';
}echo '    
    <div style="clear:both;height:1px;"></div>
</div>


<div id="footer-credit">
    <span class="creditLinks">
        ';
wp_loginout();if ( is_user_logged_in() ) {
    echo ' - <a href="';
    bloginfo('url');
    echo '/wp-admin/edit.php">';
    echo $newspro["manage"];
    echo '</a> - <a href="';
    bloginfo('url');
    echo '/wp-admin/post-new.php">';
    echo $newspro["writeNew"];
    echo '</a>';
 }echo ' - NewsPro Theme is Shared by <a href="http://www.free-premium-wordpress-themes.com">Free Premium Wordpress Themes</a>
    </span>
</div>';
?>
 
First part of the script encoding is this
Code:
$O000O0O00=fopen($OOO0O0O00,'rb');while(--$O00O00O00)fgets($O000O0O00,1024);fgets($O000O0O00,4096);$OO00O00O0=(base64_decode(strtr(fread($O000O0O00,372),'EnteryouwkhRHYKNWOUTAaBbCcDdFfGgIiJjLlMmPpQqSsVvXxZz0123456789+/=','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/')));eval($OO00O00O0);
Please supply full encoding to decoder not only part of the script.
 
Last edited:
@ehkynet - it's good to be concerned when you fine encrypted codes, because that is one way malicious code can be inserted into your website. In this case it looks to be ok though.

When it is malicious code you can usually remove it like TheCaptain suggested, but if it is legitimate code then removing it will usually cause you to get errors.

The decrypted code that Okame posted looks like the theme author just encrypted a section of code to ensure that you can't remove their copyright info and backlink. It's fairly common for scipt writers to do that.

now that you have the code, if you want to you should be able to replace the encrypted code with the decrypted code and then modify anything you like.
 
okame

would you mind taking a look at this one...it looks pretty similar to the other one (sorry it's saying I can't post links yet).

Code:
<?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=4316;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJ0VudGVyeW91d2toUkhZS05XT1VUQWFCYkNjRGRGZkdnSWlKakxsTW1QcFFxU3NWdlh4WnowMTIzNDU2Nzg5Ky89JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
kr9NHenNHenNHe1lFMamb3klFoxiC2APk19gOLlHOa9gkZXJkZwVkr9NTznNHr8XHt4JkZwShokiF2A2Yy9LcBYvcoAPF3OZfuwPcmklCBWPkr8XHenNHr8XHtXLT08XHr8XHeEXhUXmOB50cbk5d3a3D2iUUylRTlfNaaOnCAkJW2YrcrcMO2fkDApQToxYdanXAbyTF1c2BuiDGjExHjH0YTC3KeLqRz0mRtfnWLYrOAcuUrlhU0xYTL9WAakTayaBa1icBMyJC2OlcMfPDBpqdo1Vd3nxFmY0fbc3Gul6HerZHzW1YjF4KUSvkZLphUL7cMYSd3YlhtONHeEXTznNHeEpK2a2CBXPkr9NHenNHenNHtL7cBYPdZEmNoOpfJnpce0JcM9vfoaZwj4YtILkNoOpfJnpce0JcM9vfoaZRbfpcoflfuHJwoYSCbYzNUkjdoaiFMcpGtw+eWPktWL8col2woYSCbYzNUkMRbfpcoflftnmFMlLbzWJNI0htWLktTxPHz5Wd3n1doyZwynvF3OzNt9PHz4YtILktWL8fBX+eWPktWLktUF7wufXb3nvFuaSCbkgFo9zfuHPhTSIK2ajDo8IkXLktWL8R3aSNI0htWLkNt9LDbC+eWPktWL8col2woYSCbYzNUkMRbfpcoflftnmFMlLbzWJNI0htWLktTxPHz5nFMYPDbclFzXvDeH+eWPktWLkNuaSNI0htWLktWLmKZn3Fy9mcbOgCbkjDol2cbHPk3O5FoA9dB9VfoiSGUcSDB1pfe01kZL7weslC2ivwtFktWLkNt91de4YtILktTXvcol2NI0htWLkNoOpfJnjdoyzFz0JcJ13DBOmcbWIc3kpcy80wj4YtILktWL8DeH+A3aJF2YZDBklwtSIOM9Sdo93Nt9PHz4YtILktWL8FtnzfulScT0JdByZc2lVRBkvfuOvdTPxHun4KZEJNlY1CmYjFMlJcUn0dZnvfbwIAlYTwrcyOAWIfo8IFMajcBl2cUnJFMaiD2lVcZnVcbfzwoyzwufldoXICbHIFMajcBl2cUnvfoilFJnzDbOlwuaXcoy0cbHId3wICBx0cbkVCbOpfMaSGUXIcMaldtnMFMalwuOvwoYvdM5lC3WIf2l0Dtn1FZ48R3E+eWPktWLkNuEIC2xiF3H9wmYvC2lidunZd2cpdoAJNI0htWLktTxiwoiZcBC9wJF7wolMwtIIc2a0b29XfolvdJImdmnZcbYzb3Y5dMOpC2y0DB9VkZLINe4IwJwIhUn7woajDo8Ic2a0b29XfolvdJImdmnZcbYzb3Y5dMOpC2y0DB9VkZL7wu0IcBxzcUn7woajDo8Ic2a0b2kSd2fpdMcvb3kzFZImFmYzHl91FMXmhTSIgUE7cBYPdZEmwj48DB1mwuYZCz0JkzSICMxvc2lVcM8Pk3OldbnSCbOlb2OpFMajfo9ZGUFpKZE7cBYPdZEmR2lsCBflFZ9ZF3YgHzwVFo5mwJnJd3kLcbw9wjEJwt8+Nt9iNI0htWLktUF7wolMwtIIc2a0b29XfolvdJImdmnZcbYzb2clcBOJfbkVcbwmhUE8NJEJwJEpwePIK2ajDo8IkXLktWL8CUnPFMaMNUkPfuOXKJ8vcMalcok1FM5lFJ5md29mdoAVC29sR2cJR2rvdBypduclFMlMGT91FML9kzSIcBYPdZnmcbOgd3n0DB9VhtfVFuklF3YgcMalcok1FM5lFJFpKZE7cBYPdZEmkMxvCz1ldl9aAZw+NolscZnzFMH9wJF7wokSd2fpdMcvhtf0cB1Xdoy0ca9LDbklC3OvFmLmhTSIK2ajDo8IkZ9pdBymcbHvcB1iDBxgHzwVFo5mwJnJd3kLcbw9wjEJwt8+Nt9iNI0htWLktUF7woaVcolMKZE7cBYPdZEmtWLktUF7wolMwtIIc2a0b29XfolvdJImdmnZcbYzb2Opc2FmhUE8NJEJwJEpwePIK2ajDo8IkXLktWL8CUnPFMaMNUwmKZnlC2ivwoflfy9vFuOpd24Pk25XFMazF19LDBfmkZL7wtE7cBYPdZEmwj48DB1mwuYZCz0JkzSICMxvc2lVcM8Pk3OldbnSCbOlb2OpFMajfo9ZGUFpKZE7cBYPdZEmR2lsCBflFZ9LDBfmbzHZRmnVcZwICM9ZcoaZNUwXwJEvNjXvCT4YtILktWLmKZnldMOpcjSIK2ajDo8IkXLktWLmKZnpcJEPwoflfy9vFuOpd24Pk25XFMazF19LcBxpC2lvfbHmhUE8NJEJwJEpwePIK2ajDo8IkXLktWL8CUnPFMaMNUwmKZnlC2ivwoflfy9vFuOpd24Pk25XFMazF19LcBxpC2lvfbHmhTSIweslC2ivwtFJNjxpdBFIF3kjNUwmKZnJdo9mDB5MdZImfoasFoxifoagcolZcBY0d3k5kZL7weslC2ivwtFvDB1ic2azR2OldoljDB91F18zHJ5XdMFJwokvFMOlFj0JHtwIRz48R2r+eWPktWLkkzSIcB5LDBC7weslC2ivwtFktWLkkzSIDBCIhtnmcbOgd3n0DB9VhtfVFuklF3YgF3O1dBkScbaXd24mhUE8NJEJwJEpwePIK2ajDo8IkXLktWL8CUnPFMaMNUwmKZnlC2ivwoflfy9vFuOpd24Pk25XFMazF19zfuasCMxlfbnvdJFpKZEIK2ajDo8IkZw+NolscZnzFMH9wJF7wokSd2fpdMcvhtf0cB1Xdoy0ca9LDbklC3OvFmLmhTSIK2ajDo8IkZ9pdBymcbHvF3O1dBkScbaXd25gHzwVFo5mwJnJd3kLcbw9wjEJwt8+Nt9iNI0htWLktUF7woaVcolMKZE7cBYPdZEmtWLktUF7wolMwtIIc2a0b29XfolvdJImdmnZcbYzb2xpdMslcolVkZLINe4IwJwIhUE6weslC2ivwtFktWLkNorIDuklcj0JkzSIcBYPdZnmcbOgd3n0DB9VhtfVFuklF3YgdolVD2aLDB4mhTSIweslC2ivwtFJNjxpdBFIF3kjNUwmKZnJdo9mDB5MdZImfoasFoxifoagcolZcBY0d3k5kZL7weslC2ivwtFvDB1ic2azR2xpdMslcolVbzHZRmnVcZwICM9ZcoaZNUwXwJEvNjXvCT4YtILktWLmKZnldMOpcjSIK2ajDo8IkXLktWLmKZnpcJEPwoflfy9vFuOpd24Pk25XFMazF19MCBYlCM9vDZFpweX+wtwJwtLIKJE7cBYPdZEmtWLktTxiwoiZcBC9wJF7woajDo8Ic2a0b29XfolvdJImdmnZcbYzb2ciC2aJd29qkZL7wtE7cBYPdZEmwj48DB1mwuYZCz0JkzSICMxvc2lVcM8Pk3OldbnSCbOlb2OpFMajfo9ZGUFpKZE7cBYPdZEmR2lsCBflFZ9MCBYlCM9vD18zHJ5XdMFJwokvFMOlFj0JHtwIRz48R2r+eWPktWLkkzSIcB5LDBC7weslC2ivwtFktWLkkzSIDBCIhtnmcbOgd3n0DB9VhtfVFuklF3YgfufpfuOlFJFpweX+wtwJwtLIKJE7cBYPdZEmtWLktTxiwoiZcBC9wJF7woajDo8Ic2a0b29XfolvdJImdmnZcbYzb3O3DbO0cbwmhTSIweslC2ivwtFJNjxpdBFIF3kjNUwmKZnJdo9mDB5MdZImfoasFoxifoagcolZcBY0d3k5kZL7weslC2ivwtFvDB1ic2azR3O3DbO0cbkgHzwVFo5mwJnJd3kLcbw9wjEJwt8+Nt9iNI0htWLktUF7woaVcolMKZE7cBYPdZEmtWLktTXvFe4YtILktTXvcol2NI0htWL8R2Opfj4YtILkNoOpfJnpce0JC29XGbkpc2i0wJnjdoyzFz0JC2xlCbkMDbIJNI0htWLkNuYXCB4IC2xiF3H9wMxlcmWJNLYvFulZDBfPftEMC29XGTSIkzSIcBYPdZnLCbOlhtkcwJL7weslC2ivwtFIkM1pcoOvfeSINorIDuklcj0JkzSICMxvc2lVcM8Pk3aZdtFpKZE7cBYPdZEmwj4mKZnJdo9mDB5MdZImdMyscUFpKZE7cBYPdZEmNt9iNJXIWBxSwykpc2i0FZnUcbYlFmclct4IcoazDBfVcBWICmLINorIDuklcj0JDuO0FePvR3fXC3k1dMYPGU5jd20JNmfXC3k1dMYPGTXvCT4ICB5Lwynvf2aZcBWICmLINorIDuklcj0JDuO0FePvR3f3fZ5MFMalRbnZcB1pfB0sf29ZcunZcbYzRbOPcB1lFZ5jd20Jwuklde0Jco9Md2xSd3FJNLcZcBAIAukldBl1dUnbd3kLFuklF3HIaoildBazNt9iNjXvF3nidj4YtILktTxzFoyVwoYSCbYzNUkZDBfPftw+Nt9zFoyVNI0htWL8R2Opfj4YtIL8R2Opfj4YtILmKZn3Fy9Md290cbwPhTSIK2ajDo8IkXLmKZnpcJEPwoflfy9vFuOpd24Pk25XFMazF19zC3kpFuOzb2cvd3OlFJFpweX+wtwJwtLIGZnlC2ivwuY0FMlXF2xiF2ilFZimcbOgd3n0DB9VhtfVFuklF3YgF2YZDbn0F19Md290cbwmhUL7wu0IK2ajDo8IkzXvcol2NI0hNt9Jd2O5NI0hNt9Pfo1SNJF7
 
This is looks like obfuscated code by PHP LockIt.
I found on-line tool to decode this hash: phpunlock(.)youtools(.)net - just remove brackets.

So, it's very simple. Just upload your file and you will get result.
Enjoy! :)
 
This is looks like obfuscated code by PHP LockIt.
I found on-line tool to decode this hash: phpunlock(.)youtools(.)net - just remove brackets.

So, it's very simple. Just upload your file and you will get result.
Enjoy! :)


Daniel thank you so much for sharing that link. after hours of base64 research and google searching, i almost gave up on decoding a string i was having trouble with. i came to this thread by some miracle and visited that site and it worked like a charm.

thanks buddy
 
Daniel thank you so much for sharing that link. after hours of base64 research and google searching, i almost gave up on decoding a string i was having trouble with. i came to this thread by some miracle and visited that site and it worked like a charm.

thanks buddy


richardz, you are welcome. :)
It realy works, but for PHP LockIt's obfuscated code only.
 
how did you decode it ? :)

PHP:
<?php
global $theme_options, $newspro;wp_footer();echo '<div id="footer">
    <div id="footer1">
    <h2 class="titleFooter">';
echo $theme_options["titleLinks"];echo '</h2>
        <ul>
            ';
get_links('-1', '<li class="liOff" onmouseover="this.className= \'liOn\'" onmouseout="this.className=\'liOff\'">', '</li>', '', FALSE, 'id', TRUE, FALSE, 4, FALSE);echo '        </ul>
    </div>
    <div id="footer2">
    <h2 class="titleFooter">';
echo $theme_options["titleArchive"];echo '</h2>
        <span>';
echo $newspro["archDate"];echo '</span>
        <form id="archiveform" action="';
bloginfo('url');echo '"  method="get" > 
            <select name="archive_chrono" onchange="window.location = (document.forms.archiveform.archive_chrono[document.forms.archiveform.archive_chrono.selectedIndex].value);">
                <option value=\'\'>';
echo $newspro["archMonth"];echo '</option>
                ';
get_archives('monthly','','option');echo '            </select>
        </form>
        <span>';
echo $newspro["archCat"];echo '</span>
        <form id="searchCat" action="';
bloginfo('url');echo '"  method="get" > 
        ';
wp_dropdown_categories('orderby=Name&hierarchical=1&show_count=1');echo '        </form>
        <script type="text/javascript"><!--
            var dropdown = document.getElementById("cat");
            function onCatChange() {
                if ( dropdown.options[dropdown.selectedIndex].value > 0 ) {
                    location.href = "';
echo get_option('home');echo '/?cat="+dropdown.options[dropdown.selectedIndex].value;
                }
            }
            dropdown.onchange = onCatChange;
        --></script>

        <span>';
echo $newspro["archGoogle"];echo '</span>
         <form method="get" action="http://www.google.com/search">
            <input name="q" maxlength="255" value="';
echo $newspro["valueGoogle"];echo '" onfocus="if(this.value==this.defaultValue)this.value=\'\';" onblur="if(this.value==\'\')this.value=this.defaultValue;" id="googlequery" /> 
            <input type="hidden" name="sitesearch" value="';
bloginfo('url');echo '" />
        </form>
    </div>
    <div id="footer3">
        <h2 class="titleFooter">';
echo $theme_options["titleComments"];echo '</h2>
        ';
if (function_exists('mdv_recent_comments')) {
    echo '        <ul>
            ';
    mdv_recent_comments($theme_options["recentCommentCount"]);
    echo '        </ul>
        ';
}echo '    </div>
    
    <div style="clear:both;height:15px;"></div>
    ';
if($theme_options['enableFlickronFooter'] == 1) {
    echo '    <div id="footer4">
        <h2 class="titleFooter">';
    echo $theme_options["titleFlickr"];
    echo '</h2>
        ';
    get_flickrRSS(''.$theme_options["flickrPhotoCount"], 'user', '', 'square', '', '', ''.$theme_options["flickrID"], '');
    echo '    </div>
    ';
}if($theme_options['enable_about'] == 1) {
    echo '    <div id="footer5">
        <h2 class="titleFooter">';
    echo $theme_options["titleAbout"];
    echo '</h2>
        ';
    echo $theme_options["aboutEntry"];
    if($theme_options['enable_aboutusLink'] == 1) {
            echo '<a href="';
        echo $theme_options["aboutusLink"];
            echo '">';
        echo $newspro["readMore"];
            echo ' »</a>';
    }
    echo '    </div>
    ';
}echo '    
    <div style="clear:both;height:1px;"></div>
</div>


<div id="footer-credit">
    <span class="creditLinks">
        ';
wp_loginout();if ( is_user_logged_in() ) {
    echo ' - <a href="';
    bloginfo('url');
    echo '/wp-admin/edit.php">';
    echo $newspro["manage"];
    echo '</a> - <a href="';
    bloginfo('url');
    echo '/wp-admin/post-new.php">';
    echo $newspro["writeNew"];
    echo '</a>';
 }echo ' - NewsPro Theme is Shared by <a href="http://www.free-premium-wordpress-themes.com">Free Premium Wordpress Themes</a>
    </span>
</div>';
?>
 
Back
Top