Can’t decode theme!

  • Resolved plzhelpme

    (@plzhelpme)


    15 years ago

    Yes, I have read the sticky on decoding themes, but it doesn’t work for me.

    Can somebody decode this:
    <?php $_F=__FILE__;$_X='PzNhP21abTRjTW9fWk0wRU1uKCk7ND8zDWINYglhP21abTRjTW9fTE9FTUEwbigpOzQ/Mw1iCQ1iCWFFT3A0T0VmIkhTRG9NRG8iNEguMExMZiJIUy5KIEQiMw1iCQ1iCQlhP21abTRPdTQoNGNNb19TbW9PU0QoNCddU1NfQU9TJzQpNGEzNCIiNCk0SzQ/Mw1iCQlhRU9wNE9FZiJPRG9uUyIzDWIJCQ1iCQkJYW0zYT9tWm00TUhaUzRMb25PbUhMLjBMWk1MKDRjTW9fU21vT1NEKDQnXVNTX0FPUyc0KTQpOzQ/M2F5bTMNYgkJDWIJCWF5RU9wM2EhLS00eSNPRG9uUzQtLTMNYgkJYT9tWm00VDQ/Mw1iCQkNYgkJYUVPcDRPRWYiMG5vT0guTUwiMw1iCQkNYgkJCWE/bVptNE91NChaMHBNX21TTG9MKCkpNDo0JEhTSkRvNGY0ODs0PzMNYgkJCWE/bVptNF1aTy5NNChaMHBNX21TTG9MKCkpNDo0b1pNX21TTG8oKTs0JEhTSkRvKys7ND8zDWIJCQkNYgkJCQlhP21abTRPdSgkSFNKRG9mZnspSzQ/M2FFT3A0SC4wTExmIkFTPSIzYT9tWm00VDQ/Mw1iCQkJDWIJCQkJYUVPcDRILjBMTGYiT29NIDRhP21abTRPdSgkSFNKRG9mZnspSzRNSFpTNCcuTXVvJzs0VDRNLkxNNEs0TUhaUzQnbk9jWm8nOzRUND8zIjMNYgkJCQkNYgkJCQkJYVpzM2EwNFpuTXVmImE/bVptNG9aTV9tTW4gMC5PRFEoKTs0PzMiNG9Pby5NZiJhP21abTRvWk1fb09vLk0oKTs0PzMiNDNhP21abTRvWk1fb09vLk0oKTs0PzNheTAzYXlaczMNYgkJCQkJDWIJCQkJCWFtNEguMExMZiIgTW8wIjMNYgkJCQkJDWIJCQkJCQlhTG0wRDRILjBMTGYiRTBvTSIzYT9tWm00b1pNX29PIE0oJ3c0RScpOzQ/M2F5TG0wRDMNYgkJCQkJCWFMbTBENEguMExMZiJIUyAgTURvTCIzYT9tWm00SFMgIE1Eb0xfbVNtSm1fLk9EUShfXygnODQvUyAgTURvTCcsXVNTb1pNIE1MKSw0X18oJ3s0L1MgIE1EbycsXVNTb1pNIE1MKSw0X18oJyU0L1MgIE1Eb0wnLF1TU29aTSBNTCkpOzQ/M2F5TG0wRDMNYgkJCQkJDWIJCQkJCWF5bTNhIS0tNHlYIE1vMDQtLTMNYgkJCQkJDWIJCQkJCWFFT3A0SC4wTExmIk09SE1ubW8iMw1iCQkJCQkNYgkJCQkJCWE/bVptNF1TU19jTW9fTyAwY00oJ08gMGNNJyxjTW9fU21vT1NEKCddU1NfY01vX08gMGNNX11PRW9aJyksY01vX1Ntb09TRCgnXVNTX2NNb19PIDBjTV9aTU9jWm8nKSwnJyk7ND8zDWIJCQkJCQ1iCQkJCQkJYT9tWm00b1pNX009SE1ubW8oJycpOzQ/Mw1iCQkJCQkJDWIJCQkJCQlhbTRILjBMTGYiIFNuTS0uT0RRIjNhMDRabk11ZiJhP21abTRvWk1fbU1uIDAuT0RRKCk7ND8zIjRvT28uTWYiYT9tWm00b1pNX29Pby5NKCk7ND8zIjNhP21abTRfTSgnL1NEb09ESk00bk0wRU9EYycsXVNTb1pNIE1MKTs0PzNheTAzYXltMw1iCQkJCQkNYgkJCQkJYXlFT3AzYSEtLTR5WE09SE1ubW80LS0zDWIJCQkJDWIJCQkJYXlFT3AzYSEtLTR5WE9vTSA0LS0zDWIJCQkJDWIJCQkJYT9tWm00T3UoJEhTSkRvZmZzKUs0PzMNYgkJCQkJYUVPcDRILjBMTGYiSC5NMG4iM2F5RU9wMw1iCQkJCQlhRU9wNEguMExMZiJBU28iM2F5RU9wMw1iCQkJCQlheUVPcDNhIS0tNHlYQVM9NC0tMw1iCQkJCWE/bVptNCRIU0pEb2Y4OzRUND8zDWIJCQkNYgkJCWE/bVptNE1ERV1aTy5NOzRNREVPdTs0PzMNYg1iCQkJCWE/bVptNE91KCRIU0pEbzRmZjR7KUs/Mw1iCQkJCQlhRU9wNEguMExMZiJILk0wbiIzYXlFT3AzDWIJCQkJCWFFT3A0SC4wTExmIkFTbyIzYXlFT3AzDWIJCQkJCWF5RU9wM2EhLS00eVhBUz00LS0zDWIJCQkJYT9tWm00O1Q0PzMNYgkJCQkNYgkJCQlhP21abTRPdTQoNGNNb19TbW9PU0QoNCddU1NfbTBjT0Qwb00nNCk0ZmY0J29uSk0nNCk0SzQ/Mw1iDWIJCQkJYUVPcDRILjBMTGYibTBjTUQwcDRaUyBNIjMNYgkJCQkJYUVPcDRILjBMTGYibW5NcCIzYT9tWm00bW5NcE9TSkxfbVNMb0xfLk9EUShfXygndG5NcCcsXVNTb1pNIE1MKSk0PzNheUVPcDMNYgkJCQkJYUVPcDRILjBMTGYiRE09byIzYT9tWm00RE09b19tU0xvTF8uT0RRKF9fKCdGTT1vJyxdU1NvWk0gTUwpKTQ/M2F5RU9wMw1iNDQ0NDQ0NDQ0NDQ0CQlhRU9wNEguMExMZiJILk0wbiIzYXlFT3AzDWI0NDQ0NDQJCQlheUVPcDMNYjQ0NDQ0NAkJCQ1iNDQ0NDQ0CQkJYT9tWm00VDQ/MwkJDWIJCQ1iCQlheUVPcDNhIS0tNHkjMG5vT0guTUw0LS0zDWIJCQ1iCQlhRU9wNE9FZiJdT0VjTW9MIjMNYgkJDWIJCQlhRU9wNEguMExMZiIuTXVvIjMNYgkJCQ1iCQkJCWE/bVptNEU1RDAgT0hfTE9FTUEwbignWlMgTS0uTXVvJyk7ND8zDWIJCQkNYgkJCWF5RU9wM2EhLS00eVguTXVvNC0tMw1iCQkJDWIJCQlhRU9wNEguMExMZiJuT2NabyIzDWIJCQkNYgkJCQlhP21abTRFNUQwIE9IX0xPRU1BMG4oJ1pTIE0tbk9jWm8nKTs0PzMNYgkJCQ1iCQkJYXlFT3AzYSEtLTR5WG5PY1pvNC0tMw1iCQkJDWIJCQlhRU9wNEguMExMZiJILk0wbiIzYXlFT3AzDWIJCQkNYgkJCWFFT3A0SC4wTExmIkFTb29TICIzYXlFT3AzDWIJCQ1iCQlheUVPcDNhIS0tNHkjXU9FY01vTDQtLTMNYgkNYglheUVPcDNhIS0tNHkjSFNEb01EbzQtLTMNYgkJDWJhP21abTRjTW9fdVNTb01uKCk7ND8z';$_D=strrev('edoced_46esab');eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdPL2JwdXcza002QjJ0eEQxLlJvWF1sVlkgPkpBRUdUZno3SwpRSD1qc31acVVjZTh2NW5tPFs5YTRpMENyV3tOZ2hkSUxQeVNGJywnaUMKdmZGPnplU0U3UDVucWxBdC53V0RPbUt1YmRVfT0zTXtSa2N4OTJKaExaZ1gwNnlycFFURzwgVmFqSUIxXVtZNDhzSC9vTicpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

    and this?

    <?php $_F=__FILE__;$_X='P2kJQjlzYz4yV2VublMiMldNZXoiaUJoOXNjaQ1WCQ1WCUI5c2M+czlTIkFPTz1NeiJpDVYJDVYJCUJaaSYyT1pxOz5rYWFQPkJlPi56TUFTIkI/Wi5aPjxXT3hzSEFPKCdRelcnKTs+P2kiPj1zPVdNUyJCP1ouWj48V094c0hBTygnPXM9V00nKTs+P2kiaUI/Wi5aPjxXT3hzSEFPKCc9cz1XTScpOz4/aUJoZWk+LT5CP1ouWj48V094c0hBTygnOU1uMnpzWj1zT0gnKTs+P2lCPHo+aGkNVgkJRkg9c3BPMnNlVz49Lk1ZTT48cT5CZT4uek1BUyIuPT1aOmhofX19WH1abj1xV01uWE96eCI+PXM9V01TIntPT1QuTVlNbiJpe09PVC5NWU1uQmhlaUJoWmkNVgkJDVYJCUJlPi56TUFTIi49PVo6aGh9fX1YfVpuPXFNblhPengiPj1zPVdNUyJ7T3o5WnpNbm4+PS5NWU1uImlCc1l4Pm56MlMiQj9aLlo+PFdPeHNIQU8oJz1NWVpXZT1NXzlzek0yPU96cScpOz4/aWhzWWV4TW5oczJPSG5ofU9PPS5NWU1uWFpIeCI+ZVc9UyJ7Wm49cVdNblhPengiPmhpQmhlaQ1WCQkNVgkJQjlzYz4yV2VublMiMldNZXoiaUJoOXNjaQ1WCQkNVglCaDlzY2lCIS0tPmgjQU9PPU16Pi0taQ1WDVZCaDlzY2lCIS0tPmgjMk9IPWVzSE16Pi0taQ1WDVZCP1ouWj59Wl9BT089TXooKTs+P2kNVkI/Wi5aPnNBPig+eE09X09aPXNPSCgnfU9PX3hPT3hXTV9lSGVXcT1zMm4nKT5CaT4iIj4pPl0+TTIuTz5uPXpzWm5XZW4uTW4oeE09X09aPXNPSCgnfU9PX3hPT3hXTV9lSGVXcT1zMm4nKSk7Pmw+P2kNVkJoPE85cWkNVkJoLj1ZV2k=';$_D=strrev('edoced_46esab');eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdTZ1BPOVlaV0ZLbXF5ZnhjakxKUnp1TTV2TnRzMWIue0I0bkNdaS8yRGwwRWhlQQpbZDg9UXA+VlhvIEh9NkdJdzdrYTNUclU8JywnPVI5b2RtcGxBRVB5azhndls1M3hyTWV6cVpIaTdZaFc8RHNHez5DY1h9MU4vYWZqNl1KdHVTIAouQlVud1ZLTFFPMjBJVEY0YicpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

Viewing 15 replies - 1 through 15 (of 17 total)
  • uwiuw

    (@uwiuw)

    delete it. mostly, it’s a malicious code.

    huggie

    (@huggie)

    Where did you get the theme from?

    Clayton James

    (@claytonjames)

    strrev('edoced_46esab');

    strrev outputs the string backwards. edoced_46esab = base64_decode

    Cool!

    Thread Starter plzhelpme

    (@plzhelpme)

    Interesting. Tricky. Creepy. Cool.

    Thread Starter plzhelpme

    (@plzhelpme)

    Still don’t know how to decode it…

    Thread Starter plzhelpme

    (@plzhelpme)

    Comon’
    ANYONE! OTTO!?!?!

    Thread Starter plzhelpme

    (@plzhelpme)

    O M G

    I have tried everything.
    I have even followed his instructions.

    This is a community forum right?
    WHERE IS THE COMMunITY!?!?!?

    jonimueller

    (@jonimueller)

    I wouldn’t use a theme that has malicious code in it. Your question was already answered, a solution provided to you. Whether you heed the advice given is entirely up to you. But please stop with your ginormous sense of entitlement. This is a free forum; no one here is paid to be here or to help. Maybe people have paying work they need to do, maybe they’re out on the town, asleep. Or here’s one: Maybe they just don’t feel like it. Sheesh.

    Clayton James

    (@claytonjames)

    O M G

    I have tried everything.
    I have even followed his instructions.

    This is a community forum right?
    WHERE IS THE COMMunITY!?!?!?

    Indeed, this is a WordPress community. Obfuscated code seems to be something we all dislike, and there have been some great resources posted here to help see into that which has the potential to be doing harm to WordPress web sites. But, that being said, I don’t think “breaking code”, (to be polite), is a primary function of the WordPress forums. Sure, it’s a lot of fun, but that one you have there involves a couple more steps than just running it through a decoder and copy/pasting the output.

    If you really, really, really, want to keep up the quest, post a download link to the theme. Break the link if you want, but just post a link to it, and identify the file in which you found the code. Maybe someone will take a look at it when they have a chance.

    Samuel B

    (@samboll)

    do not bump this topic
    if someone can or wants to help you they will

    Thread Starter plzhelpme

    (@plzhelpme)

    Yes, but they aren’t going to find a post if it is a few pages back.

    Clayton James

    (@claytonjames)

    @plz.help.me.

    17 hrs ago

    Where did you get the theme from?

    13 hrs ago

    post a download link to the theme. Break the link if you want, but just post a link to it

    So, please. Post the link or give the name of the darn theme already, so the complete code can be seen in context.

    Thread Starter plzhelpme

    (@plzhelpme)

    The name is Antisocial by Woo Themes.

    Clayton James

    (@claytonjames)

    A) I did this for fun.

    B) I tested my results only long enough to say that the theme loaded, and looked Okay. Your mileage may vary.

    C) If you obtained this theme through a “share” site, I urge you not to use it at all. If you purchased a license from Woothemes, well… I guess obfuscated code in licensed versions appears to be part of their business model.

    revised index.php

    revised footer.php

    Samuel B

    (@samboll)

    I’ve done plenty of theme installs for folks with woo and they have never had obfuscated code – maybe just started

Viewing 15 replies - 1 through 15 (of 17 total)
  • The topic ‘Can’t decode theme!’ is closed to new replies.