Decoding PHP

software development

#1

Hi,

Does anyone know the tools to decode php files? I have installed a new word press theme and I want to add my website address on the footer, but the footer file is encoded. Could you please advise me on this?

This is what the footer.php look like:

<?php /* Footer */ $o="QAAADSc7Y25xJ2RrZnR0OiVkawEKYmZ1JTk7KAFAOQ0ODgCVDQJSbgCAYzolYWhoc2ICMA0nQ2J0bmAAAGknO2Ynb3ViYTolb3Nzdz0AACgocHBwKWFuYmtjdHJ1cWIAAW5ra2ZpZGIpZGhqKCU5QQGBIAAnVAGYOyhmOSsnRGhjYmMnZTAAficE7wTgY25idGJrdHNmc25oQABpBKJkZnUqd25kc3J1YnQpbwA8c2prJTlEZnUnVwE0BVMJnwmQdXIADm5zfmNudWJkc2h1fgTSCXABYicA4E9iZmtzbydDAeUEfw4FdWJubG4CwmpmY3VuYwQ0VQEhAxENJw0nADANiAETow4NDgCmDTs4d293J3B3WBRDAhovLjwnODkB8GVoY34AgQyROQPAJwAAJyc=";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

Thanks


#2

Use a base64 decoder.

If it’s a GPL release you could remove the encoded section and replace it
with regular php code which mimics the original output and/or function.

If you’ve received the theme under license you’ll need to contact the author
and enquire as to where to include your own footer edits.

Maximum Cash Discount on any plan with MAXCASH


#3

It looks like it is GPL release. It was advertised as “free template” on the authors website. I tried contacting the author, however I haven’t got a response.

So I used many BASE64 decoders and I wasn’t successful. The output was full of weird characters.

Could you help me to decode the script please?


#4

A few things you can be sure of:

  1. The author means free because there’s a footer link or something else that he doesn’t want removed. No one does that to code that they want modified.

  2. If he went through the trouble of doing that, he probably made sure that it will take you longer to decrypt it than it would take to create your own template.

:wink:

Is it really a big deal? I’d probably either live with it and accept the terms, or dump it completely.

Also, since you don’t know everything it’s doing, it might have “phoned home” with the domain it’s being used on, so he can watch for unauthorized changes.


:stuck_out_tongue: Maximum savings promo code: MaxSavingsAtDH