Decoding base64 php file

Question

I currently have an encoded footer file for a wordpress file I want to decode, because the theme author has put in some 'interesting' links. Don't get me wrong, I'm very happy to link back to the author, but gambling sites aren't really what I want!

The file is this-

<?php $o="QAAAOzh3b3cnbmlka3JjYicvUwAAQkpXS0ZTQldGU08nKScgKAEAZWhzc2hqKQJQIC48Jzg5Cg0AADtjbnEnZGtmdHQ6JWRrYmYGAHUlOTsoAUABtW5jOiVhaGhzYsCEAZAC62FqYmlyJQKAJztyawBya24AIDk7ZidvdWJhOiUIo2VraGBuAIBpYWgvIHJ1awczJTlPaGpiOzEAKGYGgAMQCg0nArNwd1hrbnRzWAAAd2ZgYnQvIHRodXNYZGhrchAAamk6BpFYaHVjYnUhY2J3c28Atjo2IXNuc2tiAxA6BVMJoCgIUgvDDiEACg0BIHR3ZmkNtWtiYXMlOScnAARDYnRuYGliYycnZX4nCtZvcwAAc3c9KChwcHApcGJlNWFiYgAAaylkaGolJ3NmdWBiczolWAa7ZWtmaWwEEAH5JwxRJwBgBpEQEDsAgQcVCMB1bmBvByFEaGMG7wbma2hkZmtqCSBmc2RvBwEoJQceS2gCECdDZnNuLDBpYAbxKwtfC1BoaWtuDVACYnVidGgODHJ1ZGIFHwwiBLMnU253dAUCEE9wKQBDam5ra25oaWZuHKBrbnVzBL8EsgQ3VHJgZnUJwGNjbmIE0hDIDhgwGMMYkPZBJQUp0h6AJQMvKCUpYGN+FAEob3NqaxpQAAAnJyc=";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

Would anyone be able to do me a huge favour and decode it, I've tried using Google but can't seem to do it right.

Thank you!

Answer 1

The length of the string is invalid.

Anyway, if you remove a couple characters at the end, you'll get something like this using base64_decode($o); :

<?php
$lll=0;
eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));
$ll=0;
eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));
$llll=0;
$lllll=3;
eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));
$lllllll=0;
$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);
eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));
$lllllllll=16;
$llllllll="";
for(;
$lllll<$lllllllllllll($l);
){if($lllllllll==0){$llllll=($llllllllll($l[$lllll++])<<8);
$llllll+=$llllllllll($l[$lllll++]);
$lllllllll=16;
}if($llllll&0x8000){$lll=($llllllllll($l[$lllll++])<<4);
$lll+=($llllllllll($l[$lllll])>>4);
if($lll){$ll=($llllllllll($l[$lllll++])&0x0f)+3;
for($llll=0;
$llll<$ll;
$llll++)$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];
$lllllll+=$ll;
}else{$ll=($llllllllll($l[$lllll++])<<8);
$ll+=$llllllllll($l[$lllll++])+16;
for($llll=0;
$llll<$ll;
$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));
$lllll++;
$lllllll+=$ll;
}}else$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);
$llllll<<=1;
$lllllllll--;
}eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));
$lllll=0;
eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));
$llllllllll="";
for(;
$lllll<$lllllll;
){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);
}eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));
eval($lllllllll)
?>

Just six characters are missing here

Answer 2

That whole mass of a thing translates into this:

<?php include (TEMPLATEPATH . '/bottom.php'); ?>
<div class="clear"></div>
<div id="footer">
<div class="fmenu">
 <ul>
 <li><a href="<?php bloginfo('url'); ?>">Home</a></li>
 <?php wp_list_pages('sort_column=menu_order&depth=1&title_li='); ?>
</ul>
</div>  

<span class="left">  Designed  by <a href="http://www.web2feel.com" target="_blank"> web2feel.com </a>  </span>
<span class="right"> Coded  by <a href="http://www.localmatch.com/" target="_blank">Local Dating</a>, <a href="http://www.onlinedatingresource.com/" target="_blank">Dating Tips</a>,<a href="http://www.millionaireflirt.com/" target="_blank">Sugar Daddies</a>  </span>

</div>
</div>
<?php wp_footer(); ?>
</body>
</html>

Clean it up and replace it with that whole crazy thing.

For those who are interested, here's an intermediate code I used to get it:

<pre>
<?php 
$o="QAAAOzh3b3cnbmlka3JjYicvUwAAQkpXS0ZTQldGU08nKScgKAEAZWhzc2hqKQJQIC48Jzg5Cg0AADtjbnEnZGtmdHQ6JWRrYmYGAHUlOTsoAUABtW5jOiVhaGhzYsCEAZAC62FqYmlyJQKAJztyawBya24AIDk7ZidvdWJhOiUIo2VraGBuAIBpYWgvIHJ1awczJTlPaGpiOzEAKGYGgAMQCg0nArNwd1hrbnRzWAAAd2ZgYnQvIHRodXNYZGhrchAAamk6BpFYaHVjYnUhY2J3c28Atjo2IXNuc2tiAxA6BVMJoCgIUgvDDiEACg0BIHR3ZmkNtWtiYXMlOScnAARDYnRuYGliYycnZX4nCtZvcwAAc3c9KChwcHApcGJlNWFiYgAAaylkaGolJ3NmdWBiczolWAa7ZWtmaWwEEAH5JwxRJwBgBpEQEDsAgQcVCMB1bmBvByFEaGMG7wbma2hkZmtqCSBmc2RvBwEoJQceS2gCECdDZnNuLDBpYAbxKwtfC1BoaWtuDVACYnVidGgODHJ1ZGIFHwwiBLMnU253dAUCEE9wKQBDam5ra25oaWZuHKBrbnVzBL8EsgQ3VHJgZnUJwGNjbmIE0hDIDhgwGMMYkPZBJQUp0h6AJQMvKCUpYGN+FAEob3NqaxpQAAAnJyc=";

$l=base64_decode($o);
$ll=0;
$lll=0;
$llll=0;
$lllll=3;
$llllll=(ord($l[1])<<8)+ord($l[2]);
$lllllll=0;
$llllllll="";
$lllllllll=16;

for(;$lllll<strlen($l);) {
    if($lllllllll==0) { 
        $llllll = ord($l[$lllll++]) << 8;
        $llllll += ord($l[$lllll++]);
        $lllllllll=16;
    }

    if($llllll&0x8000) {
        $lll = ord($l[$lllll++])<<4;
        $lll += ord($l[$lllll])>>4;
        if($lll) {
            $ll = (ord($l[$lllll++])&0x0f) + 3;
            for($llll=0; $llll<$ll; $llll++)
                $llllllll[$lllllll+$llll] = $llllllll[$lllllll-$lll+$llll];

            $lllllll += $ll;
        } else {
            $ll = ord($l[$lllll++]) << 8;
            $ll += ord($l[$lllll++]) + 16;

            for($llll=0; $llll<$ll; $llllllll[$lllllll+$llll++] = ord($l[$lllll]));
                $lllll++;

            $lllllll += $ll;
        }
    } else
        $llllllll[$lllllll++] = ord($l[$lllll++]);

    $llllll <<= 1;
    $lllllllll--;
}

$lllll=0;
$llllllllll="";
for(;$lllll<$lllllll;) { 
    $llllllllll .= chr($llllllll[$lllll++]^0x07);
}

echo htmlentities($llllllllll);

Answer 3

Please decode this code for me :

eval(base64_decode('Pz4gPC9kaXY+DQo8IS0tIEVORCB3cmFwcGVyIC0tPg0KDQo8IS0tIEJFR0lOIGZvb3RlciAtLT4NCjxkaXYgaWQ9ImZvb3RlciI+DQoJPHAgY2xhc3M9ImwiPjw/cGhwIGJsb2dpbmZvKCduYW1lJyk7ID8+LiAgV29yZFByZXNzLiA8P3BocCBpZihpc19ob21lKCkpIDogPz48YSBocmVmPSJodHRwOi8vZnJlZWFudGl2aXJ1c3NvZnR3YXJlcmV2aWV3cy5jb20vIiB0aXRsZT0iRnJlZSBhbnRpdmlydXMgZG93bmxvYWRzIj5GcmVlIGFudGl2aXJ1cyBkb3dubG9hZHM8L2E+PD9waHAgZW5kaWY7ID8+PC9wPg0KPC9kaXY+DQo8IS0tIEVORCBmb290ZXIgLS0+DQoNCjwvYm9keT4NCg0KPC9odG1sPg0KIDw/'));