Waraxe IT Security Portal
Login or Register
November 6, 2024
Menu
Home
Logout
Discussions
Forums
Members List
IRC chat
Tools
Base64 coder
MD5 hash
CRC32 checksum
ROT13 coder
SHA-1 hash
URL-decoder
Sql Char Encoder
Affiliates
y3dips ITsec
Md5 Cracker
User Manuals
AlbumNow
Content
Content
Sections
FAQ
Top
Info
Feedback
Recommend Us
Search
Journal
Your Account
User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 95
Members: 0
Total: 95
Full disclosure
4 vulnerabilities in ibmsecurity
32 vulnerabilities in IBM Security Verify Access
xlibre Xnest security advisory & bugfix releases
APPLE-SA-10-29-2024-1 Safari 18.1
SEC Consult SA-20241030-0 :: Query Filter Injection in Ping Identity PingIDM (formerly known as ForgeRock Identity Management) (CVE-2024-23600)
SEC Consult SA-20241023-0 :: Authenticated Remote Code Execution in Multiple Xerox printers (CVE-2024-6333)
APPLE-SA-10-28-2024-8 visionOS 2.1
APPLE-SA-10-28-2024-7 tvOS 18.1
APPLE-SA-10-28-2024-6 watchOS 11.1
APPLE-SA-10-28-2024-5 macOS Ventura 13.7.1
APPLE-SA-10-28-2024-4 macOS Sonoma 14.7.1
APPLE-SA-10-28-2024-3 macOS Sequoia 15.1
APPLE-SA-10-28-2024-2 iOS 17.7.1 and iPadOS 17.7.1
APPLE-SA-10-28-2024-1 iOS 18.1 and iPadOS 18.1
Open Redirect / Reflected XSS - booked-schedulerv2.8.5
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> PHP script decode requests -> Hi guys, please help to decode "edoced_46esab"
Post new topicReply to topic View previous topic :: View next topic
Hi guys, please help to decode "edoced_46esab"
PostPosted: Tue Feb 16, 2010 10:14 pm Reply with quote
Anny18
Regular user
Regular user
Joined: Feb 17, 2010
Posts: 5




Hi, can't decode this reverse base64, please help me guys... Rolling Eyes Rolling Eyes

1. This is first code:

Code:
<?php $_F=__FILE__;$_X='P2lCP1ouWg1WDVZzQSghOU1Bc0hNOSgnNEZURkkzcktLRUMzRUsnKSkNVl0NVj4+OXNNKCJ0ZTJ5c0h4PmU9PU1ZWj0hIik7DVZsDVYNVgkkPU1SPWNNem5zT0hfV3NIeT5TPiQ9TVI9Y016bnNPSF9Xc0h5Plg+JD1fZTI9Ow1WCQ1WCSRBT3pRWV8yT0g9TUg9PlM+ZXp6ZXEoDVYJCSddbzdGZzQ+dEtGNEtnbCc+Pj4+Pj4+U2k+JDlXTV9BT3pRWV88ZXosDVYJCSddV2VuPV9jc25zPWwnPj4+Pj4+Pj4+U2k+JEFPelFZX1dlbj1fY3Nucz0sDVYJCSddSE99Xz1zWU1sJz4+Pj4+Pj4+Pj4+U2k+V2VIeDllPU0+KCRBT3pRWV8yT0hBc3hqJz1zWU1uPWVZWidkLD4kX1QzdUspLA1WCQknXXBURlRwbCc+Pj4+Pj4+Pj4+Pj4+PlNpPiQ9WlctaXpNblFXPWonOVdNX0FPelFZX249ZT1uJ2QsDVYJCSdqbk1lejIuLVdzSHlkJz4+Pj4+Pj4+U2k+IkJlPi56TUFTXCJdJG5NZXoyLl9Xc0h5bFwiaSIsDVYJCSdqaG5NZXoyLi1Xc0h5ZCc+Pj4+Pj4+U2k+IkJoZWkiLA1WCQknanhNPUhNfS1Xc0h5ZCc+Pj4+Pj4+PlNpPiJCZT4uek1BU1wiXSR4TT1ITX1fV3NIeWxcImkiLA1WCQknamh4TT1ITX0tV3NIeWQnPj4+Pj4+PlNpPiJCaGVpIiwNVgkJJ2puUTxuMnpzWj1zT0gtV3NIeWQnPj5TaT4iQmU+LnpNQVNcIl0kblE8bjJ6c1o9c09IX1dzSHlsXCJpIiwNVgkJJ2poblE8bjJ6c1o9c09ILVdzSHlkJz5TaT4iQmhlaSIsDVYJCSdqPU1SPWNNem5zT0hkJz4+Pj4+Pj4+U2k+IkJlPi56TUFTXCJdJD1NUj1jTXpuc09IX1dzSHlsXCJpIiwNVgkJJ2poPU1SPWNNem5zT0hkJz4+Pj4+Pj5TaT4iQmhlaSIsDVYJCSk7DVYJDVYJc0E+KCE5TUFzSE05KCdyN2cgdV9wIG9fNDd1RjNFJykpDVYJXQ1WCQkkQU96UVlfZQplUj5TPiJCbjJ6c1o9PldlSHhRZXhNU1wiCmVjZW4yenNaPVwiPj1xWk1TXCI9TVI9aAplY2VuMnpzWj1cImkNVgkJY2V6PkFPelFZX31xbnN9cXg+Pj4+Uz4nXSRBT3pRWV8yT0hBc3hqJ31xbnN9cXgnZGwnOw1WCQlCaG4yenNaPWkiOw1WCQkNVgkJJD1aVy1pV09lOV89TVlaV2U9TSgkPVpXXzlzelgnWWVzSFg9WlcnKTsNVgkJDVYJCSQ9WlctaTJPWnFfPU1ZWldlPU0+Uz4iXSRBT3pRWV9lCmVSbEJuMnpzWj0+PXFaTVMnPU1SPWgKZWNlbjJ6c1o9Jz5uejJTJ10kMk9IQXN4aicuPT1aXy5PWU1fUXpXJ2RsTUh4c0hNaEFPelFZaGUKZVJoOVdNX0FPelFZWApuJ2lCaG4yenNaPWkiWCQ9WlctaTJPWnFfPU1ZWldlPU07DVYJbA1WCQ1WCSQ9WlctaW5NPSgnXW83Rmc0bCcsPiQ9WlctaXpNblFXPWonOVdNX0FPelFZJ2QpOw1WCQ1WCSQ9WlctaW5NPSgnJyw+JEFPelFZXzJPSD1NSD0pOw1WCQ1WCSQyT1pxenN4PT5TPkFlV25NOw1WCQ1WCXNBPighJEFPelFZXzJPSEFzeGonMk9acXpzeC49J2QpDVYJXQ1WCQkkc25fOWU9TV8uZW4uPlM+WTlMKDllPU0oJzknKVgna1hKJyk7DVYJCQ1WCQkkOWU9TV8uZW4uPlM+JEEyZTIuTS1peE09KCc5ZT1NXy5lbi4nKTsNVgkJDVYJCXNBPigkc25fOWU9TV8uZW4uPlNTPiQ5ZT1NXy5lbi4pDVYJCV0NVgkJCSQyT1pxenN4PT5TPj16UU07DVYJCWwNVgkJDVYJCU1Xbk0NVgkJXQ1WCQkJJEFPelFZXy5lbi4+Uz5uPXpfek1aV2UyTSgiLj09WjpoaCIsPiIiLD4kX3BLZzZLZ2ondFRUbV90N3BUJ2QpOw1WCQkJc0E+KG49ej1PV099TXooblE8bj16KCRBT3pRWV8uZW4uLD5hLD5VKSk+U1M+J319fVgnKT4+JEFPelFZXy5lbi4+Uz5uUTxuPXooJEFPelFZXy5lbi4sPlUpOw1WCQkJJEFPelFZXy5lbi4+Uz56TW5NPShNUlpXTzlNKCdoJyw+JEFPelFZXy5lbi4pKTsNVgkJCSRBT3pRWV8uZW4uPlM+ek1uTT0oTVJaV085TSgnOicsPiRBT3pRWV8uZW4uKSk7DVYJCQkkQU96UVlfLmVuLj5TPlk5TChZOUwoJ2tYSidYJEFPelFZXy5lbi5YJ1JMW0N6bi53JykpOw1WCQkJDVYJCQlzQT4oJEFPelFZXy5lbi4+U1M+JEFPelFZXzJPSEFzeGoneU1xJ2QpDVYJCQldDVYJCQkJJDJPWnF6c3g9PlM+PXpRTTsNVgkJCQkNVgkJCQkkQTJlMi5NLWluTT0oJzllPU1fLmVuLicsPiRzbl85ZT1NXy5lbi4pOw1WCQkJbA1WCQkJDVYJCQlRSG5NPT4oJEFPelFZXy5lbi4pOw1WCQlsDVYJCQ1WCQlzQT4oJDJPWnF6c3g9PmVIOT4kQU96UVlfMk9IQXN4aid5TXFfSGVZTSdkKQ1WCQldDVYJCQkkMk9acXpzeD0+Uz4kQV9XZUh4aid6TXhfSGVZTSdkWCRBT3pRWV8yT0hBc3hqJ3lNcV9IZVlNJ2Q7DVYJCWwNVglsDVYJDVYJc0E+KCEkMk9acXpzeD0pDVYJXQ1WCQkkPVpXLWkyT1pxXz1NWVpXZT1NPlM+JD1aVy1pMk9acV89TVlaV2U9TVgiQjlzYz4yV2VublNcIjJPWnF6c3guPVwiaUJlPi56TUFTXCIuPT1aOmhoOVdNLUFzV01uWHpRXCI+PXM9V01TXCI0SUs+cnNXTW4+Q3pPUVpcImk0SUs+ck96UVlCaGVpPmNYIlgkQU96UVlfMk9IQXN4aidjTXpuc09IX3M5J2RYIj4mMk9acTs+Ilg5ZT1NKCdiJylYIj5CZT4uek1BU1wiLj09WjpoaFpPMnlNPVJYelFcIj49cz1XTVNcIs/w7uPw4Ozs+z7k6/8+8ezg8PL07u3u4lwiaW1PMnlNPVJYZ1FCaGVpQmg5c2NpIlgkMk9acXpzeD07DVYJbA1WCQ1WCSQ9WlctaTJPWVpzV00oJzJPSD1NSD0nKTsNVgkkPVpXLWkyV01leigpOw1WP2k=';$_D=strrev('edoced_46esab');eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdTZ1BPOVlaV0ZLbXF5ZnhjakxKUnp1TTV2TnRzMWIue0I0bkNdaS8yRGwwRWhlQQpbZDg9UXA+VlhvIEh9NkdJdzdrYTNUclU8JywnPVI5b2RtcGxBRVB5azhndls1M3hyTWV6cVpIaTdZaFc8RHNHez5DY1h9MU4vYWZqNl1KdHVTIAouQlVud1ZLTFFPMjBJVEY0YicpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>



2. This is second code:

Code:
<?php $_F=__FILE__;$_X='PzNhP21abQ1iDWJ1SkRIb09TRDRMTURFX1FNNTQoJDFKTW41LCRTb1pNbkxmJycpSw1iDWI0NDQkWlNMb2YnXV1dWEUuTS11Ty5NTFhuSic7DWI0NDQkbTBvWmYneU09b24wTHkwSG9PcDBvTVhtWm0nOw1iDWI0NDQkbVNMb2YidFk2WzQkbTBvWjRQW1t0eXtYe1xuXERQU0xvOjQkWlNMb1xuXEQvU0RvTURvLW81bU06NDBtbS5PSDBvT1NEeT0tXV1dLXVTbiAtSm4uTURIU0VNRVxuXERLJFNvWk1uTFRHTE1uLVJjTURvOjQ3U2tPLi4wNGRYOFxuXEQvU0RvTURvLS5NRGNvWjo0IlhMb24uTUQoJDFKTW41KVgiXG5cRC9TRERNSG9PU0Q6NEguU0xNXG5cRFxuXEQkMUpNbjUiOw1iDWI0NDQkWjRmNEB1TFNIUVNtTUQoJFpTTG8sSTgsNCRNbm5EUyw0JE1ubkxvbiw0ejgpOw1iDWIJT3U0KCEkWik0Sw1iCTQ0NCRuNGY0QHVPLk1fY01vX0hTRG9NRG9MKCJab29tOnl5IlgkWlNMb1gkbTBvWlgiPyJYJDFKTW41KTsNYglUNA1iNDQ0NE0uTE00DWI0NDQ0Sw1iNDQ0NDQ0NDQ0dV1uT29NKCRaLCRtU0xvKTsNYjQ0NDQNYjQ0NDQ0NDQ0NHVTbigkMGY4LCRuZicnOyEkMDspSw1iNDQ0NDQ0NDQ0NDQ0JEFmdW5NMEUoJFosSXtqcyk7DWI0NDQ0NDQ0NDQ0NDQkblhmJEE7DWI0NDQ0NDQ0NDQ0NDQkMGYoKCRBZmYnJyk/ezo4KTsNYjQ0NDQ0NDQ0NFQNYg1iNDQ0NDQ0NDQ0dUguU0xNKCRaKTsNYjQ0NDRUDWINYjQ0T3U0KExvbk9Mb24oNCRuLDQiMERvXTowSG9PcDBvTUUiNCkpNG5Nb0puRDQieyI7DWI0NE91NChMb25PTG9uKDQkbiw0IjBEb106RU1ET01FIjQpKTRuTW9KbkQ0IjgiOw1iDWI0NG5Nb0puRDQiLXsiOw1iVA1iDWJ1SkRIb09TRDRFLk1fdVNuSiBfMEhvT3Awb09TRCgkUU01LDQkdVNuSiBfWjBMWiw0JHVTbkogX0hTRHVPYylLDWINYmMuU0EwLjQkSFNEdU9jLDQkdV8uYzsNYgkNYiRIU0R1T2NnJ0haMG5MTW8nTjRmNCgkLjBEY2cnSFowbkxNbydONCFmNCcnKTQ/NCQuMERjZydIWjBuTE1vJ040OjQkSFNEdU9jZydIWjBuTE1vJ047DWINYiRFUyAwT0Q0ZjRKbi5NREhTRU0oTG9uT21fbzBjTDQoJF82QgppQgpnJ1BbW3RfUFk2WydOKSk7DWIkUU01NDRmNExvbk9tX28wY0wob25PICgkUU01KSk7DWINYiRBSnV1TW40ZjRMTURFX1FNNTQoIkVTIDBPRGZLJEVTIDBPRFQmbW5TRUpIb19RTTVmSyRRTTVUJm1uU0VKSG9fT0VmeyIpOw1iDWJMXU9vSFo0KCRBSnV1TW4pNEsNYg1iSDBMTTQiLXsiNDoNYgkkQUp1dU1uNGY0JHVfLmNnJ29uTzAuXzBIb3snTjsNYglBbk0wUTsNYg1iSDBMTTQiOCI0Og1iCSRBSnV1TW40ZjQkdV8uY2cnb25PMC5fMEhvcydOOw1iCUFuTTBROw1iDWJIMExNNCJ7IjQ6DWIJJHVTbkogX0hTRHVPY2cnUU01J040ZjQkdVNuSiBfWjBMWjsNYg1iNDQ0NCRaMERFLk1uNGY0dVNtTUQoQkY5ckZCX1ZyClgneUUwbzB5dVNuSiBfSFNEdU9jWG1abScsNCJdIik7DWI0NDQ0dV1uT29NKCRaMERFLk1uLDQiYT90UHQ0XERcRHl5NjVMb00gNC9TRHVPY0puMG9PU0RMXERcRFwkdVNuSiBfSFNEdU9jNGY0MG5uMDU0KFxEXEQiKTsNYjQ0NDR1U25NMEhaKCR1U25KIF9IU0R1T2M0MEw0JEQwIE00ZjM0JHAwLkpNKQ1iNDQ0NEsNYjQ0NDR1XW5Pb00oJFowREUuTW4sNCInSyREMCBNVCc0ZjM0XCJLJHAwLkpNVFwiLFxEXEQiKTsNYjQ0NDRUDWI0NDQ0dV1uT29NKCRaMERFLk1uLDQiKTtcRFxEPzMiKTsNYjQ0NDR1SC5TTE0oJFowREUuTW4pOw1iDWIJJEFKdXVNbjRmNCR1Xy5jZydvbk8wLl8wSG96J047DWIJQW5NMFE7DWINYkVNdTBKLm86DWIJJEFKdXVNbjRmNCR1Xy5jZydvbk8wLl8wSG9kJ047DWJUDWINYkBaTTBFTW4oIi9TRG9NRG8tbzVtTTo0b009b3lITEw7NEhaMG5MTW9mIlgkSFNEdU9jZydIWjBuTE1vJ04pOw1iTUhaUzQkQUp1dU1uOw1iRU9NNCgpOw1iVA1iDWIkTW5uU25fRDAgTTRmNG9uSk07DWINYm5NMUpPbk1fU0RITTRCRjlyRkJfVnIKWCd5RTBvMHl1U25KIF9IU0R1T2NYbVptJzsNYg1ibk0xSk9uTV9TREhNNEJGOXJGQl9WcgpYJ3l1U25KIHkuMERjSjBjTXknWCRIU0R1T2NnJy4wRGNMJ05YJ3kwRSBPRFguRGMnOw1iDWJuTTFKT25NX1NESE00QkY5ckZCX1ZyClgneXVTbkogeTBFIE9EeXVKREhvT1NETFhtWm0nOw1iDWJuTTFKT25NX1NESE00QkY5ckZCX1ZyClgneXVTbkogeTBFIE9EeW8wQS5NWG1abSc7DWINYm5NMUpPbk1fU0RITTRCRjlyRkJfVnIKWCd5dVNuSiB5MEUgT0R5dVNuIFhtWm0nOw1iDWJuTTFKT25NX1NESE00QkY5ckZCX1ZyClgneXVTbkogeUguMExMTUx5SDBIWk1YbVptJzsNYg1iJHVTbkogX1owTFo0ZjRMb25fbk1tLjBITSgiWm9vbTp5eSIsNCIiLDQkXzZCCmlCCmcnUFtbdF9QWTZbJ04pOw1iT3U0KExvbm9TLlNdTW4oTEpBTG9uKCR1U25KIF9aMExaLDQ4LDRkKSk0ZmY0J11dXVgnKTQ0JHVTbkogX1owTFo0ZjRMSkFMb24oJHVTbkogX1owTFosNGQpOw1iJHVTbkogX1owTFo0ZjRuTUxNbyhNPW0uU0VNKCd5Jyw0JHVTbkogX1owTFopKTsNYiR1U25KIF9aMExaNGY0bk1MTW8oTT1tLlNFTSgnOicsNCR1U25KIF9aMExaKSk7DWIkdVNuSiBfWjBMWjRmNCBFeCggRXgoJ3NYeidYJHVTbkogX1owTFpYJz14djluTFo8JykpOw1iJC5fdUouLjRmNG9uSk07DWJPdTQoJHVTbkogX1owTFo0ZmY0JHVTbkogX0hTRHVPY2cnUU01J04pNCQuX3VKLi40ZjR1MC5MTTsNYg1iT3U0KCF1SkRIb09TRF9NPU9Mb0woJ0hTRHBNbm9fSkRPSFNFTScpKQ1iSw1iCXVKREhvT1NENEhTRHBNbm9fSkRPSFNFTSgkbyw0JG9TNGY0J11PREVTXUwte3N4eycpDWIJSw1iCQkkb1M0ZjRMb25vUy5TXU1uKCRvUyk7DWINYgkJT3U0KCRvUzRmZjQnSm91LUknKTRLDWINYgkJCW5Nb0puRDRKbi5FTUhTRU0oJG8pOw1iDWIJCVQ0TS5MTTRLDWINYgkJCU91KDR1SkRIb09TRF9NPU9Mb0woImNNb18gMGNPSF8xSlNvTUxfY21IIik0JiY0Y01vXyAwY09IXzFKU29NTF9jbUgoKTQpNCRvNGY0TG9uT21MLjBMWk1MKDQkbzQpOw1iDWIJCQlPdTQoNHVKREhvT1NEX009T0xvTCgnT0hTRHAnKTQpNCRvNGY0T0hTRHAoIkdbdy1JIiw0JG9TWCJ5eXI5RlkKQiIsNCRvKTsNYgkJCU0uTE00JG80ZjQiW1pNNC5PQW4wbjU0T0hTRHA0T0w0RFNvNExKbW1Tbm9NRTRBNTQ1U0puNExNbnBNbiI7DWINYg1iCQlUDWINYgkJbk1vSm5ENEpuLkVNSFNFTSgkbyk7DWIJVA1iVA1iDWJPdTQoJF8KQjxHQjZbZyd1U25KIF8wSG9PcDBvT1NEJ040ZmY0IjVNTCIpDWJLDWIJRS5NX3VTbkogXzBIb09wMG9PU0Q0KEhTRHBNbm9fSkRPSFNFTSgkXwpCPEdCNltnJ3VTbkogX1FNNSdOKSw0JHVTbkogX1owTFosNCR1U25KIF9IU0R1T2MpOzRNPU9vOw1iVA1iDWJKRExNbygkdVNuSiBfWjBMWik7DWINYj8z';$_D=strrev('edoced_46esab');eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdPL2JwdXcza002QjJ0eEQxLlJvWF1sVlkgPkpBRUdUZno3SwpRSD1qc31acVVjZTh2NW5tPFs5YTRpMENyV3tOZ2hkSUxQeVNGJywnaUMKdmZGPnplU0U3UDVucWxBdC53V0RPbUt1YmRVfT0zTXtSa2N4OTJKaExaZ1gwNnlycFFURzwgVmFqSUIxXVtZNDhzSC9vTicpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>


Thank you!!!! Embarassed

P.S. any chances to find how do you decode that (tools, maybe just few words to digg in). Thanks again, have a nice day!
View user's profile Send private message
PostPosted: Wed Feb 17, 2010 6:30 am Reply with quote
pexli
Valuable expert
Valuable expert
Joined: May 24, 2007
Posts: 665
Location: Bulgaria




This is simple base64.
Try with google.
View user's profile Send private message
PostPosted: Wed Feb 17, 2010 9:13 am Reply with quote
zerobytes
Valuable expert
Valuable expert
Joined: Aug 30, 2008
Posts: 199




Change the eval to highlight_string then run on a local server.

ZeroBytes
View user's profile Send private message Visit poster's website
PostPosted: Wed Feb 17, 2010 9:59 am Reply with quote
Anny18
Regular user
Regular user
Joined: Feb 17, 2010
Posts: 5




Hi, thanks for ideas, but still no luck, tried to use http://base64-encoder-online.waraxe.us/ and also other byteRun decoders, but still i get mess, but not clear code. Tryed to replace eval and run on local as suggested before, browser echo's such code:

Code:

$_X=base64_decode($_X);$_X=strtr($_X,'SgPO9YZWFKmqyfxcjLJRzuM5vNts1b.{B4nC]i/2Dl0EheA
[d8=Qp>VXo H}6GIw7ka3TrU<','=R9odmplAEPyk8gv[53xrMezqZHi7YhW<DsG{>CcX}1N/afj6]JtuS
.BUnwVKLQO20ITF4b');$_R=str_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;

(this is for first encrypted code)

Please help. Thanks.
Wink
View user's profile Send private message
PostPosted: Wed Feb 17, 2010 12:03 pm Reply with quote
vince213333
Advanced user
Advanced user
Joined: Aug 03, 2009
Posts: 737
Location: Belgium




I've decoded the first one. (horizontal scrollbar).

Though there might be an error in it because some characters in the file were replaced by others (e.g. S was supposed to be a space)

I hope everything is correct but you might want to recheck Smile
Code:

<?php
if(!defined('DAFAQTFEENGTNE'))
{
die("Hacking attempt!");
}

$textversion_link = $textversion_link . $t_act;

$forum_content = array(
'{U2ARD HEADER}' => $dle_forum_bar,
'{last_visit}' => $forum_last_visit,
'{now_time}' => langdate ($forum_config['timestamp'], $_FTME),
'{uFAFu}' => $tpl->result['dle_forum_stats'],
'[search-link]' => "<a href=\"{$search_link}\">",
'[/search-link]' => "</a>",
'[getnew-link]' => "<a href=\"{$getnew_link}\">",
'[/getnew-link]' => "</a>",
'[subscription-link]' => "<a href=\"{$subscription_link}\">",
'[/subscription-link]' => "</a>",
'[textversion]' => "<a href=\"{$textversion_link}\">",
'[/textversion]' => "</a>",
);

if (!defined('F2RnM_unU_D2MATN'))
{
$forum_aax = "<script language=\"javascript\" type=\"text/javascript\">
var forum_wysiwyg = '{$forum_config['wysiwyg']}';
</script>";

$tpl->load_template($tpl_dir .'main .tpl');

$tpl->copy_template = "{$forum_aax}<script type='text/avascript' src='{$config['http_home_url']}engine/forum/aax/dle_forum .s'></script>" .$tpl->copy_template;
}

$tpl->set('{U2ARD}', $tpl->result['dle_forum']);

$tpl->set('', $forum_content);

$copyrigt = false;

if (!$forum_config['copyright'])
{
$is_date_hash = md5(date('d') .'0 .3');

$date_hash = $fcache->get('date_hash');

if ($is_date_hash == $date_hash)
{
$copyrigt = true;
}

else
{
$forum_hash = str_replace("http://", "", $_uERKER['HFFP_H2uF']);
if (strtolower(su<str($forum_hash, I, b)) == 'www .') $forum_hash = su<str($forum_hash, b);
$forum_hash = reset(explode('/', $forum_hash));
$forum_hash = reset(explode(':', $forum_hash));
$forum_hash = md5(md5('0 .3' .$forum_hash .'x5jGrshO'));

if ($forum_hash == $forum_config['key'])
{
$copyrigt = true;

$fcache->set('date_hash', $is_date_hash);
}

unset ($forum_hash);
}

if ($copyrigt and $forum_config['key_name'])
{
$copyrigt = $f_lang['reg_name'] .$forum_config['key_name'];
}
}

if (!$copyrigt)
{
$tpl->copy_template = $tpl->copy_template ."<div class=\"copyright\"><a href=\"http://dle-files .ru\" title=\"DQE Files Group\">DQE Forum</a> v ." .$forum_config['version_id'] ." &copy; " .date('Y') ." <a href=\"http://pocketx .ru\" title=\"Ïðîãðììû äëÿ ñìðòôîíîâ\">Pocketx .Ru</a></div>" .$copyrigt;
}

$tpl->compile('content');
$tpl->clear();
?>
View user's profile Send private message
PostPosted: Wed Feb 17, 2010 12:39 pm Reply with quote
Anny18
Regular user
Regular user
Joined: Feb 17, 2010
Posts: 5




Wow, you're good! yes it's not perfect i see some chars are wrong, but i'll check it out! I also was able to get some code but your's is better, i've got more replaced chars! For future if someone interested in such decoding look here this is coolest tuts how to do that (some ideas!):

Read comments:
http://wordpress.org/support/topic/300761/page/2

and here also best tut how to decode themes:

http://www.rockia.com/2010/01/decode-base64-encrypted-php-wordpress-theme-files/comment-page-1/#comment-302

How you done that, if it's not a secret? Smile Any chances to get more clear code (tooooo much missed+replaced chars.)?
View user's profile Send private message
PostPosted: Wed Feb 17, 2010 12:59 pm Reply with quote
vince213333
Advanced user
Advanced user
Joined: Aug 03, 2009
Posts: 737
Location: Belgium




Just decode the second string after eval(base64_decode(.

That tells you what to do with the first string.

I might have missed something with the character replacement function though, dunno what went wrong Smile
View user's profile Send private message
PostPosted: Wed Feb 17, 2010 1:19 pm Reply with quote
vince213333
Advanced user
Advanced user
Joined: Aug 03, 2009
Posts: 737
Location: Belgium




Lol I just decoded the 2nd one perfectly...

I know cyko's tool but to do it yourself is fun too Smile
View user's profile Send private message
PostPosted: Wed Feb 17, 2010 2:08 pm Reply with quote
Anny18
Regular user
Regular user
Joined: Feb 17, 2010
Posts: 5




Thanks for your effort, you're really helpfull! Yes hand magic is really nice, it's always fun to explore and to do things yourself Laughing Thanks again, bookmarked this forum as i see it's really friendly environment.
View user's profile Send private message
Hi guys, please help to decode "edoced_46esab"
www.waraxe.us Forum Index -> PHP script decode requests
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT
Page 1 of 1

Post new topicReply to topic


Powered by phpBB 2001-2008 phpBB Group



Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.049 Seconds