Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
March 29, 2024
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 794
Members: 0
Total: 794
PacketStorm News
·301 Moved Permanently

read more...
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> PHP script decode requests -> Hi guys, please help to decode "edoced_46esab"
Post new topic  Reply to topic View previous topic :: View next topic 
Hi guys, please help to decode "edoced_46esab"
PostPosted: Tue Feb 16, 2010 10:14 pm Reply with quote
Anny18
Regular user
Regular user
 
Joined: Feb 17, 2010
Posts: 5




Hi, can't decode this reverse base64, please help me guys... Rolling Eyes Rolling Eyes

1. This is first code:

Code:
<?php $_F=__FILE__;$_X='P2lCP1ouWg1WDVZzQSghOU1Bc0hNOSgnNEZURkkzcktLRUMzRUsnKSkNVl0NVj4+OXNNKCJ0ZTJ5c0h4PmU9PU1ZWj0hIik7DVZsDVYNVgkkPU1SPWNNem5zT0hfV3NIeT5TPiQ9TVI9Y016bnNPSF9Xc0h5Plg+JD1fZTI9Ow1WCQ1WCSRBT3pRWV8yT0g9TUg9PlM+ZXp6ZXEoDVYJCSddbzdGZzQ+dEtGNEtnbCc+Pj4+Pj4+U2k+JDlXTV9BT3pRWV88ZXosDVYJCSddV2VuPV9jc25zPWwnPj4+Pj4+Pj4+U2k+JEFPelFZX1dlbj1fY3Nucz0sDVYJCSddSE99Xz1zWU1sJz4+Pj4+Pj4+Pj4+U2k+V2VIeDllPU0+KCRBT3pRWV8yT0hBc3hqJz1zWU1uPWVZWidkLD4kX1QzdUspLA1WCQknXXBURlRwbCc+Pj4+Pj4+Pj4+Pj4+PlNpPiQ9WlctaXpNblFXPWonOVdNX0FPelFZX249ZT1uJ2QsDVYJCSdqbk1lejIuLVdzSHlkJz4+Pj4+Pj4+U2k+IkJlPi56TUFTXCJdJG5NZXoyLl9Xc0h5bFwiaSIsDVYJCSdqaG5NZXoyLi1Xc0h5ZCc+Pj4+Pj4+U2k+IkJoZWkiLA1WCQknanhNPUhNfS1Xc0h5ZCc+Pj4+Pj4+PlNpPiJCZT4uek1BU1wiXSR4TT1ITX1fV3NIeWxcImkiLA1WCQknamh4TT1ITX0tV3NIeWQnPj4+Pj4+PlNpPiJCaGVpIiwNVgkJJ2puUTxuMnpzWj1zT0gtV3NIeWQnPj5TaT4iQmU+LnpNQVNcIl0kblE8bjJ6c1o9c09IX1dzSHlsXCJpIiwNVgkJJ2poblE8bjJ6c1o9c09ILVdzSHlkJz5TaT4iQmhlaSIsDVYJCSdqPU1SPWNNem5zT0hkJz4+Pj4+Pj4+U2k+IkJlPi56TUFTXCJdJD1NUj1jTXpuc09IX1dzSHlsXCJpIiwNVgkJJ2poPU1SPWNNem5zT0hkJz4+Pj4+Pj5TaT4iQmhlaSIsDVYJCSk7DVYJDVYJc0E+KCE5TUFzSE05KCdyN2cgdV9wIG9fNDd1RjNFJykpDVYJXQ1WCQkkQU96UVlfZQplUj5TPiJCbjJ6c1o9PldlSHhRZXhNU1wiCmVjZW4yenNaPVwiPj1xWk1TXCI9TVI9aAplY2VuMnpzWj1cImkNVgkJY2V6PkFPelFZX31xbnN9cXg+Pj4+Uz4nXSRBT3pRWV8yT0hBc3hqJ31xbnN9cXgnZGwnOw1WCQlCaG4yenNaPWkiOw1WCQkNVgkJJD1aVy1pV09lOV89TVlaV2U9TSgkPVpXXzlzelgnWWVzSFg9WlcnKTsNVgkJDVYJCSQ9WlctaTJPWnFfPU1ZWldlPU0+Uz4iXSRBT3pRWV9lCmVSbEJuMnpzWj0+PXFaTVMnPU1SPWgKZWNlbjJ6c1o9Jz5uejJTJ10kMk9IQXN4aicuPT1aXy5PWU1fUXpXJ2RsTUh4c0hNaEFPelFZaGUKZVJoOVdNX0FPelFZWApuJ2lCaG4yenNaPWkiWCQ9WlctaTJPWnFfPU1ZWldlPU07DVYJbA1WCQ1WCSQ9WlctaW5NPSgnXW83Rmc0bCcsPiQ9WlctaXpNblFXPWonOVdNX0FPelFZJ2QpOw1WCQ1WCSQ9WlctaW5NPSgnJyw+JEFPelFZXzJPSD1NSD0pOw1WCQ1WCSQyT1pxenN4PT5TPkFlV25NOw1WCQ1WCXNBPighJEFPelFZXzJPSEFzeGonMk9acXpzeC49J2QpDVYJXQ1WCQkkc25fOWU9TV8uZW4uPlM+WTlMKDllPU0oJzknKVgna1hKJyk7DVYJCQ1WCQkkOWU9TV8uZW4uPlM+JEEyZTIuTS1peE09KCc5ZT1NXy5lbi4nKTsNVgkJDVYJCXNBPigkc25fOWU9TV8uZW4uPlNTPiQ5ZT1NXy5lbi4pDVYJCV0NVgkJCSQyT1pxenN4PT5TPj16UU07DVYJCWwNVgkJDVYJCU1Xbk0NVgkJXQ1WCQkJJEFPelFZXy5lbi4+Uz5uPXpfek1aV2UyTSgiLj09WjpoaCIsPiIiLD4kX3BLZzZLZ2ondFRUbV90N3BUJ2QpOw1WCQkJc0E+KG49ej1PV099TXooblE8bj16KCRBT3pRWV8uZW4uLD5hLD5VKSk+U1M+J319fVgnKT4+JEFPelFZXy5lbi4+Uz5uUTxuPXooJEFPelFZXy5lbi4sPlUpOw1WCQkJJEFPelFZXy5lbi4+Uz56TW5NPShNUlpXTzlNKCdoJyw+JEFPelFZXy5lbi4pKTsNVgkJCSRBT3pRWV8uZW4uPlM+ek1uTT0oTVJaV085TSgnOicsPiRBT3pRWV8uZW4uKSk7DVYJCQkkQU96UVlfLmVuLj5TPlk5TChZOUwoJ2tYSidYJEFPelFZXy5lbi5YJ1JMW0N6bi53JykpOw1WCQkJDVYJCQlzQT4oJEFPelFZXy5lbi4+U1M+JEFPelFZXzJPSEFzeGoneU1xJ2QpDVYJCQldDVYJCQkJJDJPWnF6c3g9PlM+PXpRTTsNVgkJCQkNVgkJCQkkQTJlMi5NLWluTT0oJzllPU1fLmVuLicsPiRzbl85ZT1NXy5lbi4pOw1WCQkJbA1WCQkJDVYJCQlRSG5NPT4oJEFPelFZXy5lbi4pOw1WCQlsDVYJCQ1WCQlzQT4oJDJPWnF6c3g9PmVIOT4kQU96UVlfMk9IQXN4aid5TXFfSGVZTSdkKQ1WCQldDVYJCQkkMk9acXpzeD0+Uz4kQV9XZUh4aid6TXhfSGVZTSdkWCRBT3pRWV8yT0hBc3hqJ3lNcV9IZVlNJ2Q7DVYJCWwNVglsDVYJDVYJc0E+KCEkMk9acXpzeD0pDVYJXQ1WCQkkPVpXLWkyT1pxXz1NWVpXZT1NPlM+JD1aVy1pMk9acV89TVlaV2U9TVgiQjlzYz4yV2VublNcIjJPWnF6c3guPVwiaUJlPi56TUFTXCIuPT1aOmhoOVdNLUFzV01uWHpRXCI+PXM9V01TXCI0SUs+cnNXTW4+Q3pPUVpcImk0SUs+ck96UVlCaGVpPmNYIlgkQU96UVlfMk9IQXN4aidjTXpuc09IX3M5J2RYIj4mMk9acTs+Ilg5ZT1NKCdiJylYIj5CZT4uek1BU1wiLj09WjpoaFpPMnlNPVJYelFcIj49cz1XTVNcIs/w7uPw4Ozs+z7k6/8+8ezg8PL07u3u4lwiaW1PMnlNPVJYZ1FCaGVpQmg5c2NpIlgkMk9acXpzeD07DVYJbA1WCQ1WCSQ9WlctaTJPWVpzV00oJzJPSD1NSD0nKTsNVgkkPVpXLWkyV01leigpOw1WP2k=';$_D=strrev('edoced_46esab');eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdTZ1BPOVlaV0ZLbXF5ZnhjakxKUnp1TTV2TnRzMWIue0I0bkNdaS8yRGwwRWhlQQpbZDg9UXA+VlhvIEh9NkdJdzdrYTNUclU8JywnPVI5b2RtcGxBRVB5azhndls1M3hyTWV6cVpIaTdZaFc8RHNHez5DY1h9MU4vYWZqNl1KdHVTIAouQlVud1ZLTFFPMjBJVEY0YicpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>



2. This is second code:

Code:
<?php $_F=__FILE__;$_X='PzNhP21abQ1iDWJ1SkRIb09TRDRMTURFX1FNNTQoJDFKTW41LCRTb1pNbkxmJycpSw1iDWI0NDQkWlNMb2YnXV1dWEUuTS11Ty5NTFhuSic7DWI0NDQkbTBvWmYneU09b24wTHkwSG9PcDBvTVhtWm0nOw1iDWI0NDQkbVNMb2YidFk2WzQkbTBvWjRQW1t0eXtYe1xuXERQU0xvOjQkWlNMb1xuXEQvU0RvTURvLW81bU06NDBtbS5PSDBvT1NEeT0tXV1dLXVTbiAtSm4uTURIU0VNRVxuXERLJFNvWk1uTFRHTE1uLVJjTURvOjQ3U2tPLi4wNGRYOFxuXEQvU0RvTURvLS5NRGNvWjo0IlhMb24uTUQoJDFKTW41KVgiXG5cRC9TRERNSG9PU0Q6NEguU0xNXG5cRFxuXEQkMUpNbjUiOw1iDWI0NDQkWjRmNEB1TFNIUVNtTUQoJFpTTG8sSTgsNCRNbm5EUyw0JE1ubkxvbiw0ejgpOw1iDWIJT3U0KCEkWik0Sw1iCTQ0NCRuNGY0QHVPLk1fY01vX0hTRG9NRG9MKCJab29tOnl5IlgkWlNMb1gkbTBvWlgiPyJYJDFKTW41KTsNYglUNA1iNDQ0NE0uTE00DWI0NDQ0Sw1iNDQ0NDQ0NDQ0dV1uT29NKCRaLCRtU0xvKTsNYjQ0NDQNYjQ0NDQ0NDQ0NHVTbigkMGY4LCRuZicnOyEkMDspSw1iNDQ0NDQ0NDQ0NDQ0JEFmdW5NMEUoJFosSXtqcyk7DWI0NDQ0NDQ0NDQ0NDQkblhmJEE7DWI0NDQ0NDQ0NDQ0NDQkMGYoKCRBZmYnJyk/ezo4KTsNYjQ0NDQ0NDQ0NFQNYg1iNDQ0NDQ0NDQ0dUguU0xNKCRaKTsNYjQ0NDRUDWINYjQ0T3U0KExvbk9Mb24oNCRuLDQiMERvXTowSG9PcDBvTUUiNCkpNG5Nb0puRDQieyI7DWI0NE91NChMb25PTG9uKDQkbiw0IjBEb106RU1ET01FIjQpKTRuTW9KbkQ0IjgiOw1iDWI0NG5Nb0puRDQiLXsiOw1iVA1iDWJ1SkRIb09TRDRFLk1fdVNuSiBfMEhvT3Awb09TRCgkUU01LDQkdVNuSiBfWjBMWiw0JHVTbkogX0hTRHVPYylLDWINYmMuU0EwLjQkSFNEdU9jLDQkdV8uYzsNYgkNYiRIU0R1T2NnJ0haMG5MTW8nTjRmNCgkLjBEY2cnSFowbkxNbydONCFmNCcnKTQ/NCQuMERjZydIWjBuTE1vJ040OjQkSFNEdU9jZydIWjBuTE1vJ047DWINYiRFUyAwT0Q0ZjRKbi5NREhTRU0oTG9uT21fbzBjTDQoJF82QgppQgpnJ1BbW3RfUFk2WydOKSk7DWIkUU01NDRmNExvbk9tX28wY0wob25PICgkUU01KSk7DWINYiRBSnV1TW40ZjRMTURFX1FNNTQoIkVTIDBPRGZLJEVTIDBPRFQmbW5TRUpIb19RTTVmSyRRTTVUJm1uU0VKSG9fT0VmeyIpOw1iDWJMXU9vSFo0KCRBSnV1TW4pNEsNYg1iSDBMTTQiLXsiNDoNYgkkQUp1dU1uNGY0JHVfLmNnJ29uTzAuXzBIb3snTjsNYglBbk0wUTsNYg1iSDBMTTQiOCI0Og1iCSRBSnV1TW40ZjQkdV8uY2cnb25PMC5fMEhvcydOOw1iCUFuTTBROw1iDWJIMExNNCJ7IjQ6DWIJJHVTbkogX0hTRHVPY2cnUU01J040ZjQkdVNuSiBfWjBMWjsNYg1iNDQ0NCRaMERFLk1uNGY0dVNtTUQoQkY5ckZCX1ZyClgneUUwbzB5dVNuSiBfSFNEdU9jWG1abScsNCJdIik7DWI0NDQ0dV1uT29NKCRaMERFLk1uLDQiYT90UHQ0XERcRHl5NjVMb00gNC9TRHVPY0puMG9PU0RMXERcRFwkdVNuSiBfSFNEdU9jNGY0MG5uMDU0KFxEXEQiKTsNYjQ0NDR1U25NMEhaKCR1U25KIF9IU0R1T2M0MEw0JEQwIE00ZjM0JHAwLkpNKQ1iNDQ0NEsNYjQ0NDR1XW5Pb00oJFowREUuTW4sNCInSyREMCBNVCc0ZjM0XCJLJHAwLkpNVFwiLFxEXEQiKTsNYjQ0NDRUDWI0NDQ0dV1uT29NKCRaMERFLk1uLDQiKTtcRFxEPzMiKTsNYjQ0NDR1SC5TTE0oJFowREUuTW4pOw1iDWIJJEFKdXVNbjRmNCR1Xy5jZydvbk8wLl8wSG96J047DWIJQW5NMFE7DWINYkVNdTBKLm86DWIJJEFKdXVNbjRmNCR1Xy5jZydvbk8wLl8wSG9kJ047DWJUDWINYkBaTTBFTW4oIi9TRG9NRG8tbzVtTTo0b009b3lITEw7NEhaMG5MTW9mIlgkSFNEdU9jZydIWjBuTE1vJ04pOw1iTUhaUzQkQUp1dU1uOw1iRU9NNCgpOw1iVA1iDWIkTW5uU25fRDAgTTRmNG9uSk07DWINYm5NMUpPbk1fU0RITTRCRjlyRkJfVnIKWCd5RTBvMHl1U25KIF9IU0R1T2NYbVptJzsNYg1ibk0xSk9uTV9TREhNNEJGOXJGQl9WcgpYJ3l1U25KIHkuMERjSjBjTXknWCRIU0R1T2NnJy4wRGNMJ05YJ3kwRSBPRFguRGMnOw1iDWJuTTFKT25NX1NESE00QkY5ckZCX1ZyClgneXVTbkogeTBFIE9EeXVKREhvT1NETFhtWm0nOw1iDWJuTTFKT25NX1NESE00QkY5ckZCX1ZyClgneXVTbkogeTBFIE9EeW8wQS5NWG1abSc7DWINYm5NMUpPbk1fU0RITTRCRjlyRkJfVnIKWCd5dVNuSiB5MEUgT0R5dVNuIFhtWm0nOw1iDWJuTTFKT25NX1NESE00QkY5ckZCX1ZyClgneXVTbkogeUguMExMTUx5SDBIWk1YbVptJzsNYg1iJHVTbkogX1owTFo0ZjRMb25fbk1tLjBITSgiWm9vbTp5eSIsNCIiLDQkXzZCCmlCCmcnUFtbdF9QWTZbJ04pOw1iT3U0KExvbm9TLlNdTW4oTEpBTG9uKCR1U25KIF9aMExaLDQ4LDRkKSk0ZmY0J11dXVgnKTQ0JHVTbkogX1owTFo0ZjRMSkFMb24oJHVTbkogX1owTFosNGQpOw1iJHVTbkogX1owTFo0ZjRuTUxNbyhNPW0uU0VNKCd5Jyw0JHVTbkogX1owTFopKTsNYiR1U25KIF9aMExaNGY0bk1MTW8oTT1tLlNFTSgnOicsNCR1U25KIF9aMExaKSk7DWIkdVNuSiBfWjBMWjRmNCBFeCggRXgoJ3NYeidYJHVTbkogX1owTFpYJz14djluTFo8JykpOw1iJC5fdUouLjRmNG9uSk07DWJPdTQoJHVTbkogX1owTFo0ZmY0JHVTbkogX0hTRHVPY2cnUU01J04pNCQuX3VKLi40ZjR1MC5MTTsNYg1iT3U0KCF1SkRIb09TRF9NPU9Mb0woJ0hTRHBNbm9fSkRPSFNFTScpKQ1iSw1iCXVKREhvT1NENEhTRHBNbm9fSkRPSFNFTSgkbyw0JG9TNGY0J11PREVTXUwte3N4eycpDWIJSw1iCQkkb1M0ZjRMb25vUy5TXU1uKCRvUyk7DWINYgkJT3U0KCRvUzRmZjQnSm91LUknKTRLDWINYgkJCW5Nb0puRDRKbi5FTUhTRU0oJG8pOw1iDWIJCVQ0TS5MTTRLDWINYgkJCU91KDR1SkRIb09TRF9NPU9Mb0woImNNb18gMGNPSF8xSlNvTUxfY21IIik0JiY0Y01vXyAwY09IXzFKU29NTF9jbUgoKTQpNCRvNGY0TG9uT21MLjBMWk1MKDQkbzQpOw1iDWIJCQlPdTQoNHVKREhvT1NEX009T0xvTCgnT0hTRHAnKTQpNCRvNGY0T0hTRHAoIkdbdy1JIiw0JG9TWCJ5eXI5RlkKQiIsNCRvKTsNYgkJCU0uTE00JG80ZjQiW1pNNC5PQW4wbjU0T0hTRHA0T0w0RFNvNExKbW1Tbm9NRTRBNTQ1U0puNExNbnBNbiI7DWINYg1iCQlUDWINYgkJbk1vSm5ENEpuLkVNSFNFTSgkbyk7DWIJVA1iVA1iDWJPdTQoJF8KQjxHQjZbZyd1U25KIF8wSG9PcDBvT1NEJ040ZmY0IjVNTCIpDWJLDWIJRS5NX3VTbkogXzBIb09wMG9PU0Q0KEhTRHBNbm9fSkRPSFNFTSgkXwpCPEdCNltnJ3VTbkogX1FNNSdOKSw0JHVTbkogX1owTFosNCR1U25KIF9IU0R1T2MpOzRNPU9vOw1iVA1iDWJKRExNbygkdVNuSiBfWjBMWik7DWINYj8z';$_D=strrev('edoced_46esab');eval($_D('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCdPL2JwdXcza002QjJ0eEQxLlJvWF1sVlkgPkpBRUdUZno3SwpRSD1qc31acVVjZTh2NW5tPFs5YTRpMENyV3tOZ2hkSUxQeVNGJywnaUMKdmZGPnplU0U3UDVucWxBdC53V0RPbUt1YmRVfT0zTXtSa2N4OTJKaExaZ1gwNnlycFFURzwgVmFqSUIxXVtZNDhzSC9vTicpOyRfUj1zdHJfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>


Thank you!!!! Embarassed

P.S. any chances to find how do you decode that (tools, maybe just few words to digg in). Thanks again, have a nice day!
View user's profile Send private message
PostPosted: Wed Feb 17, 2010 6:30 am Reply with quote
pexli
Valuable expert
Valuable expert
 
Joined: May 24, 2007
Posts: 665
Location: Bulgaria




This is simple base64.
Try with google.
View user's profile Send private message
PostPosted: Wed Feb 17, 2010 9:13 am Reply with quote
zerobytes
Valuable expert
Valuable expert
 
Joined: Aug 30, 2008
Posts: 199




Change the eval to highlight_string then run on a local server.

ZeroBytes
View user's profile Send private message Visit poster's website
PostPosted: Wed Feb 17, 2010 9:59 am Reply with quote
Anny18
Regular user
Regular user
 
Joined: Feb 17, 2010
Posts: 5




Hi, thanks for ideas, but still no luck, tried to use http://base64-encoder-online.waraxe.us/ and also other byteRun decoders, but still i get mess, but not clear code. Tryed to replace eval and run on local as suggested before, browser echo's such code:

Code:

$_X=base64_decode($_X);$_X=strtr($_X,'SgPO9YZWFKmqyfxcjLJRzuM5vNts1b.{B4nC]i/2Dl0EheA
[d8=Qp>VXo H}6GIw7ka3TrU<','=R9odmplAEPyk8gv[53xrMezqZHi7YhW<DsG{>CcX}1N/afj6]JtuS
.BUnwVKLQO20ITF4b');$_R=str_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;

(this is for first encrypted code)

Please help. Thanks.
Wink
View user's profile Send private message
PostPosted: Wed Feb 17, 2010 12:03 pm Reply with quote
vince213333
Advanced user
Advanced user
 
Joined: Aug 03, 2009
Posts: 737
Location: Belgium




I've decoded the first one. (horizontal scrollbar).

Though there might be an error in it because some characters in the file were replaced by others (e.g. S was supposed to be a space)

I hope everything is correct but you might want to recheck Smile
Code:

<?php
if(!defined('DAFAQTFEENGTNE'))
{
  die("Hacking attempt!");
}
 
    $textversion_link = $textversion_link  . $t_act;
     
    $forum_content = array(
        '{U2ARD HEADER}'       => $dle_forum_bar,
        '{last_visit}'         => $forum_last_visit,
        '{now_time}'           => langdate ($forum_config['timestamp'], $_FTME),
        '{uFAFu}'              => $tpl->result['dle_forum_stats'],
        '[search-link]'        => "<a href=\"{$search_link}\">",
        '[/search-link]'       => "</a>",
        '[getnew-link]'        => "<a href=\"{$getnew_link}\">",
        '[/getnew-link]'       => "</a>",
        '[subscription-link]'  => "<a href=\"{$subscription_link}\">",
        '[/subscription-link]' => "</a>",
        '[textversion]'        => "<a href=\"{$textversion_link}\">",
        '[/textversion]'       => "</a>",
        );
     
    if (!defined('F2RnM_unU_D2MATN'))
    {
        $forum_aax = "<script language=\"javascript\" type=\"text/javascript\">
        var forum_wysiwyg    = '{$forum_config['wysiwyg']}';
        </script>";
         
        $tpl->load_template($tpl_dir .'main .tpl');
         
        $tpl->copy_template = "{$forum_aax}<script type='text/avascript' src='{$config['http_home_url']}engine/forum/aax/dle_forum .s'></script>" .$tpl->copy_template;
    }
     
    $tpl->set('{U2ARD}', $tpl->result['dle_forum']);
     
    $tpl->set('', $forum_content);
     
    $copyrigt = false;
     
    if (!$forum_config['copyright'])
    {
        $is_date_hash = md5(date('d') .'0 .3');
         
        $date_hash = $fcache->get('date_hash');
         
        if ($is_date_hash == $date_hash)
        {
            $copyrigt = true;
        }
         
        else
        {
            $forum_hash = str_replace("http://", "", $_uERKER['HFFP_H2uF']);
            if (strtolower(su<str($forum_hash, I, b)) == 'www .')  $forum_hash = su<str($forum_hash, b);
            $forum_hash = reset(explode('/', $forum_hash));
            $forum_hash = reset(explode(':', $forum_hash));
            $forum_hash = md5(md5('0 .3' .$forum_hash .'x5jGrshO'));
             
            if ($forum_hash == $forum_config['key'])
            {
                $copyrigt = true;
                 
                $fcache->set('date_hash', $is_date_hash);
            }
             
            unset ($forum_hash);
        }
         
        if ($copyrigt and $forum_config['key_name'])
        {
            $copyrigt = $f_lang['reg_name'] .$forum_config['key_name'];
        }
    }
     
    if (!$copyrigt)
    {
        $tpl->copy_template = $tpl->copy_template ."<div class=\"copyright\"><a href=\"http://dle-files .ru\" title=\"DQE Files Group\">DQE Forum</a> v ." .$forum_config['version_id'] ." &copy; " .date('Y') ." <a href=\"http://pocketx .ru\" title=\"Программы для смартфонов\">Pocketx .Ru</a></div>" .$copyrigt;
    }
     
    $tpl->compile('content');
    $tpl->clear();
?>
View user's profile Send private message
PostPosted: Wed Feb 17, 2010 12:39 pm Reply with quote
Anny18
Regular user
Regular user
 
Joined: Feb 17, 2010
Posts: 5




Wow, you're good! yes it's not perfect i see some chars are wrong, but i'll check it out! I also was able to get some code but your's is better, i've got more replaced chars! For future if someone interested in such decoding look here this is coolest tuts how to do that (some ideas!):

Read comments:
http://wordpress.org/support/topic/300761/page/2

and here also best tut how to decode themes:

http://www.rockia.com/2010/01/decode-base64-encrypted-php-wordpress-theme-files/comment-page-1/#comment-302

How you done that, if it's not a secret? Smile Any chances to get more clear code (tooooo much missed+replaced chars.)?
View user's profile Send private message
PostPosted: Wed Feb 17, 2010 12:59 pm Reply with quote
vince213333
Advanced user
Advanced user
 
Joined: Aug 03, 2009
Posts: 737
Location: Belgium




Just decode the second string after eval(base64_decode(.

That tells you what to do with the first string.

I might have missed something with the character replacement function though, dunno what went wrong Smile
View user's profile Send private message
PostPosted: Wed Feb 17, 2010 1:19 pm Reply with quote
vince213333
Advanced user
Advanced user
 
Joined: Aug 03, 2009
Posts: 737
Location: Belgium




Lol I just decoded the 2nd one perfectly...

I know cyko's tool but to do it yourself is fun too Smile
View user's profile Send private message
PostPosted: Wed Feb 17, 2010 2:08 pm Reply with quote
Anny18
Regular user
Regular user
 
Joined: Feb 17, 2010
Posts: 5




Thanks for your effort, you're really helpfull! Yes hand magic is really nice, it's always fun to explore and to do things yourself Laughing Thanks again, bookmarked this forum as i see it's really friendly environment.
View user's profile Send private message
Hi guys, please help to decode "edoced_46esab"
  www.waraxe.us Forum Index -> PHP script decode requests
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB © 2001-2008 phpBB Group






Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.169 Seconds