hi guys,
well, i was looking at some stuff in my laptop and found the following encoded code
it is from a wordpress template but its decoding mechanism is very interesting and i would like to know how it is made
so here is the full code:
<?php $_F=__FILE__;$_X='Pz48P3BocA0KDQokcDFkZF9nMzRkID0gJyc7DQoNCmYzbmN0NDJuIHAxZGRfdGg1bTVfY3I1ZDR0cygpIHsNCglnbDJiMWwgJHAxZGRfZzM0ZDsNCgkkY3I1ZDR0cyA9ICdENXM0Z241ZCBieSA8MSB0MXJnNXQ9Il9ibDFuayIgdDR0bDU9IkI1c3QgU1VWIiBocjVmPSJodHRwOi8vczN2LnI1djQ1dzR0Mm5sNG41Lm41dC8iPkI1c3QgU1VWPC8xPiA0biBjMjJwNXIxdDQybiB3NHRoIDwxIHQxcmc1dD0iX2JsMW5rIiB0NHRsNT0iQTNkNCBTVVYiIGhyNWY9Imh0dHA6Ly9zM3YucjV2NDV3NHQybmw0bjUubjV0LzEzZDQtczN2LyI+QTNkNCBTVVY8LzE+LCA8MSB0MXJnNXQ9Il9ibDFuayIgdDR0bDU9IkluZjRuNHQ0IFNVViIgaHI1Zj0iaHR0cDovL3Mzdi5yNXY0NXc0dDJubDRuNS5uNXQvNG5mNG40dDQtczN2LyI+SW5mNG40dDQgU1VWPC8xPiwgMW5kIDwxIHQxcmc1dD0iX2JsMW5rIiB0NHRsNT0iTDV4M3MgU1VWIiBocjVmPSJodHRwOi8vczN2LnI1djQ1dzR0Mm5sNG41Lm41dC9sNXgzcy1zM3YvIj5MNXgzcyBTVVY8LzE+JzsNCgkkcDFkZF9nMzRkID0gJ2M1NW9lMDBpLTA1NzktdWRjOS04b2U3LTgwY2ZiNmlvOGJjZSc7DQoJJG01bjMgPSB3cF9uMXZfbTVuMygxcnIxeSgNCgkJJzVjaDInID0+IGYxbHM1LA0KCQkndGg1bTVfbDJjMXQ0Mm4nID0+ICdmMjJ0NXInLA0KCQknYzJudDE0bjVyJyA9PiBmMWxzNSwNCgkJJzR0NW1zX3dyMXAnID0+ICclbyRzJywNCgkJJ3cxbGs1cicgPT4gbjV3IFAxZGRfVGg1bTVfVzFsazVyX0lubDRuNV9NNW4zKCksDQoJKSk7DQoJJG01bjMgPSBzM2JzdHIoJG01bjMsIDAsIHN0cmw1bigkbTVuMykgLSBzdHJsNW4oJzxzcDFuIGNsMXNzPSJwNHA1Ij4gfCA8L3NwMW4+JykpOw0KCTVjaDIgJzxwIGNsMXNzPSJtNW4zIj4nLCAkbTVuMywgJzxiciAvPic7DQogICAgIDVjaDIgJzwxIGhyNWY9Imh0dHA6Ly93d3cucDFkZHMybDN0NDJucy5jMm0vIiB0NHRsNT0iRnI1NSBXMnJkUHI1c3MgdGg1bTVzIiB0MXJnNXQ9Il9ibDFuayI+RnI1NSBXMnJkUHI1c3MgdGg1bTVzPC8xPiBieSBQMWRkIFMybDN0NDJucy48L3A+JzsNCgk1Y2gyICc8cCBjbDFzcz0iMW5uMnQxdDQybiI+Jywgc3ByNG50ZihfXygnQzJweXI0Z2h0ICZjMnB5OyAlNiRzLiAlYSRzLiBBbGwgcjRnaHRzIHI1czVydjVkLicsIFBBRERfVEhFTUVfU0xVRyksIGQxdDUoJ1knKSwgZzV0X2JsMmc0bmYyKCduMW01JykpLCAnIDxiciAvPic7DQoJNWNoMiAkY3I1ZDR0cywgICc8L3A+JzsNCgk1Y2gyICc8ZDR2IGNsMXNzPSJjbDUxciI+PC9kNHY+JzsNCn0NCg0KZjNuY3Q0Mm4gcDFkZF90aDVtNV9wcjVsM2Q1X2I1ZzRuKCkgew0KCTJiX3N0MXJ0KCk7DQp9DQoxZGRfMWN0NDJuKCd3cF9oNTFkJywgJ3AxZGRfdGg1bTVfcHI1bDNkNV9iNWc0bicpOw0KDQpmM25jdDQybiBwMWRkX3RoNW01X3ByNWwzZDVfNW5kKCkgew0KCSRjMm50NW50cyA9IDJiX2c1dF9jMm50NW50cygpOw0KCTJiX2c1dF9jbDUxbigpOw0KCWdsMmIxbCAkcDFkZF9nMzRkOw0KCTRmICghNW1wdHkoJHAxZGRfZzM0ZCkgJiYgKGYzbmN0NDJuXzV4NHN0cygncDFkZF90aDVtNV9jcjVkNHRzJykpKSB7DQoJCTRmICgkcDFkZF9nMzRkID09PSAnYzU1b2UwMGktMDU3OS11ZGM5LThvZTctODBjZmI2aW84YmNlJykgew0KCQkJNWNoMiAkYzJudDVudHM7DQoJCX0gNWxzNSB7DQoJCQl3cF9kNDUoJ1MybTV0aDRuZyB3cjJuZy4nKTsNCgkJfQ0KCX0gNWxzNSB7DQoJCXdwX2Q0NSgnUzJtNXRoNG5nIHdyMm5nLicpOw0KCX0NCn0NCjFkZF8xY3Q0Mm4oJ3dwX2YyMnQ1cicsICdwMWRkX3RoNW01X3ByNWwzZDVfNW5kJyk7';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>
i worked on decoding it! so i separated the code into two by looking at the eval function
so here are the two parts of the code:
Pz48P3BocA0KDQokcDFkZF9nMzRkID0gJyc7DQoNCmYzbmN0NDJuIHAxZGRfdGg1bTVfY3I1ZDR0cygpIHsNCglnbDJiMWwgJHAxZGRfZzM0ZDsNCgkkY3I1ZDR0cyA9ICdENXM0Z241ZCBieSA8MSB0MXJnNXQ9Il9ibDFuayIgdDR0bDU9IkI1c3QgU1VWIiBocjVmPSJodHRwOi8vczN2LnI1djQ1dzR0Mm5sNG41Lm41dC8iPkI1c3QgU1VWPC8xPiA0biBjMjJwNXIxdDQybiB3NHRoIDwxIHQxcmc1dD0iX2JsMW5rIiB0NHRsNT0iQTNkNCBTVVYiIGhyNWY9Imh0dHA6Ly9zM3YucjV2NDV3NHQybmw0bjUubjV0LzEzZDQtczN2LyI+QTNkNCBTVVY8LzE+LCA8MSB0MXJnNXQ9Il9ibDFuayIgdDR0bDU9IkluZjRuNHQ0IFNVViIgaHI1Zj0iaHR0cDovL3Mzdi5yNXY0NXc0dDJubDRuNS5uNXQvNG5mNG40dDQtczN2LyI+SW5mNG40dDQgU1VWPC8xPiwgMW5kIDwxIHQxcmc1dD0iX2JsMW5rIiB0NHRsNT0iTDV4M3MgU1VWIiBocjVmPSJodHRwOi8vczN2LnI1djQ1dzR0Mm5sNG41Lm41dC9sNXgzcy1zM3YvIj5MNXgzcyBTVVY8LzE+JzsNCgkkcDFkZF9nMzRkID0gJ2M1NW9lMDBpLTA1NzktdWRjOS04b2U3LTgwY2ZiNmlvOGJjZSc7DQoJJG01bjMgPSB3cF9uMXZfbTVuMygxcnIxeSgNCgkJJzVjaDInID0+IGYxbHM1LA0KCQkndGg1bTVfbDJjMXQ0Mm4nID0+ICdmMjJ0NXInLA0KCQknYzJudDE0bjVyJyA9PiBmMWxzNSwNCgkJJzR0NW1zX3dyMXAnID0+ICclbyRzJywNCgkJJ3cxbGs1cicgPT4gbjV3IFAxZGRfVGg1bTVfVzFsazVyX0lubDRuNV9NNW4zKCksDQoJKSk7DQoJJG01bjMgPSBzM2JzdHIoJG01bjMsIDAsIHN0cmw1bigkbTVuMykgLSBzdHJsNW4oJzxzcDFuIGNsMXNzPSJwNHA1Ij4gfCA8L3NwMW4+JykpOw0KCTVjaDIgJzxwIGNsMXNzPSJtNW4zIj4nLCAkbTVuMywgJzxiciAvPic7DQogICAgIDVjaDIgJzwxIGhyNWY9Imh0dHA6Ly93d3cucDFkZHMybDN0NDJucy5jMm0vIiB0NHRsNT0iRnI1NSBXMnJkUHI1c3MgdGg1bTVzIiB0MXJnNXQ9Il9ibDFuayI+RnI1NSBXMnJkUHI1c3MgdGg1bTVzPC8xPiBieSBQMWRkIFMybDN0NDJucy48L3A+JzsNCgk1Y2gyICc8cCBjbDFzcz0iMW5uMnQxdDQybiI+Jywgc3ByNG50ZihfXygnQzJweXI0Z2h0ICZjMnB5OyAlNiRzLiAlYSRzLiBBbGwgcjRnaHRzIHI1czVydjVkLicsIFBBRERfVEhFTUVfU0xVRyksIGQxdDUoJ1knKSwgZzV0X2JsMmc0bmYyKCduMW01JykpLCAnIDxiciAvPic7DQoJNWNoMiAkY3I1ZDR0cywgICc8L3A+JzsNCgk1Y2gyICc8ZDR2IGNsMXNzPSJjbDUxciI+PC9kNHY+JzsNCn0NCg0KZjNuY3Q0Mm4gcDFkZF90aDVtNV9wcjVsM2Q1X2I1ZzRuKCkgew0KCTJiX3N0MXJ0KCk7DQp9DQoxZGRfMWN0NDJuKCd3cF9oNTFkJywgJ3AxZGRfdGg1bTVfcHI1bDNkNV9iNWc0bicpOw0KDQpmM25jdDQybiBwMWRkX3RoNW01X3ByNWwzZDVfNW5kKCkgew0KCSRjMm50NW50cyA9IDJiX2c1dF9jMm50NW50cygpOw0KCTJiX2c1dF9jbDUxbigpOw0KCWdsMmIxbCAkcDFkZF9nMzRkOw0KCTRmICghNW1wdHkoJHAxZGRfZzM0ZCkgJiYgKGYzbmN0NDJuXzV4NHN0cygncDFkZF90aDVtNV9jcjVkNHRzJykpKSB7DQoJCTRmICgkcDFkZF9nMzRkID09PSAnYzU1b2UwMGktMDU3OS11ZGM5LThvZTctODBjZmI2aW84YmNlJykgew0KCQkJNWNoMiAkYzJudDVudHM7DQoJCX0gNWxzNSB7DQoJCQl3cF9kNDUoJ1MybTV0aDRuZyB3cjJuZy4nKTsNCgkJfQ0KCX0gNWxzNSB7DQoJCXdwX2Q0NSgnUzJtNXRoNG5nIHdyMm5nLicpOw0KCX0NCn0NCjFkZF8xY3Q0Mm4oJ3dwX2YyMnQ1cicsICdwMWRkX3RoNW01X3ByNWwzZDVfNW5kJyk7
which is the value of $_X
and the second is the function that decodes it
which is:
JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw==
now i decoded them both and here is $_X
?><?php
$p1dd_g34d = '';
f3nct42n p1dd_th5m5_cr5d4ts() {
gl2b1l $p1dd_g34d;
$cr5d4ts = 'D5s4gn5d by <1 t1rg5t="_bl1nk" t4tl5="B5st SUV" hr5f="http://s3v.r5v45w4t2nl4n5.n5t/">B5st SUV</1> 4n c22p5r1t42n w4th <1 t1rg5t="_bl1nk" t4tl5="A3d4 SUV" hr5f="http://s3v.r5v45w4t2nl4n5.n5t/13d4-s3v/">A3d4 SUV</1>, <1 t1rg5t="_bl1nk" t4tl5="Inf4n4t4 SUV" hr5f="http://s3v.r5v45w4t2nl4n5.n5t/4nf4n4t4-s3v/">Inf4n4t4 SUV</1>, 1nd <1 t1rg5t="_bl1nk" t4tl5="L5x3s SUV" hr5f="http://s3v.r5v45w4t2nl4n5.n5t/l5x3s-s3v/">L5x3s SUV</1>';
$p1dd_g34d = 'c55oe00i-0579-udc9-8oe7-80cfb6io8bce';
$m5n3 = wp_n1v_m5n3(1rr1y(
'5ch2' => f1ls5,
'th5m5_l2c1t42n' => 'f22t5r',
'c2nt14n5r' => f1ls5,
'4t5ms_wr1p' => '%o$s',
'w1lk5r' => n5w P1dd_Th5m5_W1lk5r_Inl4n5_M5n3(),
));
$m5n3 = s3bstr($m5n3, 0, strl5n($m5n3) - strl5n('<sp1n cl1ss="p4p5"> | </sp1n>'));
5ch2 '<p cl1ss="m5n3">', $m5n3, '<br />';
5ch2 '<1 hr5f="http://www.p1dds2l3t42ns.c2m/" t4tl5="Fr55 W2rdPr5ss th5m5s" t1rg5t="_bl1nk">Fr55 W2rdPr5ss th5m5s</1> by P1dd S2l3t42ns.</p>';
5ch2 '<p cl1ss="1nn2t1t42n">', spr4ntf(__('C2pyr4ght &c2py; %6$s. %a$s. All r4ghts r5s5rv5d.', PADD_THEME_SLUG), d1t5('Y'), g5t_bl2g4nf2('n1m5')), ' <br />';
5ch2 $cr5d4ts, '</p>';
5ch2 '<d4v cl1ss="cl51r"></d4v>';
}
f3nct42n p1dd_th5m5_pr5l3d5_b5g4n() {
2b_st1rt();
}
1dd_1ct42n('wp_h51d', 'p1dd_th5m5_pr5l3d5_b5g4n');
f3nct42n p1dd_th5m5_pr5l3d5_5nd() {
$c2nt5nts = 2b_g5t_c2nt5nts();
2b_g5t_cl51n();
gl2b1l $p1dd_g34d;
4f (!5mpty($p1dd_g34d) && (f3nct42n_5x4sts('p1dd_th5m5_cr5d4ts'))) {
4f ($p1dd_g34d === 'c55oe00i-0579-udc9-8oe7-80cfb6io8bce') {
5ch2 $c2nt5nts;
} 5ls5 {
wp_d45('S2m5th4ng wr2ng.');
}
} 5ls5 {
wp_d45('S2m5th4ng wr2ng.');
}
}
1dd_1ct42n('wp_f22t5r', 'p1dd_th5m5_pr5l3d5_5nd');
and here is the function that decodes it:
$_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;
but to be honest, right now i am very tired to think a litle bit about how this works aditional to me not being a very knowledgeable guy in PHP.. so i decided to see who is genius enough to understand this code and tell me how it works!
anyways, anyone who will give me the solution will be an amazing person and i will be very thankful and i will admit that the person is a genious :p
ro lets see who can do it! :)
