decoding a eval(base64_decode

[bradgrafelman]

Basically, what I do is first just echo the base64_decode'd version of the first hash so that I can visually inspect it. AFAIK, unless there's some buffer overflow lurking out there, there's no harm in simply viewing the decoded hash.

Once I can see it, I can replace eva( with echo(, or do whatever I need to display the second/third/fourth/etc. layer (instead of eval()uating it).

Without a doubt, never eval() a code straight away - always echo it first so you can visually inspect it. If something looks fishy... play it safe and don't eval() it :p

RedneckExorcist wrote:

So can someone help me decrypt it?

That's what we've been doing.

Change the eval() to echo() so you can see the first layer. You'll notice that inside the decoded string, there is yet another eval() call. So, store this first decoded layer into a variable. Then, use [man]str_replace[/man] to replace 'eval(' with 'echo(' so that the second layer of decoded code is displayed instead of evaluated (your code only goes through 2 layers of base64 encoding).

[Kudose]

Laserlight, that's what I figured but just needed some reassurance.

Redneck, this is what it comes out to:

$codelock_code="Pz48P3BocA0Ka!jbHVkZSgibmVlZGVkLnBocCIpOw0KDQppZigkcCA9PSAiTG9naW4iKSB7DQpjaGVja0xvZ2luKCR1c2VyLCAkcHdvcmQpOw0KfQ0KDQokcXVlcnkgPSAiU0VMRUNUICogRlJPTSBsb2dnZWRpbiBXSEVSRSBpcG51bSA9ICckaXAnIjsNCiRyZXN1bHQgPSBAbXlzcWxfcXVlcnkoJHF1ZXJ5KQ0KI*CBvciBkaWUobXlzcWxfZXJyb3IoKSk7DQokcm93ID0gbXlzcWxfZmV0Y2hfYXJyYXkoJHJlc3VsdCk7DQpAZXh0cmFjdCgkcm93KTsNCmlmKCRhdXRoaWQgPT0gInllcyIpIHsNCkBzZXNzaW9uX3N0YXJ0KCk7DQokX1NFU1NJT05bJ21lbWJlcm5hbWUnXSA9ICRuYW1lOw0KJF9TRVNTSU9OWydwYXNzJ10gPSAkcGFzczsNCg0KfQ0KDQpAc2Vzc2lvbl9zdGFydCgnbWVtYmVybmFtZScpOw0KQHNlc3Npb25fc3RhcnQoJ3Bhc3MnKTsNCg0KJHVzZXJpZCA9ICRtZW1iZXJuYW1lOw0KJHB3b3JkID0gJHBhc3M7DQoNCiRsb2dnZWRpbiA9ICIiOw0KDQokcXVlcnkgPSAiU0VMRUNUICogRlJPTSBtZW1iZXJzIFdIRVJFIHVzZXJuYW1lID0gJyR1c2VyaWQnIEFORCBwYXNzd29yZCA9ICckcHdvcmQnIjsNCiRyZXN1bHQgPSBteXNxbF9xdWVyeSgkcXVlcnkpDQogI*G9yIGRpZSgiQ291bGRuJ3QgRXhlY3V0ZSBRMjM0dWVyeSIpOw0KJHJvdyA9IG15c3FsX2ZldGNoX2FycmF5KCRyZXN1bHQpOw0KQGV4dHJhY3QoJHJvdyk7DQppZigkZGlzYWJsZSA9PSAiMCIpIHsNCmlmKCRhdXRoID09ICIxIikgew0KaWYoJHN0YXR1cyA9PSAiMSIpIHsNCiRudW1yY!rID0gJHJhbms7DQppZigkcmFuayA+PSAxMCkgew0KJGxvZ2dlZGluID0gInllcyI7DQoNCn19fX0NCg0KDQp0cmlhbERheXMoKTsNCmluY2x1ZGUoImluY2x1ZGUucGhwIik7DQoNCnNob3dEYXRlKCk7DQpzZ!kRW1haWwoKTsNCg0KDQppZigkcCA9PSAiIikgew0KaHBTdGF0cygpOw0KfQ0KDQppZigkcCA9PSAiQ2hhbmdlQ29sb3IiKSB7DQpDaGFuZ2VTaXRlQ29sb3IoJGNvbG9yKTsNCn0NCg0KDQppZigkcCA9PSAiV2ViYm90Iikgew0KZGlzcFdlYmJvdCgpOw0KfQ0KDQoNCmlmKCRwID09ICJDbGFuV2FycyIpIHsNCmRpc3BDbGFuV2FycygpOw0KfQ0KDQppZigkcCA9PSAiQ2xhbldhckluZm8iKSB7DQpkaXNwQ2xhbldhckluZm8oJGN3aWQpOw0KfQ0KDQoNCmlmKCRwID09ICJTaXRlUG9pbnRzIikgew0KZGlzcFNpdGVQb2ludHMoKTsNCn0NCg0KaWYoJHAgPT0gIlNjcmltVGVhbSIpIHsNCmRpc3BTY3JpbVRlYW0oKTsNCn0NCg0KaWYoJHAgPT0gIlNjcmltUHJvZmlsZSIpIHsNCmRpc3BTY3JpbVByb2ZpbGUoJHVzZXIpOw0KfQ0KDQppZigkcCA9PSAiTWVtYmVyUGljcyIpIHsNCmRpc3BNZW1iZXJQaWNzKCk7DQp9DQoNCmlmKCRwID09ICJWaWV3Q29tbWVudHMiKSB7DQpkaXNwQ29tbWVudHMoJG5ld3NudW0sICRzKTsNCn0NCmlmKCRwID09ICJDaGFsbGVuZ2VzIikgew0KZGlzcENoYWxsZ!nZSgpOw0KfQ0KLyoNCmlmKCRwID09ICJCbmV0U3RhdHMiKSB7DQpkaXNwQm5ldFN0YXRzKCk7DQp9DQoqLw0KaWYoJHAgPT0gIkdlbmVyYWxHcmFkZXMiKSB7DQpkaXNwR0coKTsNCn0NCg0KaWYoJHAgPT0gIk1lZGFsS!mbyIpIHsNCmRpc3BXaG9IYXNXaGF0TWVkYWwoJG0pOw0KfQ0KDQppZigkcCA9PSAiVHJpYWxMb2dpbiIpIHsNCmNoZWNrVHJpYWxMb2dpbigkdHJpYWxuYW1lLCAkdHJpYWxwYXNzKTsNCn0NCg0KaWYoJHAgPT0gIkRpcGxvbWFjeVJlcXVlc3QiKSB7DQpkaXBsb21hY3lSZXEoKTsNCn0NCg0KaWYoJHAgPT0gIk1lZGFsQ291bnQiKSB7DQptZWRhbENvd!0KCk7DQp9DQoNCmlmKCRwID09ICJUb3VybmV5U3RhZmYiKSB7DQpkaXNwVG91cm5leVN0YWZmKCk7DQp9DQoNCg0KaWYoJHAgPT0gIkRheXMiKSB7DQpkYXlzKCk7DQp9DQoNCmlmKCRwID09ICJOZXdzIikgew0KZGlzcE5ld3MoInB1YmxpYyIsICRudW1yY!rKTsNCn0NCg0KaWYoJHAgPT0gIkNoYXRCb2FyZCIpIHsNCmRpc3BOZXdzKGNoYXRib2FyZCwgJG51bXJhbmspOw0KfQ0KDQoNCmlmKCRwID09ICJQYXN0V2FycyIpIHsNCmRpc3BXYXJzKCk7DQp9DQoNCmlmKCRwID09ICJEb3dubG9hZCIpIHsNCmRpc3BEb3dubG9hZHMoJGRsKTsNCg0KfQ0KDQppZigkcCA9PSAiU211cmZOYW1lcyIpIHsNCmRpc3BTbXVyZnMoKTsNCn0NCg0KaWYoJHAgPT0gIklBUmVxdWVzdCIpIHsNCmRpc3BJQSgpOw0KfQ0KDQppZigkcCA9PSAiRm9ydW0iKSB7DQplY2hvICINCjx0YWJsZSBhbGlnbj0nY2VudGVyJyBib3JkZXI9JzAnIGNlbGxzcGFja!nPScwJyBjZWxscGFkZGluZz0nMCc+DQo8dHI+DQo8dGQgY2xhc3M9J21haW4nPjxiPjxhIGhyZWY9JyRmb3J1bXVybCcgdGFyZ2V0PSdfYmxhbmsnPkVudGVyIHRoZSBGb3J1bTwvYT48L3RkPjwvdHI+PC90YWJsZT4iOw0KfQ0KDQppZigkcCA9PSAiUHJvZmlsZSIpIHsNCm1lbWJlcnNPbmxpbmUoKTsNCiRpcGFkZHJlc3MgPSAiTG9nZ2VkIjsNCmRpc3BQcm9maWxlKCR1c2VyKTsNCg0KfQ0KDQppZigkcCA9PSAiTWVtYmVycyIgQU5EICRzb3J0ICE9ICIxIikgew0KaGlnaERTTCgpOw0KZGlzcE1lbWJlcnMoKTsNCn0NCg0KaWYoJHAgPT0gIk1lbWJlcnMiIEFORCAkc29ydCA9PSAiMSIpIHsNCmhpZ2hEU0woKTsNCnNvcnRNZW1iZXJzKCRzb3J0YnkpOw0KfQ0KDQoNCmlmKCRwID09ICJUcmlhbE1lbWJlcnMiKSB7DQpoaWdoRFNMKCk7DQpkaXNwVHJpYWxNZW1iZXJzKCRnKTsNCn0NCmlmKCRwID09ICJJQU1lbWJlcnMiKSB7DQpkaXNwSUFNZW1iZXJzKCk7DQp9DQoNCmlmKCRwID09ICJIYWxsb2ZGYW1lIikgew0KZGlzcEhhbGwoRmFtZSk7DQp9DQoNCmlmKCRwID09ICJIYWxsb2ZTaGFtZSIpIHsNCmRpc3BIYWxsKCJIYWxsb2ZTaGFtZSIpOw0KfQ0KDQppZigkcCA9PSAiSGVyb3MiKSB7DQpkaXNwSGFsbCgiSGVyb3MiKTsNCn0NCg0KaWYoJHAgPT0gIk1PTSIpIHsNCmRpc3BIYWxsKCJNT00iKTsNCn0NCg0KDQppZigkcCA9PSAiQ2xhbkxlZ2VuZHMiKSB7DQpkaXNwSGFsbCgiQ2xhbkxlZ2VuZHMiKTsNCn0NCg0KaWYoJHAgPT0gIlRvdXJuYW1lbnRzIikgew0KZGlzcFRvdXJueSgpOw0KfQ0KDQppZigkcCA9PSAiVG91cm5leUluZm8iKSB7DQpkaXNwVG91cm55S!mbygkaWRudW0pOw0KfQ0KDQppZigkcCA9PSAiU3F1YWRzIikgew0KZGlzcFNxdWFkcygpOw0KfQ0KDQppZigkcCA9PSAiU3F1YWRJbmZvIikgew0KZGlzcFNxdWFkS!mbygkc3F1YWQpOw0KfQ0KDQppZigkcCA9PSAiTWVkYWxzIikgew0KZGlzcE1lZGFscygpOw0KfQ0KDQppZigkcCA9PSAiUmFua3MiKSB7DQpkaXNwUmFua3MoKTsNCn0NCmlmKCRwID09ICJSdWxlcyIpIHsNCmRpc3BSdWxlcygpOw0KfQ0KDQppZigkcCA9PSAiTG9zdFBhc3N3b3JkIikgew0KbG9zdFBhc3N3b3JkKCk7DQp9DQoNCmlmKCRwID09ICJEaXBsb21hY3kiKSB7DQpkaXNwRGlwbG9tYWN5KCk7DQp9DQppZigkcCA9PSAiRGlwbG9tYWN5S!mbyIpIHsNCmRpcGxvbWFjeUluZm8oJGNsY!pZCk7DQp9DQoNCmlmKCRwID09ICJUb3BNZW1iZXJzIikgew0KdG9wTWVtYmVycygkdG9wKTsNCn0NCg0KaWYoJHAgPT0gIkhpc3RvcnkiKSB7DQpkaXNwSGlzdG9yeSgpOw0KfQ0KDQppZigkcCA9PSAiU2VhcmNoIikgew0Kc2VhcmNoKCRib3gpOw0KfQ0KDQppZigkcCA9PSAiQ2FsZ!kZXIiKSB7DQpkaXNwQ2FsZ!kZXIoJG0sICR5KTsNCn0NCg0KaWYoJHAgPT0gIkNhbGVuZGVyRXZlbnQiKSB7DQpkaXNwQ2FsZ!kZXJFdmVudHMoJGQsICRtLCAkeSk7DQp9DQoNCmlmKCRwID09ICJVVGhlaWYiKSB7DQpraWxsU2l0ZSgpOw0KfQ0KDQoNCmNvcHlyaWdodCgpOw0Ka!jbHVkZSgiYm90dG9tLmh0bWwiKTsNCg0KDQo/Pjw/UEhQIA=="; $codelock_code=str_replace("@","CAg", $codelock_code); $codelock_code=str_replace("!", "W5", $codelock_code); $codelock_code=str_replace("*", "CAgI", $codelock_code); $codelock_code=base64_decode($codelock_code); eval($codelock_code);

Which turns into:

?><?php
include("needed.php");

if($p == "Login") {
checkLogin($user, $pword);
}

$query = "SELECT * FROM loggedin WHERE ipnum = '$ip'";
$result = @mysql_query($query)
     or die(mysql_error());
$row = mysql_fetch_array($result);
@extract($row);
if($authid == "yes") {
@session_start();
$_SESSION['membername'] = $name;
$_SESSION['pass'] = $pass;

}

@session_start('membername');
@session_start('pass');

$userid = $membername;
$pword = $pass;

$loggedin = "";

$query = "SELECT * FROM members WHERE username = '$userid' AND password = '$pword'";
$result = mysql_query($query)
     or die("Couldn't Execute Q234uery");
$row = mysql_fetch_array($result);
@extract($row);
if($disable == "0") {
if($auth == "1") {
if($status == "1") {
$numrank = $rank;
if($rank >= 10) {
$loggedin = "yes";

}}}}


trialDays();
include("include.php");

showDate();
sendEmail();


if($p == "") {
hpStats();
}

if($p == "ChangeColor") {
ChangeSiteColor($color);
}


if($p == "Webbot") {
dispWebbot();
}


if($p == "ClanWars") {
dispClanWars();
}

if($p == "ClanWarInfo") {
dispClanWarInfo($cwid);
}


if($p == "SitePoints") {
dispSitePoints();
}

if($p == "ScrimTeam") {
dispScrimTeam();
}

if($p == "ScrimProfile") {
dispScrimProfile($user);
}

if($p == "MemberPics") {
dispMemberPics();
}

if($p == "ViewComments") {
dispComments($newsnum, $s);
}
if($p == "Challenges") {
dispChallenge();
}
/*
if($p == "BnetStats") {
dispBnetStats();
}
*/
if($p == "GeneralGrades") {
dispGG();
}

if($p == "MedalInfo") {
dispWhoHasWhatMedal($m);
}

if($p == "TrialLogin") {
checkTrialLogin($trialname, $trialpass);
}

if($p == "DiplomacyRequest") {
diplomacyReq();
}

if($p == "MedalCount") {
medalCount();
}

if($p == "TourneyStaff") {
dispTourneyStaff();
}


if($p == "Days") {
days();
}

if($p == "News") {
dispNews("public", $numrank);
}

if($p == "ChatBoard") {
dispNews(chatboard, $numrank);
}


if($p == "PastWars") {
dispWars();
}

if($p == "Download") {
dispDownloads($dl);

}

if($p == "SmurfNames") {
dispSmurfs();
}

if($p == "IARequest") {
dispIA();
}

if($p == "Forum") {
echo "
<table align='center' border='0' cellspacing='0' cellpadding='0'>
<tr>
<td class='main'><b><a href='$forumurl' target='_blank'>Enter the Forum</a></td></tr></table>";
}

if($p == "Profile") {
membersOnline();
$ipaddress = "Logged";
dispProfile($user);

}

if($p == "Members" AND $sort != "1") {
highDSL();
dispMembers();
}

if($p == "Members" AND $sort == "1") {
highDSL();
sortMembers($sortby);
}


if($p == "TrialMembers") {
highDSL();
dispTrialMembers($g);
}
if($p == "IAMembers") {
dispIAMembers();
}

if($p == "HallofFame") {
dispHall(Fame);
}

if($p == "HallofShame") {
dispHall("HallofShame");
}

if($p == "Heros") {
dispHall("Heros");
}

if($p == "MOM") {
dispHall("MOM");
}


if($p == "ClanLegends") {
dispHall("ClanLegends");
}

if($p == "Tournaments") {
dispTourny();
}

if($p == "TourneyInfo") {
dispTournyInfo($idnum);
}

if($p == "Squads") {
dispSquads();
}

if($p == "SquadInfo") {
dispSquadInfo($squad);
}

if($p == "Medals") {
dispMedals();
}

if($p == "Ranks") {
dispRanks();
}
if($p == "Rules") {
dispRules();
}

if($p == "LostPassword") {
lostPassword();
}

if($p == "Diplomacy") {
dispDiplomacy();
}
if($p == "DiplomacyInfo") {
diplomacyInfo($clanid);
}

if($p == "TopMembers") {
topMembers($top);
}

if($p == "History") {
dispHistory();
}

if($p == "Search") {
search($box);
}

if($p == "Calender") {
dispCalender($m, $y);
}

if($p == "CalenderEvent") {
dispCalenderEvents($d, $m, $y);
}

if($p == "UTheif") {
killSite();
}


copyright();
include("bottom.html");


?><?PHP  

[Kudose]

Brad: Thanks for your post too. I made mine while you were posting.

[etully]

So can someone help me decrypt it?

Quit being lazy. Learn to use the print statement.

[Weedpacket]

This is starting to look like a pretty effective encryption technique :evilgrin:

eval(gzuncompress(base64_decode("
eJwNlEUO7FgCwO7Sq9/KIi+cqFdhrHCFNqMKM/Pp5x/BluXi/PV/qvcYs2mY12Lb/qS/rSDx/+VF
NuXFn38K7TJ7oThGdmJZC26eOpYKR0qMrSISYjrjT0fUjA0j9MW58zS/qw9HKaYMIiycXJoy7W7s
kC7AZbbTR5/CNhHoWulmFKmBOzJD0xHmoIJIeYw6nbEGkYx8qzP77kCX5UcZpsTl095VjlKPLjoz
Tm5NH+FNMoVyvb5++I7T1dWzqePLTfOGayx2VWCTuYGiFX2Jwry6o0l/ImXbJVmVhoQbJz9GoitU
8s+OUreXBE1nn98ombTRC7Q+c9XE4nZkURDwldGX4533yDqPlD/4wdDEvtgrZqmIP/EgUW4VyG5z
2qqnL+iZ+96jHzv4uA4E6OmBcIBsD0jg2FxnAW84NIbx0PyhkvQF+2HdGwFfdTVYokEzC84ZIgmF
K3DbWY5/0qcHezeud5mYMPfW7FR92RlR9jPPXxZ94FBnhITUx7p7TBmtL3mnQFhTs5kbGqNXZCRs
hbbb2Rt+ry8DGi3ygbhP7FeS+/CEkeaMayVAR/PEakFZe39PzWhoViv5quo7DfdFnpzsjBh7fhBG
9HhlmnOW71XrOJAG49jxF/3l8JkCATJDcLOH1GcVb0mP3rx71jaIfvM1f803Ik6V4vF67N8gRnWC
Y+Zkr3iGjTJII6bGQDw82TuzGnBxypv1bKFyQ9MUNl6K9zEUsKvadmR76igV3NFPGu991tlOcIq0
dhpEu1nSfrR+AJSmu8zpQ+pu/EKPzeZRLX5F36JKElmKFaGuZ6D2iwPz4jtixzjtVxysDrV1YZtC
X+SOMmaLcOzSSkUmRWc1vp/anUmXQOc38fGUuZX10rzYPrJKyMmsRRKFCOpTvY2dwXplTHTd3lUr
HcYZyFzIA2eSBUFNgTeOLOR747mtOsPcGplH3ttmyhiKeRZB6EF2mooioJ+jJ7IMfZ1plGi4EU5n
36Gmu8Yqe06spa2+qp7e8nHyA8wuRYE51Vy6cof1874rqKV1IFhklqvO7omAELzPGlYuJzdqpFMc
81cE+gJpCWwGTO1WC/gjM0pfVL+GeWbP2sm6fhhtJ2aqybTmau5Ee/4qxDKan3opV+U8qdfS/Llz
0yjY1ITXbEx3DPE8v1w0F+YdkaoDewXbIHM958W0nMHj9QFX0zqNKr9ZIWOYBdZQwa0V8VVURZcy
wMY4/+K2of4Mq7frTFChNr/h5AxSGUmvKOTsl70VGsAt1p1xFoL+IbAVwognGAtJ+jsC1XieOANB
YbQr+M4CGYVSMRSoyiDD84pkfF0kXDe3nXPLyRKLvRXDUJ8v1ogRQlD7KTTmpcmKUxzNfMCgJalP
WCMPElNjEGZGC3+LfgclQU2HZ+w2HNjRWyCEgtofUfRoQVUeg5knyLtQdeqKjZOqTYm4Uogy+sxT
73bnZa5oEkDzK+o4bpP1BpY1DubVfDb9S3img4Nk3aq3CDR0ztNZMja5ruqPDqOYng5QW1ETzgWx
AU132ponzHhcnt03PeoQiBXXVx/nGTlzVQlxXBhp62FO4WO8VQNZG0HJesW56bp9XxKSLo72lt67
3LOQH9XqYP3VJD0930ZJnj83yVQnffB5z2jrS/04ZMVmfAP4fROrVwSxUDLJtBd46WCczfHhVzH5
obbFTrTEGSVtFBUq9Rg0VX5sqhg+jv0GsllhF+cYue9gVyHJne8ffEBbYNPFL7uLmI5aGqU1Cv2b
0HCXg5WBb7PlUkqeS65dI8jWu7C21IGHUxZER9VrPh5cCg46K5i5MClVEft4qv8bBZKpqec0Kuxv
AdtzRAfGuprNifVj0n8bRMHooefudmRkVx4jeBFZ+vvwUQLGD4enWqSWbj5Djf7Cw0DCsumHiEBE
3n+jhkAqZujDp8xm3mhdJ/l9WzyJ1koxV4cp5KtcRiHHzHOoR3lyvj4/bDDz6SqdvcapHaeNAHtW
+T6zayb9K6HHlatKY8WPsz0i+r1hCqOYorQxGIIruqpGlvrn33///e//xhWSuQ==
")));

[bradgrafelman]

Why stop at 20, Weedpacket? :p

[madwormer2]

Surely this all puts unnecessary load on the server?

[bradgrafelman]

I'm sure at some point it becomes noticable, but keep in mind that other (more secure) techniques (e.g. Zend Encoder) have to decode their encoded data, too.

[EWord]

Hello,

i'm a total newbie when it comes to php and base64. But i have a problem cause im thinking that a file on my server is sending informations. Can someone explain me how i can decode a base64 encrpyted php file? I think its encrypted more than once cause everytime i try it, i just get binary code output.

Starts like this

eval(gzinflate(base64_decode('FZrHDqtauoRfpWd9rhiQkzockXPOTFrkDCaDn/

TIA
Saskia

[fcc]

I have this attached file can you help me decode it?
I tried with this decrypt.txt in php but I did not manage it.

Thanks Kind Regards
Franco

[Horizon88]

You do realize the last post in this thread is from JUNE, correct?
Coded.txt, once you look at the code in a bit better formatting, you see it does this:
sets $F equal to the name of itself (the file)
sets $X to an encrypted string
decodes and evaluates:

JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='

I would assume that code would then, once decoded and evaluated, act on decoding and evaluating those two variables. Also, your decript.php uses gzinflate, not base64_decode, which is what your encoding in coded.txt is.

Sooooo.... go back and read the rest of this thread (not the manual), and see how they break down the base64 encoding, in the first couple of posts. Then, implement THAT on the SECOND encoding in your file. Then you can figure out what it does to the first encoding, and decode that.

Just don't hurt yourself :/ If I have more time in a bit I'll decode it for you

Edit: Okay, done with supper.
That second encoding evaluates out to this:

$_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;

$_X then decodes to this:

?>v1r l4nks = n5w Arr1y(); $t4m5n2w ORDER BY 4d ASC") 2r d45(mysql_5rr2r()); $p55l_1d_c23nt = mysql_r5s3lt(mysql_q35ry("SELECT COUNT(*) 1s N3m FROM 1dp55l5rs WHERE st1t3s = 6 AND 5xp4r5 > $t4m5n2w"),0); 4f($1ff4l41t54d!="") { $p55l_1d_c23nt = $p55l_1d_c23nt+6; $c23nt5r6 = 6; pr4nt "l4nks[6] = 5sc1p5('http://www.1dp55l5rs.c2m/2ff5r-".$1ff4l41t54d."-6i8eo-6.html');"; } 5ls5 { $c23nt5r6 = 0; } wh4l5 ($r2wpd = mysql_f5tch_1rr1y($p55l_d1t1)) { ++$c23nt5r6; pr4nt "l4nks[".$c23nt5r6."] = 5sc1p5('".$r2wpd['l4nk']."');"; pr4nt "\n"; } ?> v1r b4g_4m1g5s = n5w Arr1y(); 

Which then seems to evaluate out to:

?>var links = new Array(); $timenow ORDER BY id ASC") or die(mysql_error()); $peel_ad_count = mysql_result(mysql_query("SELECT COUNT(*) as Num FROM adpeelers WHERE status = 1 AND expire > $timenow"),0); if($affiliateid!="") { $peel_ad_count = $peel_ad_count+1; $counter1 = 1; print "links[1] = escape('http://www.adpeelers.com/offer-".$affiliateid."-15863-1.html');"; } else { $counter1 = 0; } while ($rowpd = mysql_fetch_array($peel_data)) { ++$counter1; print "links[".$counter1."] = escape('".$rowpd['link']."');"; print "\n"; } ?> var big_images = new Array();

Then, I'm not sure about this next bit, but it looks like it tries to replace any references to FILE in the original evaluated code with the actual filename it's running from, then executes that code.

Looks like it's an ad loading script?

[fcc]

Thanks very much Horizon88
yes it is an ad code. I purchased this ad script and I want to see if I can change the image sizes.
I hope I can end up with a working PHP file
Thanks again
Franco

[alifaan]

Can some 1 help me to decode this

<? eval(gzinflate(base64_decode('
bZCxisMwEERrG/wPgz8g6o2iwDV3XZpAajla24tt
SScpEQf5+MjxlRm2WGbYB7MnVRVBGn6AzbEdnEsU
WtXUKCO9gqHIoyWD/q+D1JgCDcd2Ssl3QuScD6ue
6ffOt/lwc2urznZhS7hSHzkRvu68GApSaAVtzWdE
pn5yMbEdR6I57qBCwM/uYjv/3iI8oR+aF90vhCEQ
QacOF+c/YZPz2aeJVvpH4uqC8YFixOVtb1wpSsum
lqL8oPRu6qrad7xVktML
'))); ?>

Thanks...

[alifaan]

Can some 1 help me to decode this

<? eval(gzinflate(base64_decode('
bZCxisMwEERrG/wPgz8g6o2iwDV3XZpAajla24tt
SScpEQf5+MjxlRm2WGbYB7MnVRVBGn6AzbEdnEsU
WtXUKCO9gqHIoyWD/q+D1JgCDcd2Ssl3QuScD6ue
6ffOt/lwc2urznZhS7hSHzkRvu68GApSaAVtzWdE
pn5yMbEdR6I57qBCwM/uYjv/3iI8oR+aF90vhCEQ
QacOF+c/YZPz2aeJVvpH4uqC8YFixOVtb1wpSsum
lqL8oPRu6qrad7xVktML
'))); ?>

Thanks

[bradgrafelman]

This thread is full of discussion and code snippets suggesting methods of decoding the encrypted text (ex. changing eval() to echo()); I would recommend you re-read the thread.

In fact, if you'd read the thread, you probably would already have your answer by now instead of waiting on someone else to do it for you.

[Horizon88]

Could you lock this or something, brad? People keep coming in and just adding their questions onto the end without actually doing anything. :/

[bradgrafelman]

Actually, I agree;

If you have found this thread because you're looking to decode some base64 encoded PHP script, I highly recommend you:

• Read this thread (especially the beginning, when the problem was presented and people offered suggestions)

• Realize that this pubilc forum is not here to break others' security measures (albeit quite weak) who felt that they needed to obfuscate their code for whatever reason

If you honestly have a question that pertains with base64_encode() or _decode(), please create a new thread with your problem! I'm definitely not discouraging anyone with a legitimate question involving base64 encoding.

Otherwise, this thread is being locked from further replies. If Parabola, the thread creator, wishes to reopen to this thread, please PM either myself or one of the other mods with a link to this thread and it will be re-opened.