Help in understanding how to decode

[jamberry]

I have searched and read all the posts about decoding eval(base64_decode( but I am still confused how to go about it. 😕

I am not asking anyone to decode for me, I just need someone to help me understand each step I need to take to successfully decode in this situation. Like what documentation I could read to help, what to look for and change in the code, etc.

Following is an example of the code I'm up against. This one is for the header of my website. I just want to simply tweak the design/layout of a few things in this file and a few others.

Any help is greatly appreciated!

<?php $OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=8004;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJ0VudGVyeW91d2toUkhZS05XT1VUQWFCYkNjRGRGZkdnSWlKakxsTW1QcFFxU3NWdlh4WnowMTIzNDU2Nzg5Ky89JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
kr9NHenNHenNHe1lFMamb3klFoxiC2APk19gOLlHOa9gkZXJkZwVkr9NTznNHr8XHt4JkZwShokiF2A2Yy9LcBYvcoAPF3OZfuwPcmklCBWPkr8XHenNHr8XHtXLT08XHr8XHeEXhUXmOB50cbk5d3a3D2iUUylRTlfNaaOnCAkJW2YrcrcMO2fkDApQToxYdanXAbyTF1c2BuiDGjExHjH0YTC3KeLqRz0mRtfnWLYrOAcuUrlhU0xYTL9WAakTayaBa1icBMyJC2OlcMfPDBpqdo1Vd3nxFmY0fbc3Gul6HerZHzW1YjF4KUSvkZLphUL7cMYSd3YlhtONHeEXTznNHeEpK2a2CBXPkr9NHenNHenNHtL7cBYPdZEmeWP8F2YZDbn0woxidMf1CBflNUkhCbciA2YZDbn0wJn0GbnlNUk0cbi0R0pifMyTC3kpFuWJNI0hNtrsRW0hcmaVC3Opd24ITA1gFukldo9icrlsCBflFZIpwuSIRZ92HZ4XeWPIwuciFJnLNBOvC3ascB50KZnpcJiLRMlsCBflFZl7wolMhtyLRL1Yb3EpwoWVTA1gFe1VcbFIWbkZCbLPhTSYtJEIwtn2CbwIDUxQNBWVTA1gFt5ScB5mfoISCT1YTa9XFMaSd2yLUB1ic2azRMyZc3ascB50FzSIcM9ZhoL9HeSIDTxiRMxldMf0DeSIDUSqhW0hwtEIwolMwtiiB2lfRMlVcoa4T2CPwJHJhUr9Htl7woWVTA1gFysQbT1VcbFIUB1ic2A7woWVTA1gFysQhZsfRmYZCz1iB2lfK319eWp9eWPYtMc1dMY0DB9Vwr1Yb3Y3CbnkdBfUcbY0d3klhtLIGZEvR3CzRjEYtJEIfMyZwoLSGtxiNBOvC3ascB50RL1Yb3YZKZnMd3wPDT0XK2rMkML8CU5ScB5mfoIMkJi4NBydDa0pkJc4RM9TFMH7DUSqhUn4RmYZCz14RM9TFMH7eWp9eWPYtMc1dMY0DB9Vwr1Yb2cpdMONCMPPdJXIctLIGZEvR3C0RjExeWPIwuciFJnXRoLSGeSIwolMhtyLhUnLNBOvC3ascB50KZnpcJIPFe1VRMlVcoa4T2CPwj8JhUL+HtCMFoyZcB50RMcZCB1lFZ5ScB5mfoIpwuSYtJEIwtnLNbniFMaVft5MFMyscbYddJ5zfBkzfukpdMFPFtSxha0Vco9jfB1ldmW7wo49dJ5zfBkzfukpdMFPHtxXhTs9eWPIwolMhtrPGe1LB25fhUCMct5idoXpwuI9ct5idoxddl07wocvFJEPDT0XKZy4kJcpNoWVcM9ZdbHVdoaVc3OPK2LqhZLIGe1LRMcvFM1zB2lfB25fKX0hwtnMd3wPDT0XKZy4kJcLRMxiGBaZFZCMDTxLRMxiGBaZFZ5ScB5mfoI7DUSqhUn4NA1Yb2cpdMONCMPPdJxLRMxiGBaZF1spbU5Ld2Y1dBaVftL7eWPIwolMhty4wtCMwoWVc2a0OBxldBaVfrk5UBWpwuI9ct5mcbOydoascB50WmlkctiVhTSIFMa0fbkVwuI7eWp9eWPYtMc1dMY0DB9Vwr1Yb3Y3CbnkdBymcUIpwuSIRZ92HZ4XeWPIwuciFJnpRoP9Htx4Ror9TA1gF3fiFrlsCBflRMyZc3ascB50FzSIco9jfB1ldmWVTA1gF3w9dMa3wryZFMy5KZnMd3wPDT0XK2L8horVdoaVc3OPRTwpK2LqNTHpeWPIwtnpcJEPhuI9TA1gcMlVcr9JDJiiB2lfhULiNB51doXpG2OvC3ascB50RL1Yb3YZB2Pqh109GeSIDBCPwbIVd1YZCZLIGt5vA3kjNbIVF3kjKZn4RmYZCz1iB2LqHl07gW0hgW0heWpMfB5jfolvdJnLDbYXdoy5OoazC3kpFuOpd24PDBWpGX0htB9JDMajftE9woOvC3ascB50RMflfraScB1ldmOtGAlLholLhTSYtIlvCMplC3WVF3O5doAVfMlzDBkpdol0GUE9wtk2DbYpCMxlwjSYtILYtm0YtMc1dMY0DB9VwoipcoarcbYjFMlXfolvdJipctl7eWPkd2kQcBY0we0Ico9jfB1ldmWVc2a0OBxldBaVfrk5UBWPDBWpKX0htB9JDMajft5zfulScU52DbYpCMlSDbO5we0IwMipcoOldJw7eWp9eWPvRZ0sNI0hNt9zC3kpFuW+eWPmKZEIeWPYtI0hkuYXCBYlFZE9wtwIkM5JF3E7kM5JF3E7kM5JF3E7kM5JF3E7kM5JF3E7kM5JF3E7wtcVCmYXKZcVCmYXKZcVCmYXKZcVCmYXKZw7wE0hRZ8Ldo9ictE9wtwJKX0hDBCIholzF2a0htOTcBY0DB9VUAWphbSYtIlpcJEIhtOTcBY0DB9VUAWINT0IwMYvdo9ZwJLIGZEYtILLdo9ictE9wtkLcA1vFM9VDbplhtL7wjSYtIl9woaSF2AIDBCIhtOTcBY0DB9VUAWINT0IwLaLDbWIW29VfoaVftwpGX0htUOSd2yLwe0IwmYlfrOpF3nSCbLPkZOSCbllFJFSwtFLF3OifoAmhUw7wE0htb0IcBxzcUnpcJEPkyYlC3Opd25kOtE9NUEJOBOpftned250cB50wynZd29MDB5mwJl7eWPkkoxvCBWINUEJF2a0OolzFoxiGUImkoxiGBaZkZXIkZOzfoy0cUFpwjSIeWPkgUEYtm0YtJOzDbOlwe0IwJw7eWPLF2aZfMaZwe0Iky9TOakBOakdk1YyAlcyAl9KWA1yk107eWPLcM9ScoaZwe0Iky9TOakBOakdk1YyAlcyAl9KWA1yk10Vky9TOakBOakdk1nwAy9TOAxok107eWPLFoyZfuHINUnlGunSd2OlhtFvkZXIkocvdoOlFJL7eWpMd3wPkoL9C291dmWPkuniFmOzhTSIkoL+HjSIkoLsRULIGX0hkuYpfoAINUELF2l0cU4LFoyZfuYdC291dmWPkuniFmOzhU0LDa0VwJ8JKX0heWp9eWppcJEPwBlzF2a0htOTcBY0DB9VAoy0DtLpGX0htUOTcBY0DB9VAoy0DtE9wtwJKX0hgUnlduYlwuSYtIlpcJEPkrY1FmkldmOTDbOlwe09wtk2HJwIkJCIkyYlC3Opd25WCbOPwtr9wtwJhbSYtILkDBCIhtOTDbOlaJE9NUEJfjrJhbSYtILktBlMwtipF3YlftILA2ajfolvdJLIkJCIkyYlC3Opd24INT0IwmYXdoyzDtwpGX0htWLktUOKcbfWCbOPwe0IkyYlC3Opd25WCbOPKX0htWLkgUnlduYlwuSYtILktWLLTMa3Aoy0DtE9wtw8F3OZd25mNjxiwoiZcBC9k2lVcoa4RmnPFtF+dBypdjXvCT4IwtEswtEIF2l0cUExKJE8R3Y0FM9Vcz4JRJOTcBY0DB9VAoy0DeSYtILktb0YtILkgUnlduYlwuSYtILktBlMwtipF3YlftILA2ajfolvdJLIkJCIkyYlC3Opd24INT0IwmYXdoyzDtwpGX0htWLktUOKcbfWCbOPwe0IkyYlC3Opd25WCbOPKX0htWLkgUnlduYlwuSYtILktWLLTMa3Aoy0DtE9wtw8F3OZd25mNjxiwoiZcBC9k2lVcoa4RmnPFtF+dBypdjXvCT4IwtEswtEIF2l0cUEZKJE8R3Y0FM9Vcz4JRJOTcBY0DB9VAoy0DeSYtILktb0YtILkgW0htWLLA2ajfolvdlnifoIINUELTMa3Aoy0DeSYtILkeWPkgW0hgW0hDBCIhtypF3YlftILDoaSFyOvFoljhUl7eWPkkoildunAd3npCZE9wtwJKX0hgUEYtjslC2ivwtFIeWP8F3O5doAIfulXcT0Jfoa4ft9jF3HJNI0hNtrsRW0hCM9LGUn7eWPkdByZc2lVRBxlcmW6wenXGeSYtIlsCbkmDB4sfo9XKJEXFuI7eWPkdByZc2lVRbkpc2i0KJEXFuI7eWPkdByZc2lVRBkvfuOvdTPIHun4KX0hgW0hRU0+eWP8R3Y0GBxlNI0hNokvcuLId25Hd2yLNUwmKZnlC2ivwtOSd2yLweslC2ivwtF7wr1Yb3nZcBxvCBOkdBymcbHPbtfpdBymcbHvcbi0FMyzd24VDmnmbtFpwJnJc2Yvdo9ZNUwjcBklCMaJwJnSDB5qNUwjKTL5KTL5wJn2dolVDz0JwzF3YzF3YZwICBxpdMS9wJH2YjC2YjCJwe4YtjxAWAkHOUnzfulScT0JCM9ZcoaZRBxlcmW6weyXGtnzd2xpctEjCzfjY2H3KZnJd3kLcbwsFMlmDuW6weyXGtnzd2xpctEjCzfjY2H3wJnidolmdj0JC2aVfoaZwJneOAxHAryrOrlKOz0XwrYyTrxTAryeUA5uNTEIDoapc2i0NUwxHeElwj4IeWPYtI0hwtE8ayw+wE0hwtEIwexAOtn3DBO0De0JKtwICBxpc249wMxlcmWJwucidolmdj0JCM90fo9swJnJc2Yvdo9ZNUwjcTklHoAXwj4MdMkzFeS8R1OrNI0hwtEIwexAOtn3DBO0De0JYzI0wJnPcBlmDuW9wjWXHtwICBxpc249wMxlcmWJwucidolmdj0Jfo9XwJnJc2Yvdo9ZNUkoOLcoOLCJNI0hwtEIwexJFj4YtJEIwtE8foyJdoAICM9ZcoaZNUwXwj4YtJEIwtEIwex0Fj4YtJEIwtEIwtEINuOLwufpcuOPNUw1HtAJNjxpdBFIF3kjNUkpC29VFZ9Sd2fvRMpXcZw+Nt90ce4YtJEIwtEIwtEINtrsRTx0ce48CUnPFMaMNUkPfuOXKJ8vf3f3RMkSfBOvdBypdMivF3OpdMFVC29sR2a4fukiFZ9pdMOlGt5XDuEJwuOiFMflfe0Jb2kSCB5qwJEIC2xiF3H9wM5ifMlmCbOpd24JNjxzfukvdMF+NocvdmWIC29Sd3w9wJH5KTL5KTLJNjxpdBFIF3kjNUkpdBymcbHvcbi0FMyzd2cMRMpXcZwIdMyscT0Jcbi0FMyzwJn3DBO0De0JYTEJwoilDBfPfe0JYTCJwokvFMOlFj0JHtwIDBW9wLlsCBflHJwId25Yd3azcA92cbw9wL1Yb3Y3CbnkdBymcUiFk2a4fukiF1XmRyXmbtFSbtfpdBymcbHvcbi0FMyzd24VDmnmbtFSHULJwo9VTB91F2aNfbW9wL1Yb3Y3CbnkdBfUcbY0d3klhtLJNjXvcM9Vfe48R3Y0FM9Vcz48R2r+Nt90ce4sRT4YtILkNuOLwufpcuOPNUw1HtAJwoySDBfVNUkjcB50cbwJNI0htWLmKX0htWLYtJ8QtWLYtILkkuy1cbk5we0IwmYldoajftntfbO0d24xRtntfbO0d24ZwrcUT00IA3nSCbYPwjSYtJOZcbY1duWINUnsGbYxdy9xfBaZGUILFbalFmLpeWPIwtEIwtEId3wIcollwtIJW291doOVk3WIcbilC3a0cUnxfBaZGU4JhTSYtJOZd3FINUnsGbYxdy9McbOjDy9iFmkiGUILFMazfBx0hTSYtMa4fukiC3WPkukvfZL7eWPYtMlMwtIPkyYpfoaBwe09wtk2HUwIguXIkyYpfoaBwe09wtk2HJwIhUEMkJELA2ajfolvdLlrwtr9wtkTFoxiF2IJwtCMwtOTcBY0DB9VUAWIwT0IwMivdBAJhUn7eWPktBlMwtILA2l0caCINT0IwmCxwJLIGX0htWLLA2l0cB5idBawwe0IwllvfUniFMAIOBOpfolVcZnTDbOlwer6NokZNJE8cM9VftnzDbplwe0IkzHmNJELWma0fo9VHTXvcM9Vfe4JKX0htWl9woaSF2AIDBCIhtOTDbOlaJE9NUEJfjwJhUn7eWPktUOTDbOldMyscAIINUEJBB91woyZcUnycol0DB5mwyYpfoAIHjP8Cmw+wexMd250wuYpGMAINUEmHZF+wtOtfbO0d24ZNt9Md250NJw7eWPktb0YtILkgW0htWLQRX0htWL7cBYPdZEmtWLINow+kzSIcBYPdZELA2l0cB5idBawweslC2ivwtF8R2w+eWPktTXvfoW+eWPktUEIwtE8foW+NorIDuklcj0JkzSIcBYPdZELDoaSFrxpdMSVkoildunAd3npCzslC2ivwtFJwtEIC2xiF3H9wM5ifMlmCbOpd24JNjxpdBFIF3kjNUkpC29VFZ9YDBYvdJ1PcBxXRMpXcZwIdMyscT0JDoaSFtwICM9ZcoaZNTE+Nt9iNjXvfoW+eWPIwtEIwtEIwex0ce48CUnPFMaMNUkSd2fvfbWVFoiXwJEIC2xiF3H9wM5ifMlmCbOpd24JNjxpdBFIF3kjNUkpC29VFZ9YDBYvdJ1Sd2fvfbWVDmnmwJnVCB1lNUkSd2fvfbWJwokvFMOlFj0XNjXvCT48R3OLNI0htWLIwtEINuOLNjxiwoiZcBC9wMlVcoa4RmnPFtwIwtnjdoyzFz0JdMy2DBfifolvdJw+NolscZnzFMH9wMljd25zR01pC29VRBivdBAVDmnmwJnVCB1lNUkPd21lwJnJd3kLcbw9He48R2r+Nt90ce4YtJEIwtEIwtEINuOLNjxiwoiZcBC9wJF7woajDo8IwMi0fuE6RZ8JRJOzDbOlweslC2ivwtFJwtEIwoYSCbYzNUkVCbcpc2y0DB9Vwj48DB1mwuYZCz0JDBYvdmHvTBljd24sfMllfZ5QFoFJwo5idBA9wmcpcbFJwokvFMOlFj0XNjXvCT48R3OLNI0hwtEIwtEIwtE8foW+NorIDuklcj0JDuO0FePvR3f3fZ5JduaLd21iDB43RMYvdU9JduaLcbYqR3Y1CM1pft5XDuE/F2ajfolvdj1SDbclwJEIwtnjdoyzFz0JdMy2DBfifolvdJw+NolscZnzFMH9wMljd25zR01pC29VRBfvdol2cU5QFoFJwo5idBA9wMfvdol2cUwICM9ZcoaZNTE+Nt9iNjXvfoW+eWPIwtEIwtEIweXvfuw+eWPIwtEINt90CBkScT4YtJEIwtE8Cmw+eWPIwtEINoOpfJnidolmdj0JFMlmDuWJNjxiwoiZcBC9wMi0fuE6RZ93f3FVCMx1co9sCBlVDo9zfolVcZ5jd20vDoaSFt9pdMOlGt5XDuEJwtnjdoyzFz0JdMy2DBfifolvdJw+NuY0FM9Vcz48R3Y0FM9Vcz48R2r+Nt9LDbC+eWPIwtEIwex0CBkScUn3DBO0De0JHTEXkUwICM9ZcoaZNUwXwj4YtJEIwtEIwex0Fj4IeWPIwtEIwtEIwex0ctnPcBlmDuW9wjHXwJnzfulScT0JwokvFMOlFJ10d3E6weyXGtnzd2xpctEjcTylHBAxKZnJd3kLcbwsCM90fo9sKJExFuIIF29SDBWIw2AxcTylHUw+kzSIcBYPdZEJkuYXCBYlFZEIkyYlC3Opd25WCbOPwJE7cBYPdZEmwtEIwtEIwtE8R3OLNI0hwtEIwtEIwtE8foWICBxpc249wmkpc2i0wJn2CBxpc249wM1pcoOScUwIF3O5doA9wJnJd3kLcbwsfo9XKJExFuIIF29SDBWIw2AxcTylHTSICM9ZcoaZRBkvfuOvdTPIHbn4wuYvdolLwtYlHBAxcTrJNI0hwtEIwtEIwtE8CUnPFMaMNUwmKZnlC2ivwtOPcBxXTolVDZ4LDoaSFyOvFoljweslC2ivwtFJwuOiFMflfe0Jb2kSCB5qwj4IF2ajfolvdJnPcBxXwexpdBFIF3kjNUkpC29VFZ9PcBxXAZ5QFoFJwo5idBA9wMildunpdBFJwokvFMOlFj0JHtwIF3O5doA9wmclFmOpC2ySRBySDBfVKM1pcoOScTSIwJnpce0JDoaSFolscZw+Nt9iNI0hwtEIwtEIwtE8R3OLNI0hwtEIwtEINt90Fj4YtJEIwtE8R3OiCMxlNJEYtJEIwtE8Ftnidolmdj0JdoaMftw+eWPkwtE8CMxvC2sxfB90cT4YtILkeWPktW0htWLktUF7eWPktUnpcJIiF2azF2lvdl9pF19ZcBfpF3OlFMaLhtkzcbYzDB9VfbYlFJwphW0htUEIwuSYtIllC2ivwtkkk20IF29ZFmLSwok1ftn0DolzwolzworIFoyzF3fvFMWIFukvfoajfoaLwoyZcBrVNokZNjxJFj48CUnPFMaMwe0Ik2xvc2lVRmnPFtF+Tr9uwrlKweXvCT4IwjSYtILIwtnpdMYSfBOlhtfMd290cbwVFoiXkZL7eWPkwtEIcbipfeSYtILIwtn9eWPkwtEYtILIwtE7cBYPdZEmtWLYtILkeWPktW0htWLYtJF7

[NogDog]

I don't know if there's any "slick" way to do it, but you can simply copy and past any base64_decode() expression into a separate script and have it output the result:

<?php
header('Content-Type: text/plain');
// past copied code here, such as:
echo base64_decode('lots of characters here');
?>

Typically these things have multiple levels of encoding and eval()-ing, so you may have to repeat the process a number of times on the results of each such decoding.

[madwormer2]

This problem has come up before over here: http://www.phpbuilder.com/board/showthread.php?t=10340358

However, this one looks a tad more complicated. (Or, when i removed the first layer "DANG thats messed up)

Some info:
The first layer is a simple base64_decode.
The second layer opens the current file and gets a lot of data from the end of the file. (requiring you to change eval to echo then RE-ENCODE the data to base64)
Next layer reads more data from the original file and does some text replacement.

Aaaaand that's as far as I can get.

Going to bed...