Need help to decode eval base64_decode

Mawk

I'm refering to this thread where it has been discussed before.

I have this footer.php which is a part of a free WordPress theme, and WordPress is opensource. So it's kinda annoying that the footer is encrypted when I just wan't to add a link.

The footer contains all this spam links which people probably paid the designer to have him put there, but that kinda destroys the point of opensource. I totaly understand the designer having his backlink, but spam links in a free opensource theme?

For all I know, it could be some maliciously code or something.

You can check out the theme and a demo here.

This is what the footer.php code looks like:

<?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
$o="QAAUOyhjbnE5Cg0KDScAEDsA0CduADRjOiVhaGhzYnUlAZYBwCcB3GtiOABhcwIRAbEAQQoNDg4nO281OVViAB1kYmlzJ1dodHM7KAEABbMCMScCQQ7AO3JrOQDSAFEBEQ4AkQBEOzh3b3cnAAFgYnNYZnVkb25xYnQvIHcEkCAHZX4AYSArJzIuPCc4OQ4FSAAABCcFcT/AOygGkAKHATAGQQ8FBCAHgg1cam5jY2tiYWA2DY0NeERoamoN8HQNvw2QJ2RrZnQfwHQ6JQJVBIEIMhGwB+IN8QESJ2BraGVmAIBrJyNwd2NlPBgFI3R2ayc6JwACJVRCS0JEUydDTlRTTkkAkE4QKEMrJxARWHNuc2tiAMR3BrBwaHUL8GMrJ2QJQ1gCcAXTARUDQgFgAiZmcnNvIBBodQMnY2ZzYlhganMBJ2Z3d3UEGGhxYmMrBKtzfndiKwV1BGNYcnVACGsCZFRSRVRTVU5JQC8CNWRoaUAQcxJwKzYrNDcuJ0ZUCCFYYn9kCEpidXdzBaNBVUhKD/MqOQNkdAGjSwADQkFTJ0hSU0JVJ01ITkkCVQzRA1l0J0hJJy8TUgNnKQP0WAIhEFAnOgSDwQYCdAFhdClOQy4BY1BPQlVCCPEccVjAfg71F2AgNiAnRklDAbYPMQFxAWIDwwSxWOJgF4UBwgGDSFVDCtBFXgPGFYUnQ0JURIA1AkNLTkpOUyc2NyUe4CDBIwtkdASAwCwKpC+BdWJ0cmtzdC8gsS4CsAPTI2gEA3Jzd3JzArF3dWJYT1NKSwHABHKkBgGkKSNwW2kF1WFodWJmZG8SsAZmZiMBdCcHNS4nfCcmA/o7a245JScpB0MADCclO2Ynb3ViYTpbJQFQOWJ3YgCZdWpma25pbC8ExSo5FaADNSUkBvRwAyoDEQI3AWRYTkMnKSclWyUnLIIFgB/AaGknAqAHAwL3FnICMgLzCUEndHN1bncPgFhzZmARwAUEIDIlZR30KSU7KGY5Jz3uOygMsRJAPpAF83oAcxSlEwsBaCMH4hYkA0NiCfxkb2gnAjQ8OFFURgQCIxihAEFGb0ZvYnUPwHVuYG9TwAmwA0EAQgR4RtFXb2hzaHRAlCcR8GFrbmRsdUbsDg4DwDta1WZpAeZkbmtrZnV+RvEBYkh0A8MlOVVnASNVF/hUVC9Ugjtf5gClBaILQQEXDUAFUmGHZWhzEABzaGoG4SdDYnRuYGliYydlfkAAJyL1JW9zc3c9KChwcHApdWIAQXFuYnBsbmlgdDpxJTknSGkkABQAYidVAZJ0GpBmOSknIWlldHc8EGhEaGMCkCdjaGliBQ8FA3QCEGtidAEGY25gYnRzKSCAJTlDZnMBUAUaJ2GAewjfCNBzZmtsCRMI0SlybCU5UGIOQGV0bnMI+wPvDLJ3bwmAa2hobHJ36bAHkxpQCpBLASJ0JydyHHM7FX4BJTsoZWgwAGN+JCAdEHNqazk=";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

And I've tried my self to decode it replacing eval with print and so on, but I guess I'm to much of an newbie to get it.

Is there anyone out there that would be that kind to help me decode this, or atleast give me a push in the right direction? My intention is not to remove any links, but to add my own link.

I hope someone sees the irony of an encoded footer, in a free theme from an opensource software, containing spam links.

Weedpacket

Mawk wrote:
I hope someone sees the irony of an encoded footer, in a free theme from an opensource software, containing spam links.

Not really. Just because Wordpress is open source doesn't mean what other people do with it has to be open source.

But you may like to mention it to WordPress, and get their opinion on whether their licensing terms have been violated. And/or leave a comment with the originating site.

And of course, all the mechanisms for deobfuscating the string are there in the code that renders the theme, and the other threads you mention are more extensive than they should need to be.

See the comment, see this site's AUP. Closing the thread.