decode/encode

[ChatIndia]

<?php

eval(gzinflate(base64_decode('FZVFsoRaokWHU+8FDUic+C0kcXfoVODummf0/9YIdsTaVt3Z+E8Durkes7P6J8+OisT/W1bFUlb//EdIQ1nY3IRtIhthwq4JGPYuVMp/tBo4/W0nAwWXDje33svr2M9XCpgpT+uTshWR0gdWHDadQx2wqg62LXtQPO+QifC8irJlp9w6gTy7iYbsAbg3FxoQ7XQaeIeWj7B9XR8va1Jgd0QUfmfgLH3vD70ThdWUhkHDdNnYi6XlEuIEKAgYNOaU4WucovfE4fNlUprpIWtdaNmLdirxhulqDJw4aVakl5PIGJVXunE8q8AWvCxgi4D8uNrYr/qd1nv4M00qXM1jPOkifQ/OSlLmeR8VwC06qLwUw+qhpAoTogYGJa5XEy1rWBmGqwSbgSwCOeVeT16mbRcLzfzNH/60/X11dUzzyE/UDtj4KeBxnrHz7C0XPb02J4huDAq5FC+C9VfP2An0LelNY9tLQDMVKgf2jtyAQCDWv5wV1UmIknvoGmuRANNKR/H8SAzs3BenbJtPjpndFlv0Zfw61VqZHgVP0RW4fzyvtFIqQlEl/17B3BwmVHDD2W6mV6tr58D4VxbYh4f+sMSNFsrlj8raYcT8nY/d2AgLNlGxak3JV+FU76hM7qH0gkf3ATlp4lNyjP2LMpejl754Zlko9qLypGzU1tn1Y//tY6KKmbjmZksmz1sajRAMJNenKwyIDvNjsfQ6Ii3XhnQ8Pnofk/EnYr94MkbO5MvV+SxSMyNX842Z3MxvrHLmgUWAttXOj/AUR64jWP7+oSBpTcrcqVkexpN+Jg6A/Eq5/nloDl3OX+nstyu15iAZkGp2FhSVEsE9E1Ayca8sdMxR7YnC1Uh7tPEiOuSuxsnsgq8YtYdYGADRQm6dWjvselDNl15owkM5GsV0slW9OuNIvArx8P+YP4QschH+ob6bgOIQER4jbnrr9QTyJSPTOI9otLNgLh3vCSpZpFI1NT2Y4tToBJ4jbfwabatd31MMjO/gqGzt4GlU50LPF0fKatLLPX1lX4myNmySUB1Rc9cyt7qZEPk6Zh8u8iM/DSEMv+jjL3PCQdr3JzwLk6SDwHGZP5VLzdSwnNn9IxveplVabdfancerC8a1xj13S1zk9k8qtRG6eKYeL64poAwr3rV7e4hvXzjp5I8tToHQdewxYARInKJ5jt51FBv0Fhe5k5J0kZpjuRrlGBdxfjqy8u3LadzvGkVS6jf7iC5PpTPyLsU1mZv+pwvdaZwS6fDZzN0yxcUmH/WYGndiSREdx8vnOrVNwRqsF56+wq605fx+SHAm2Y/hzM/c4r/Ancw3aHf/vcinLUy7td6SXK+I4+pFfKi2Y650XMdx0fALtQ1m4tehZMox7Fh6qtKfKAzhBpLnt9BqGU05CCKvhYvdcD/iifH6dx66TgvbXhaHN3dSqvyhzmwpiHJ/y48nryG7MPBsfGRdiGrl5qOTDuulVK65kiSXFyOlFJxMLe+2i5h8/NJObX9tlFHTfr2D7liaafm2D4PVQcQQywfPfhDqRZvIaJevHgONHNJcDxm0lvD4CyhZHj3kyc/kBItSsPl+jd65VMoyFgEDofJ6CHSyqxaXSbgRTrcvu57B/0155OcRLUEh+tunL1Iwc8SuyYG28qeat8yvRkc42pKKL49NaP8bIAg1ixJScc5oagDRg6VUDcgBl+gSjKgjtbyb0biUoHRRyV96q7n3EPQITZPv6RswNCpYnOge2sXtQMOXB3p5L+7vS5DWw8pshV4JaXQH9HKyUv86k9GRuSpI8sEsHzlVvsPsXJkbAgPBxnZGlrO7zsfJhE1LoFfEXFQ6beMP50VNZQGQSoz6iKFWR4GBbhyOXsFPti39GoPZuCkjJiPqMxAHMwWhoxEb+9cYY5iwKpGnv17ANPixdE7te8ZvDQ94uBK1oV5BGWjzHwNmrFCptDuZvyIpJpBH+m5kbP7Jmkg5YMAV9zujRfdeCs+URK1tvCKQP7nWcULwi41KgIp6BzwnXS+hzXhIiboN3i+OiRt4J2i+LKsKms9W9ImKx8DiJVLMAWmJ5sM6ZyyfeZddvqNH9jFIfVlNHW4qCMOcvxuyzDXLfgZUa56fS2chzfYI2mw1Pf3u/SZ0Fudzrkzm0HFdjEe/MZ89QPqPJCn2/yZbmMFkyAYInmNB5MIJa5fOPbwfBANG59dF4p/Lhxcn4XI0NLnj5Jhe9yPRwvlCcCPnjsP3z4HhOWQvBnIK0IIyahqNNNXfmwBRVCE0oYBZ9vbvDsNbcUVCNjgggV2VUwxpw7RJ5eyktLsNjOEBwiNwx1PDNARBMAwj9X/+/fff//t/')));

?>

what's this?

 

[misson]

What's the source? What do you get if you keep decoding & inflating the data?

 

[descalzo]

First deflate/decode just brings up another eval(gzinflate(base64_decode()))) , which returns another. I didn't go any further down.Seems someone is trying very hard to hide the true nature of the code. Obviously I didn't run any of the 'eval's

 

[ChatIndia]

Its some footer links at the bottom of my wordpress blog. When I try to remove the links my whole blog get crashed. To remove those links successfully I gotta understand its structure.

 

[leafypiggy]

They're there for a reason - don't remove them. If you really don't want to see them (though you're probably breaking a Terms of Use for the poor soul who labored away at making the theme and releasing it for free - asking only for some return linkage in return), just use CSS to hide the links.

 

[Skizzerz]

echo '</div><!--/rightsidebar-->
</div><!--/content-->

<!-- Start footer -->

<div class="clear"></div>';

include(TEMPLATEPATH."/flickr.php");

echo '<div id="footer">
<p>&copy; '.date("Y").' '.get_bloginfo('name').'.</p>
<p>Powered by <a href="http://www.wordpress.org/">Wordpress</a>.</p>
<p><span>Theme designed by <a href="http://www.libertybathrooms.com/cheap-bathroom-suites.html">Bathroom suites</a> | In conjunction with <a href="http://moomeg.net">Web directory</a> , <a href="http://www.nerdjobs.de/" title="nerdjobs">Nerdjobs</a> , <a href="http://mw3f.com/">Modern Warfare 3</a>.</span></p> 
</div>

</div>';
 
$silkglow_google_analytics = get_option('silkglow_google_analytics');
if ($silkglow_google_analytics != '') { echo stripslashes($silkglow_google_analytics); }
wp_footer();
echo '</body></html>';

EDIT: And as Neil posted above, it's usually illegal (or at least bad form/taste) to remove the copyright link for the theme designer

 

[ChatIndia]

great, thanks skizzerz! How did you do that?

 

[Skizzerz]

Unlike descalzo, who stopped after 2-3 times, I kept going with the gzinflate(base64_decode()) nonsense until it provided something useful (trimming out the eval() each time, of course). All in all about 4-5 minutes of work

 

[misson]

You can also have PHP do all the work using preg_match to pull out the encoded data, then calling gzinflate ∘ base64_decode on same in a loop, but I'm lazy that way. However, it seems imprudent to post code that defeats an encoding scheme for a copyright notice.

 

[descalzo]

However, it seems imprudent to post code that defeats an encoding scheme for a copyright notice.

Most free templates have simple copyright code, not this arcane stuff. Plus, the ultimate links in this case are effectively spam, not copyright notices.

Hiding things like this is a nice way to sneak malicious code into a template.

 

[Skizzerz]

misson:

The reason I decoded that wasn't so that people can remove the copyright link, it was so that you could save a good .1-.5 seconds every page load because it doesn't have to go through all that crap to get at the HTML. Whether or not people wish to remove the links is their own prerogative, I just recommend against it without contacting the theme author.

Also, in this case mindless copy/paste was faster than spending 15 minutes writing a script to do it for me, and since I don't forsee needing to do this again at all anytime in the forseeable future... well, sometimes writing a script isn't always the laziest way to do something

 

[essellar]

"It's amazing how much mature wisdom resembles being too tired." (Robert A. Heinlein)

I remember spending weeks on end with a milling machine, welder, soldering iron, oscilloscope and signal tracer to automate a task that took me about thirty-eight seconds every other month. Ah, youth. Nowadays I just pay some kid to do it for me.

 

[misson]

@Skizzerz: I bet you've got the skill to write the script in about the same amount of time it took to do it by hand.

It's that special brand of virtuous laziness that can benefit others.