Theme decoding thread

  • First read this information.

    Seriously, READ THAT THREAD BEFORE POSTING HERE. That thread will give you details on how to decrypt these sort of things yourself. Almost everything posted here has been something that could have been easily decrypted by simply reading that post.

    We recommend that you do not use encrypted themes. Encryption is often used to insert malicious code. Decoding part of an encrypted theme does not mean that it is all clean. If you choose to use an encrypted theme, it is at your own risk.

    If your theme has been posted under a non-GPL license, it may be against the terms of the theme to attempt to decode it or to have someone else decode it for you.

    If you can’t decode your own encrypted themes using this information and still want to use one rather than pick from the thousands of themes that don’t have obfuscated code in them, post your request for decryption in here, and maybe someone will help you out.

    Note

    • Code should be place into a pastebin, not into this thread.
    • Decoding the theme does not guarantee safety from malicious code.
    • Seperate decoding threads will be closed.
    • Best practice is to avoid such websites that distribute malicious code in themes (most of them just provide ripped knockoff themes, why trust these people?)
Viewing 15 replies - 211 through 225 (of 448 total)

  • I could really use some help with this header…

    https://pastebin.com/xZySTHHH

    Thanks in advance!!

    The encoded part of the header:
    <?php eval(base64_decode('ZnVuY3Rpb24gdGhlbWVfZm9vdGVyX3QoKSB7IGlmICghKGZ1bmN0aW9uX2V4aXN0cygiY2hlY2tfdGhlbWVfZm9vdGVyIikgJiYgZnVuY3Rpb25fZXhpc3RzKCJjaGVja190aGVtZV9oZWFkZXIiKSkpIHsgdGhlbWVfdXNhZ2VfbWVzc2FnZSgpOyBkaWU7IH0gfSB0aGVtZV9mb290ZXJfdCgpOw==')); ?>

    decode:
    function theme_footer_t() { if (!(function_exists("check_theme_footer") && function_exists("check_theme_header"))) { theme_usage_message(); die; } } theme_footer_t();

    I have managed to decrypt the footer but when I change something I get a message that I am not allowed to change the footer. I really dont want links to credit repair or online gambling on my site.

    Is there anyway you could help me? The theme is https://wpcrunchy.com/our-themes/newspress/

    Header: https://pastebin.com/3W0jJz4M
    Functions: https://pastebin.com/1ASbe5Ru
    Footer: https://pastebin.com/QjuhmpiS

    moved from:
    https://www.ads-software.com/support/topic/please-decode-this-for-me-help?replies=1
    for:
    mariafferrnanda

    <?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=688;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJzNUdm1GYit4MEpoUzZWZThkUXVwcWFjaVhFeVVZa2puOS8yT0lad2Y0ZzFHQXJSekJMTVBXdE43NUtIQ29EbHM9JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
JFD86mT86mT86mtZYwafi7JZY+L/XNq4JtDnQIZ6QaDnJMB2JM0RJFD8pPT86FoB6v52JM0Ah+J/YNqNVbDIEcVzE+q4Y7QMkx04EfJZXcd4JFoB6mT86FoB6vBIpWoB6FoB6m3BhuBf6tQNUqE2h79Buw/pVZEZe+QQkiTLXcVgcFaKaaZGyw5KSPJ8uag7EOQf6qkTYZJHdILVqbkWpOYtuW/mUWQAYPWfSvkTdIVFQqExuFZhuWLVpIDdqaJpabacat/Ecwb2XNQZEwk4ycgGU+tRU7TLYfVWkiE7jxZH6mFM6PdtVOY5euAzJMIghuICEwVAU7VZhvQ86m3BpPT86m3geNaNXcB4JFD86mT86mT86vICEcV4UM3fvdIoSNQgkO598vFrSuTZUwd90NVzUfQZUfdrXiJZXu3rSp5Vv9IJmd4JvpLIyiX9ycdD0wEzU7QZY20lmd4JvdIoYvTgEmW2XNDBjiJgEN/W0OKdU7kZYwaI0+JK0mL/0+/MEcXD0w/Wkx3HSMD7k7YREfJZEutBYwaryiarSikzYwQBYwaPYMtWy+arEi6RXNDr02TMEcBD0wQzEwDAU+D70OK+YwaZ0bTMEctgkcW9aNDMExTMEiVP0bQ4EctZYPBzXp59J23feMTnEu9fQ+aPyckREcd9XfI9JMBfp+ZfyxQvYwZfyxdfhpA9eNaOy+o9JM3oXuT4Ywaw8uJ4kxQBe2ozk7k7SwaAEck/UfQWy+arEi6RXNDr02TWyiQAEpW2QcLZENbRkvTqy+arEi628IaAEck/Ufd9a+/ZUcaP8vD/8OBzYm5Vv9IJvdWhvdIoSNQgkO598vFrSuTZUwd90NEzU7QZY23rSp5Vv9IoSNQgkO598vFrSuTZUwd90NVzUfQ/ycKZY23rSp5Vv9IVv9IfeMTgUwVAkcQZhbQbpaT6daQbqFbquv3R0vYzycKOUxaIEi6zYNVMyiTWYMKByx3fhpA9eNaOy+o9JBIfeMT7YbDwUNDWEi04hpA9eNaOy+o9JBIVvOBzXwDIjp5VvOBzyxQrUm5feB==

    @ mariafferrnanda

    echo '		</div> <!-- end #content-area -->

		<div id="footer">
			<p id="copyright">Powered by <a href="https://www.free-premium-wordpress-themes.com" rel="dofollow">Free Premium WordPress Themes</a> & '; _e('Designed by ','LightBright'); ;echo ' <a href="https://www.elegantthemes.com" title="Elegant Themes">Elegant Themes</a></p>

		</div> <!-- end #footer -->
	</div> <!-- end #container -->

	'; include(TEMPLATEPATH . '/includes/scripts.php'); ;echo '	'; wp_footer(); ;echo '
</body>
</html>';

    I used the decoder system, it did decode understanding html and php, but When I put it in the footer, isn’t worked.

    Thanks for your wise help.

    This is the footer code:

    <?php // This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited.
$OOO0O0O00=__FILE__;$O00O00O00=__LINE__;$OO00O0000=1036;eval((base64_decode('JE8wMDBPME8wMD1mb3BlbigkT09PME8wTzAwLCdyYicpO3doaWxlKC0tJE8wME8wME8wMClmZ2V0cygkTzAwME8wTzAwLDEwMjQpO2ZnZXRzKCRPMDAwTzBPMDAsNDA5Nik7JE9PMDBPMDBPMD0oYmFzZTY0X2RlY29kZShzdHJ0cihmcmVhZCgkTzAwME8wTzAwLDM3MiksJzNUdm1GYit4MEpoUzZWZThkUXVwcWFjaVhFeVVZa2puOS8yT0lad2Y0ZzFHQXJSekJMTVBXdE43NUtIQ29EbHM9JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>
JFD86mT86mT86mtZYwafi7JZY+L/XNq4JtDnQIZ6QaDnJMB2JM0RJFD8pPT86FoB6v52JM0Ah+J/YNqNVbDIEcVzE+q4Y7QMkx04EfJZXcd4JFoB6mT86FoB6vBIpWoB6FoB6m3BhuBf6tQNUqE2h79Buw/pVZEZe+QQkiTLXcVgcFaKaaZGyw5KSPJ8uag7EOQf6qkTYZJHdILVqbkWpOYtuW/mUWQAYPWfSvkTdIVFQqExuFZhuWLVpIDdqaJpabacat/Ecwb2XNQZEwk4ycgGU+tRU7TLYfVWkiE7jxZH6mFM6PdtVOY5euAzJMIghuICEwVAU7VZhvQ86m3BpPT86m3geNaNXcB4JFD86mT86mT86vICEcV4UM3fvdIoSNQgkO598vFrSuTZUwd90NVzUfQ/ycKZYO09SuWlmd4J8vDIyiXl0mB/SuW9EcKI0vVOUNKWXcZREi09SuWlvdIVv9IVv9IoE+ZN0+ZI8uJwUNDWEi0289WhvdIoE+ZN0+ZI8uJwUNDWEi0rk7J/YxTZY20lmd4JvdIoE+ZN0+ZI8uJwUNDWEi0rXNDRk+aRkv0lmd4JvdIJJPA9ycX9hv3/EfaRX7QgUNKnEi/gY7QPhvkIjcK/UcZOi7VgE+a2Xi0fhuTonv3/ExZRXctgXtDPycQZXwbMhvk+UNDWEi0fhu3g0m49eNaOy+o9JM3Vv9IJvdIfeMTZUwQgEOA9eNaOy+o9JBIJvpBzE+ZN823o0uWr0+aREv3OEwDzk+aMScVzUfQZUfd9SuWlmd4JvdIoYvTgEmW2XNDBjiJgEN/W0OKmU7TKYwZfyxd9JwVzYxIC0vYC0+aOy+o9E+bWEu92cu0geM3CEcV4UM3f0vErycQIU7dC0mL/0+/MEcXD02YC0+JAUNkgUwEzhvktYwBfhpA9eNaOy+o9JM0lJPA9XwLzENZREwo4JNK/UcqfhpA9eNaOy+o9JPBzXp5A0FbAUvTuyck4kx69qwaPEiJNEcdR0vTdU7kZYwaI0+JK0mL/0+/MEcXD0w/Wkx3HSMD7k7YREfJZEutBYwaryiarSikzYwQBYwaPYMtWy+arEi6RXNDr02TMEcBD0wQzEwDAU+D70OK+YwaZ0bkzYwQBYwaPYMTqy+arEi6oSNFl8vDB89WhvdIoSNQgkO598vFrSuTZUwd90NEzU7QZY2t7YwbBY+aM0vWr89WhvpBzE+ZN823o0uWr0+aREv3OEwDzk+aM0vWr89IJmd4JvdIJmd4JJPA9ycKOUxaIEu/qQqtdpFbqQaTTaF99S23fSNZRXNLtE+aPS7VOYwZBkx6RY+/BJMIC0mrZXN/z0vYVv9IfeMT7YbDwUNDWEi04hpA9eNaOy+o9JBIVvOBzXwDIjp5VvOBzyxQrUm5feB==

    Don’t worry, I resolve it. The problem is I was pasting the part: “<?php // This file is protected by copyright law and provided under license.” on the decoder, doing this is an error.

    You have to paste all under the <?php//>, not this.

    Hi could u decode this please

    [Code moderated. Please use the pastebin]

    Could you decode this please

    https://wordpress.pastebin.com/eqE5cVh2

    @vronar:
    https://pastebin.com/WgCS8MiW

    ?? Thanks. you really save my day. ??

    Can you help me please!

    <?php /* WARNING: This file is protected by copyright law. To reverse engineer or decode this file is strictly prohibited. */
$o="QAAADTs4d293J25pZGtyY2InLwAAU0JKV0tGU0JXRlNPJyknIACAKGVoc3NoaikCUCAuPCc4OQ4AAA0NO2NucSduYzolYWhoc2ICCHUlJzkNDgFTZGtmdHQBgGtiYQAAcyU5DQ1DYnRuYGknZX49JwAAO2Ynb3ViYTolb3Nzdz0oKAAAZGhrZGZ0ZmQpZGhqKG53ZgAAYyp0a2JicWIlJ3Nuc2tiOgAAJURrbmRsJ3NoJ0VyfiduVwiAZmMnVAISdCU5AOk7KGY5Jyc7AABldSg5DURod351bmBvcychSABkALA8Jw3TYmRvaCdjZnNiLyBIAF4MUDg5AYRla2hgbmlhaC8gaRAwZmpiAaMhaWNmdG8DpQInY2J0ZAG0dW53c25oaQKQEIANBzMGIyMQoSc6AgMnYGJzWGgCUi8gYWJpaFgBgQMBlDEIMnRzBCB0EjBvYnQvAzIVIg07KBUQ1+AS4BWCZAIAdBQwDIIUQBOGBqMJJ3V0dDVYEBJydWsF8Tg5JTlUcmUKMWViE0FXA8BodHN0OygRsApzF/cEfWRoampiaRvAc3RYBQ8FCEQCZAUxCwUK+CBka2JmdSORIDkMow4NDgCTIrAl4nB3EJJidS8PE4IUBCBlaGN+OQCAb3NqaxwAJwAQ";eval(base64_decode("JGxsbD0wO2V2YWwoYmFzZTY0X2RlY29kZSgiSkd4c2JHeHNiR3hzYkd4c1BTZGlZWE5sTmpSZlpHVmpiMlJsSnpzPSIpKTskbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd3OUoyOXlaQ2M3IikpOyRsbGxsPTA7JGxsbGxsPTM7ZXZhbCgkbGxsbGxsbGxsbGwoIkpHdzlKR3hzYkd4c2JHeHNiR3hzS0NSdktUcz0iKSk7JGxsbGxsbGw9MDskbGxsbGxsPSgkbGxsbGxsbGxsbCgkbFsxXSk8PDgpKyRsbGxsbGxsbGxsKCRsWzJdKTtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JHdzlKM04wY214bGJpYzciKSk7JGxsbGxsbGxsbD0xNjskbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGxsbGxsbGwoJGwpOyl7aWYoJGxsbGxsbGxsbD09MCl7JGxsbGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsbGxsbCs9JGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTskbGxsbGxsbGxsPTE2O31pZigkbGxsbGxsJjB4ODAwMCl7JGxsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8NCk7JGxsbCs9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbF0pPj40KTtpZigkbGxsKXskbGw9KCRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSkmMHgwZikrMztmb3IoJGxsbGw9MDskbGxsbDwkbGw7JGxsbGwrKykkbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGxdPSRsbGxsbGxsbFskbGxsbGxsbC0kbGxsKyRsbGxsXTskbGxsbGxsbCs9JGxsO31lbHNleyRsbD0oJGxsbGxsbGxsbGwoJGxbJGxsbGxsKytdKTw8OCk7JGxsKz0kbGxsbGxsbGxsbCgkbFskbGxsbGwrK10pKzE2O2ZvcigkbGxsbD0wOyRsbGxsPCRsbDskbGxsbGxsbGxbJGxsbGxsbGwrJGxsbGwrK109JGxsbGxsbGxsbGwoJGxbJGxsbGxsXSkpOyRsbGxsbCsrOyRsbGxsbGxsKz0kbGw7fX1lbHNlJGxsbGxsbGxsWyRsbGxsbGxsKytdPSRsbGxsbGxsbGxsKCRsWyRsbGxsbCsrXSk7JGxsbGxsbDw8PTE7JGxsbGxsbGxsbC0tO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkd4c2JEMG5ZMmh5SnpzPSIpKTskbGxsbGw9MDtldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkQwaVB5SXVKR3hzYkd4c2JHeHNiR3hzYkNnMk1pazciKSk7JGxsbGxsbGxsbGw9IiI7Zm9yKDskbGxsbGw8JGxsbGxsbGw7KXskbGxsbGxsbGxsbC49JGxsbGxsbGxsbGxsbCgkbGxsbGxsbGxbJGxsbGxsKytdXjB4MDcpO31ldmFsKCRsbGxsbGxsbGxsbCgiSkd4c2JHeHNiR3hzYkM0OUpHeHNiR3hzYkd4c2JHd3VKR3hzYkd4c2JHeHNiR3hzYkNnMk1Da3VJajhpT3c9PSIpKTtldmFsKCRsbGxsbGxsbGwpOw=="));return;?>

    I need some help with my footer. It’s not decoded in any way, but if I alter the footer at all, my website will show up as a blank white screen. Here’s the footer: https://pastebin.com/ztAqVQuE

    Any ideas? Even changing one letter will result in my website showing a blank white screen… I’m not sure what that would be related to, nor do I have any idea of how it would work.

    @tr_ugur_tr

    You can try this. Check it over for syntax first.

    https://pastebin.com/YPijNxCB

    @besweeet

    The nasty bits that are disabling the theme will be (most likely) two or three base64 encoded strings found in the themes functions.php file.

Viewing 15 replies - 211 through 225 (of 448 total)
  • The topic ‘Theme decoding thread’ is closed to new replies.