Please help me to Decode this???

Discussion in 'PHP' started by roopajyothi, May 4, 2010.

  1. #1
    Can some one decode the following PHP Code


     
    roopajyothi, May 4, 2010 IP
  2. mfscripts

    mfscripts Banned

    Messages:
    319
    Likes Received:
    4
    Best Answers:
    8
    Trophy Points:
    90
    Digital Goods:
    3
    #2
    Where's it from? I guess it's encoded for a reason...?
     
    mfscripts, May 4, 2010 IP
  3. JAY6390

    JAY6390 Peon

    Messages:
    918
    Likes Received:
    31
    Best Answers:
    0
    Trophy Points:
    0
    #3
    You clearly haven't posted the whole code
     
    JAY6390, May 4, 2010 IP
  4. nabil_kadimi

    nabil_kadimi Well-Known Member

    Messages:
    1,065
    Likes Received:
    69
    Best Answers:
    0
    Trophy Points:
    195
    #4
    Yes, this code is incomplete, it's isn't hard to decipher, but make it easy by writing the whole code inside [P H P] and [/ P H P ] tags
     
    nabil_kadimi, May 4, 2010 IP
  5. JAY6390

    JAY6390 Peon

    Messages:
    918
    Likes Received:
    31
    Best Answers:
    0
    Trophy Points:
    0
    #5
    But without the spaces in the php, like so...[php] [/php]
     
    JAY6390, May 4, 2010 IP
  6. roopajyothi

    roopajyothi Active Member

    Messages:
    1,302
    Likes Received:
    11
    Best Answers:
    0
    Trophy Points:
    80
    #6
    Hi here the full code goes


    
    
    
    <?php /* blabalabla. */$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$OOO000O00=$OOO000000{0}.$OOO000000{12}.$OOO000000{7}.$OOO000000{5}.$OOO000000{15};$O0O000O00=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14}.$OOO000000{3};$O0O00OO00=$OOO000000{0}.$OOO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};$OOO00000O=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};$OOO0O0O00=__FILE__;$OO00O0000=3140;eval($OOO0000O0('aWYoITApJE8wMDBPME8wMD0kT09PMDAwTzAwKCRPT08wTzBPMDAsJ3JiJyk7JE8wTzAwME8wMCgkTzAwME8wTzAwLDEwMjQpOyRPME8wMDBPMDAoJE8wMDBPME8wMCw0MDk2KTskT08wME8wME8wPSRPT08wMDAwTzAoJE9PTzAwMDAwTygkTzBPMDBPTzAwKCRPMDAwTzBPMDAsMzgwKSwnVEZhMkcrM3Byc2dqeG5tTWNOUGZEcTVCWUUvQWJTOFdoZWtIOUpPaVJMNEtkd1ZveVVRSXU3Q3Y2MXRaMGxYej0nLCdBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OSsvJykpO2V2YWwoJE9PMDBPMDBPMCk7'));return;?>
    sGlMx2FMx2FMx27JbOqiBvsJb3UeYCDRs7lWN9JxNqlWsQyksQrVsGlMfIFMxG0yxa6ksQrdsGlMfITyx2FMxah9fulMx2Tyx2FMgaNMxG0yxGlMx2TRsG0yx2FMxG0yxay9fu0yxG0yx2TygPyiqGEex9bKxvFQbCS4831wf5nmD3EGbfqa5DDoc5sfm+SRE5wrmDLM/qsxnGw9S7Eo8qqNPBDvcvYCxBN/x3UY8HuijaSFc9nGNDEpPGJgPuUnf9lcDqsfq+q5q7eE5O+kYCNJEOSR/5LKA37VAvFUbinuSBEv8pJtx2GQxIc7nHb6mPdosQ9LgfwOYCUobCDRsG0yx2FMxG0yxa9ZEBEeAah9fu0yxG0yxG0ygfd=2cLOS51HS3JoAkFkS5JdE++fgaNebirdspqQAGqVYCl9EqNRE5ulxP9naidnaOEobOqeYChRs3+QbkFebQT9/Cq1Mf69SO+dS5DLrTugsp+ISprhjHuhgaN7bOU+AOnoE3qD/3qwMfuUgPTzs3wJ8P6iMPbVSBsdE51HACNJgaNCY5U7EP9VsQYimkT9/Cq1jkblsQ69SO+dS5DVsQYimyugbiNQ/5uRsp+ISprdsQYigfdnaisJSpqQAkT9bBnubHdnaiunaOE7AOnu/5lVr3SJSG+9E3lVD3lIS+FQACnJbvxRs3+O/5UJjaNHAC1uE51uDpsJgcug8yugspnUA2uiDuqxNDnDraRhNJsMfPFeE3NoAiximyugs3+9EpsJbI7TABJIb5UWbBqJbi9RspnUAa9Z2cLv/3JdEPh9Y5N9bOqHMDFw8BnUA+lOEBNH/+lebvnoYQh9Y5N9bOqIgP9h2cLZ2cR9/51HBCELA3qVY57Jr2uhsC+9E3lVbQ0ijkNeE3NQE5nAsCSQAvqyEOldE3qQs7uVsQ0ijkNeE3NQE5nAsC+9E3lVEOldE3qQs7uVsQlLAOndS5NJbQ0ijkNeEOJdEfdnakN7bOUWb3lIS+lO/5UJr2uhsCeuSpTtjQ0ijkNWDuqPq9qP57n+DJE+DJlmcD7+BP6ijvseb+leE37LAk0ijkNLAOnWEOJdE51eA5DZ2cR9AiqwE3luE3lubQTlr3noS51ug3q6b3UoE3DRsQ0ijaNWDuqPq9qP57FrD+lfNDU3BP9LjfrZ2cR9E3lubIuisIdnaOEobkTRs39lx2d9/fy9AiqwE3luE3lubId9/PdKgPFZ2cR9E3lubQTlraN9AvNIjkbVjk0imyugWcugspqQA+lyAvnuBCELA3qWYCeJYCdhMPT9E3lubQ6ibO+yBC+9A5JVjQbVs3JVY7lO/5UJAO+wEfdnaOJOraeO/5UJBCq6/BnubQh9SBsdBvFobvNWEOJdEqlH/3qH/Q9LrTug8yug/51HApq9EPh9SBsdBvFobvNWEOJdEqlH/3qH/Q9Z2cLl2cLl2cLQEBN7bO6hs3noAiNJAiNcbODZ2cLl2cLLEkTRr5E7AOnu/5lVBCq6/BnubQhiECqubOqwAvNJYClVS3qVSpnYSpsesQ9LrpdnaOE7AOnu/5lVr3SJSpsJA5luE5noAiNJAiNI5pNQYPh9qBsdD3+u/G+VEGE7AOnu/5lVfO+wEPy9b3+QY57IM5+QbO+1gaSHAC1usIuXsQbLgcug8yugspFebO+wbvnubkTlr3s7/5U9DqxRspFebO+wbQ9Z2cR9YChhMPFHSBsdBCJV/BcRgfdnaOn7bOUWbCquAvFugaNH/aU2qqsxf7FDB7qPfay9qBsdD3+u/G+VEGE7AOnu/5lVfO+wEP9Z2cLLEkTRspFebO+wbQGlsQbLrTug8yugYvqQA+lIEBNobpcRs3nRjGnqD9UMD+NWDGlfqaUHAvqVSah9b3+QY57IgP9Z2cLHSBsdBvnJS3lySah9YChdc7qPfGlcq+lcf7nDN9J+fGNfjaNyYBseABnISprLmyugWcugYvqQA+lIEBNobpcRs3nRjGnqD9UMD+NWPGqFNGqPj2TLmyugYvqQA+lIEBNobpcRs3nRjGnqD9UMD+NWD9qDqqsmq+sFfJn3NqrdSps7EP9Z2cR9b3+iEPTlr3n7bOUWEBeJYQh9YChLmyugYvqQA+lHA3lIEPh9YChLmyugbOquSBsVraNyY5SJmyugWcugWcug/5YRs3JVbvNeA3UyYBNRraGlrabobO+yBC+9A5JVjQbL2cLZ2cR9bv+dMPSfNDU+c7chgkF3D9lnr3+9E3lVbQbZ2cR9Y5N9bOqIMDFw8BnUA+lUS5qQ8Ph9bv+dgfdnaiSR/5UJgaNeE3NQE5xlc371bv+dBCEJS3nRBC+IbClHgaNeE3NQEBxLgPTnaidnakNLAOnWEOJdE51eA5DhMPTiY5N9AC1IjQbVs3+9EpsJY7diEvsoSBFOACU9EBriBP6ijQbVs3+9EpsJY7diY5N9AC1OACU9EBriBP6ijvnJSpNLAOSIjiFRbabZ2cLT/51HApq9EPT9/51HBCELA3qVY57Jmyugs3JVY7lO/5UJAO+wEPTlraSeE3NoAixosQ69Y5N9bOqH5QSibOl7b3EoA3NJbkSSjkbosQ69Y5N9bOqH5QSeE3NoAOEoA3NJbkSSjkboEiqVYvNLAC1IjiFRbabZ2cLT/51HApq9EPT9/51HBCELA3qVY57JmyugWcugW5qdbCDh8yug/5YhgaNWDuqfDuJMfJdibOqi/BnuEBsJEaSSraGlr2GL2cLZ2cR9SBsdr2uhsCeuSpTtjQlQYBFLE3+HS3JoAiFQACELSpxVYClwjCULYCqVbCDoA3JHE51IEqlybOlHEBnIjiFRbabZ2cR9bOqIbaTlr3SJSpsJA5luE5noAiNJAiNI5pNQYPh9SBsdj3+QbO+1gaSLbablMkNWDuqPq9qP5QSPND7MqGqWcDNGDkSSjaS7bOyiMf69B7n+DJE+DJdiDuqPq9qPBu1FfDDiBPyib3+1b3+dsIuXs3+QAvSAsvFe8BFeAaSSjaSCEBriMf69YBsoS7diSOqQs7uLgfdnaOJOgaNQEBnyMfu1gcug8yugspn1b7lyYBJyY5ylsQbZ2cR9bv+dr2uhrJqcNG+DNPFeE37LAkFfNqchb3+1b3+dr2uhsQNI8BnWb3+1b3+dsyugac9saqSrNqs+r3NoA5+LAkTlrab9bvJIBCNoA5+LAkbkmyugspsJbCl7bOnJr2uhABJIb5UWbBqJbi9RraNIb5yhgfdnakN7bOyhMPTi/pNub2Rojvseb3J9Y5nu/5lVbpsoEOJubQ1HACuoA3JHE51IEPld/5nJAinJBCJIbvqJjiFRbabZ2cR9E3+I/+lHAC1uE51ubI7iEBNQE57oS3qHAC1uE51ub7eubOGRspqQAa9Z2cLJYCeoraN9YBnRBCnoAiNJAiNImyugEBeLSaTRgfdnai7JApnJrpdnakNWDuqfDuJMfJdibOqi/BnuEBsJEaSSr2uhgaNQEBnyMfuUgPTzxPTtr2ThmyugWcugWcugWcug
    
    
    
    
    PHP:
     
    roopajyothi, May 4, 2010 IP
  7. danx10

    danx10 Peon

    Messages:
    1,179
    Likes Received:
    44
    Best Answers:
    2
    Trophy Points:
    0
    #7
    Its for a license file (hxxp://rapidactionprofits[dot]com/license/license_process.php), nothing malicous heres a snippet..

    <?php
    function buildQS($arr,$urlEncodeThem=1) {
    	foreach($arr as $key=>$value) $qstr .= ($urlEncodeThem==1) ?$key.'='.urlencode($value).'&': $key.'='.$value.'&';
    	rtrim($qstr,'&');
    	return $qstr;
    }
    function getAddonPostProcess($afile,$contentPre) {
    	$sql='SELECT * FROM addons';
    	$addres=@mysql_query($sql);
    	while($addrec=@mysql_fetch_assoc($addres)) {
    		$inc_filename = 'addons/'.$addrec['groupfolder'].'/'.$addrec['addonfolder'].'/includes/'.$afile;
    		$url_post_file = 'http://'.$_SERVER[SERVER_NAME].'/rap_admin/'.$inc_filename;
    		$numdotdots = count(explode('/',$_SERVER[PHP_SELF]))-2;
    		$dots='';
    		for ($i=0;
    		$i<$numdotdots;
    		$i++) {
    			$dots = $dots.'../';
    		}
    		$url_post_file_check = $dots.'rap_admin/'.$inc_filename;
    		if (file_exists($url_post_file_check)) {
    			include($url_post_file_check);
    		}
    	}
    	return $contentPre;
    }
    //etc...
    
    PHP:
    Furthermore the /* blabalabla. */ contained a disclaimer, which you failed to leave intact,

    for these reason's I won't post the whole decode (to avoid misuse/abuse).
     
    danx10, May 4, 2010 IP