How to decrypt this code?

Discussion in 'PHP' started by lumpy, May 2, 2011.

  1. #1
    Hey. I have some code which is encrypted, can how help me decrypt it ?

    <?php if (!function_exists("T7FC56270E7A70FA81A5935B72EACBE29")) { function T7FC56270E7A70FA81A5935B72EACBE29($TF186217753C37B9B9F958D906208506E) { $TF186217753C37B9B9F958D906208506E = base64_decode($TF186217753C37B9B9F958D906208506E); $T7FC56270E7A70FA81A5935B72EACBE29 = 0; $T9D5ED678FE57BCCA610140957AFAB571 = 0; $T0D61F8370CAD1D412F80B84D143E1257 = 0; $TF623E75AF30E62BBD73D6DF5B50BB7B5 = (ord($TF186217753C37B9B9F958D906208506E[1]) << 8) + ord($TF186217753C37B9B9F958D906208506E[2]); $T3A3EA00CFC35332CEDF6E5E9A32E94DA = 3; $T800618943025315F869E4E1F09471012 = 0; $TDFCF28D0734569A6A693BC8194DE62BF = 16; $TC1D9F50F86825A1A2302EC2449C17196 = ""; $TDD7536794B63BF90ECCFD37F9B147D7F = strlen($TF186217753C37B9B9F958D906208506E); $TFF44570ACA8241914870AFBC310CDB85 = __FILE__; $TFF44570ACA8241914870AFBC310CDB85 = file_get_contents($TFF44570ACA8241914870AFBC310CDB85); $TA5F3C6A11B03839D46AF9FB43C97C188 = 0; preg_match(base64_decode("LyhwcmludHxzcHJpbnR8ZWNobykv"), $TFF44570ACA8241914870AFBC310CDB85, $TA5F3C6A11B03839D46AF9FB43C97C188); for (;$T3A3EA00CFC35332CEDF6E5E9A32E94DA<$TDD7536794B63BF90ECCFD37F9B147D7F;) { if (count($TA5F3C6A11B03839D46AF9FB43C97C188)) exit; if ($TDFCF28D0734569A6A693BC8194DE62BF == 0) { $TF623E75AF30E62BBD73D6DF5B50BB7B5 = (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA++]) << 8); $TF623E75AF30E62BBD73D6DF5B50BB7B5 += ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA++]); $TDFCF28D0734569A6A693BC8194DE62BF = 16; } if ($TF623E75AF30E62BBD73D6DF5B50BB7B5 & 0x8000) { $T7FC56270E7A70FA81A5935B72EACBE29 = (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA++]) << 4); $T7FC56270E7A70FA81A5935B72EACBE29 += (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA]) >> 4); if ($T7FC56270E7A70FA81A5935B72EACBE29) { $T9D5ED678FE57BCCA610140957AFAB571 = (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA++]) & 0x0F) + 3; for ($T0D61F8370CAD1D412F80B84D143E1257 = 0; $T0D61F8370CAD1D412F80B84D143E1257 < $T9D5ED678FE57BCCA610140957AFAB571; $T0D61F8370CAD1D412F80B84D143E1257++) $TC1D9F50F86825A1A2302EC2449C17196[$T800618943025315F869E4E1F09471012+$T0D61F8370CAD1D412F80B84D143E1257] = $TC1D9F50F86825A1A2302EC2449C17196[$T800618943025315F869E4E1F09471012-$T7FC56270E7A70FA81A5935B72EACBE29+$T0D61F8370CAD1D412F80B84D143E1257]; $T800618943025315F869E4E1F09471012 += $T9D5ED678FE57BCCA610140957AFAB571; } else { $T9D5ED678FE57BCCA610140957AFAB571 = (ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA++]) << 8); $T9D5ED678FE57BCCA610140957AFAB571 += ord($TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA++]) + 16; for ($T0D61F8370CAD1D412F80B84D143E1257 = 0; $T0D61F8370CAD1D412F80B84D143E1257 < $T9D5ED678FE57BCCA610140957AFAB571; $TC1D9F50F86825A1A2302EC2449C17196[$T800618943025315F869E4E1F09471012+$T0D61F8370CAD1D412F80B84D143E1257++] = $TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA]); $T3A3EA00CFC35332CEDF6E5E9A32E94DA++; $T800618943025315F869E4E1F09471012 += $T9D5ED678FE57BCCA610140957AFAB571; } } else $TC1D9F50F86825A1A2302EC2449C17196[$T800618943025315F869E4E1F09471012++] = $TF186217753C37B9B9F958D906208506E[$T3A3EA00CFC35332CEDF6E5E9A32E94DA++]; $TF623E75AF30E62BBD73D6DF5B50BB7B5 <<= 1; $TDFCF28D0734569A6A693BC8194DE62BF--; if ($T3A3EA00CFC35332CEDF6E5E9A32E94DA == $TDD7536794B63BF90ECCFD37F9B147D7F) { $TFF44570ACA8241914870AFBC310CDB85 = implode("", $TC1D9F50F86825A1A2302EC2449C17196); $TFF44570ACA8241914870AFBC310CDB85 = "?".">".$TFF44570ACA8241914870AFBC310CDB85."<"."?"; return $TFF44570ACA8241914870AFBC310CDB85; } } } } eval(T7FC56270E7A70FA81A5935B72EACBE29("QAAAPD9waHAgIGZ1bmN0aW9uIAAAdGhlX3RyZW5kX2NhdGVnbwAAcmllcyAoJGVjaG89dHJ1ZQAgKXsgICAkcG9zdAIRID0gZ2UwgHRfA1EC9HkoKTsCIGlmIChpc18CIGFycmF5KAL2KSk6AcAgZm9yZRgIYWNoBXAEhmFzICRucGMCAyAkbEMgaQYAdGNbXQYQAYEtPgXwX25hbWW8/AXRIAnwBEQA8QDgaWYAkQdRCqIEcwtBBLcwXYQOAjFlbHNlCEJyZXR1cm4B/QWhBMJ9wngKghFVYmxvZwfRICgP8wEGD/MA8WluZhQwbygiAlEiEBIkZXhwC9AAYGxvZGUBxCgiICIsICQCkQIxAiN0b3QCIGNvEgF1bnQWEHhwAWNsYXN0d29yZAGwyMANkAGZZWYDAWltcAUnFgJfc2xpY2WEcAKiLDAsIAUYLTEpBVIQpAQRLiAiIABzPHNwYW4+IiAuD/AG5QGAPC8BgxKAQCB9D/pyZW1vdmVfbRtwX2xpbmsAECgkY29udGVudCkgIOEgJG1hQEB0HPA9IHByZWdfANIoJy88YSAABGhyZWY9IiguKykiIGMNkHM9UjwiBFEtBFEiPgGBL2knEYAE9ACgA9Jlc/ggC2Ic8gESBoUbUF9kYXRhEcBzdHJfcgwAZXBsYQ+hAlJlc1swXSwgJzwvN99wPgVYBLIgA6Ae8gCABCIOQCAOUQEAAYIIJAFw4BABYQ/gMRthYl9pbWFnZSswdz04MoRBCpBoPTU3AHBkZWYI0CJObyBJAgJQUEYc4GQesWtleT0nA0InI0JnbG9iM8JhbDOjBmAgJAHCA8A0ATBybWV0YTKzLRmxPklEBcAEMCwgN0IDEmcC0CQRZGlyG6ABByJ0aHVtYi470D9zcmM9HNIFMxygABAmYW1wO2g9JGgmYQCQdz0kdyBAJmEAkHpjPTEmYQCQcT0xMDAmR7hhAKBubVQDwwyQBmEio2cAsBCCEGpzaG9EA3I+wGl0bCbQbGltaXQ9MjYKgANBKYY9MQCQdAGxPScPExvhZW1wdD/wAYIpnAMQciAkANIMsBwQaXBfdGFncyhD8QFyCfAoJycsADBmYTpgK6MIYQShAuBsZW4ohvAD4yk8PSQIAgUyfT1BKIMEUgXLc3Vic3APdCK3Br8GsSwnIC4uLicsBWQjMgelRRIXej09MQbCIA7BDEQSQCAHxySVCDIBsiAmEiCgRxQ2cwijZWxsaXBzFCBzdHITQA1gLeMZEmlmKAEgAPAoJACAKSA+OdBlbgHDIPKNATENgQQyAhIsID6wJALwLTMpIPEMACIHdPgBLtYEgAEwDJEtHW5ld19leGNlcnBHsPXvFLIhIQ4yDiJzBpJfCsUqQROhAzUpC5EgERKmBhkgE21vW9Bwb3B1bGFyXy2xcygMczBFCAJ3cGRiCZAgJHJlcXVlc3QNoCIBoFNFTEVDVCAvkQMxXxSCLCBDT1UMRk5UKCQDIWBAb21tR2BzLmMAkwXSXwDASUQpIEFTICcBVVACJyBGUk9NbyAgA5QFIXMLQAR7EwIIRi49UaBXSEVSRcGAVCAGgl9hcHByT5BYsScxJyBBTkSPwAUaLklENaAMwAmvCaUDQgfhX3N0YXR1QkBzDqAncHVibfBoJwf/IEdST1VQHA0gQlkGdQ00Dx4gT1JERVICkQIkXw9SB8AgREVTQwVzB0EG4RAUHBFyZXN1bHQ9nHMoDyUbwjXBefJzGjN5zHMgeZEE0QH0ICTfOSOxARFzedMAsUsBHQEvEn0gOQFhlALbIjAJ0vxyKREy9QIWBAABgDLWcmVjHqANcBiiZWQVEnNA/ygxQGltdD04IAjzJR8lHhIVJZEAxQtBI3Db/CI6AcRzCiISNSAhXyFdGzYEFAqSBdAEjxtfSUSwfhsocgu0BzJMSU1JVA7TBJMLMR0PHQ8dD2/n95bJHQ8dD3N0LQYM1RnQTOMd3z7AIKMiHd8d3KZoOAt3cISQQmF1QHNfdHdlYWt1sGGoMg5xZM8nP/ICQD0mSQE9MGVDRmAkcAMxNIAEOgPX+CMtYgJTp+MCsIlyc3BsaXSJcFxuL4HhBHLfUALTM8M9P3CYogGiA8MCA2kEMDAQMXdoaWzHx4Awe8AgPCCQQALwKJQJkAAxJGVvIzEHAonVjJqQkGxpII7BjxcnPAEwJDGKc7ZzeQcjWxOFJGldXQJcbh+SBWEAQCRpKysIIX0AwMKLERGOYCEtLVAQslQT4S0tPmxAIAgSAdN/vi8B7APwA+EEEDZWXTFIsLyiZb6zGMa3AAE0YWIk//sBBAp0ESAOUhVcAlTDMBOjFawB9AREAjMV32kV3wtQMgIgIC2xpix1bKV0KFwnfCIpYxoAZNn/y8AA4y+lsxX9KzEWEEPzBXIAUBNiq+Qbe6tTBQPcCBwxAKM+BbIcUgITJDFoYXMtB/IgJDIv/yQzHZ95HZ8HkDVRUucBEgBSCRQXXAQxfrEhux1U5ZoDgSJpVhQnPCKAQxBDGXAgVCLfAiEvAj8+Qj0nIyNhZGRfOZMgKCc3VRykBSA0wCckj6gfPUQnHkIgBD1mb290ZXIDoQUAANMngwMC0Agp9gHcINfSPz4NCjxkaXYflCJjbwCkcHlyaWdodCIBkAkBqXdyfABlctoAAYER0SYCoQ0wQwMVIDIwMDUgLSA89GbwIjVixcDasFncID8+IMwASGI9IgIouBFuubDocT/UAM3zAehob+oQAaA+AUgDKDwvYT6EggcQQWxsIAsycyB5QGVydmVkAWANQJgKCmFEZXNpZ24BEGJ5CBEGI2h0dAAAcDovL3d3dy5lbGVnYW50d0gQcBdAbWWBki8iIHRhcn4gPSJfYgoAbGFuawEAabpAPSJGcmVlIFdQCYAgVGhlAsAiPgELCOEsIG1hZGUgYAJmApEHLy93ZWJnYXpldHRllzAuAVN1ay9jYXJzBw8gEoRDAeAiPgBhBcEIACBhbmQMT3d3LnNlYXJjaGVuAHFnaW5lLmx0ZC4FkAtADE9sZT2hgAJwTyI+U0VPBSE8Lx+QHnAAhnNjcmkCAHB0IHR5cAKgdGV4dC9qYXZhwjgBYx+BdmFyIBgBdXJsSyAciRqlOw0KTzF2AlRpbdYhAlkDsdVCczsdUAK0aXNfA9HgJwUAHlgBVCgpPyIxIjpwsT8+AwD1IAoi6cQLQQljCs9yDCAiINxCBRgHsWRpcgeAanNA4y8xJXMuanMiPgVfBV8FX2NobxCyBVYCP0Jha2VyUybRdEJUBZ8LggWfBZ8FnygwA8RHb3RoaWMFbwVvGwcQT2xvZwr2Y28N4XJuZXIQLxV/agU/8mDboxV6YXV0bwUf8vgFHwUfQycFGmRkyfB1D24C4rHCzyAq8D0gYQAAcnJheSAoMiw0LDYsOCwxMOQDUoMehRqSX3M3gGluZ193YXJuAIDURHgBJD+SAdWSwT+gX29wdGlvbiggIgkBw4IDkAMAcyIgKU7wc3MqAGFkbWluBFAmHbUmICEA8Qgx9QBoQbAE5imM9VDiIkkRPDcwCKIgaWQ9XlFtZS0I1CdX9Cd1cFNBZCAAIGZEcCc+PHA+PHN0cm9uZz4CAiIuX18oJ0eiIGlzIG5vdJYAbgQDZmlndXJN4HlldC4nKS4iLMAC8wAQICIuc3ByaW50ZigDgVlvdSAIkW11c3REByUxJC/AY28ENCB0aAVgcgR0C+FBoctxIGlAoG8gd29yawXALCBKoyIB4nMuH9A/nUE9EcEtEqNzIikH0Qrw/KFFMg6RlvJ00AAwawcoJxNyXwvwaWNlc2sx9hAEYRMVGcVrgiBuiAOFaW5pdANRcmVnaU3bc29AX3QLIQP1cwOCH2YCX3QcgRtAewoRAEKADB//JF9SRVFVRVNUWycJsR/UJ13h5x/BsIJKoCRfR0UCABBhAZR9JD0gA/gBQwIT/wEG0JcCBCTxwAXRE+YihQJCJ1NhdmUgUyrzDsNzJyA9BWAEwwJ1ICJzKn9uZ3Mi+YARa4QbK3IgIGhlJUByKCJMb4bgLeA6H0Aq0MQMHR8vsXMmcwhQZD10cnVle/AL8CAgCz1kaWUoBMN9llEKw1JlEiAK3wYACtZkdlA95XRlCt8K0QUDCd86H9A2ACbfBZBzJn5xdAnP/0AaMUGCJ0ALIABjAJDSmBGjbz3yc19jc3NfKeBqcyETP2VSdHnJIHAIAiBvkQkubWV0ABBhYm94LWhvbGRlcvjwDQoJCQAAd2lkdGg6IDM1MHB4OyBmbABEb2F0OiBsZWZ0asAJCW14IGluLns6IAHScDBQJ+AA4iAxATABcQBBArF9BNAGLWBXLuoxByAgLmluc2mFUHsCUAkEfwSxBQHcGASGHeBPDgMKYAojMTAwJTsgEJ2BOjE4ACc0cHghaW1wb3J0j7A7IAfiA2YDX4eOoNA6MTMyA15G0RLwE4ANCjxef154AjBqACJRdWVyeShkb2N1XVB0KS70cGQmEHkoOtUoJMQwDhAkKCIjMaopLnN1D5libWl0AqcCkh1iWMMDPSAuDMcekzpzKCAIAGN0ZWRKYGxlbmd0aCA+IDMgQEMpFSEgIAlhbGVy7KBPbmx5MTCbscBABBDa1CB0byBiZSAuQWFzIGZlYXkHdFcBUQAW8AhDICDBtGZhbHNlAXYVUAID5H4B5DSRAdR9KQCQCQ0KAIIUUHxSEjCK8ywRPwAAPg==")); ?>

    I would really appreciate.
     
    lumpy, May 2, 2011 IP
  2. MayurGondaliya

    MayurGondaliya Well-Known Member

    Messages:
    1,233
    Likes Received:
    38
    Best Answers:
    0
    Trophy Points:
    170
    #2
    It is hard. It seems that the things that look encoded are base64 which can be easily decoded using base64_decode php function. However, it uses the encoded words thorough out the code block, you may need to build the lexical analyzer to decode all.

    Just a question, you are trying to remove the the encoded blocks added by the CCL licensed script or theme ?
     
    MayurGondaliya, May 2, 2011 IP
  3. salmanshafiq

    salmanshafiq Well-Known Member

    Messages:
    260
    Likes Received:
    5
    Best Answers:
    0
    Trophy Points:
    128
    #3
    I don't think so It can b decrypted
     
    salmanshafiq, May 2, 2011 IP
  4. lumpy

    lumpy Well-Known Member

    Messages:
    942
    Likes Received:
    15
    Best Answers:
    0
    Trophy Points:
    160
    #4
    No, I'm trying to decrypt the code so I can add a few functions to the WORDPRESS Gallery. I also need to set up new dimensions for photos and so on.
     
    lumpy, May 3, 2011 IP
  5. jezzz

    jezzz Notable Member

    Messages:
    4,884
    Likes Received:
    190
    Best Answers:
    0
    Trophy Points:
    200
    #5
    I guess you can decrypt only by making small slices of codes and merge them together. You can't decrypt in single attempt
     
    jezzz, May 4, 2011 IP
  6. Mak3MyDay

    Mak3MyDay Peon

    Messages:
    25
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #6
    As what I have noticed, every token encrypted has a 33 character length. You can test on php hash algo that returns 33 character length..
     
    Mak3MyDay, May 4, 2011 IP
  7. textsurp

    textsurp Peon

    Messages:
    55
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #7
    Slowly decrypt each bit, as often as u need to
     
    textsurp, May 6, 2011 IP
  8. lumpy

    lumpy Well-Known Member

    Messages:
    942
    Likes Received:
    15
    Best Answers:
    0
    Trophy Points:
    160
    #8
    So this code was encrypted manually ? Is there any tool I can use to decrypt it faster?
     
    lumpy, May 6, 2011 IP
  9. jezzz

    jezzz Notable Member

    Messages:
    4,884
    Likes Received:
    190
    Best Answers:
    0
    Trophy Points:
    200
    #9
    You can not do it faster unless you make it in slices then it become far reliable to use
     
    jezzz, May 6, 2011 IP