Web Development

I have this following file and I would quite like to get it decoded - any help / advice is appreciated. I would like to know how to decrypt it, however if someone is able to do it for me I would be equally grateful.

The huge block-o-stuff is base64-encoded. Decoding it just gets you more junk. It's nested nested nestings crammed into evals crammed into evals, with all the variable names altered into garbage, so it will take much persistence and detective work to unravel. It's probably been through a mutator script. They sacrificed a lot of efficiency for this obscureness -- PHP has to undo all this doublethink step by step.

You can use the online base64 decoder to decode that text and other text like it.

The \x78 stuff is escape sequences for ASCII characters. \x78 is 'x' for instance.

I appreciate the fast reply - I doubt I will try it any further. I had been trying to decode it base64 myself but I couldn't get very far.

Thanks for letting me know

Out of curiousity what is this bit for: $u4a8c1797b16="\x62\141\x73\145\x36\64\x5f\144\x65\143\x6f\144\x65

Code:

$ printf "\x62\141\x73\145\x36\64\x5f\144\x65\143\x6f\144\x65\n"

base64_decode

$

thanks, I actually got that bit :P

Oh, you're asking why it's in a string?

They put the name of a function in it and used it in an eval, rather than running it directly, just to make it even harder to understand.

A census of the base-64-decoder output shows 15 parens and one pair of curly braces, so it may be reencoded in sections:

ct dec hex octal iso8859-1
282 034 22 042 '"'
146 036 24 044 '$'
15 040 28 050 '('
15 041 29 051 ')'
424 043 2b 053 '+'
6 044 2c 054 ','
120 046 2e 056 '.'
468 047 2f 057 '/'
725 048 30 060 '0'
761 049 31 061 '1'
680 050 32 062 '2'
784 051 33 063 '3'
766 052 34 064 '4'
823 053 35 065 '5'
884 054 36 066 '6'
681 055 37 067 '7'
702 056 38 070 '8'
771 057 39 071 '9'
1 058 3a 072 ':'
136 059 3b 073 ';'
135 061 3d 075 '='
1 063 3f 077 '?'
1 064 40 100 '@'
415 065 41 101 'A'
378 066 42 102 'B'
430 067 43 103 'C'
399 068 44 104 'D'
377 069 45 105 'E'
427 070 46 106 'F'
375 071 47 107 'G'
420 072 48 110 'H'
446 073 49 111 'I'
441 074 4a 112 'J'
400 075 4b 113 'K'
430 076 4c 114 'L'
422 077 4d 115 'M'
368 078 4e 116 'N'
400 079 4f 117 'O'
396 080 50 120 'P'
368 081 51 121 'Q'
380 082 52 122 'R'
435 083 53 123 'S'
410 084 54 124 'T'
392 085 55 125 'U'
360 086 56 126 'V'
430 087 57 127 'W'
419 088 58 130 'X'
359 089 59 131 'Y'
395 090 5a 132 'Z'
226 092 5c 134 '\'
4 095 5f 137 '_'
673 097 61 141 'a'
721 098 62 142 'b'
790 099 63 143 'c'
706 100 64 144 'd'
728 101 65 145 'e'
637 102 66 146 'f'
441 103 67 147 'g'
456 104 68 150 'h'
464 105 69 151 'i'
414 106 6a 152 'j'
372 107 6b 153 'k'
384 108 6c 154 'l'
430 109 6d 155 'm'
457 110 6e 156 'n'
429 111 6f 157 'o'
402 112 70 160 'p'
475 113 71 161 'q'
417 114 72 162 'r'
406 115 73 163 's'
418 116 74 164 't'
400 117 75 165 'u'
362 118 76 166 'v'
461 119 77 167 'w'
528 120 78 170 'x'
390 121 79 171 'y'
421 122 7a 172 'z'
1 123 7b 173 '{'
1 125 7d 175 '}'
32813 Total