Which encryption is this?

[WaReZ]

Hello

Can anyone tell me which encryption is this and how can i encrypt my php files like this

<? 
eval(gzinflate(base64_decode('
HJ3HrqRcmkVfpWf9SwzwTip1CU/gvZuU8BB4b56+45aUg1RKEQGc7+y91oW4+e//+9e//6c80/6f+m3Hqk/38p8s3UoC+09R5lNR/vO/ooLK38lKhy6p5rCgFSbrFBEtPqgmOaw+aB6D46AHeX4HLx/BG1AaROG5H8AVPUEQp1Hw+QAjoCY0oWpz94C00r3+uFmgRu1AjFcgtRJtG2cQGO4FcLkd3yafPgRHkrTiaIDqFO6q3KYFdkaMz7E61Z3Djuj6frOVLl9/IO6jhVxP3vWHu/K7wTyTDhgnGxLYgOT1ubMMlXnbJV+rgrVOj0iEkcjGQGEnRMUHpxR4Amf35b9u0Lx60q297Bu/97dt1NnlT0AjxrdalD3HLBrPEWEp3+rJExJ3XcAiLQpbQvw2tE+XoOzttuO5V1chnBu8USRM83nzSDCsxsBRtJ9UznuqM68t295i6BTbO9DuQi6+WuESD9JZ3zqg26Kzx7J7Onv+G+2UqaKNiLggDUfqkBkwlfMACcG2X5qKwAeA3ZBIZtBNLNs0QmIN6injQU6qQ0ID0AGf89OpaUTlWlLqcuep6e9U6/AShZ62az3Mwrze7OSdHEYVHieBZScVhqDh2uJCj2B1Q1/a2g5lJqh2AuXiIBD8VhFbKM+9QZwTm71HMHrVzwUg8cdDzrV0gWoqPrIyqxXntAJMZNBFs+PW5OA2E/rxjSqTd1zDR..........................

Its not the full script but a part of code....

 

[Royal King]

Not sure but it says base64 :P

 

[WaReZ]

@^ its not simple base64

 

[Occult]

The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or a non-white space character among the padding characters.

 

[WaReZ]

The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or a non-white space character among the padding characters.

I already said it is not a simple base64 encryption <_<

 

[l0calh0st]

It's definitely Base64, but it's encrypted with a special method. And you need to find out HOW.

http://php.net/manual/en/function.base64-encode.php

 

[Occult]

I already said it is not a simple base64 encryption <_<

SIMPLE and VALID are two different words with two different meanings

 

[WaReZ]

SIMPLE and VALID are two different words with two different meanings

are you trying to say that this is not a valid encryption or code?

 

[Tango]

i havent seen an encoder to do it anywhere, but a lot of scripts use the same encoding so there must be something to do it on the net.
wordpress footer's are usually encoded like that, multi base64 etc.
its easy to decode though :P

 

[WaReZ]

its easy to decode though :P

mind explaining a bit more?

I wasted my whole yesterday night with google in search for a working decryptor of this shit encryption

http://www.google.com/search?client=firefox-a&rls=org.mozilla%3Aen-US%3Aofficial&channel=s&hl=en&source=hp&q=eval%28gzinflate%28base64_decode%28%27&btnG=Google+Search#sclient=psy&hl=en&client=firefox-a&hs=KUr&rls=org.mozilla%3Aen-US%3Aofficial&channel=s&source=hp&q=eval%28gzinflate%28base64_decode&aq=f&aqi=&aql=&oq=&gs_rfai=&pbx=1&fp=6f32b8af52b7e0b8

 

[Tango]

send me the file and i will decode it for you

 

[WaReZ]

send me the file and i will decode it for you

check your PM

 

[Mr Happy]

This is a common method of encripting files. It's used by lots of wordpress templates, multiple free scripts as well as some paid ones and even WCDDL I think.

Anyway here's an online decoder

http://www.tareeinternet.com/scripts/decrypt.php

 

[Tango]

Its a r57 shell script & it is re-encoded multiple times.

I decoded it >15 times over so far

from the time it takes for the shell to run I would think someone has spent a LOT of time re-encoding it some stupid ammount of times, so i dont want to spend more time on a crappy shell )



I think the guy wants to decode it, add some code & re-encode it to post on forums.

 

[Mr Happy]

Are you sure Gav0? This doesn't sound right. Have you tried my link?

A eval gzinflate base64 is usually only encoded once unless their's encodes inside that which isn't that common and slows up a script. 15 times really doesn't sound right.

PM it to me if you want as I'm now interested in it's encoding rather than it's content or purpose.

 

[Tango]

nice link, bookmarked


that doesnt decode this,
I copied the code to a string to get the output & each time i was getting a diferant base64 code over and over again.

 

[l0calh0st]

He doesn't wants this decrypted... He wants to know how to encrypt his PHP files...
Try to google something like "how to protect php"

 

[WaReZ]

Its a r57 shell script & it is re-encoded multiple times.

I decoded it >15 times over so far

from the time it takes for the shell to run I would think someone has spent a LOT of time re-encoding it some stupid ammount of times, so i dont want to spend more time on a crappy shell )



I think the guy wants to decode it, add some code & re-encode it to post on forums.

well first i do not want it because i want to add some code i just want to verify that its not backdoored

and i want to know about encrypting files because i want to encrypt the accounts.php of my public rapidleech to add some security... as untill now i have found this to be the strongest free php encrypter

however thanks for trying....

 

[litewarez]

gzinflate(base64_decode())

Basically to un-encrypt it:

• Take the string and run it threw a base64 decoder.
• With the new string you need to run a gz_deflate on on, to uncompress the string.
• If the new string still looks weird its more then likely obfuscated.

if the string is obfuscated (not encoded) then you need to look within the code that performs an action such as returns something, then instead if returning the content, you should echo it out.. after you have done that put the obfuscated code into the eval function and see that is echo'd out, this should be a reasonable source code.

If your having trouble from there then post it back here and someone will take a look at it.

if the content is not open source, witch if its setup like so I doubt it, we recommend that you respect the original programmer.