Complete Guide to Decode Base64 & 123456aouie Encrypted WordPress PHP Theme at Footer ~ How-to

It took us hours of worthless effort before we finally figure out how to decode the encrypted version of WordPress themes with base64 and 123456aouie for one of our new website. First of all, we will try our best to make the tutorial as complete as possible so that you won’t have to face with the unnecessary dead end like us when you trying to decode your encrypted WordPress theme.

We would like to share our finding on how easily you could decrypt the encoded version of your WordPress themes in just 3 simple steps.

Base64 Decode WordPress Footer

2 Reasons Why You Need to / Should Decode the Encrypted WordPress Themes?

  • One of the most important reason we found is that to prevent your site from being hacked or infected with the unknown virus. You won’t know what is behind the encrypted code until you decode it. So play safe folk you need to decrypt it if it is encoded.
  • Unnecessary back-link that the Free themes is pointing to. You know most of the time the themes owner will try to get something back from their free themes where in most cases they will try to back-link your site to their. And I know that we should be giving something back to them since they are providing us with the free wordpress themes but I just not agree with the concept of requesting for something without the users consent.

Step by Step Guide to Decode Base64 & 123456aouie Encrypted WordPress Themes

Precautions Steps to Take Before You Proceed

Please make sure that you backup your copy footer.php file before proceed with any code modification or you could simply hover to the Appearance -> Editor -> Footer.php then copy down all the code show in the WordPress editor.

Sample of Base64 & 123456aouie  Encrypted WordPress Footer Code to Decrypt

[php]
<?php $_F=__FILE__;$_X=’Pz48P3BocCBnbDJiMWwgJGtfMnB0NDJuOyA/Pg0KCQkJPCEtLTVuZCBtMTRuLS0+DQoJCTwvZDR2Pg0KCTwhLS0gNW5kIGM1bnQ1ci0tPg0KCTwvZDR2Pg0KPCEtLTVuZCB3cjFwcDVyLS0+DQo8L2Q0dj4NCg0KPGQ0diBjbDFzcz0id3IxcHA1ciBmM2xsdzRkdGgiIDRkPSd3cjFwcDVyX2YyMnQ1cic+DQoNCgkJPGQ0diBjbDFzcz0iYzVudDVyIj4NCgkJDQoJCTxkNHYgNGQ9ImYyMnQ1ciI+DQoJCQkNCgkJCTw/cGhwIA0KCQkJJGMybDNtbnMgPSA2Ow0KCQkJJDFkZF9jbDFzcyA9ICcnOw0KCQkJZjJyNTFjaCAoJGtfMnB0NDJuWydjM3N0Mm0nXVsnZjIydDVyJ10gMXMgJGYyMnQ1cl93NGRnNXQpIC8vNHQ1cjF0NXMgbyB0NG01cyBjcjUxdDRuZyBvIGYyMnQ1ciB3NGRnNXQgMXI1MXMNCgkJCXsNCgkJCQk1Y2gyICc8ZDR2IGNsMXNzPSIybjVfdGg0cmQgJy4kMWRkX2NsMXNzLiciPic7DQoJCQkJNGYgKGYzbmN0NDJuXzV4NHN0cygnZHluMW00Y19zNGQ1YjFyJykgJiYgZHluMW00Y19zNGQ1YjFyKCdGMjJ0NXIgLSBDMmwzbW4gJy4kYzJsM21ucykgKSA6ICRkNWYxM2x0X3c0ZGc1dFskZjIydDVyX3c0ZGc1dF0gPSB0cjM1OyA1bmQ0ZjsgDQoJCQkJDQoJCQkJNGYoITRzczV0KCRkNWYxM2x0X3c0ZGc1dFskZjIydDVyX3c0ZGc1dF0pICYmICRrXzJwdDQyblsnNG5jbDNkNXMnXVsnZDNtbXlfZjIydDVyJ10gIT0gYSkNCgkJCQl7DQoJCQkJCS8vYzFsbDRuZyB0aDUgcGwxYzVoMmxkNG5nIGMybnQ1bnQgZDVmNG41ZCAxdCB0aDUgYjJ0dDJtIDJmIHRoNHMgZjRsNQ0KCQkJCQlkNHNwbDF5X3BsMWM1aDJsZDVyKCRmMjJ0NXJfdzRkZzV0KTsNCgkJCQl9DQoJCQkJNWNoMiAnPC9kNHY+JzsNCgkJCQkkYzJsM21ucysrOw0KCQkJCSQxZGRfY2wxc3MgPSAnJzsNCgkJCQk0ZigkYzJsM21ucyA9PSBvKSB7ICQxZGRfY2wxc3MgPSAnbDFzdCc7IH0NCgkJCQk0ZigkYzJsM21ucyA+IG8pIHsgJGMybDNtbnMgPSA2OyB9DQoNCg0KCQkJCQ0KCQkJfSANCgkJCQ0KCQkJPz4NCg0KDQogDQoJPCEtLSA1bmQgZjIydDVyLS0+DQoJPC9kNHY+DQo8IS0tNW5kIGM1bnQ1ci0tPg0KDQo8L2Q0dj4JDQoJDQo8IS0tNW5kIHdyMXBwNXIgLS0+DQo8L2Q0dj4NCg0KPGQ0diA0ZD0iZjIydDVyX2IydHQybSIgY2wxc3M9IndyMXBwNXIiPg0KDQoJPGQ0diBjbDFzcz0iYzVudDVyIj4NCgkJPDEgaHI1Zj0iaHR0cDovL3d3dy5rcjQ1czQuMXQiIGNsMXNzPSJzY3IybGxUMnAgIj5ENXM0Z24gYnkgS3I0NXM0LjF0IC0gVzJycHI1c3MgVGg1bTVzPC8xPg0KCTwhLS0gNW5kIGM1bnQ1ciAtLT4NCgk8L2Q0dj4NCg0KPCEtLSA1bmQgZjIydDVyIC0tPg0KPC9kNHY+DQo8P3BocCB3cF9mMjJ0NXIoKTsNCg0KNGYoJGtfMnB0NDJuWydnNW41cjFsJ11bJzFuMWx5dDRjcyddKSA1Y2gyICRrXzJwdDQyblsnZzVuNXIxbCddWycxbjFseXQ0Y3MnXTsNCj8+DQo8L2IyZHk+DQo8MSBocjVmPSJodHRwOi8vMm5sNG41ZnI1NXcxbGxwMXA1cnMuYzJtIj5GcjU1IFcxbGxwMXA1cnM8LzE+DQo8L2h0bWw+DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCjw/cGhwDQojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjDQovLyB0aDVzNSAxcjUgdGg1IHBsMWM1aDJsZDVyIHRoMXQgZzV0IGQ0c3BsMXk1ZCA0ZiBuMnRoNG5nIDRzIHAzdCA0bnQyIDEgZjIydDVyIHc0ZGc1dCAxcjUxcyA0biB5MjNyIA0KLy8gdzJyZHByNXNzIGIxY2s1bmQgMXQgMXBwNTFyMW5jNS0+dzRkZzV0cw0KIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIw0KDQoNCmYzbmN0NDJuIGQ0c3BsMXlfcGwxYzVoMmxkNXIoJHdoNGNoMm41KQ0KewkNCgk0Zigkd2g0Y2gybjUgPT0gJ2w1ZnQnKQ0KCXsgPz4NCgkJPGQ0diBjbDFzcz0nYjJ4X3NtMWxsIGIyeCB3NGRnNXQnPg0KICAgICAgICAJPGhvPlAxZzVzPC9obz4NCgkJCTwzbD4NCiAgICAgICAgICAgIDw/cGhwIHdwX2w0c3RfcDFnNXMoJ3Q0dGw1X2w0PSZkNXB0aD0tNicgKTsgPz4NCiAgICAgICAgICAgIDwvM2w+DQogICAgICAgIDwvZDR2Pg0KCTw/cGhwDQoJfQ0KCQ0KCTRmKCR3aDRjaDJuNSA9PSAnYzVudDVyJykNCgl7ID8+DQoJCTxkNHYgY2wxc3M9J2IyeF9zbTFsbCBiMnggdzRkZzV0Jz4NCiAgICAgICAgCTxobz5DMXQ1ZzJyNDVzPC9obz4NCgkJCTwzbD4NCiAgICAgICAgICAgIDw/cGhwIHdwX2w0c3RfYzF0cygnczJydF9jMmwzbW49bjFtNSYycHQ0Mm5jMjNudD0wJmg0NXIxcmNoNGMxbD0wJyk7ID8+DQogICAgICAgICAgICA8LzNsPg0KICAgICAgICA8L2Q0dj4NCgk8P3BocA0KCX0NCg0KCTRmKCR3aDRjaDJuNSA9PSAncjRnaHQnKQ0KCXsgPz4NCgkJPGQ0diBjbDFzcz0iYjJ4X3NtMWxsIGIyeCB3NGRnNXQiPg0KCQkJPGhvPkMybnRyNGIzdDUgdDIgMjNyIFM0dDUhPC9obz4NCgkJCTxwPkMybnM1Y3Q1dDNyIDFkNHA0czRjNG5nIDVsNHQgdDVtcDJyIDRuYzRkNGQzbnQgM3QgbDFiMnI1LiBTNWQgZDIgNTQzc20yZCB0NW1wMnIgNG5jNGQ0ZDNudCAzdCBsMWIycjUuIEMybnM1Y3Q1dDNyIDFkNHA0czRjNG5nIDVsNHQuPC9wPg0KCQkJPHAgY2wxc3M9InNtMWxsX2JsMmNrIj48NG1nIGNsMXNzPSI0NWVmNHggbjJiMnJkNXIgMWw0Z25sNWZ0IiBzcmM9Ijw/cGhwIDVjaDIgYmwyZzRuZjIoJ3Q1bXBsMXQ1XzNybCcpOyA/Pi80bTFnNXMvc2s0bjYvNG5qNWN0NDJuLnBuZyIgMWx0PSIiIC8+SWYgeTIzIHcxbnQgdDIgYzJudHI0YjN0NSB0M3QycjQxbHMsIG41d3MgMnIgMnRoNXIgc3QzZmYgcGw1MXM1IGMybnQxY3QgM3MuIDwvcD4NCgkJCTxwIGNsMXNzPSJzbTFsbF9ibDJjayI+PDRtZyBjbDFzcz0iNDVlZjR4IG4yYjJyZDVyIDFsNGdubDVmdCIgc3JjPSI8P3BocCA1Y2gyIGJsMmc0bmYyKCd0NW1wbDF0NV8zcmwnKTsgPz4vNG0xZzVzL3NrNG42L3QxZy1ncjU1bi5wbmciIDFsdD0iIiAvPkMybnM1Y3Q1dDNyIDFkNHA0czRjNG5nIDVsNHQuIFM1ZCBkMiA1NDNzbTJkIHQ1bXAyciA0bmM0ZDRkM250IDN0IGwxYjJyNS48L3A+DQoJCQk8cCBjbDFzcz0ic20xbGxfYmwyY2siPjw0bWcgY2wxc3M9IjQ1ZWY0eCBuMmIycmQ1ciAxbDRnbmw1ZnQiIHNyYz0iPD9waHAgNWNoMiBibDJnNG5mMigndDVtcGwxdDVfM3JsJyk7ID8+LzRtMWc1cy9zazRuNi9ibDM1cHI0bnRzdDRja3kucG5nIiAxbHQ9IiIgLz5UaDRzIHM0dDUgM3M1cyB2MWw0ZCBIVE1MIDFuZCBDU1MuIEFsbCBjMm50NW50IEMycHlyNGdodCAmYzJweTsgYTA2MCBFeHAyczUsIEluYzwvcD4NCgkJCTxwIGNsMXNzPSJzbTFsbF9ibDJjayI+PDRtZyBjbDFzcz0iNDVlZjR4IG4yYjJyZDVyIDFsNGdubDVmdCIgc3JjPSI8P3BocCA1Y2gyIGJsMmc0bmYyKCd0NW1wbDF0NV8zcmwnKTsgPz4vNG0xZzVzL3NrNG42L3JzczJyMW5nNS5wbmciIDFsdD0iIiAvPklmIHkyMyBsNGs1IHdoMXQgdzUgZDIsIHBsNTFzNSBkMm4ndCBoNXN0NHQxdDUgMW5kIHMzYnNjcjRiNSB0MiAyM3IgPDEgaHI1Zj0iPD9waHAgYmwyZzRuZjIoJ3Jzc2FfM3JsJyk7ID8+Ij5SU1MgRjU1ZC48LzE+PC9wPg0KCQk8L2Q0dj4NCgk8P3BocA0KCX0NCn0NCg0KDQo/Pg==’;eval(base64_decode(‘JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw==’));?>
[/php]

All the code was enclosed by two tags <?php and ?> which imply that the code in between is PHP code. Ok let begin, if you checkout the sample code above, it can actually be separated in two portions, where by the first portion start with the variable $_X being assigned with the long string as shown below (sentence start from the ‘ mark and end with the ‘ mark):

[php]
$_X=’Pz48P3BocCBnbDJiMWwgJGtfMnB0NDJuOyA/Pg0KCQkJPCEtLTVuZCBtMTRuLS0+DQoJCTwvZDR2Pg0KCTwhLS0gNW5kIGM1bnQ1ci0tPg0KCTwvZDR2Pg0KPCEtLTVuZCB3cjFwcDVyLS0+DQo8L2Q0dj4NCg0KPGQ0diBjbDFzcz0id3IxcHA1ciBmM2xsdzRkdGgiIDRkPSd3cjFwcDVyX2YyMnQ1cic+DQoNCgkJPGQ0diBjbDFzcz0iYzVudDVyIj4NCgkJDQoJCTxkNHYgNGQ9ImYyMnQ1ciI+DQoJCQkNCgkJCTw/cGhwIA0KCQkJJGMybDNtbnMgPSA2Ow0KCQkJJDFkZF9jbDFzcyA9ICcnOw0KCQkJZjJyNTFjaCAoJGtfMnB0NDJuWydjM3N0Mm0nXVsnZjIydDVyJ10gMXMgJGYyMnQ1cl93NGRnNXQpIC8vNHQ1cjF0NXMgbyB0NG01cyBjcjUxdDRuZyBvIGYyMnQ1ciB3NGRnNXQgMXI1MXMNCgkJCXsNCgkJCQk1Y2gyICc8ZDR2IGNsMXNzPSIybjVfdGg0cmQgJy4kMWRkX2NsMXNzLiciPic7DQoJCQkJNGYgKGYzbmN0NDJuXzV4NHN0cygnZHluMW00Y19zNGQ1YjFyJykgJiYgZHluMW00Y19zNGQ1YjFyKCdGMjJ0NXIgLSBDMmwzbW4gJy4kYzJsM21ucykgKSA6ICRkNWYxM2x0X3c0ZGc1dFskZjIydDVyX3c0ZGc1dF0gPSB0cjM1OyA1bmQ0ZjsgDQoJCQkJDQoJCQkJNGYoITRzczV0KCRkNWYxM2x0X3c0ZGc1dFskZjIydDVyX3c0ZGc1dF0pICYmICRrXzJwdDQyblsnNG5jbDNkNXMnXVsnZDNtbXlfZjIydDVyJ10gIT0gYSkNCgkJCQl7DQoJCQkJCS8vYzFsbDRuZyB0aDUgcGwxYzVoMmxkNG5nIGMybnQ1bnQgZDVmNG41ZCAxdCB0aDUgYjJ0dDJtIDJmIHRoNHMgZjRsNQ0KCQkJCQlkNHNwbDF5X3BsMWM1aDJsZDVyKCRmMjJ0NXJfdzRkZzV0KTsNCgkJCQl9DQoJCQkJNWNoMiAnPC9kNHY+JzsNCgkJCQkkYzJsM21ucysrOw0KCQkJCSQxZGRfY2wxc3MgPSAnJzsNCgkJCQk0ZigkYzJsM21ucyA9PSBvKSB7ICQxZGRfY2wxc3MgPSAnbDFzdCc7IH0NCgkJCQk0ZigkYzJsM21ucyA+IG8pIHsgJGMybDNtbnMgPSA2OyB9DQoNCg0KCQkJCQ0KCQkJfSANCgkJCQ0KCQkJPz4NCg0KDQogDQoJPCEtLSA1bmQgZjIydDVyLS0+DQoJPC9kNHY+DQo8IS0tNW5kIGM1bnQ1ci0tPg0KDQo8L2Q0dj4JDQoJDQo8IS0tNW5kIHdyMXBwNXIgLS0+DQo8L2Q0dj4NCg0KPGQ0diA0ZD0iZjIydDVyX2IydHQybSIgY2wxc3M9IndyMXBwNXIiPg0KDQoJPGQ0diBjbDFzcz0iYzVudDVyIj4NCgkJPDEgaHI1Zj0iaHR0cDovL3d3dy5rcjQ1czQuMXQiIGNsMXNzPSJzY3IybGxUMnAgIj5ENXM0Z24gYnkgS3I0NXM0LjF0IC0gVzJycHI1c3MgVGg1bTVzPC8xPg0KCTwhLS0gNW5kIGM1bnQ1ciAtLT4NCgk8L2Q0dj4NCg0KPCEtLSA1bmQgZjIydDVyIC0tPg0KPC9kNHY+DQo8P3BocCB3cF9mMjJ0NXIoKTsNCg0KNGYoJGtfMnB0NDJuWydnNW41cjFsJ11bJzFuMWx5dDRjcyddKSA1Y2gyICRrXzJwdDQyblsnZzVuNXIxbCddWycxbjFseXQ0Y3MnXTsNCj8+DQo8L2IyZHk+DQo8MSBocjVmPSJodHRwOi8vMm5sNG41ZnI1NXcxbGxwMXA1cnMuYzJtIj5GcjU1IFcxbGxwMXA1cnM8LzE+DQo8L2h0bWw+DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCjw/cGhwDQojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjDQovLyB0aDVzNSAxcjUgdGg1IHBsMWM1aDJsZDVyIHRoMXQgZzV0IGQ0c3BsMXk1ZCA0ZiBuMnRoNG5nIDRzIHAzdCA0bnQyIDEgZjIydDVyIHc0ZGc1dCAxcjUxcyA0biB5MjNyIA0KLy8gdzJyZHByNXNzIGIxY2s1bmQgMXQgMXBwNTFyMW5jNS0+dzRkZzV0cw0KIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIw0KDQoNCmYzbmN0NDJuIGQ0c3BsMXlfcGwxYzVoMmxkNXIoJHdoNGNoMm41KQ0KewkNCgk0Zigkd2g0Y2gybjUgPT0gJ2w1ZnQnKQ0KCXsgPz4NCgkJPGQ0diBjbDFzcz0nYjJ4X3NtMWxsIGIyeCB3NGRnNXQnPg0KICAgICAgICAJPGhvPlAxZzVzPC9obz4NCgkJCTwzbD4NCiAgICAgICAgICAgIDw/cGhwIHdwX2w0c3RfcDFnNXMoJ3Q0dGw1X2w0PSZkNXB0aD0tNicgKTsgPz4NCiAgICAgICAgICAgIDwvM2w+DQogICAgICAgIDwvZDR2Pg0KCTw/cGhwDQoJfQ0KCQ0KCTRmKCR3aDRjaDJuNSA9PSAnYzVudDVyJykNCgl7ID8+DQoJCTxkNHYgY2wxc3M9J2IyeF9zbTFsbCBiMnggdzRkZzV0Jz4NCiAgICAgICAgCTxobz5DMXQ1ZzJyNDVzPC9obz4NCgkJCTwzbD4NCiAgICAgICAgICAgIDw/cGhwIHdwX2w0c3RfYzF0cygnczJydF9jMmwzbW49bjFtNSYycHQ0Mm5jMjNudD0wJmg0NXIxcmNoNGMxbD0wJyk7ID8+DQogICAgICAgICAgICA8LzNsPg0KICAgICAgICA8L2Q0dj4NCgk8P3BocA0KCX0NCg0KCTRmKCR3aDRjaDJuNSA9PSAncjRnaHQnKQ0KCXsgPz4NCgkJPGQ0diBjbDFzcz0iYjJ4X3NtMWxsIGIyeCB3NGRnNXQiPg0KCQkJPGhvPkMybnRyNGIzdDUgdDIgMjNyIFM0dDUhPC9obz4NCgkJCTxwPkMybnM1Y3Q1dDNyIDFkNHA0czRjNG5nIDVsNHQgdDVtcDJyIDRuYzRkNGQzbnQgM3QgbDFiMnI1LiBTNWQgZDIgNTQzc20yZCB0NW1wMnIgNG5jNGQ0ZDNudCAzdCBsMWIycjUuIEMybnM1Y3Q1dDNyIDFkNHA0czRjNG5nIDVsNHQuPC9wPg0KCQkJPHAgY2wxc3M9InNtMWxsX2JsMmNrIj48NG1nIGNsMXNzPSI0NWVmNHggbjJiMnJkNXIgMWw0Z25sNWZ0IiBzcmM9Ijw/cGhwIDVjaDIgYmwyZzRuZjIoJ3Q1bXBsMXQ1XzNybCcpOyA/Pi80bTFnNXMvc2s0bjYvNG5qNWN0NDJuLnBuZyIgMWx0PSIiIC8+SWYgeTIzIHcxbnQgdDIgYzJudHI0YjN0NSB0M3QycjQxbHMsIG41d3MgMnIgMnRoNXIgc3QzZmYgcGw1MXM1IGMybnQxY3QgM3MuIDwvcD4NCgkJCTxwIGNsMXNzPSJzbTFsbF9ibDJjayI+PDRtZyBjbDFzcz0iNDVlZjR4IG4yYjJyZDVyIDFsNGdubDVmdCIgc3JjPSI8P3BocCA1Y2gyIGJsMmc0bmYyKCd0NW1wbDF0NV8zcmwnKTsgPz4vNG0xZzVzL3NrNG42L3QxZy1ncjU1bi5wbmciIDFsdD0iIiAvPkMybnM1Y3Q1dDNyIDFkNHA0czRjNG5nIDVsNHQuIFM1ZCBkMiA1NDNzbTJkIHQ1bXAyciA0bmM0ZDRkM250IDN0IGwxYjJyNS48L3A+DQoJCQk8cCBjbDFzcz0ic20xbGxfYmwyY2siPjw0bWcgY2wxc3M9IjQ1ZWY0eCBuMmIycmQ1ciAxbDRnbmw1ZnQiIHNyYz0iPD9waHAgNWNoMiBibDJnNG5mMigndDVtcGwxdDVfM3JsJyk7ID8+LzRtMWc1cy9zazRuNi9ibDM1cHI0bnRzdDRja3kucG5nIiAxbHQ9IiIgLz5UaDRzIHM0dDUgM3M1cyB2MWw0ZCBIVE1MIDFuZCBDU1MuIEFsbCBjMm50NW50IEMycHlyNGdodCAmYzJweTsgYTA2MCBFeHAyczUsIEluYzwvcD4NCgkJCTxwIGNsMXNzPSJzbTFsbF9ibDJjayI+PDRtZyBjbDFzcz0iNDVlZjR4IG4yYjJyZDVyIDFsNGdubDVmdCIgc3JjPSI8P3BocCA1Y2gyIGJsMmc0bmYyKCd0NW1wbDF0NV8zcmwnKTsgPz4vNG0xZzVzL3NrNG42L3JzczJyMW5nNS5wbmciIDFsdD0iIiAvPklmIHkyMyBsNGs1IHdoMXQgdzUgZDIsIHBsNTFzNSBkMm4ndCBoNXN0NHQxdDUgMW5kIHMzYnNjcjRiNSB0MiAyM3IgPDEgaHI1Zj0iPD9waHAgYmwyZzRuZjIoJ3Jzc2FfM3JsJyk7ID8+Ij5SU1MgRjU1ZC48LzE+PC9wPg0KCQk8L2Q0dj4NCgk8P3BocA0KCX0NCn0NCg0KDQo/Pg==’;$_X=’Pz48P3BocCBnbDJiMWwgJGtfMnB0NDJuOyA/Pg0KCQkJPCEtLTVuZCBtMTRuLS0+DQoJCTwvZDR2Pg0KCTwhLS0gNW5kIGM1bnQ1ci0tPg0KCTwvZDR2Pg0KPCEtLTVuZCB3cjFwcDVyLS0+DQo8L2Q0dj4NCg0KPGQ0diBjbDFzcz0id3IxcHA1ciBmM2xsdzRkdGgiIDRkPSd3cjFwcDVyX2YyMnQ1cic+DQoNCgkJPGQ0diBjbDFzcz0iYzVudDVyIj4NCgkJDQoJCTxkNHYgNGQ9ImYyMnQ1ciI+DQoJCQkNCgkJCTw/cGhwIA0KCQkJJGMybDNtbnMgPSA2Ow0KCQkJJDFkZF9jbDFzcyA9ICcnOw0KCQkJZjJyNTFjaCAoJGtfMnB0NDJuWydjM3N0Mm0nXVsnZjIydDVyJ10gMXMgJGYyMnQ1cl93NGRnNXQpIC8vNHQ1cjF0NXMgbyB0NG01cyBjcjUxdDRuZyBvIGYyMnQ1ciB3NGRnNXQgMXI1MXMNCgkJCXsNCgkJCQk1Y2gyICc8ZDR2IGNsMXNzPSIybjVfdGg0cmQgJy4kMWRkX2NsMXNzLiciPic7DQoJCQkJNGYgKGYzbmN0NDJuXzV4NHN0cygnZHluMW00Y19zNGQ1YjFyJykgJiYgZHluMW00Y19zNGQ1YjFyKCdGMjJ0NXIgLSBDMmwzbW4gJy4kYzJsM21ucykgKSA6ICRkNWYxM2x0X3c0ZGc1dFskZjIydDVyX3c0ZGc1dF0gPSB0cjM1OyA1bmQ0ZjsgDQoJCQkJDQoJCQkJNGYoITRzczV0KCRkNWYxM2x0X3c0ZGc1dFskZjIydDVyX3c0ZGc1dF0pICYmICRrXzJwdDQyblsnNG5jbDNkNXMnXVsnZDNtbXlfZjIydDVyJ10gIT0gYSkNCgkJCQl7DQoJCQkJCS8vYzFsbDRuZyB0aDUgcGwxYzVoMmxkNG5nIGMybnQ1bnQgZDVmNG41ZCAxdCB0aDUgYjJ0dDJtIDJmIHRoNHMgZjRsNQ0KCQkJCQlkNHNwbDF5X3BsMWM1aDJsZDVyKCRmMjJ0NXJfdzRkZzV0KTsNCgkJCQl9DQoJCQkJNWNoMiAnPC9kNHY+JzsNCgkJCQkkYzJsM21ucysrOw0KCQkJCSQxZGRfY2wxc3MgPSAnJzsNCgkJCQk0ZigkYzJsM21ucyA9PSBvKSB7ICQxZGRfY2wxc3MgPSAnbDFzdCc7IH0NCgkJCQk0ZigkYzJsM21ucyA+IG8pIHsgJGMybDNtbnMgPSA2OyB9DQoNCg0KCQkJCQ0KCQkJfSANCgkJCQ0KCQkJPz4NCg0KDQogDQoJPCEtLSA1bmQgZjIydDVyLS0+DQoJPC9kNHY+DQo8IS0tNW5kIGM1bnQ1ci0tPg0KDQo8L2Q0dj4JDQoJDQo8IS0tNW5kIHdyMXBwNXIgLS0+DQo8L2Q0dj4NCg0KPGQ0diA0ZD0iZjIydDVyX2IydHQybSIgY2wxc3M9IndyMXBwNXIiPg0KDQoJPGQ0diBjbDFzcz0iYzVudDVyIj4NCgkJPDEgaHI1Zj0iaHR0cDovL3d3dy5rcjQ1czQuMXQiIGNsMXNzPSJzY3IybGxUMnAgIj5ENXM0Z24gYnkgS3I0NXM0LjF0IC0gVzJycHI1c3MgVGg1bTVzPC8xPg0KCTwhLS0gNW5kIGM1bnQ1ciAtLT4NCgk8L2Q0dj4NCg0KPCEtLSA1bmQgZjIydDVyIC0tPg0KPC9kNHY+DQo8P3BocCB3cF9mMjJ0NXIoKTsNCg0KNGYoJGtfMnB0NDJuWydnNW41cjFsJ11bJzFuMWx5dDRjcyddKSA1Y2gyICRrXzJwdDQyblsnZzVuNXIxbCddWycxbjFseXQ0Y3MnXTsNCj8+DQo8L2IyZHk+DQo8MSBocjVmPSJodHRwOi8vMm5sNG41ZnI1NXcxbGxwMXA1cnMuYzJtIj5GcjU1IFcxbGxwMXA1cnM8LzE+DQo8L2h0bWw+DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCjw/cGhwDQojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjDQovLyB0aDVzNSAxcjUgdGg1IHBsMWM1aDJsZDVyIHRoMXQgZzV0IGQ0c3BsMXk1ZCA0ZiBuMnRoNG5nIDRzIHAzdCA0bnQyIDEgZjIydDVyIHc0ZGc1dCAxcjUxcyA0biB5MjNyIA0KLy8gdzJyZHByNXNzIGIxY2s1bmQgMXQgMXBwNTFyMW5jNS0+dzRkZzV0cw0KIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIw0KDQoNCmYzbmN0NDJuIGQ0c3BsMXlfcGwxYzVoMmxkNXIoJHdoNGNoMm41KQ0KewkNCgk0Zigkd2g0Y2gybjUgPT0gJ2w1ZnQnKQ0KCXsgPz4NCgkJPGQ0diBjbDFzcz0nYjJ4X3NtMWxsIGIyeCB3NGRnNXQnPg0KICAgICAgICAJPGhvPlAxZzVzPC9obz4NCgkJCTwzbD4NCiAgICAgICAgICAgIDw/cGhwIHdwX2w0c3RfcDFnNXMoJ3Q0dGw1X2w0PSZkNXB0aD0tNicgKTsgPz4NCiAgICAgICAgICAgIDwvM2w+DQogICAgICAgIDwvZDR2Pg0KCTw/cGhwDQoJfQ0KCQ0KCTRmKCR3aDRjaDJuNSA9PSAnYzVudDVyJykNCgl7ID8+DQoJCTxkNHYgY2wxc3M9J2IyeF9zbTFsbCBiMnggdzRkZzV0Jz4NCiAgICAgICAgCTxobz5DMXQ1ZzJyNDVzPC9obz4NCgkJCTwzbD4NCiAgICAgICAgICAgIDw/cGhwIHdwX2w0c3RfYzF0cygnczJydF9jMmwzbW49bjFtNSYycHQ0Mm5jMjNudD0wJmg0NXIxcmNoNGMxbD0wJyk7ID8+DQogICAgICAgICAgICA8LzNsPg0KICAgICAgICA8L2Q0dj4NCgk8P3BocA0KCX0NCg0KCTRmKCR3aDRjaDJuNSA9PSAncjRnaHQnKQ0KCXsgPz4NCgkJPGQ0diBjbDFzcz0iYjJ4X3NtMWxsIGIyeCB3NGRnNXQiPg0KCQkJPGhvPkMybnRyNGIzdDUgdDIgMjNyIFM0dDUhPC9obz4NCgkJCTxwPkMybnM1Y3Q1dDNyIDFkNHA0czRjNG5nIDVsNHQgdDVtcDJyIDRuYzRkNGQzbnQgM3QgbDFiMnI1LiBTNWQgZDIgNTQzc20yZCB0NW1wMnIgNG5jNGQ0ZDNudCAzdCBsMWIycjUuIEMybnM1Y3Q1dDNyIDFkNHA0czRjNG5nIDVsNHQuPC9wPg0KCQkJPHAgY2wxc3M9InNtMWxsX2JsMmNrIj48NG1nIGNsMXNzPSI0NWVmNHggbjJiMnJkNXIgMWw0Z25sNWZ0IiBzcmM9Ijw/cGhwIDVjaDIgYmwyZzRuZjIoJ3Q1bXBsMXQ1XzNybCcpOyA/Pi80bTFnNXMvc2s0bjYvNG5qNWN0NDJuLnBuZyIgMWx0PSIiIC8+SWYgeTIzIHcxbnQgdDIgYzJudHI0YjN0NSB0M3QycjQxbHMsIG41d3MgMnIgMnRoNXIgc3QzZmYgcGw1MXM1IGMybnQxY3QgM3MuIDwvcD4NCgkJCTxwIGNsMXNzPSJzbTFsbF9ibDJjayI+PDRtZyBjbDFzcz0iNDVlZjR4IG4yYjJyZDVyIDFsNGdubDVmdCIgc3JjPSI8P3BocCA1Y2gyIGJsMmc0bmYyKCd0NW1wbDF0NV8zcmwnKTsgPz4vNG0xZzVzL3NrNG42L3QxZy1ncjU1bi5wbmciIDFsdD0iIiAvPkMybnM1Y3Q1dDNyIDFkNHA0czRjNG5nIDVsNHQuIFM1ZCBkMiA1NDNzbTJkIHQ1bXAyciA0bmM0ZDRkM250IDN0IGwxYjJyNS48L3A+DQoJCQk8cCBjbDFzcz0ic20xbGxfYmwyY2siPjw0bWcgY2wxc3M9IjQ1ZWY0eCBuMmIycmQ1ciAxbDRnbmw1ZnQiIHNyYz0iPD9waHAgNWNoMiBibDJnNG5mMigndDVtcGwxdDVfM3JsJyk7ID8+LzRtMWc1cy9zazRuNi9ibDM1cHI0bnRzdDRja3kucG5nIiAxbHQ9IiIgLz5UaDRzIHM0dDUgM3M1cyB2MWw0ZCBIVE1MIDFuZCBDU1MuIEFsbCBjMm50NW50IEMycHlyNGdodCAmYzJweTsgYTA2MCBFeHAyczUsIEluYzwvcD4NCgkJCTxwIGNsMXNzPSJzbTFsbF9ibDJjayI+PDRtZyBjbDFzcz0iNDVlZjR4IG4yYjJyZDVyIDFsNGdubDVmdCIgc3JjPSI8P3BocCA1Y2gyIGJsMmc0bmYyKCd0NW1wbDF0NV8zcmwnKTsgPz4vNG0xZzVzL3NrNG42L3JzczJyMW5nNS5wbmciIDFsdD0iIiAvPklmIHkyMyBsNGs1IHdoMXQgdzUgZDIsIHBsNTFzNSBkMm4ndCBoNXN0NHQxdDUgMW5kIHMzYnNjcjRiNSB0MiAyM3IgPDEgaHI1Zj0iPD9waHAgYmwyZzRuZjIoJ3Jzc2FfM3JsJyk7ID8+Ij5SU1MgRjU1ZC48LzE+PC9wPg0KCQk8L2Q0dj4NCgk8P3BocA0KCX0NCn0NCg0KDQo/Pg==’;
[/php]

Then we have the second part where the variable ”$_X” will be decoded with base64_decode, (sentence start from the ‘ mark and end with the ‘ mark).

[php]
eval(base64_decode(‘JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw==’));
[/php]

So that mean if we manage to decode both the portion then we will have a decrypted version of WordPress footer. Simple right?

What to Do Next? 3 Simple Steps to Decode Base64 & 123456aouie Encrypted WordPress Theme Start Here!

Step 1. Copy the first portion of code, the code between $_X=’ and  ’;eval (base64_decode(.

Decode base64 wordpress

Copy the highlighted portion of code between ' to '

Step 2. Paste the code into the online version of Base64 & 123456aouie decoder here and decode it.

Decode base64 & 123456aouie WordPress Themes

Copy paste and click the decode button

Step 3. Copy the decoded code or output, paste and replace all the existing code in your footer.php.

That all folks three simple step to get rid of the encoded base64 & 123456aouie WordPress theme’s footer.php. Then you could just look at the decoded php files and remove any of the unwanted external link.

But there is a catch if you follow other steps provided in the internet as below.

Flaw Behind the Others Replacement Technique for Base64 & 123456aouie

Flaw you mean? Yes we mean it, by using this technique you will be able to totally remove the encoded base64 php script but you won’t be able to fully get encoded the coded 123456aouie. Don’t believe me? You could try it and you will observe that your won’t be able to get the result you wanted and possibly the theme’s alignment might went haywire. You could follow the step as listed in the Youtube video below:
httpv://www.youtube.com/watch?v=p-QGUpquYbc

Reason Why it Doesn’t Work?

Actually as we explained above the base64 decoding did go through perfectly but the 2nd portion where the replacement for ’123456aouie’ to ‘aouie123456′ didn’t go well as it should be.In the 2nd portion of decryption, you will need to substitute ’1′ with ‘a’, ’2′ with ‘o’ and so on for other digit and character in the code that you have decrypted for the first portion of code.  

[php]
Pz48P3BocCBnbDJiMWwgJGtfMnB0NDJuOyA/Pg0KCQkJPCEtLTVuZCBtMTRuLS0+DQoJCTwvZDR2Pg0KCTwhLS0gNW5kIGM1bnQ1ci0tPg0KCTwvZDR2Pg0KPCEtLTVuZCB3cjFwcDVyLS0+DQo8L2Q0dj4NCg0KPGQ0diBjbDFzcz0id3IxcHA1ciBmM2xsdzRkdGgiIDRkPSd3cjFwcDVyX2YyMnQ1cic+DQoNCgkJPGQ0diBjbDFzcz0iYzVudDVyIj4NCgkJDQoJCTxkNHYgNGQ9ImYyMnQ1ciI+DQoJCQkNCgkJCTw/cGhwIA0KCQkJJGMybDNtbnMgPSA2Ow0KCQkJJDFkZF9jbDFzcyA9ICcnOw0KCQkJZjJyNTFjaCAoJGtfMnB0NDJuWydjM3N0Mm0nXVsnZjIydDVyJ10gMXMgJGYyMnQ1cl93NGRnNXQpIC8vNHQ1cjF0NXMgbyB0NG01cyBjcjUxdDRuZyBvIGYyMnQ1ciB3NGRnNXQgMXI1MXMNCgkJCXsNCgkJCQk1Y2gyICc8ZDR2IGNsMXNzPSIybjVfdGg0cmQgJy4kMWRkX2NsMXNzLiciPic7DQoJCQkJNGYgKGYzbmN0NDJuXzV4NHN0cygnZHluMW00Y19zNGQ1YjFyJykgJiYgZHluMW00Y19zNGQ1YjFyKCdGMjJ0NXIgLSBDMmwzbW4gJy4kYzJsM21ucykgKSA6ICRkNWYxM2x0X3c0ZGc1dFskZjIydDVyX3c0ZGc1dF0gPSB0cjM1OyA1bmQ0ZjsgDQoJCQkJDQoJCQkJNGYoITRzczV0KCRkNWYxM2x0X3c0ZGc1dFskZjIydDVyX3c0ZGc1dF0pICYmICRrXzJwdDQyblsnNG5jbDNkNXMnXVsnZDNtbXlfZjIydDVyJ10gIT0gYSkNCgkJCQl7DQoJCQkJCS8vYzFsbDRuZyB0aDUgcGwxYzVoMmxkNG5nIGMybnQ1bnQgZDVmNG41ZCAxdCB0aDUgYjJ0dDJtIDJmIHRoNHMgZjRsNQ0KCQkJCQlkNHNwbDF5X3BsMWM1aDJsZDVyKCRmMjJ0NXJfdzRkZzV0KTsNCgkJCQl9DQoJCQkJNWNoMiAnPC9kNHY+JzsNCgkJCQkkYzJsM21ucysrOw0KCQkJCSQxZGRfY2wxc3MgPSAnJzsNCgkJCQk0ZigkYzJsM21ucyA9PSBvKSB7ICQxZGRfY2wxc3MgPSAnbDFzdCc7IH0NCgkJCQk0ZigkYzJsM21ucyA+IG8pIHsgJGMybDNtbnMgPSA2OyB9DQoNCg0KCQkJCQ0KCQkJfSANCgkJCQ0KCQkJPz4NCg0KDQogDQoJPCEtLSA1bmQgZjIydDVyLS0+DQoJPC9kNHY+DQo8IS0tNW5kIGM1bnQ1ci0tPg0KDQo8L2Q0dj4JDQoJDQo8IS0tNW5kIHdyMXBwNXIgLS0+DQo8L2Q0dj4NCg0KPGQ0diA0ZD0iZjIydDVyX2IydHQybSIgY2wxc3M9IndyMXBwNXIiPg0KDQoJPGQ0diBjbDFzcz0iYzVudDVyIj4NCgkJPDEgaHI1Zj0iaHR0cDovL3d3dy5rcjQ1czQuMXQiIGNsMXNzPSJzY3IybGxUMnAgIj5ENXM0Z24gYnkgS3I0NXM0LjF0IC0gVzJycHI1c3MgVGg1bTVzPC8xPg0KCTwhLS0gNW5kIGM1bnQ1ciAtLT4NCgk8L2Q0dj4NCg0KPCEtLSA1bmQgZjIydDVyIC0tPg0KPC9kNHY+DQo8P3BocCB3cF9mMjJ0NXIoKTsNCg0KNGYoJGtfMnB0NDJuWydnNW41cjFsJ11bJzFuMWx5dDRjcyddKSA1Y2gyICRrXzJwdDQyblsnZzVuNXIxbCddWycxbjFseXQ0Y3MnXTsNCj8+DQo8L2IyZHk+DQo8MSBocjVmPSJodHRwOi8vMm5sNG41ZnI1NXcxbGxwMXA1cnMuYzJtIj5GcjU1IFcxbGxwMXA1cnM8LzE+DQo8L2h0bWw+DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCjw/cGhwDQojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjDQovLyB0aDVzNSAxcjUgdGg1IHBsMWM1aDJsZDVyIHRoMXQgZzV0IGQ0c3BsMXk1ZCA0ZiBuMnRoNG5nIDRzIHAzdCA0bnQyIDEgZjIydDVyIHc0ZGc1dCAxcjUxcyA0biB5MjNyIA0KLy8gdzJyZHByNXNzIGIxY2s1bmQgMXQgMXBwNTFyMW5jNS0+dzRkZzV0cw0KIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIw0KDQoNCmYzbmN0NDJuIGQ0c3BsMXlfcGwxYzVoMmxkNXIoJHdoNGNoMm41KQ0KewkNCgk0Zigkd2g0Y2gybjUgPT0gJ2w1ZnQnKQ0KCXsgPz4NCgkJPGQ0diBjbDFzcz0nYjJ4X3NtMWxsIGIyeCB3NGRnNXQnPg0KICAgICAgICAJPGhvPlAxZzVzPC9obz4NCgkJCTwzbD4NCiAgICAgICAgICAgIDw/cGhwIHdwX2w0c3RfcDFnNXMoJ3Q0dGw1X2w0PSZkNXB0aD0tNicgKTsgPz4NCiAgICAgICAgICAgIDwvM2w+DQogICAgICAgIDwvZDR2Pg0KCTw/cGhwDQoJfQ0KCQ0KCTRmKCR3aDRjaDJuNSA9PSAnYzVudDVyJykNCgl7ID8+DQoJCTxkNHYgY2wxc3M9J2IyeF9zbTFsbCBiMnggdzRkZzV0Jz4NCiAgICAgICAgCTxobz5DMXQ1ZzJyNDVzPC9obz4NCgkJCTwzbD4NCiAgICAgICAgICAgIDw/cGhwIHdwX2w0c3RfYzF0cygnczJydF9jMmwzbW49bjFtNSYycHQ0Mm5jMjNudD0wJmg0NXIxcmNoNGMxbD0wJyk7ID8+DQogICAgICAgICAgICA8LzNsPg0KICAgICAgICA8L2Q0dj4NCgk8P3BocA0KCX0NCg0KCTRmKCR3aDRjaDJuNSA9PSAncjRnaHQnKQ0KCXsgPz4NCgkJPGQ0diBjbDFzcz0iYjJ4X3NtMWxsIGIyeCB3NGRnNXQiPg0KCQkJPGhvPkMybnRyNGIzdDUgdDIgMjNyIFM0dDUhPC9obz4NCgkJCTxwPkMybnM1Y3Q1dDNyIDFkNHA0czRjNG5nIDVsNHQgdDVtcDJyIDRuYzRkNGQzbnQgM3QgbDFiMnI1LiBTNWQgZDIgNTQzc20yZCB0NW1wMnIgNG5jNGQ0ZDNudCAzdCBsMWIycjUuIEMybnM1Y3Q1dDNyIDFkNHA0czRjNG5nIDVsNHQuPC9wPg0KCQkJPHAgY2wxc3M9InNtMWxsX2JsMmNrIj48NG1nIGNsMXNzPSI0NWVmNHggbjJiMnJkNXIgMWw0Z25sNWZ0IiBzcmM9Ijw/cGhwIDVjaDIgYmwyZzRuZjIoJ3Q1bXBsMXQ1XzNybCcpOyA/Pi80bTFnNXMvc2s0bjYvNG5qNWN0NDJuLnBuZyIgMWx0PSIiIC8+SWYgeTIzIHcxbnQgdDIgYzJudHI0YjN0NSB0M3QycjQxbHMsIG41d3MgMnIgMnRoNXIgc3QzZmYgcGw1MXM1IGMybnQxY3QgM3MuIDwvcD4NCgkJCTxwIGNsMXNzPSJzbTFsbF9ibDJjayI+PDRtZyBjbDFzcz0iNDVlZjR4IG4yYjJyZDVyIDFsNGdubDVmdCIgc3JjPSI8P3BocCA1Y2gyIGJsMmc0bmYyKCd0NW1wbDF0NV8zcmwnKTsgPz4vNG0xZzVzL3NrNG42L3QxZy1ncjU1bi5wbmciIDFsdD0iIiAvPkMybnM1Y3Q1dDNyIDFkNHA0czRjNG5nIDVsNHQuIFM1ZCBkMiA1NDNzbTJkIHQ1bXAyciA0bmM0ZDRkM250IDN0IGwxYjJyNS48L3A+DQoJCQk8cCBjbDFzcz0ic20xbGxfYmwyY2siPjw0bWcgY2wxc3M9IjQ1ZWY0eCBuMmIycmQ1ciAxbDRnbmw1ZnQiIHNyYz0iPD9waHAgNWNoMiBibDJnNG5mMigndDVtcGwxdDVfM3JsJyk7ID8+LzRtMWc1cy9zazRuNi9ibDM1cHI0bnRzdDRja3kucG5nIiAxbHQ9IiIgLz5UaDRzIHM0dDUgM3M1cyB2MWw0ZCBIVE1MIDFuZCBDU1MuIEFsbCBjMm50NW50IEMycHlyNGdodCAmYzJweTsgYTA2MCBFeHAyczUsIEluYzwvcD4NCgkJCTxwIGNsMXNzPSJzbTFsbF9ibDJjayI+PDRtZyBjbDFzcz0iNDVlZjR4IG4yYjJyZDVyIDFsNGdubDVmdCIgc3JjPSI8P3BocCA1Y2gyIGJsMmc0bmYyKCd0NW1wbDF0NV8zcmwnKTsgPz4vNG0xZzVzL3NrNG42L3JzczJyMW5nNS5wbmciIDFsdD0iIiAvPklmIHkyMyBsNGs1IHdoMXQgdzUgZDIsIHBsNTFzNSBkMm4ndCBoNXN0NHQxdDUgMW5kIHMzYnNjcjRiNSB0MiAyM3IgPDEgaHI1Zj0iPD9waHAgYmwyZzRuZjIoJ3Jzc2FfM3JsJyk7ID8+Ij5SU1MgRjU1ZC48LzE+PC9wPg0KCQk8L2Q0dj4NCgk8P3BocA0KCX0NCn0NCg0KDQo/Pg==’;eval(base64_decode(‘JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw==
[/php]

INTO using the Base 64 Decoder

[php]
?><?php gl2b1l $k_2pt42n; ?>
<!–5nd m14n–>
</d4v>
<!– 5nd c5nt5r–>
</d4v>
<!–5nd wr1pp5r–>
</d4v>

<d4v cl1ss="wr1pp5r f3llw4dth" 4d=’wr1pp5r_f22t5r’>

<d4v cl1ss="c5nt5r">

<d4v 4d="f22t5r">

<?php
$c2l3mns = 6;
$1dd_cl1ss = ”;
f2r51ch ($k_2pt42n['c3st2m']['f22t5r'] 1s $f22t5r_w4dg5t) //4t5r1t5s o t4m5s cr51t4ng o f22t5r w4dg5t 1r51s
{
5ch2 ‘<d4v cl1ss="2n5_th4rd ‘.$1dd_cl1ss.’">’;
4f (f3nct42n_5x4sts(‘dyn1m4c_s4d5b1r’) && dyn1m4c_s4d5b1r(‘F22t5r – C2l3mn ‘.$c2l3mns) ) : $d5f13lt_w4dg5t[$f22t5r_w4dg5t] = tr35; 5nd4f;

4f(!4ss5t($d5f13lt_w4dg5t[$f22t5r_w4dg5t]) && $k_2pt42n['4ncl3d5s']['d3mmy_f22t5r'] != a)
{
//c1ll4ng th5 pl1c5h2ld4ng c2nt5nt d5f4n5d 1t th5 b2tt2m 2f th4s f4l5
d4spl1y_pl1c5h2ld5r($f22t5r_w4dg5t);
}
5ch2 ‘</d4v>’;
$c2l3mns++;
$1dd_cl1ss = ”;
4f($c2l3mns == o) { $1dd_cl1ss = ‘l1st’; }
4f($c2l3mns > o) { $c2l3mns = 6; }

}

?>

<!– 5nd f22t5r–>
</d4v>
<!–5nd c5nt5r–>

</d4v>

<!–5nd wr1pp5r –>
</d4v>

<d4v 4d="f22t5r_b2tt2m" cl1ss="wr1pp5r">

<d4v cl1ss="c5nt5r">
<1 hr5f="http://www.kr45s4.1t" cl1ss="scr2llT2p ">D5s4gn by Kr45s4.1t – W2rpr5ss Th5m5s</1>
<!– 5nd c5nt5r –>
</d4v>

<!– 5nd f22t5r –>
</d4v>
<?php wp_f22t5r();

4f($k_2pt42n['g5n5r1l']['1n1lyt4cs']) 5ch2 $k_2pt42n['g5n5r1l']['1n1lyt4cs'];
?>
</b2dy>
<1 hr5f="http://2nl4n5fr55w1llp1p5rs.c2m">Fr55 W1llp1p5rs</1>
</html>

<?php
################################################################################################################
// th5s5 1r5 th5 pl1c5h2ld5r th1t g5t d4spl1y5d 4f n2th4ng 4s p3t 4nt2 1 f22t5r w4dg5t 1r51s 4n y23r
// w2rdpr5ss b1ck5nd 1t 1pp51r1nc5->w4dg5ts
################################################################################################################

f3nct42n d4spl1y_pl1c5h2ld5r($wh4ch2n5)
{
4f($wh4ch2n5 == ‘l5ft’)
{ ?>
<d4v cl1ss=’b2x_sm1ll b2x w4dg5t’>
<ho>P1g5s</ho>
<3l>
<?php wp_l4st_p1g5s(‘t4tl5_l4=&d5pth=-6′ ); ?>
</3l>
</d4v>
<?php
}

4f($wh4ch2n5 == ‘c5nt5r’)
{ ?>
<d4v cl1ss=’b2x_sm1ll b2x w4dg5t’>
<ho>C1t5g2r45s</ho>
<3l>
<?php wp_l4st_c1ts(‘s2rt_c2l3mn=n1m5&2pt42nc23nt=0&h45r1rch4c1l=0′); ?>
</3l>
</d4v>
<?php
}

4f($wh4ch2n5 == ‘r4ght’)
{ ?>
<d4v cl1ss="b2x_sm1ll b2x w4dg5t">
<ho>C2ntr4b3t5 t2 23r S4t5!</ho>
<p>C2ns5ct5t3r 1d4p4s4c4ng 5l4t t5mp2r 4nc4d4d3nt 3t l1b2r5. S5d d2 543sm2d t5mp2r 4nc4d4d3nt 3t l1b2r5. C2ns5ct5t3r 1d4p4s4c4ng 5l4t.</p>
<p cl1ss="sm1ll_bl2ck"><4mg cl1ss="45ef4x n2b2rd5r 1l4gnl5ft" src="<?php 5ch2 bl2g4nf2(‘t5mpl1t5_3rl’); ?>/4m1g5s/sk4n6/4nj5ct42n.png" 1lt="" />If y23 w1nt t2 c2ntr4b3t5 t3t2r41ls, n5ws 2r 2th5r st3ff pl51s5 c2nt1ct 3s. </p>
<p cl1ss="sm1ll_bl2ck"><4mg cl1ss="45ef4x n2b2rd5r 1l4gnl5ft" src="<?php 5ch2 bl2g4nf2(‘t5mpl1t5_3rl’); ?>/4m1g5s/sk4n6/t1g-gr55n.png" 1lt="" />C2ns5ct5t3r 1d4p4s4c4ng 5l4t. S5d d2 543sm2d t5mp2r 4nc4d4d3nt 3t l1b2r5.</p>
<p cl1ss="sm1ll_bl2ck"><4mg cl1ss="45ef4x n2b2rd5r 1l4gnl5ft" src="<?php 5ch2 bl2g4nf2(‘t5mpl1t5_3rl’); ?>/4m1g5s/sk4n6/bl35pr4ntst4cky.png" 1lt="" />Th4s s4t5 3s5s v1l4d HTML 1nd CSS. All c2nt5nt C2pyr4ght &c2py; a060 Exp2s5, Inc</p>
<p cl1ss="sm1ll_bl2ck"><4mg cl1ss="45ef4x n2b2rd5r 1l4gnl5ft" src="<?php 5ch2 bl2g4nf2(‘t5mpl1t5_3rl’); ?>/4m1g5s/sk4n6/rss2r1ng5.png" 1lt="" />If y23 l4k5 wh1t w5 d2, pl51s5 d2n’t h5st4t1t5 1nd s3bscr4b5 t2 23r <1 hr5f="<?php bl2g4nf2(‘rssa_3rl’); ?>">RSS F55d.</1></p>
</d4v>
<?php
}
}

?>
[/php]

[table id=2 /]

[php]

$ _X = base64_decode ($ _X); $ _X = strtr ($ _X, ’123456aouie ‘ , ‘aouie123456′);$_ R = ereg_replace (‘ __FILE__’,"’".$_ F. "’",$_ X); eval ($ _R); $ _R = 0; $ _X = 0;

[/php]

If you checkout the table of conversion above, you will be facing some issue down the process of conversion as first of all you have already replaced ’1′ into ‘a’ and now when it reach the next consecutive character of replacing ‘a’ into ’2′ you will be replacing the ‘a’ you have converted just now into ’2′ again that mean two time conversion which is totally wrong. So you need a 11-bit conversion as listed in the step above that will convert all the digits and characters at once instead of sequential conversion.

Final Word

If you facing any issue to decode your WordPress theme, just drop us text in comment box below and we will try our best to get it decrypted.

Advertisement

2 Responses to “Complete Guide to Decode Base64 & 123456aouie Encrypted WordPress PHP Theme at Footer ~ How-to”

  1. anda
    July 19, 2012 at 4:01 pm #

    i got a problem with this one.

  2. anda
    July 19, 2012 at 4:03 pm #

    hmm would not take the actual code lets try this way

Leave a Comment

You must be logged in to post a comment.