Annoying Coding Methods (solved)

So I finally figured out how to decrypt the insanity of the footer for this theme.

To see what I started out with see the first post –> Annyoing Coding Methods

Simply changing the eval() to echo just printed out a ?> because I found out the first thing in the code was a ?>, so it ended the PHP tag and simply printed out the ending ?> tag.

So… I decided to remove all PHP tags… like <?php <? and ?> with:

<?php
$remove = array(">","<");
$replace = array("&gt;","&lt;");
$string = 'FREAKISHLY LONG ENCRYPTED STRING HERE';
echo str_replace($remove,$replace,gzinflate(str_rot13(base64_decode($string))));
# echo str_replace($remove,$replace,gzinflate(base64_decode($string)));<br />
?>

So that worked liked I hoped it would, BUT it prints out nearly the exact same thing I had to begin with, just with another random string. So I keep replacing cryptic code in the $string variable over and over. The output varied from eval(gzinflate(str_rot13(base64_decode($string)))); to eval(gzinflate(base64_decode($string))); Hence the extra (commented) line in the above code. I probably repeated this method at least 50 times until I actually saw the real source code. (And yes, after doing that I realize that I could have just written a little code to loop through it, but I had no idea how many iterations it would take)

The string of data got smaller and smaller each time. The last string before the real code is only about a fifth of the length of the original:

tVRdb5swFH3OpP2HOx6WRCrQZm8ZpdKkVX1opCqNtr5FBi7g1djMNk3z73exE5q0Vbs97AXM/Tgcn3vsi3SUFPwBeHEebHhRoTVB+vHDyEdzwYzZJ4o+kVy0dQu8hAmUncwtV3KNj9xYMxkXW8kanq8NLzBjejyFz5/hWXAyvsbSwqVSFvuKKcwBhUF6Xbj/jpJO+MUoEdzxYsFApArSpJ4d87LcCgzSJeYoLbSKuCRxPduBHODR2rGnnjXTec0fkFj3Ddm2f45Pxmen9Mg7Y1VDCyKQ9q+4f0+/7hkSTvxEsk964j7o/4Gy4GXfAU7MmNT8v7IueVX/o675X+m6QMte6ukhHetNu9ZYEVfUk51IPkvCDBVCVVyqzvqKA9H6Iga1xvI8qK1t53H8wAQvmFU62nyJlK7ivMb8PqYS1KgDcMTOg1XNDbSsQtg1oAFm4O5qtbiGs+gUbq3muQ3SH30aEpZlet+Ldxal4ZlAuNq2qFf4aGHB9H3XwjWTVUewQfocKol7DGLP3tnBRumi1WiMoz8wvlEb2kEB2RZ+UsVNX3ECxhL1UJWhrTFk2oLBhknLcyBiRkkmoO0ywU3NZQWtYLZUuomCdMA4IHQ8l4ZmdzSTt637ZNRXTDx4eLgvSme23XXhGjI35lJNxuRO9EcGQnja9xzekep4U8Bk8bJjs4l+YVkKLsQ2ylUTN3RgaWghtZFrWH96CGnho7B8ijrM8FVEi3kttRKiRwzSFX2ChCUF3mgiDnTqrMpUobvGd166GFgF31y0b4+cRKZlcqf3HqtELObPtdPGzNadFl6/IP0uyX1k7sny9nbqZz1AOVA/jVlwlPgUEmc/xrxW7tKTXbP+3WEP5l0Bu69oV2l5g3pNcrWTM19gMFeyoIIwTA9MMDjMe2DvsSEdkyJbt6htI+ga+AM=

I repeated the workflow one more time and was excited to see real code!
</p> <div id="widgets"> <div class="widgetd"> <php if ( function_exists('dynamic_sidebar') && dynamic_sidebar('Left Footer') ) : else : ?> <ul> <li id="a" class="wg"> <h2 class="widgettitle">Recent posts</h2> <p> <ul><span style="color: #0000BB" mce_style="color: #0000BB"><?php get_archives</span><span style="color: #007700" mce_style="color: #007700">(</span><span style="color: #DD0000" mce_style="color: #DD0000">‘postbypost’</span><span style="color: #007700" mce_style="color: #007700">,</span><span style="color: #DD0000" mce_style="color: #DD0000">‘10′</span><span style="color: #007700" mce_style="color: #007700">,</span><span style="color: #DD0000" mce_style="color: #DD0000">‘custom’</span><span style="color: #007700" mce_style="color: #007700">,</span><span style="color: #DD0000" mce_style="color: #DD0000">‘ <li>‘</span><span style="color: #007700" mce_style="color: #007700">,</span><span style="color: #DD0000" mce_style="color: #DD0000">‘</li> <p>‘</span><span style="color: #007700" mce_style="color: #007700">); </span><span style="color: #0000BB" mce_style="color: #0000BB">?><br /></span></ul> <p></li> <p></ul> <p><span style="color: #0000BB" mce_style="color: #0000BB"><?php </span><span style="color: #007700" mce_style="color: #007700">endif; </span><span style="color: #0000BB" mce_style="color: #0000BB">?><br /></span></div> <p> <div class="widgetd"><span style="color: #0000BB" mce_style="color: #0000BB"><?php </span><span style="color: #007700" mce_style="color: #007700">if ( </span><span style="color: #0000BB" mce_style="color: #0000BB">function_exists</span><span style="color: #007700" mce_style="color: #007700">(</span><span style="color: #DD0000" mce_style="color: #DD0000">‘dynamic_sidebar’</span><span style="color: #007700" mce_style="color: #007700">) && </span><span style="color: #0000BB" mce_style="color: #0000BB">dynamic_sidebar</span><span style="color: #007700" mce_style="color: #007700">(</span><span style="color: #DD0000" mce_style="color: #DD0000">‘Right Footer’</span><span style="color: #007700" mce_style="color: #007700">) ) : else : </span><span style="color: #0000BB" mce_style="color: #0000BB">?><br /></span> <ul> <li id="c" class="wg"> <h2 class="widgettitle">Meta</h2> <p> <ul></p> <p><span style="color: #0000BB" mce_style="color: #0000BB"><?php wp_register</span><span style="color: #007700" mce_style="color: #007700">(); </span><span style="color: #0000BB" mce_style="color: #0000BB">?><br /></span> <li><span style="color: #0000BB" mce_style="color: #0000BB"><?php wp_loginout</span><span style="color: #007700" mce_style="color: #007700">(); </span><span style="color: #0000BB" mce_style="color: #0000BB">?></span></li> <p> <li><a href="http://validator.w3.org/check/referer" title="This page validates as XHTML 1.0 Strict">Valid <abbr title="eXtensible HyperText Markup Language">XHTML 1.0 Strict</abbr></a></li> <p> <li><a href="http://wordpress.org/" title="Powered by WordPress, state-of-the-art semantic personal publishing platform.">WordPress</a></li> </p> <p><span style="color: #0000BB" mce_style="color: #0000BB"><?php wp_meta</span><span style="color: #007700" mce_style="color: #007700">(); </span><span style="color: #0000BB" mce_style="color: #0000BB">?><br /></span></ul> <p></li> <p></ul> <p></div> <p><span style="color: #0000BB" mce_style="color: #0000BB"><?php </span><span style="color: #007700" mce_style="color: #007700">endif; </span><span style="color: #0000BB" mce_style="color: #0000BB">?><br /></span></div> <p> <div id="footer"><span style="color: #0000BB" mce_style="color: #0000BB"><?php bloginfo</span><span style="color: #007700" mce_style="color: #007700">(</span><span style="color: #DD0000" mce_style="color: #DD0000">‘name’</span><span style="color: #007700" mce_style="color: #007700">); </span><span style="color: #0000BB" mce_style="color: #0000BB">?></span> – Powered by: <a href="http://wordpress.org/">WordPress</a> and <a href="http://www.jefflilly.com/mustang-restoration/">Mustang Restoration</a> – <a href="http://www.technroll.com">Tech n Roll</a> – <a href="http://www.flighttobodrum.com">Flight to Bodrum</a>.<br /><span><br /><a href="feed:<span style="color: #0000BB" mce_style="color: #0000BB"><?php bloginfo</span><span style="color: #007700" mce_style="color: #007700">(</span><span style="color: #DD0000" mce_style="color: #DD0000">‘rss2_url’</span><span style="color: #007700" mce_style="color: #007700">); </span><span style="color: #0000BB" mce_style="color: #0000BB">?></span>“>Entries (RSS)</a></span><br /><span id="f2"></span><br /><!-- <span style="color: #0000BB" mce_style="color: #0000BB"><?php </span><span style="color: #007700" mce_style="color: #007700">echo </span><span style="color: #0000BB" mce_style="color: #0000BB">get_num_queries</span><span style="color: #007700" mce_style="color: #007700">(); </span><span style="color: #0000BB" mce_style="color: #0000BB">?></span> queries. <span style="color: #0000BB" mce_style="color: #0000BB"><?php timer_stop</span><span style="color: #007700" mce_style="color: #007700">(</span><span style="color: #0000BB" mce_style="color: #0000BB">1</span><span style="color: #007700" mce_style="color: #007700">); </span><span style="color: #0000BB" mce_style="color: #0000BB">?></span> seconds. –></div> <p><span style="color: #0000BB" mce_style="color: #0000BB"><?php wp_footer</span><span style="color: #007700" mce_style="color: #007700">(); </span><span style="color: #0000BB" mce_style="color: #0000BB">?><br /></span></div> <p></body><br /></html>

You’ll notice instead of <?php it printed out php because they were removed with the str_replace function. There’s also no ending ?> tags at the end of the PHP code but simply replace them where they belong and remove the links in the end and you’re done!
Update: changed the str_replace() search/replace terms so now everything will look like it should (for some reason I overlooked this simple correction a week ago … lol
I’ve got no idea why the person that made this theme felt it necessary to keep their blasted links so sacred … whatever.