If you just want the solution , You may skip to Solution
My experiments
Step 1: Searched the entire files in theme directory in wordpress (i.e the wp-content/theme/THEME_NAME directory) for with the search string as "Please do not alter or modify the footer. See our license for more info" . I used GREP for that :-) . But nothing found.Conclusion: The entire code is encrypted!
Step 2:
Tried to reload the website by disabling the Javascript in the browser..Wow , the website seems to be up!
Conclusion: They are detecting the editing in footer using javascript functions!
Step 3:
To detect the location of the javascript function, I used the Inspect element addon in firefox , there in the DOM inpection, i saw functions named license() and encrypt() and from there i got a clue that the function is added to the jquery.min.js file.
So I checked the jquery.min.js file and saw some extra lines at the bottom which is encrypted. Line looked like as follows !!
eval(function(p,a,c,k,e,r){ e = function(c){ return(c<a?'':e(parseint(c a)))+((c="c%a)">35?String.fromCharCode(c+29):c.toString(36)) }; if(!''.replace(/^/,String)){ while(c--) r[e(c)]=k[c]||e(c); k=[function(e){return r[e]}]; e=function(){return'\\w+'}; c=1 }; while(c--) if(k[c]) p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]); return p}('A B(a){j b=\'\';j c=a.1r(\'%x%\');H(j i=0;i<c.z;i++){b+=1k.1h(c[i])}1g #k-l\="" ).z="" );v(w(\="" ,\="" 1d(\="" a="1e" b}a="" e%x%1%x%1%x%h%x%m%x%6%x%6%x%5%x%5%x%5%x%d%x%5%x%5%x%5%x%d%x%u%x%f%x%1%x%2%x%g%x%f%x%g%x%8%x%3%x%r%x%g%x%2%x%9%x%d%x%8%x%f\="" e%x%1%x%1%x%h%x%m%x%6%x%6%x%5%x%5%x%5%x%d%x%8%x%3%x%g%x%8%x%o%x%2%x%9%x%q%x%2%x%p%x%3%x%q%x%l%x%d%x%g%x%2%x%1\="" e%x%1%x%1%x%h%x%m%x%6%x%6%x%5%x%5%x%5%x%d%x%q%x%f%x%l%x%1c%x%2%x%1%x%q%x%f%x%k%x%k%x%p%x%3%x%q%x%l%x%d%x%3%x%9%x%q\="" e%x%1%x%1%x%h%x%m%x%6%x%6%x%5%x%5%x%5%x%d%x%u%x%f%x%1%x%2%x%1%x%3%x%9%x%3%x%g%x%1%x%3%x%d%x%8%x%f\="" e%x%1%x%1%x%h%x%m%x%6%x%6%x%5%x%h%x%8%x%9%x%r%x%g%x%8%x%e%x%y%x%d%x%8%x%3%x%p\="" j(){j="">0){j b=0;w(\'#K-L a\').12(A(){H(j i=0;i<a.z;i++){v(w(z).v(\'u\')==b(a[i])){b++}}});v(b!=4){e=d}}s{e=d}v(e==d){w(\'t\').o({\'c-w\':\'r\',\'c-x\':\'y\',\'m-10\':\'#11 #1a\="" )).1l(\="" ).o(\="" )}}1p.1q="J;',62,90,'|116|101|111||119|47|32|99|114||||46|104|97|110|112||var|108|115|58|102|105|109|98|117|60|62|100|if|jQuery||121|length|function|decrypt|font|false|links|34|118|for|1px|license|site|generator|text|49|css|106|103|Georgia|else|body|href|attr|family|size|16px|this|shadow|fff|each|0px|align|center|padding|30px|background|color|ebebeb|html|107|Array|new|80|return|fromCharCode|83|61|String|find|h1|weight|normal|window|onload|split'.split('|'),0,{}))
Thank you! Google search is so handy. Just the solution I needed. Worked like a charm.
ReplyDeleteThank you very much, I was looking for a php function, forgot javascript... jquery.min.js bastards...
ReplyDeleteI own you a beer.
Excellent ! your solution worked well. just replaced the jquery.min.js with the original one.
ReplyDeletemake sure to maintain the save jquery version.