What is this encoding, and how do I decode it? - php

Question

I recently obtained a Wordpress theme and cannot figure out what all of this encoding is that contains a massive number of underscores. I have figured out WHAT it does, but I have't figured out how to decode it quicker than one-by-one. Can you
1) tell me what the encoding is? AND
2) how to decode it, quicker?
function aj_________e() {
global $_GET, $wt___q;
$dw________e = rk_______g();
$xt____________m = pc__p();
$zq_______o = iw__________h();
$ci______m = "full";
if ($_GET["wp_cache_cl"] == "197ab5deb39daad8baacae1bdd5a8852") {
if ($zq_______o == "file") {
$rd_________v = $dw________e["dir_upload"]["path"]."/".$xt____________m.".jpg";
if ($wt___q($rd_________v)) {
#unlink($rd_________v);
$ci______m = "deleted";
}
}
$uk___s = array(
"s" => $ci______m,
"t" => time(),
"v" => WP_ID
);
echo "<!--";
foreach ($uk___s AS $ce_____________t => $ik__________m) echo " [$ce_____________t:$ik__________m]";
echo " -->";
}
}

Answer 1

Wordpress is obfucated. You can't read them so easy. About this : http://en.wikipedia.org/wiki/Obfuscation

Answer 2

I think the original author ran this code through some kind of an obfuscator. Perhaps contact them for a clean version?

Answer 3

This code periodically replaces some file contents with updated advertising controlled by the theme supplier. Obfuscated code generally gets its pound of flesh by advertising, including advertising you don't want. (Okay, this code doesn't do that part of the thing - but you have only presented a snippet of the code here.)
The bit you missed out is stuff like this, which assigns the value base64_decode to a variable conveniently named $csGIYFfb. Once you know the values all of the strings, you can read the code:
$HnSjwuR='e';
$JBzO='s';
$CiCHjis='6';
$APNhIK='d';
$TWmEOd='d';
$jygti='_';
$PuGIIg='4';
$nyyif='e';
$mgtv='o';
$AJAsO='a';
$LRRqTj='e';
$KCHbUS='b';
$DjstEZ='c';
$csGIYFfb=$KCHbUS.$AJAsO.$JBzO.$LRRqTj.$CiCHjis.$PuGIIg.$jygti.$TWmEOd.$HnSjwuR.$DjstEZ.$mgtv.$APNhIK.$nyyif;
Just to be clear here, the code you have supplied is hardly obfuscated -- it is merely uglified, with possibly meaningful variable and function names replaced by random strings containing large swathes of underscores. The part of the code you did not present defines the meaning of these functions, which happen to use curl to fill your system with possibly unwanted advertising.