Last night I went to a local shop that was having a seminar on tires and chains, and it was awesome. Now, I knew as I was leaving that I'd be hitting rain, but it didn't look like it'd get terribly nasty, and, hey, I have the gear for it! When I left I packed everything up (zip-lock bags for everything I care about, rain pants on over my jeans and pads, plastic bags inside my boots) in case I hit rain before getting to the shop. Only bit that I carried with without wearing was my rain jacket as it was HOT out (in all black leather). I learned all this on my trip back from Indiana, and how important staying dry is for maintaining your concentration. The last 5 miles or so of my trip to the shop was a mad dash through the rain, rather than putting my jacket on, as I was close enough that I didn't want to stop. However, I got there almost on time, and mostly dry.

The seminar was great, I learned a ton, but some people kept asking questions, and I saw the sky outside get darker, and darker. Finally we got to the end (checking out the bikes of the few people that road) and I got mine in second. After thanking everyone for putting it on (free of charge!) I geared up to roll out.

To set the stage, it was about 9:15, pitch black, and thunder storming, but I assumed that I was good to go. I had all my gear (except for rubber kitchen gloves under my leathers, as I felt I'd be done soon enough) on and had 240 miles of rainy riding at Interstate speeds with rain gear, and forced myself to experience riding without rain gear for about 10-15 miles in pouring rain just in case. I was fairly confident that if I just stayed off the major highways I'd be fine. That little instinct probably saved me a world of hurt.

As I pulled out onto the first road I flipped my face shield down to block out the rain, and was a bit annoyed at how dirty it was. I tried to wipe it off, but it didn't help. With rain on there, and probably all the bug guts and dirt from my Indiana trip, any ambient light washed out my vision completely. Cars coming towards me rendered my vision useless. I started to experiment with opening the face shield slightly over the next mile, but I simply couldn't see any signs well enough to read them, or judge distances in the best of circumstances, and couldn't even see my speedometer in the worst.

50 miles from home, that late at night, there's not too many options. I could have stopped, tried to clean my helmet (with what?), tried to figure out how to cut down on glare from cars (it has a built in sun visor), or kept riding and opened the shield. I kept riding and opened the shield.

From my experience coming home from Rolling Thunder I knew what rain felt like on bare skin, and hard rain through leathers, but I'd yet to be smacked in the face by it at speed. Its not fun without goggles, as every time you turn your head to check a cross street, look down to check your speedometer, or look up to read a sign rain blasts into your eyes, and of course you can't close them, you're moving at speed. In addition, simply looking forwards your face is getting smacked by rain... and water at 50mph stings.

After a few miles on the outskirts of the town this shop was in, it started to really suck. The street lights started disappearing, the street moved down to one lane, and my glasses were well and truly soaking wet. My vision was maybe at 100 feet, and for pot holes and debris in the road it was literally when I hit it, I'd know. I basically picked a mini-van, and stayed behind it, following their lights into the darkness. Then we got into tree-lined on both sides, and there was no ambient light, I actually preferred this, as with no cars coming I could actually see! However, with cars coming I was again unable to see anything but the car's headlights.

Around here, sucky turned worse. My engine started sputtering when I'd idle. So the first stop light I pulled up to, I saw my RPMs start dropping, the engine coughed, and she shut off. Not this again. This happened in the rain storm after Rolling Thunder, and the only solution was to keep RPMs up around 5-7k (idle is around 2k). As I'd rev, great spouts of steam would come flying out the front of my bike like a pissed off dragon coming awake (it'd be colored red from the car tail lights in front of me). Naturally this means that to stop I couldn't clutch in, drop to first gear, and brake. I had to clutch in, set my throttle quickly to about 50% and brake (using on the front brake in the water) while holding the throttle in the same hand. Cramp Buster saved my life... maybe literally. Oh, and fun fact, if your glasses' lenses are at the temperature of air moving at 30mph, and soaking wet, what happens when you stop at a light? That's right, completely fogged up. One hand on the clutch, one on the throttle/brake... there's no way to take them off and nothing to clean them with if you could.

So the rest of the 30 miles to home is a blur of adrenaline influenced memories of lighting cracking overhead, thunder rolling by (only at stop lights, couldn't hear it as I was moving), pot holes barely avoided and not avoided, shoulders ridden on, medians missed by inches, and me screaming the Dropkick Murphies' version of Amazing Grace into the night. I had two guys try to take me out, one caught himself, the other I had time to avoid.... I'm sure he saw me, simply didn't care. Ate water from a semi cab hitting a pot hole next to me, and nearly caught a deer (it crossed in front of the car behind me).

Most terrifying ride of my life.

But... I'd experienced riding in the rain, so that didn't scare me. I'd experienced what rain feels like on bare skin, so while it stung it didn't phase me past the first 5 minutes. I'd ridding at night and in thunder storms, so those weren't the bits that bugged me. What scared me was not knowing what was more than a second in front of me for more than 90% of that ride, and knowing that if something did come up I had no escape options. Thanks to the practice I forced on myself earlier in my riding career (and someone looking out for me), this situation turned out alright. I made it home within an hour and a half, I didn't hit a single object, and I think my bike isn't very messed up. When I arrived home, I got off the bike, looked up into the sky, and pulled a Shawshank Redemption, amazed and thankful that I was home, and in one piece.

So the next time you think "Gee, I could do X, but its a little not good for it right now" ask yourself if you might ever be caught in the same situation without experiencing it. Then go out and experience it so you can have some control over the circumstances, I'm so thankful I did.

 
/* V8 - WARNING: This file is protected by copyright law.
To reverse engineer or decode this file is strictly prohibited. */
 

Well that's weird, because in the style.css we read:

/*The CSS, XHTML and design is released under GPL*/

(Side note, if you don't know what we mean by GPL, check out their site.)

No, they don't say PHP in there, however I read that (because 'design' is included) as "This theme is GPL'd". Poking around their website, I see no mention that you're required to keep any part of the theme the same.

If we read past the warning about reverse engineering, we see why they included it, a nasty big base64 encoded blob, then an eval command. Pastebin paste is here.

This piqued my interest, as I can think of very few legitimate reasons to do such obfuscation, or why there should be so much (footer.php is 47kb!). My initial thought was that I'd opened a backdoor into my site, with lesser thoughts to them being able to push random stuff into my footer (the last way I was infected), and finally just trying to control the links on the bottom of the page so that even if I were to edit their theme (as is my right under the GPL) I couldn't take credit for it myself, they'd always have credit for it. None of those sat right with me, so I hit up the local IRC channel, and we started puzzling.

First I base64_decode'd the garbage that was being run from the eval command (and yes, its gonna overflow the line by a LOT):

 
$lll=0;eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));$ll=0;eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));$llll=0;$lllll=3;eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));$lllllll=0;$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));$lllllllll=16;$llllllll="";for(;$lllll<$lllllllllllll($l);){if($lllllllll==0){$llllll=($llllllllll($l[$lllll++])<<8);$llllll+=$llllllllll($l[$lllll++]);$lllllllll=16;}if($llllll&0x8000){$lll=($llllllllll($l[$lllll++])<<4);$lll+=($llllllllll($l[$lllll])>>4);if($lll){$ll=($llllllllll($l[$lllll++])&0x0f)+3;for($llll=0;$llll<$ll;$llll++)$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];$lllllll+=$ll;}else{$ll=($llllllllll($l[$lllll++])<<8);$ll+=$llllllllll($l[$lllll++])+16;for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));$lllll++;$lllllll+=$ll;}}else$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);$llllll<<=1;$lllllllll--;}eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));$lllll=0;eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));$llllllllll="";for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));eval($lllllllll);
 

If you want to be able to READ that:

 
<?php
    $lll=0;
    eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));
    $ll=0;
    eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));
    $llll=0;
    $lllll=3;
    eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));
    $lllllll=0;
    $llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);
    eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));
    $lllllllll=16;
    $llllllll="";
    for(;$lllll<$lllllllllllll($l);){
        if($lllllllll==0){
            $llllll=($llllllllll($l[$lllll++])<<8);
            $llllll+=$llllllllll($l[$lllll++]);
            $lllllllll=16;
        }if($llllll&0x8000){
            $lll=($llllllllll($l[$lllll++])<<4);
            $lll+=($llllllllll($l[$lllll])>>4);
            if($lll){
                $ll=($llllllllll($l[$lllll++])&0x0f)+3;
                for($llll=0;$llll<$ll;$llll++)
                    $llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];
                $lllllll+=$ll;
            }else{
                $ll=($llllllllll($l[$lllll++])<<8);
                $ll+=$llllllllll($l[$lllll++])+16;
                for($llll=0;
                    $llll<$ll;
                    $llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));
                $lllll++;
                $lllllll+=$ll;
            }
        } else
            $llllllll[$lllllll++]=$llllllllll($l[$lllll++]);
        $llllll<<=1;
        $lllllllll--;
    }
    eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));
    $lllll=0;
    eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));
    $llllllllll="";
    for(;$lllll<$lllllll;){
        $llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);
    }
    eval($lllllllllll(
        "JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));
    eval($lllllllll);
?>
 

Wonderful, more base64 junk, and obfuscation. Yea, when was the last time you read a legitimate program that looked as the above (not in Perl). Been a while for me as well. So we went to work first by translating all the base_64 junk into english. Please note that the very first eval binds $lllllllllll to base64_decode so I've gone ahead and done that part already. I removed the eval() calls, and replaced them with the base64 translation on every line ending in //here.

 
<?php
 
    $lll=0;
    $lllllllllll='base64_decode'; //here
    $ll=0;
    $llllllllll='ord';  //here
    $llll=0;
    $lllll=3;
    $l=$lllllllllll($o); //here
    $lllllll=0;
    $llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);
    $lllllllllllll='strlen'; //here
    $lllllllll=16;
    $llllllll="";
    for(;$lllll<$lllllllllllll($l);){
        if($lllllllll==0){
            $llllll=($llllllllll($l[$lllll++])<<8);
            $llllll+=$llllllllll($l[$lllll++]);
            $lllllllll=16;
        }if($llllll&0x8000){
            $lll=($llllllllll($l[$lllll++])<<4);
            $lll+=($llllllllll($l[$lllll])>>4);
            if($lll){
                $ll=($llllllllll($l[$lllll++])&0x0f)+3;
                for($llll=0;$llll<$ll;$llll++)
                    $llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];
                $lllllll+=$ll;
            }else{
                $ll=($llllllllll($l[$lllll++])<<8);
                $ll+=$llllllllll($l[$lllll++])+16;
                for($llll=0;
                    $llll<$ll;
                    $llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));
                $lllll++;
                $lllllll+=$ll;
            }
        } else
            $llllllll[$lllllll++]=$llllllllll($l[$lllll++]);
        $llllll<<=1;
        $lllllllll--;
    }
    $llllllllllll='chr'; //here
    $lllll=0;
    $lllllllll="?".$llllllllllll(62); //here
    $llllllllll="";
    for(;$lllll<$lllllll;){
        $llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);
    }
    $lllllllll.=$llllllllll.$llllllllllll(60)."?"; //here
    eval($lllllllll);
?>
 

Next we perform the variable transformations that the first few eval() calls call for. Please note that towards the bottom there are a few variables we can't simply replace just yet.

 
<?php
 
    $lll=0;
    $ll=0;
    $llll=0;
    $lllll=3;
    $l=base64_decode($o); //Leaving this since I only want it to evaluate once
    $lllllll=0;
    $llllll=(ord($l[1])<<8)+ord($l[2]);
    $lllllllll=16;
    $llllllll="";
    for(;$lllll<strlen($l);){
        if($lllllllll==0){
            $llllll=(ord($l[$lllll++])<<8);
            $llllll+=ord($l[$lllll++]);
            $lllllllll=16;
        }if($llllll&0x8000){
            $lll=(ord($l[$lllll++])<<4);
            $lll+=(ord($l[$lllll])>>4);
            if($lll){
                $ll=(ord($l[$lllll++])&0x0f)+3;
                for($llll=0;$llll<$ll;$llll++)
                    $llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];
                $lllllll+=$ll;
            }else{
                $ll=(ord($l[$lllll++])<<8);
                $ll+=ord($l[$lllll++])+16;
                for($llll=0;
                    $llll<$ll;
                    $llllllll[$lllllll+$llll++]=ord($l[$lllll]));
                $lllll++;
                $lllllll+=$ll;
            }
        } else
            $llllllll[$lllllll++]=ord($l[$lllll++]);
        $llllll<<=1;
        $lllllllll--;
    }
    $lllll=0;
    $lllllllll="?".chr(62); //Leaving as we can't evaluate yet.
    $llllllllll="";
    for(;$lllll<$lllllll;){
        $llllllllll.=chr($llllllll[$lllll++]^0x07);
    }
    $lllllllll.=$llllllllll.chr(60)."?"; //Leaving as we can't evaluate yet.
    eval($lllllllll);
?>
 

Now, let's make it readable by translating all those $l variables into english letters. First one will be $a, next $b, etc etc. Alright, I missed one and had to go back, but here it is.

 
<?php
 
    $a=0;
    $b=0;
    $c=0;
    $d=3;
    $l=base64_decode($o); //leaving this as $l
    $e=0;
    $g=(ord($l[1])<<8)+ord($l[2]); //whoops, skipped one...
    $f=16;
    $h="";
    for(;$d<strlen($l);){
        if($f==0){
            $g=(ord($l[$d++])<<8);
            $g+=ord($l[$d++]);
            $f=16;
        }if($g&0x8000){
            $a=(ord($l[$d++])<<4);
            $a+=(ord($l[$d])>>4);
            if($a){
                $b=(ord($l[$d++])&0x0f)+3;
                for($c=0;$c<$b;$c++)
                    $h[$e+$c]=$h[$e-$a+$c];
                $e+=$b;
            }else{
                $b=(ord($l[$d++])<<8);
                $b+=ord($l[$d++])+16;
                for($c=0;
                    $c<$b;
                    $h[$e+$c++]=ord($l[$d]));
                $d++;
                $e+=$b;
            }
        } else
            $h[$e++]=ord($l[$d++]);
        $g<<=1;
        $f--;
    }
    $d=0;
    $f="?".chr(62); //here
    $i="";
    for(;$d<$e;){
        $i.=chr($h[$d++]^0x07);
    }
    $f.=$i.chr(60)."?"; //here
    eval($f);
?>
 

At this point its almost readable, although astute observers will have noted one variable that's weird. $o is wrapped in a base64_decode call, and bound to $l. $o is, shockingly enough, 44K of... packed binary. I didn't notice this until someone else pointed it out, I just glossed over all that junk and had started on the obvious eval command. To get a good view of it, try here.

Line 9 of the above can be simplified, so let's do that and turn it into the following (just to get an idea of the exact numbers we can). We can also run the strlen() call and learn that the length of $l is 33222! Geez... So let's replace that in the for loop on (old) line 12. $e after the massive loop becomes 83760, we can replace that also. And finally I replace the chr() calls towards the end and just put them into the strings that they're concatted to.

 
    $ga = ord($l[1])<<8; //48
    $gb = ord($l[2]); //0
    $g = $ga + $gb; //48
    ....
    for(;$d<33222;){
    ....
    $f="?>";
    ....
    for(;$d<83760;){
    ....
    $f.=$i."<?";
 

So, where does this leave us? We have a nice little (readable) script that does (something) on a HUGE bit of packed binary. Now, if you look at the for loop there, its not going to be fun to step through. Our index goes up to 33222, and is incremented by at most 6 every iteration. At worst you'll be stepping by 1. Well, the eval() command isn't until the end, so lets just see what that nasty big loop spits out, hmm? As long as you die() before the eval command, you'll be alright. What this spits out is a nasty huge array...

 
Array
(
    [0] => 59
    [1] => 56
    [2] => 119
    [3] => 111
    [4] => 119
    [5] => 13
    //....<snip 83000ish lines>
    [83754] => 97
    [83755] => 60
    [83756] => 13
    [83757] => 13
    [83758] => 56
    [83759] => 57
)
 

Now that's just lovely. Hmm, but looking at the values it gives me an idea. I decided to spit out an array of the values from the right side, and how many times they're referenced.

 
Array
(
    [59] => 93
    [56] => 1
    [119] => 1110
    [111] => 2748
    [13] => 630
    [36] => 70
    [35] => 349
    [99] => 1773
    [98] => 8490
    [101] => 1112
    [114] => 3197
    [96] => 1525
    [39] => 7322
    [58] => 227
    [54] => 153
    [60] => 577
    [107] => 3064
    [110] => 3057
    [105] => 4299
    [108] => 1170
    [102] => 4179
    [125] => 766
    [51] => 94
    [104] => 2476
    [116] => 3241
    [115] => 4404
    [88] => 414
    [84] => 541
    [66] => 354
    [85] => 163
    [81] => 130
    [92] => 19
    [32] => 1487
    [79] => 425
    [83] => 386
    [87] => 187
    [72] => 101
    [90] => 19
    [97] => 635
    [47] => 127
    [46] => 127
    [100] => 2031
    [37] => 305
    [61] => 391
    [41] => 886
    [117] => 4419
    [57] => 100
    [86] => 2
    [82] => 79
    [78] => 59
    [106] => 1421
    [69] => 438
    [112] => 1295
    [42] => 688
    [126] => 198
    [40] => 1630
    [53] => 110
    [52] => 82
    [55] => 105
    [63] => 30
    [67] => 209
    [74] => 153
    [50] => 74
    [48] => 37
    [62] => 27
    [113] => 313
    [89] => 3
    [43] => 3496
    [70] => 297
    [73] => 169
    [68] => 172
    [80] => 271
    [14] => 1161
    [65] => 243
    [76] => 337
    [127] => 186
    [95] => 10
    [93] => 47
    [64] => 213
    [33] => 442
    [75] => 103
    [49] => 34
    [118] => 5
    [77] => 36
    [109] => 41
    [124] => 17
    [122] => 17
    [44] => 10
    [34] => 21
    [45] => 9
    [123] => 5
)
 

The minimum is 13, and the max is 127, so these do fit nicely on an ASCII table. Now, 13 is a LOT smaller than I expected (down at carriage return), but such is life. Sorted it looks a bit better, but doesn't map nicely to the ASCII values I'd hoped to see the most of.

 
Array
(
    [13] => 630
    [14] => 1161
    [32] => 1487
    [33] => 442
    [34] => 21
    [35] => 349
    [36] => 70
    [37] => 305
    [39] => 7322
    [40] => 1630
    [41] => 886
    [42] => 688
    [43] => 3496
    [44] => 10
    [45] => 9
    [46] => 127
    [47] => 127
    [48] => 37
    [49] => 34
    [50] => 74
    [51] => 94
    [52] => 82
    [53] => 110
    [54] => 153
    [55] => 105
    [56] => 1
    [57] => 100
    [58] => 227
    [59] => 93
    [60] => 577
    [61] => 391
    [62] => 27
    [63] => 30
    [64] => 213
    [65] => 243
    [66] => 354
    [67] => 209
    [68] => 172
    [69] => 438
    [70] => 297
    [72] => 101
    [73] => 169
    [74] => 153
    [75] => 103
    [76] => 337
    [77] => 36
    [78] => 59
    [79] => 425
    [80] => 271
    [81] => 130
    [82] => 79
    [83] => 386
    [84] => 541
    [85] => 163
    [86] => 2
    [87] => 187
    [88] => 414
    [89] => 3
    [90] => 19
    [92] => 19
    [93] => 47
    [95] => 10
    [96] => 1525
    [97] => 635
    [98] => 8490
    [99] => 1773
    [100] => 2031
    [101] => 1112
    [102] => 4179
    [104] => 2476
    [105] => 4299
    [106] => 1421
    [107] => 3064
    [108] => 1170
    [109] => 41
    [110] => 3057
    [111] => 2748
    [112] => 1295
    [113] => 313
    [114] => 3197
    [115] => 4404
    [116] => 3241
    [117] => 4419
    [118] => 5
    [119] => 1110
    [122] => 17
    [123] => 5
    [124] => 17
    [125] => 766
    [126] => 198
    [127] => 186
)
 

Thankfully we're not done yet, notice that these values are called along with a ^0x07... so maybe if we change the list to reflect this operation it'll look better. In order to make it tidy, and to continue the assumption, I've substituted the character for the integer.

 
Array
(
    [<tab>] => 1161
    [
<line feed>] => 630
    [ ] => 7322
    ["] => 305
    [#] => 70
    [$] => 349
    [%] => 21
    [&] => 442
    ['] => 1487
    [(] => 127
    [)] => 127
    [*] => 9
    [+] => 10
    [,] => 3496
    [-] => 688
    [.] => 886
    [/] => 1630
    [0] => 105
    [1] => 153
    [2] => 110
    [3] => 82
    [4] => 94
    [5] => 74
    [6] => 34
    [7] => 37
    [8] => 30
    [9] => 27
    [:] => 391
    [;] => 577
    [<] => 93
    [=] => 227
    [>] => 100
    [?] => 1
    [A] => 297
    [B] => 438
    [C] => 172
    [D] => 209
    [E] => 354
    [F] => 243
    [G] => 213
    [H] => 425
    [I] => 59
    [J] => 36
    [K] => 337
    [L] => 103
    [M] => 153
    [N] => 169
    [O] => 101
    [P] => 187
    [Q] => 2
    [R] => 163
    [S] => 541
    [T] => 386
    [U] => 79
    [V] => 130
    [W] => 271
    [X] => 10
    [Z] => 47
    [[] => 19
    []] => 19
    [^] => 3
    [_] => 414
    [a] => 4179
    [b] => 1112
    [c] => 2031
    [d] => 1773
    [e] => 8490
    [f] => 635
    [g] => 1525
    [h] => 2748
    [i] => 3057
    [j] => 41
    [k] => 1170
    [l] => 3064
    [m] => 1421
    [n] => 4299
    [o] => 2476
    [p] => 1110
    [q] => 5
    [r] => 4419
    [s] => 3241
    [t] => 4404
    [u] => 3197
    [v] => 313
    [w] => 1295
    [x] => 186
    [y] => 198
    [z] => 766
    [{] => 17
    [|] => 5
    [}] => 17
)

This looks good to me. notice the matched braces (17 each), matched parens (127 each), and almost matched carrots (93 and 100). Also take note that there's much more lowercase than uppercase letters, and that lowercase 'e' is far above the other letters, implying this has English words (or at least English something) in it.

And again we end up with a nasty large for loop, completely worthless to try to step through:

 
    for(;$d<83760;){
        $i.=chr($h[$d++]^0x07);
    }
 

83760 steps in that loop, building whatever it is we're going to eval at the end char by char! I'm going to cheat again, run the loop, spit out the result, and die before the eval. Looks like 632 lines of... more php! Yay, this time its not obfuscated!

It starts off with 410 lines of 4 arrays of URLs, most appearing German. After that it does some work on your domain name and the requested page, then does some work on all of the above to pull out specific URLs to seed your footer with. They were nice enough to include a $debug flag, which I turned on, and ran on a different site that I wasn't too worried about. Here's the spit out:

 
host: thievestavern.com
uri: /final_code.php
numbers: 0
 
final_code.php
url: thievestavern.com/final_code.php
url_base64: dGhpZXZlc3RhdmVybi5jb20vZmluYWxfY29kZS5waHA=
url_zahl: 20295
 
array_a_count: 22
array_b_count: 90
array_c_count: 87
array_d_count: 145
array_e_count: 2
url_count: 32
 
crc32 url: -1485503542
intval(crc32 count): 1485503542
 
count_a (url_count + numbers): 03542
 
count_a % array_a_count: 03542 % 22
count_a (Rest nach Teilung): 0
 
count_b (url_count + numbers): 03542
 
count_b % array_b_count: 03542 % 90
count_b (Rest nach Teilung): 32
 
count_c (url_count + numbers): 03542
 
count_c % array_c_count: 03542 % 87
count_c (Rest nach Teilung): 62
 
count_d (url_count + numbers): 03542
 
count_d % array_d_count: 03542 % 145
count_d (Rest nach Teilung): 62
 
count_e (url_count + numbers): 03542
 
count_e % array_e_count: 03542 % 2
count_e (Rest nach Teilung): 0
 
url_zahl % anchor_1_count: 20295 % 6
 
url_zahl_rest_1: 3
anchor_1_count: 6
 
url_zahl_rest_2: 2
anchor_2_count: 7
 
url_zahl_rest_3: 5
anchor_3_count: 10
 
url_zahl_rest_4: 0
anchor_4_count: 11
 
url_zahl_rest_5: 2
anchor_5_count: 7
 
count: 03542
//Links were spit out here... I'm not including them as
//I don't want to advertise for random people
 

Conclusions
I'm considering this question solved. The obfuscated piece of junk that was residing in my footer turns out to be nothing more than a very paranoid way to put links into the footer. Its handy as it'll be hard to automatically figure out which sites have these spam footers (if I couldn't do this), it also intimidates the normal user to not remove the links. This is fairly clever, and involved, and a nice feature is that they can simply change the $o to get a whole new set of links to spit out, or to change the footer's design. I'll give them props for that.

All of the above makes me say that themespack.com isn't really interested in putting good free (as in freedom, and beer) themes into the hands of bloggers, they're more interested in themselves. Can I fault them? No. However, I do take issue with trying to hide behind 'copyright' to prevent me from changing the links on my own blog.

If you get one of these themes I'd highly recommend you do the following: Go into the footer, and remove the 'alignleft' div. Put in a 'theme created by ' link, and then give yourself credit for editing it. As is your right under the GPL. I'd love to say to run the script and give credit to the supposed creators, but those end up being random German companies, clearly not people in the business of writing PHP.

Oh, and for the record, all of the above is what the server does when it runs the PHP code, so I'm not reverse engineering it anymore than a few calls to base64_decode does.

Blade is the system that started as a pure gaming rig, back in January 2005, and quickly became my full-time Linux do-everything box. It was my first 'new' build, all the others had been with scavenged parts. It seems cheesy, but tonight I'm dismantling her and I feel pretty sad, actually. This computer went through 3 power supplies, but otherwise had no mechanical issues. I ended up adding 2 hard drives to have almost a Terabyte of storage on there, an extra 2GB of RAM, a 'new' (at the time) GeForce 6800XT, and logged untold thousands of hours of gaming on her. LAN parties too numerous to count, dozens (hundreds including stuff for school) of software projects, and just about all my Walraven programming was done from her keyboard. Her uptime (aside from a summer in storage while I was out of the country) was probably up around 95%, not 5 9's but everything I ever asked for. Honestly, it was to the point where when I finally graduated and got a place with an office separate from my bedroom I'd wake up and wonder why she was off (as I couldn't see the running-lights). Now she's sitting in pieces on my floor as I part out what's good, and what's bad.

Living for another build:

• All the small bits: Screws, Jumpers, CMOS battery, etc.
• Case... she's served me well.
• Hard Drives, no data corruption that I know of.
• CD-ROM, still good but ordered a new one anyhow to get SATA.
• Peripherals, I may have damaged my USB mouse, but I think the others still work.
• RAM, its still good, and decent stuff too!
• Video card will definitely find a new home, she's still great!
• Heat sink, SPU had a nice heatsink, might as well keep that.

Bound for the scrap heap:

• PSU. When I plug a power cord in I get big blue sparks off the back power switch.
• Motherboard, although she won't hit the trash yet. I'm thinking of making a display for it.
• CPU. I don't have a spare board to test and see if its still good. If I can nab one off a friend I'll test, but otherwise this is gone.

What I ordered:

• Motherboard: obviously need a new one of these.
• RAM, my old stuff is DDR, need to get at least DDR2 for a new motherboard.
• CPU, again an old form factor just can't be found on modern boards.
• CD-ROM, I need a SATA CD-ROM as the new mobo only has one IDE slot and I have two IDE drives (yes, still).
• PSU, nice new 630W with a good long warranty!

The above should get me back up and running nicely, though in the future I'll be picking up a PCI-E video card (my old ones are all AGP) so I can run monitors dual-head. Have a nice 9800GT (my old card's big brother, XFS) picked out for early May, I think. This is money I did not want to have to spend now, so the optional pieces are waiting. I think that once I get the system up and running I'm going to do a nice reformat to clean up all the drives (begs the question of where I'll keep the data) and start from scratch. I'll consider it a new build, and let the name 'Blade' go to rest.

With all that said, I'll go back to dealing with the remains. If anyone knows of fun ways to display a motherboard, let me know. I want to honor this build somehow.

Good night, friend.

Sadly, CAPTCHAs are a technology we need to combat spam, which accounts for at least 80% of email today, not to mention message boards, instant messages, or text-messages. However, we're merely engaged in a technology arms race with spammers, this is *not* a technology that is winning any fights, we just try to stay one step ahead. This is increasingly hard with CAPTCHA entry being a job in countries with lower incomes, spammers cheating by offering porn in return for solving a CAPTCHA, and (in a case that doesn't just apply humans) CAPTCHA breaking drives AI research. Basically, no 'new' CAPTCHA technology is going to keep spammers out for long. A bleak future indeed. On the other hand, we already have 80%, how much worse can it get? I think the real answer lies in spam filters, although for the most part those are also in a mere arms race, but at least then you can control your own computer, not just leave the image out there for another human to crack.

Test.

Test 2...

Big Test

Now we're testing an edit, and adding in a link to the plugin's home.

Background
The controversy starts (ok, the immediate controversy in this issue) when the Jyllands-Posten, a Danish newspaper, published 12 cartoons depicting Muhammad about 2 and a half years ago. They were published when an artist writing about the life of Muhammad and the Qu'ran couldn't find an artist to draw the cover of his book (he would eventually find one who worked anonymously). I'll let the cultural editor for the newspaper explain why they were published in his own words (quote taken from wikipedia as the original article has disappeared from the paper's website):

The modern, secular society is rejected by some Muslims. They demand a special position, insisting on special consideration of their own religious feelings. It is incompatible with contemporary democracy and freedom of speech, where you must be ready to put up with insults, mockery and ridicule. It is certainly not always attractive and nice to look at, and it does not mean that religious feelings should be made fun of at any price, but that is of minor importance in the present context. [...] we are on our way to a slippery slope where no-one can tell how the self-censorship will end. That is why Morgenavisen Jyllands-Posten has invited members of the Danish editorial cartoonists union to draw Muhammad as they see him. [...]

The fallout of article was three Dutch embassies being torched, over 100 deaths during riots in Middle Eastern Countries, and many terrorist leaders calling for his death. More riots broke out a few months ago when the cartoons were republished to show what the controversy was. So the Dutch already have a stigma of "Islamaphobia" hanging over their heads.

Geert Wilders/PVV
Geert is the author of this film, and a politician in the Dutch House of Representatives, where he is the leader of the Party for Freedom party. Contrary to the name of the party, this political party doesn't stand for individual freedoms, they stand for freedom from government. Unfortunately that doesn't just mean freedom from such things as socialized health care, they also want to abolish such things as minimum wage.

Of course at the same time of not wanting the government to be involved in individual's lives, they want crackdowns on immigration. Specifically they want to slow down immigration from Middle Eastern Countries. As for Middle Easterners that come to the Netherlands, the PVV wants them to realize that Judeo-Christian culture is predominant, and that the immigrants should adapt. And this from a party with "Freedom" in its name.

Geert himself, is interesting in that he calls himself a "defender of free speech" and "critic of Islam" in almost the same breath. Sure, being a critic fits in nicely with free speech, but his "critique" includes banning the Qu'ran. How can any politician who wants freedom of speech for his own writings take away the freedom of religion for 5.5% of his country's population?

Fitna, the Movie
And so it was that Fitna was born, brainchild of Geert. He hoped (initial rumors indicated) to show the world what was wrong with Islam. No one knew exactly how that would happen (though as the release date got closer, it was previewed by people who leaked the content), and I for one was quite interested. I was hoping for some good research into Shari'a Law and how it was being applied in Europe, as well as studies about extremism and its causes, to name two ideas for good movies.

The movie was supposed to launch around the 22nd/23rd, but Network Solutions (web host for fitnathemovie.com) took the site down hours before Geert was able to post the video. What remained was a small note saying they were investigating the content of the site to make sure it fit into their Acceptable Use Policy. The applicable section (in the list of prohibited uses) is as follows, emphasis mine:

Transmission, distribution, uploading, posting or storage of any material in violation of any applicable law or regulation is prohibited. This includes, without limitation, material protected by copyright, trademark, trade secret or other intellectual property right used without proper authorization, and material that is obscene, defamatory, libelous, unlawful, harassing, abusive, threatening, harmful, vulgar, constitutes an illegal threat, violates export control laws, hate propaganda, fraudulent material or fraudulent activity, invasive of privacy or publicity rights, profane, indecent or otherwise objectionable material of any kind or nature. You may not transmit, distribute, or store material that contains a virus, "Trojan Horse," corrupted data, or any software or information to promote or utilize software or any of Network Solutions services to deliver unsolicited e-mail. You further agree not to transmit any material that encourages conduct that could constitute a criminal offense, gives rise to civil liability or otherwise violates any applicable local, state, national or international law or regulation.

Now, I'm not a lawyer for Network Solutions, nor have I talked to one, but the parts I highlighted are the reasons I assume they're looking into the content. I'm sure they got complaints from Muslims that the site was hosting offensive material, more likely to be 'hate propaganda' than 'harassment'. (The movie also contains copyright violations, see below). Many sites get complaints, and I was quite upset at the time to see Network Solutions cave (hey, if I was posting offensive content, I wouldn't have chosen a US host when ThePirateBay is doing so well overseas) to this pressure thinking that they should take a stand for Freedom of Speech.

That is, until I finally saw the video. LiveLeak decided to have a backbone (Internet pun not intended) and host the film, with a note on the front page that they weren't endorsing the content, merely Freedom of Speech. I thought this was a good avenue to go down, especially with a mandatory click through agreeing you want to see offensive materials. Anyone who wanted the see what Geert had to say could, and those that might be offended couldn't accidentally stumble across it. (LiveLeak has since taken the movie down after receiving death threats. They apologized for not standing up for Freedom of Speech, but cite their employees well-being as coming first. I wholeheartedly agree).

Unfortunately what Geert had to say was, well, not much. It was somehow researched at a level below that of even a Michael Moore film, and was just as sensationalist, if not more so. The first 7 minutes is publicly available news footage (aka, no new insight) of various terrorist related activities, juxtaposed with 5 verses from the Qu'ran. Everything from Madrid, to September 11, 2001 in slow motion, to a video I originally mistook to be the Pearl beheading, instead it is Eugene Armstrong, another American in Iraq at the time. An extensive breakdown of the film's "plot" can be found here.

My reaction to this first section was two-fold. First off it, unfortunately, drudged up memories and feelings from those attacks which is clearly what it was designed to do. Second, it made me wonder just how dumb the supporters of this movie have to be to base this entire segment on 5 verses. No context is given for any of them, nor actual analysis other than how extremist Muslims have acted. I won't say that these verses are not used to justify terrorism, what I will say is that most Muslims do not view it as a call to terrorism. But to pull five verses, show these atrocities and leave the unspoken link that all Muslims will behave this way is just uncalled for. Its not journalism, and its not activism, its pure stupidity.

The next section is designed to show the 'threat' of Islam, with quotes of Islam taking over the world. Unfortunately for Geert, these quotes come from places we'd expect them, such as Iran's President and well-known anti-Semites. If he had clips of "domestic terror" defendants this section might have a lot more force.

Finally he had a section on Islam and the Netherlands. This was the "best researched" section, in that he pulled from a lot more news sources for his headlines. He attempts to show that if Shari'a Law is introduced into Europe, Gays and Women will lose a lot of rights, honor killings will start and basically all hell will break loose. He makes some decent points here, with the killer of Theo Van Gogh (another guy who made an anti-Islamic film, though his was a lot better) saying he'd kill him again if he could, and mentioning Ayaan Hrisi Ali. Unfortunately I can't speak for the situation of Islam in the Netherlands, so i have no idea if he's embellishing it, or finally presenting an accurate picture.

The closing seconds show a hand on a Qu'ran, then fade to black as you hear a ripping sound. This is controversial as (Muslim's believe) you shouldn't defile the Qu'ran by ripping pages out. Then a message floats up saying that it was actually a phone book, and that it was up to Muslims to rip out the hateful parts of the Qu'ran. This is the one part of the movie I agree with, and I'm not even in completel agreement here. It is on Muslims to get extremism under control, whether that be through the reforms Christianity did (remember, Islam is between the ages of the Crusades and Spanish Inquisition for Christian history) or through more rigorous policing of their imams and religions leaders I don't know. What I disagree with is that they must rewrite the Qu'ran to do so. To rewrite it would be to deny that the Qu'ran (as it is now) is the word of Allah, and introduce more "Satanic Verses". Instead, they should look at other meanings of jihad, meaning "To strive for", and listen to the moderates that have fled the Middle East.

Fallout
I actually had to stumble across a link to the movie the night it was released, because there was relatively no fallout. There was more news on Network Solutions taking down his other site than there was about Fitna coming out. I'll always remember a headline I saw the next day: "Dozens protest in Pakistan over Movie." Yes, you read that right, dozens, not hundreds, not thousands, dozens. And not a single death. In other words, Geert has failed to do what I think his goal was, incite more violence to convince the Netherlands Islam needs to be dealt with. If mobs had crowded the street, or if he'd been killed, his party could further its agenda and work towards banning the Qu'ran, but nothing happened. Muslims went to their prayers on Friday peacefully, realizing that to do anything violent would be playing into Geert's hands. Of course, there has been more protests since then in the Middle East and the Netherlands, and the Dutch Envoy in Iran has been summoned to speak for what happened, but even before the movie was release the Dutch government was smart and condemned the movie. While they weren't going to censor Free Speech, they were going to make sure that Muslims understand this is the work of one man, not a country, and not a nationality. Oh, if only Geert understood the same for extremists, that they don't speak for their religion or nationality as a whole.

As for additional fallout from the movie, Geert is being sued by Kurt Westergaard, the author of the cartoon depicting Muhammad in a turban with a bomb, for using the cartoon without his permission, a violation of copyright. He also might be sued by Salah Edin, an Arab rapper who Geert mistook for the killer of Van Gogh, Muhammad Bouyeri.

And, ironically, Omar Bakri, an Islamic extremist, actually liked the film, saying that if you removed the drawin of Muhammad with a bomb, it could be used as an Al-Qaida recruitment video. Geert's desire to show the horror of Islam might actually be used to recruit for Jihad, a fact which further supports my claim that he only released it to incite more attacks.

Conclusion
In the end, I support Geert's right to Free Speech. I applaud him for the bravery to stand up for what he believes in, even in the face of death threats, and I wish him well. However I think this movie is nothing more than sensationalist drivel, aimed at provoking more violence in the same way that Ann Coulter and Michael Moore throw barbs back and forth in our country. The only difference is that Moore targeted McDonald's and Geert singled out a religion with at least 1.1 billion followers (of which on 20% are in 'Arab' countries where most of the extremism is found). To release such a video that is entirely negative and clearly designed to provoke violence is reckless and wrong.

Anyway, I finally figured out that its all about control. We all want control of our lives, of our money, of ourselves, and that's natural. But Apple wants complete control over their products, even after you buy them, and that's wrong. What am I referring to? The "awesome" press conference today where Steve Jobs unveiled the iPhone SDK plan.

Quick recap of the plan: Developers pay $99 a year (or more for an enterprise license) to use the SDK. Once they have something, it must be distributed through the Apple App Store. To get into the App Store, each must be vetted by Apple to make sure it conforms to their policies.

Now you know my feelings on DRM. I hate it. If I buy something, I expect the rights to do with it as I please. Steve Jobs feels the same way, or so he says. I've long argued that he doesn't really mean that, but now I kind of think he does. See he specifically says DRM on music is wrong. He also points out that they don't own the music anyway, so they can't control it. What Steve Jobs wants is for everything Apple owns to be DRM'd and everything else to be free! Don't believe me?

- Apple computers (I'm talking 90's era when America and the world were getting in good with computers) were sealed with Torx screws. So what? Well at the time, and still, an average human being has no clue what that is (they've never had to crack an XBox to mod it) nor do they have Torx screw drivers to open it.

- FairPlay, the DRM created by Apple, is supposed to be a good system. Yet Steve Jobs, in the article I quoted earlier, claims that to release it worldwide would be to have someone reverse engineer it, and break it. Clearly a few things are going on here. First off they're banking on some form of security by obscurity which any good security professional would laugh at. Second they're betting that people can't break FairPlay if they don't have the source, which is wrong also. And third they're trying to protect their handy little algorithm from the rest of the world. Why was iTunes never released on Linux when it originated on the Mac (a Unix core)? My guess is because Apple is afraid someone would reverse engineer it and they had to protect their secrets.

- The iPhone. Gosh, where to start. Sell a locked phone, on only one network, that you get kickbacks from... Why not allow any service to use it? (I've heard from an Apple employee its because some services need specialized packages by the provider. That's all fine, but its not that other networks were given the chance to implement those packages, its that the phone was locked, period).

- This SDK. Now, its not uncommon to pay to use someone's SDK. I've got no problem with that, you spend money to make money as my brother just pointed out. My problem comes with the fact that they have to go through the app store. I'm sure this is done in the name of "security", 'cause iTunes has never been infected before. Oh wait, it has. Why can't an independant coder such as myself offer a download from his mobile phone equipped website? Why must I use their store? (Oh, and you can post free apps, at least they're not forcing you to charge).

- The store. The reason you have to go through the store is so Apple can vette your product, and make sure you're not bypassing their locks! What a wonderful little software depot they run here, so long as all the developers drink the Koolade. I can understand trying to make sure people don't get past a few boundaries, they point out VoIP over the cellular network to get past minutes plans. I'd like to point out my cheap little Razr can do that to bypass the minutes plans (a quick google search turned up this link, but I remember thinking about setting up my desktop to handle calls last summer from a website I was reading at the time, so I know there's more home-grown solutions).Oh yea, and the store takes a 30% cut.

How does any of the above not point to Apple controlling its products? Sure, companies do that, they control their products. But few companies give me such a shiver when I hear of each new ploy than Apple does. And the worst part is, all the coverage I've seen of this plan has been good, not a single piece has questioned Apples need to vette every developer's contribution, or for them to take 30% for doing nothing.

For once, and I shudder to say this, I have to like Facebook's model better. Put the API out there, let the public go crazy, and keep it free! You get just as much content, you get a much wider variety (unlike the few whack biscuits I saw who said this would "spur creativity" within the iPhone community), and you get community interaction. What's more to love? With this plan you'll get the people who planned on writing for the iPhone anyways, along with businesses who just want to replace their Blackberries. Of course, those are the people who wouldn't try to do something shocking and free with their phone, so maybe that's why Apple wants only them. Forget the hackers that might do something cool, lets go the safe and greedy route.

So here's to you Steve Jobs! If you truly believed what you said in your article on music, you'd think twice about this plan. Every year Apple turns more and more into what they always thought they were fighting, the mindless overlords bent on controlling their populace.

Remember the 'equipment malfunction' during the Super Bowl a few years back? How it was a severe understatement, as well as a stupid excuse for a dumb plan? The MPAA (Motion Picture Association of America) has just made a digital version. They traditionally blame college students for all manner of atrocities, everything from wanting to watch legal DVDs on their Linux machine to downloading movies. A wee bit ago (2005) they announced shocking statistics that proved college students were responsible for 40% of all illegal movies downloaded. This led to a campaign of terror at many big-name schools, as well as lobbying to force Congress to add in stipulations for cracking down on file sharing in new higher education funding. It turns out, they were wrong. Taken from their statement:

While in the process of recently updating that study with current data, we discovered there
had been an isolated error in the LEK process two years ago that resulted in an inflated
number for piracy by college students. The 2005 study had incorrectly concluded that 44
percent of the motion picture industry’s domestic losses were attributable to piracy by
college students. The 2007 study will report that number to be approximately 15 percent...

That's right, they had a little math error, and inflated the number by 3 times its value. That's a nice sized oops. Of course they're very apologetic, but that doesn't really change the fact that after the 2005 study MPAA increased its lobbying in Congress to punish college students. This increase resulted in two bills now going before Congress, the College Opportunity and Affordability Act of 2007, which will require schools to crack down on filesharing or lose all federal financial aid, and the Prioritizing Resources and Organization for Intellectual Property, which will increase fines and create a new federal agency devoted to tracking down 'large-scale' infringers. Thankfully both of these bills haven't been passed yet, there's still time to call your representatives and tell them to vote it down! Do you want your kid's college losing financial aid because they haven't devoted enough resources to tracking down music downloaders instead of teaching your kid? Do we really need a new Agency (your tax dollars at work!) to protect the money of MPAA or RIAA?

There is an upside to all this, believe it or not. Amazon is releasing its MP3 service now. It sells MP3's (no issues with having to change format for iTunes, Windows Media Player, or any other player) that are DRM free! Plus it has songs from the four big labels, the first DRM free site to do so. And, though it may vary by song, the songs are cheaper than Apple's DRM'd music (I saw hot new singles at 89 cents each). This is a huge win win situation. Not only are the songs relevant (3.3 million and counting), and cheap, but DRM free and supported by a major company! I'll be supporting this site for sure, if more people use Amazon as opposed to your other favorite (lets say iTunes, remembering that all Amazon songs can be put into your iTunes library as well) hopefully the industry will get the idea that DRM is bad.