/* V8 - WARNING: This file is protected by copyright law.
To reverse engineer or decode this file is strictly prohibited. */
 

Well that's weird, because in the style.css we read:

/*The CSS, XHTML and design is released under GPL*/

(Side note, if you don't know what we mean by GPL, check out their site.)

No, they don't say PHP in there, however I read that (because 'design' is included) as "This theme is GPL'd". Poking around their website, I see no mention that you're required to keep any part of the theme the same.

If we read past the warning about reverse engineering, we see why they included it, a nasty big base64 encoded blob, then an eval command. Pastebin paste is here.

This piqued my interest, as I can think of very few legitimate reasons to do such obfuscation, or why there should be so much (footer.php is 47kb!). My initial thought was that I'd opened a backdoor into my site, with lesser thoughts to them being able to push random stuff into my footer (the last way I was infected), and finally just trying to control the links on the bottom of the page so that even if I were to edit their theme (as is my right under the GPL) I couldn't take credit for it myself, they'd always have credit for it. None of those sat right with me, so I hit up the local IRC channel, and we started puzzling.

First I base64_decode'd the garbage that was being run from the eval command (and yes, its gonna overflow the line by a LOT):

 
$lll=0;eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));$ll=0;eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));$llll=0;$lllll=3;eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));$lllllll=0;$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));$lllllllll=16;$llllllll="";for(;$lllll<$lllllllllllll($l);){if($lllllllll==0){$llllll=($llllllllll($l[$lllll++])<<8);$llllll+=$llllllllll($l[$lllll++]);$lllllllll=16;}if($llllll&0x8000){$lll=($llllllllll($l[$lllll++])<<4);$lll+=($llllllllll($l[$lllll])>>4);if($lll){$ll=($llllllllll($l[$lllll++])&0x0f)+3;for($llll=0;$llll<$ll;$llll++)$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];$lllllll+=$ll;}else{$ll=($llllllllll($l[$lllll++])<<8);$ll+=$llllllllll($l[$lllll++])+16;for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));$lllll++;$lllllll+=$ll;}}else$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);$llllll<<=1;$lllllllll--;}eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));$lllll=0;eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));$llllllllll="";for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));eval($lllllllll);
 

If you want to be able to READ that:

 
<?php
    $lll=0;
    eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));
    $ll=0;
    eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));
    $llll=0;
    $lllll=3;
    eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));
    $lllllll=0;
    $llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);
    eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));
    $lllllllll=16;
    $llllllll="";
    for(;$lllll<$lllllllllllll($l);){
        if($lllllllll==0){
            $llllll=($llllllllll($l[$lllll++])<<8);
            $llllll+=$llllllllll($l[$lllll++]);
            $lllllllll=16;
        }if($llllll&0x8000){
            $lll=($llllllllll($l[$lllll++])<<4);
            $lll+=($llllllllll($l[$lllll])>>4);
            if($lll){
                $ll=($llllllllll($l[$lllll++])&0x0f)+3;
                for($llll=0;$llll<$ll;$llll++)
                    $llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];
                $lllllll+=$ll;
            }else{
                $ll=($llllllllll($l[$lllll++])<<8);
                $ll+=$llllllllll($l[$lllll++])+16;
                for($llll=0;
                    $llll<$ll;
                    $llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));
                $lllll++;
                $lllllll+=$ll;
            }
        } else
            $llllllll[$lllllll++]=$llllllllll($l[$lllll++]);
        $llllll<<=1;
        $lllllllll--;
    }
    eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));
    $lllll=0;
    eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));
    $llllllllll="";
    for(;$lllll<$lllllll;){
        $llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);
    }
    eval($lllllllllll(
        "JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));
    eval($lllllllll);
?>
 

Wonderful, more base64 junk, and obfuscation. Yea, when was the last time you read a legitimate program that looked as the above (not in Perl). Been a while for me as well. So we went to work first by translating all the base_64 junk into english. Please note that the very first eval binds $lllllllllll to base64_decode so I've gone ahead and done that part already. I removed the eval() calls, and replaced them with the base64 translation on every line ending in //here.

 
<?php
 
    $lll=0;
    $lllllllllll='base64_decode'; //here
    $ll=0;
    $llllllllll='ord';  //here
    $llll=0;
    $lllll=3;
    $l=$lllllllllll($o); //here
    $lllllll=0;
    $llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);
    $lllllllllllll='strlen'; //here
    $lllllllll=16;
    $llllllll="";
    for(;$lllll<$lllllllllllll($l);){
        if($lllllllll==0){
            $llllll=($llllllllll($l[$lllll++])<<8);
            $llllll+=$llllllllll($l[$lllll++]);
            $lllllllll=16;
        }if($llllll&0x8000){
            $lll=($llllllllll($l[$lllll++])<<4);
            $lll+=($llllllllll($l[$lllll])>>4);
            if($lll){
                $ll=($llllllllll($l[$lllll++])&0x0f)+3;
                for($llll=0;$llll<$ll;$llll++)
                    $llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];
                $lllllll+=$ll;
            }else{
                $ll=($llllllllll($l[$lllll++])<<8);
                $ll+=$llllllllll($l[$lllll++])+16;
                for($llll=0;
                    $llll<$ll;
                    $llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));
                $lllll++;
                $lllllll+=$ll;
            }
        } else
            $llllllll[$lllllll++]=$llllllllll($l[$lllll++]);
        $llllll<<=1;
        $lllllllll--;
    }
    $llllllllllll='chr'; //here
    $lllll=0;
    $lllllllll="?".$llllllllllll(62); //here
    $llllllllll="";
    for(;$lllll<$lllllll;){
        $llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);
    }
    $lllllllll.=$llllllllll.$llllllllllll(60)."?"; //here
    eval($lllllllll);
?>
 

Next we perform the variable transformations that the first few eval() calls call for. Please note that towards the bottom there are a few variables we can't simply replace just yet.

 
<?php
 
    $lll=0;
    $ll=0;
    $llll=0;
    $lllll=3;
    $l=base64_decode($o); //Leaving this since I only want it to evaluate once
    $lllllll=0;
    $llllll=(ord($l[1])<<8)+ord($l[2]);
    $lllllllll=16;
    $llllllll="";
    for(;$lllll<strlen($l);){
        if($lllllllll==0){
            $llllll=(ord($l[$lllll++])<<8);
            $llllll+=ord($l[$lllll++]);
            $lllllllll=16;
        }if($llllll&0x8000){
            $lll=(ord($l[$lllll++])<<4);
            $lll+=(ord($l[$lllll])>>4);
            if($lll){
                $ll=(ord($l[$lllll++])&0x0f)+3;
                for($llll=0;$llll<$ll;$llll++)
                    $llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];
                $lllllll+=$ll;
            }else{
                $ll=(ord($l[$lllll++])<<8);
                $ll+=ord($l[$lllll++])+16;
                for($llll=0;
                    $llll<$ll;
                    $llllllll[$lllllll+$llll++]=ord($l[$lllll]));
                $lllll++;
                $lllllll+=$ll;
            }
        } else
            $llllllll[$lllllll++]=ord($l[$lllll++]);
        $llllll<<=1;
        $lllllllll--;
    }
    $lllll=0;
    $lllllllll="?".chr(62); //Leaving as we can't evaluate yet.
    $llllllllll="";
    for(;$lllll<$lllllll;){
        $llllllllll.=chr($llllllll[$lllll++]^0x07);
    }
    $lllllllll.=$llllllllll.chr(60)."?"; //Leaving as we can't evaluate yet.
    eval($lllllllll);
?>
 

Now, let's make it readable by translating all those $l variables into english letters. First one will be $a, next $b, etc etc. Alright, I missed one and had to go back, but here it is.

 
<?php
 
    $a=0;
    $b=0;
    $c=0;
    $d=3;
    $l=base64_decode($o); //leaving this as $l
    $e=0;
    $g=(ord($l[1])<<8)+ord($l[2]); //whoops, skipped one...
    $f=16;
    $h="";
    for(;$d<strlen($l);){
        if($f==0){
            $g=(ord($l[$d++])<<8);
            $g+=ord($l[$d++]);
            $f=16;
        }if($g&0x8000){
            $a=(ord($l[$d++])<<4);
            $a+=(ord($l[$d])>>4);
            if($a){
                $b=(ord($l[$d++])&0x0f)+3;
                for($c=0;$c<$b;$c++)
                    $h[$e+$c]=$h[$e-$a+$c];
                $e+=$b;
            }else{
                $b=(ord($l[$d++])<<8);
                $b+=ord($l[$d++])+16;
                for($c=0;
                    $c<$b;
                    $h[$e+$c++]=ord($l[$d]));
                $d++;
                $e+=$b;
            }
        } else
            $h[$e++]=ord($l[$d++]);
        $g<<=1;
        $f--;
    }
    $d=0;
    $f="?".chr(62); //here
    $i="";
    for(;$d<$e;){
        $i.=chr($h[$d++]^0x07);
    }
    $f.=$i.chr(60)."?"; //here
    eval($f);
?>
 

At this point its almost readable, although astute observers will have noted one variable that's weird. $o is wrapped in a base64_decode call, and bound to $l. $o is, shockingly enough, 44K of... packed binary. I didn't notice this until someone else pointed it out, I just glossed over all that junk and had started on the obvious eval command. To get a good view of it, try here.

Line 9 of the above can be simplified, so let's do that and turn it into the following (just to get an idea of the exact numbers we can). We can also run the strlen() call and learn that the length of $l is 33222! Geez... So let's replace that in the for loop on (old) line 12. $e after the massive loop becomes 83760, we can replace that also. And finally I replace the chr() calls towards the end and just put them into the strings that they're concatted to.

 
    $ga = ord($l[1])<<8; //48
    $gb = ord($l[2]); //0
    $g = $ga + $gb; //48
    ....
    for(;$d<33222;){
    ....
    $f="?>";
    ....
    for(;$d<83760;){
    ....
    $f.=$i."<?";
 

So, where does this leave us? We have a nice little (readable) script that does (something) on a HUGE bit of packed binary. Now, if you look at the for loop there, its not going to be fun to step through. Our index goes up to 33222, and is incremented by at most 6 every iteration. At worst you'll be stepping by 1. Well, the eval() command isn't until the end, so lets just see what that nasty big loop spits out, hmm? As long as you die() before the eval command, you'll be alright. What this spits out is a nasty huge array...

 
Array
(
    [0] => 59
    [1] => 56
    [2] => 119
    [3] => 111
    [4] => 119
    [5] => 13
    //....<snip 83000ish lines>
    [83754] => 97
    [83755] => 60
    [83756] => 13
    [83757] => 13
    [83758] => 56
    [83759] => 57
)
 

Now that's just lovely. Hmm, but looking at the values it gives me an idea. I decided to spit out an array of the values from the right side, and how many times they're referenced.

 
Array
(
    [59] => 93
    [56] => 1
    [119] => 1110
    [111] => 2748
    [13] => 630
    [36] => 70
    [35] => 349
    [99] => 1773
    [98] => 8490
    [101] => 1112
    [114] => 3197
    [96] => 1525
    [39] => 7322
    [58] => 227
    [54] => 153
    [60] => 577
    [107] => 3064
    [110] => 3057
    [105] => 4299
    [108] => 1170
    [102] => 4179
    [125] => 766
    [51] => 94
    [104] => 2476
    [116] => 3241
    [115] => 4404
    [88] => 414
    [84] => 541
    [66] => 354
    [85] => 163
    [81] => 130
    [92] => 19
    [32] => 1487
    [79] => 425
    [83] => 386
    [87] => 187
    [72] => 101
    [90] => 19
    [97] => 635
    [47] => 127
    [46] => 127
    [100] => 2031
    [37] => 305
    [61] => 391
    [41] => 886
    [117] => 4419
    [57] => 100
    [86] => 2
    [82] => 79
    [78] => 59
    [106] => 1421
    [69] => 438
    [112] => 1295
    [42] => 688
    [126] => 198
    [40] => 1630
    [53] => 110
    [52] => 82
    [55] => 105
    [63] => 30
    [67] => 209
    [74] => 153
    [50] => 74
    [48] => 37
    [62] => 27
    [113] => 313
    [89] => 3
    [43] => 3496
    [70] => 297
    [73] => 169
    [68] => 172
    [80] => 271
    [14] => 1161
    [65] => 243
    [76] => 337
    [127] => 186
    [95] => 10
    [93] => 47
    [64] => 213
    [33] => 442
    [75] => 103
    [49] => 34
    [118] => 5
    [77] => 36
    [109] => 41
    [124] => 17
    [122] => 17
    [44] => 10
    [34] => 21
    [45] => 9
    [123] => 5
)
 

The minimum is 13, and the max is 127, so these do fit nicely on an ASCII table. Now, 13 is a LOT smaller than I expected (down at carriage return), but such is life. Sorted it looks a bit better, but doesn't map nicely to the ASCII values I'd hoped to see the most of.

 
Array
(
    [13] => 630
    [14] => 1161
    [32] => 1487
    [33] => 442
    [34] => 21
    [35] => 349
    [36] => 70
    [37] => 305
    [39] => 7322
    [40] => 1630
    [41] => 886
    [42] => 688
    [43] => 3496
    [44] => 10
    [45] => 9
    [46] => 127
    [47] => 127
    [48] => 37
    [49] => 34
    [50] => 74
    [51] => 94
    [52] => 82
    [53] => 110
    [54] => 153
    [55] => 105
    [56] => 1
    [57] => 100
    [58] => 227
    [59] => 93
    [60] => 577
    [61] => 391
    [62] => 27
    [63] => 30
    [64] => 213
    [65] => 243
    [66] => 354
    [67] => 209
    [68] => 172
    [69] => 438
    [70] => 297
    [72] => 101
    [73] => 169
    [74] => 153
    [75] => 103
    [76] => 337
    [77] => 36
    [78] => 59
    [79] => 425
    [80] => 271
    [81] => 130
    [82] => 79
    [83] => 386
    [84] => 541
    [85] => 163
    [86] => 2
    [87] => 187
    [88] => 414
    [89] => 3
    [90] => 19
    [92] => 19
    [93] => 47
    [95] => 10
    [96] => 1525
    [97] => 635
    [98] => 8490
    [99] => 1773
    [100] => 2031
    [101] => 1112
    [102] => 4179
    [104] => 2476
    [105] => 4299
    [106] => 1421
    [107] => 3064
    [108] => 1170
    [109] => 41
    [110] => 3057
    [111] => 2748
    [112] => 1295
    [113] => 313
    [114] => 3197
    [115] => 4404
    [116] => 3241
    [117] => 4419
    [118] => 5
    [119] => 1110
    [122] => 17
    [123] => 5
    [124] => 17
    [125] => 766
    [126] => 198
    [127] => 186
)
 

Thankfully we're not done yet, notice that these values are called along with a ^0x07... so maybe if we change the list to reflect this operation it'll look better. In order to make it tidy, and to continue the assumption, I've substituted the character for the integer.

 
Array
(
    [<tab>] => 1161
    [
<line feed>] => 630
    [ ] => 7322
    ["] => 305
    [#] => 70
    [$] => 349
    [%] => 21
    [&] => 442
    ['] => 1487
    [(] => 127
    [)] => 127
    [*] => 9
    [+] => 10
    [,] => 3496
    [-] => 688
    [.] => 886
    [/] => 1630
    [0] => 105
    [1] => 153
    [2] => 110
    [3] => 82
    [4] => 94
    [5] => 74
    [6] => 34
    [7] => 37
    [8] => 30
    [9] => 27
    [:] => 391
    [;] => 577
    [<] => 93
    [=] => 227
    [>] => 100
    [?] => 1
    [A] => 297
    [B] => 438
    [C] => 172
    [D] => 209
    [E] => 354
    [F] => 243
    [G] => 213
    [H] => 425
    [I] => 59
    [J] => 36
    [K] => 337
    [L] => 103
    [M] => 153
    [N] => 169
    [O] => 101
    [P] => 187
    [Q] => 2
    [R] => 163
    [S] => 541
    [T] => 386
    [U] => 79
    [V] => 130
    [W] => 271
    [X] => 10
    [Z] => 47
    [[] => 19
    []] => 19
    [^] => 3
    [_] => 414
    [a] => 4179
    [b] => 1112
    [c] => 2031
    [d] => 1773
    [e] => 8490
    [f] => 635
    [g] => 1525
    [h] => 2748
    [i] => 3057
    [j] => 41
    [k] => 1170
    [l] => 3064
    [m] => 1421
    [n] => 4299
    [o] => 2476
    [p] => 1110
    [q] => 5
    [r] => 4419
    [s] => 3241
    [t] => 4404
    [u] => 3197
    [v] => 313
    [w] => 1295
    [x] => 186
    [y] => 198
    [z] => 766
    [{] => 17
    [|] => 5
    [}] => 17
)

This looks good to me. notice the matched braces (17 each), matched parens (127 each), and almost matched carrots (93 and 100). Also take note that there's much more lowercase than uppercase letters, and that lowercase 'e' is far above the other letters, implying this has English words (or at least English something) in it.

And again we end up with a nasty large for loop, completely worthless to try to step through:

 
    for(;$d<83760;){
        $i.=chr($h[$d++]^0x07);
    }
 

83760 steps in that loop, building whatever it is we're going to eval at the end char by char! I'm going to cheat again, run the loop, spit out the result, and die before the eval. Looks like 632 lines of... more php! Yay, this time its not obfuscated!

It starts off with 410 lines of 4 arrays of URLs, most appearing German. After that it does some work on your domain name and the requested page, then does some work on all of the above to pull out specific URLs to seed your footer with. They were nice enough to include a $debug flag, which I turned on, and ran on a different site that I wasn't too worried about. Here's the spit out:

 
host: thievestavern.com
uri: /final_code.php
numbers: 0
 
final_code.php
url: thievestavern.com/final_code.php
url_base64: dGhpZXZlc3RhdmVybi5jb20vZmluYWxfY29kZS5waHA=
url_zahl: 20295
 
array_a_count: 22
array_b_count: 90
array_c_count: 87
array_d_count: 145
array_e_count: 2
url_count: 32
 
crc32 url: -1485503542
intval(crc32 count): 1485503542
 
count_a (url_count + numbers): 03542
 
count_a % array_a_count: 03542 % 22
count_a (Rest nach Teilung): 0
 
count_b (url_count + numbers): 03542
 
count_b % array_b_count: 03542 % 90
count_b (Rest nach Teilung): 32
 
count_c (url_count + numbers): 03542
 
count_c % array_c_count: 03542 % 87
count_c (Rest nach Teilung): 62
 
count_d (url_count + numbers): 03542
 
count_d % array_d_count: 03542 % 145
count_d (Rest nach Teilung): 62
 
count_e (url_count + numbers): 03542
 
count_e % array_e_count: 03542 % 2
count_e (Rest nach Teilung): 0
 
url_zahl % anchor_1_count: 20295 % 6
 
url_zahl_rest_1: 3
anchor_1_count: 6
 
url_zahl_rest_2: 2
anchor_2_count: 7
 
url_zahl_rest_3: 5
anchor_3_count: 10
 
url_zahl_rest_4: 0
anchor_4_count: 11
 
url_zahl_rest_5: 2
anchor_5_count: 7
 
count: 03542
//Links were spit out here... I'm not including them as
//I don't want to advertise for random people
 

Conclusions
I'm considering this question solved. The obfuscated piece of junk that was residing in my footer turns out to be nothing more than a very paranoid way to put links into the footer. Its handy as it'll be hard to automatically figure out which sites have these spam footers (if I couldn't do this), it also intimidates the normal user to not remove the links. This is fairly clever, and involved, and a nice feature is that they can simply change the $o to get a whole new set of links to spit out, or to change the footer's design. I'll give them props for that.

All of the above makes me say that themespack.com isn't really interested in putting good free (as in freedom, and beer) themes into the hands of bloggers, they're more interested in themselves. Can I fault them? No. However, I do take issue with trying to hide behind 'copyright' to prevent me from changing the links on my own blog.

If you get one of these themes I'd highly recommend you do the following: Go into the footer, and remove the 'alignleft' div. Put in a 'theme created by ' link, and then give yourself credit for editing it. As is your right under the GPL. I'd love to say to run the script and give credit to the supposed creators, but those end up being random German companies, clearly not people in the business of writing PHP.

Oh, and for the record, all of the above is what the server does when it runs the PHP code, so I'm not reverse engineering it anymore than a few calls to base64_decode does.

(And for the record, I'm not assuming 'male', I'm using 'he' since its quicker to type than 'she', or 'he/she').

First, there seems to be a basic assumption of sanity for the writer. I think this is the worst assumption made so far, and the most likely to bite us in the butt. While there's a chance someone was simply sending a letter to Fermi to see what they thought, pranking their co-workers, or whatever the reason, I think its at least just as likely that this is a crackpot guy who saw that Fermi has a .gov address and decided to send in something relating to their abduction, a secret formula, or world peace.

Three bits of evidence for this. The first (that hurts my thought of mental illness) is that the address it was shipped to is not given on the main website's contact page. This seems to imply sanity and foreknowledge, or at least some stalking, to come up with a different address. If we use Archive.org, you can see that while the address was different a year ago, it was a formatting, not substantive change. In fact, the address the letter was sent to is given on the website in quite a few places, so it is conceivable still that the author came across it coming to their site from a link, and not the main page looking for the address.

The second bit of evidence is the symbols that are used. As some have pointed out, this looks a lot like a Rosetta Stone for another message. While some of the symbols look clearly human (Upper case Phi, no doubt about it), others simply can't be found in our alphabets, yet look close to what some hypothesize should be a galactic, math based language. Where am I going with this? Perhaps (and please take this with a grain of salt, I don't personally believe in it) someone who believes in abductions found this message, understood it, and is trying to teach the language to only those humans who are worthy of learning it. Hence my thought of 'crackpot'. Sure, it may come out in the next 24 hours that these symbols match up to something else, and the guy is sane. Just remember, if it does come out to be a conspiracy, you heard it here first.

Finally, Fermi sat on the letter for a year before dusting it off and passing it off to the public. I can think of three reasons for this. The first is they honestly didn't have the people to bother. That could be, but judging by the reaction of the Slashdot community and other scientists I know, them putting this up in a break room, or an internal email, would garner a lot of attention during down time. The second thought is that they just didn't care. This would lend credence to my mental illness thought, they wrote it off immediately upon receiving it, rather than even attempt to decode it. Or, perhaps they've been working on it for a year, and got no where. I'm sure they would have the top and bottom solved, but maybe the middle bit has eluded them as well, which again would lend credence to it not having any real meaning at all.

Second, a lot of people seemed confused on the time frame. Fermi started they received this over a year ago, but some were reading into stories of interstellar communication that they assumed were related. We can't assume anything about the time frame other than any information made available after March 5th, 2007 is *not* involved in this message. In fact, due to the elaborateness of this message, I'd guess at least a week before that, as well. So anything after the end of February 2007 cannot play a role in this message. Of course, if research was going on before then, and only released afterwards the author may still have obtained a copy, or even worked on the project, and could have that information.

Third, there's the assumption that the middle portion (the symbols/'hex' characters) is a straight key, meaning one character corresponds to its hex character. I think that's wrong. A simple frequency chart shows the following:

As you can see, the frequency still fits into our base 3 assumption. I think that's very important, as the author uses base three (we assume, and can come up with English-correct translations for) in the top and bottom portions. So, rather than say that the sideways triangle equals 'F', we should say that it equals 3.

Now, translating the message into the frequencies, then decoding as we did for the top and bottom portions yields something cute (assuming that 222 is a space, not 000). We get:

111_1_111 111_1_111 111_11_111 11_111_11
111_1_1 11_11_11 111_1_11 11_111_111

OR

D D G G
E _ F S

There was speculation initially that the 'Basse' 'misspelling' in the message meant the middle bit should be a song. Well using this translation we have a song! It can be read left to right (half note D, half note G, quarter note E, quarter note rest, F sharp), or top down (quarter note D, quarter note E, quarter note D, quarter note rest, quarter note G quarter note F, G sharp). Of course, in many circles (especially Close Encounters of the Third Kind, and Independence Day) music and lights are thought to be 'universal' languages to chat up aliens with. Hmm. Not saying that's the answer, but playing it is kind of catchy.

Going along with this assumption was the thought that 1 and A (and also 's') needed to be assigned values. I'd argue that they are assigned values as seen above. They're included in the chart 0 times, so they're all worth 0. And if you're as good with off by one errors as I am, that will get your hopes up for the 'initials' between the 'key' and the bottom.

Well, those are my thoughts on the assumptions that are being made so far. Hope it helps someone out there!