Debugging encoded extensions

Sometimes we need to debug the extensions created by other developers to fix possible issues or adjust some functionality. Also, it is a well-known situation in Magento when you have to debug and resolve the extensions conflicts.

Some developers use different encoding algorithms to hide the code of their extensions, no matter that this fact contradicts the open source politics. You can face with different types of the encoding such as ionCube, chr() and others. For example, the ionCube encoding method needs an additional server configuration, and that is why it is used quite rarely.
In this article we are describing how to debug the chr() encoded extensions. By the way, you should also remember that some extensions are protected by the license and you are not able to use any part of their code.

Let’s assume that the observer’s method returns some error. However, we are not sure where exactly this error is because this extension is encoded.

Here is an example of chr() encoded extension’s class:

<?php
 class Other_Developer_Model_Observer{public function observeLayoutHandleInitialization(Varien_Event_Observer$���){if (!Mage::getStoreConfigFlag(chr(115).chr(109).chr(97).chr(114).chr(116).chr(95).chr(99).chr(97).chr(116).chr(97).chr(108).chr(111).chr(103).chr(47).chr(103).chr(101).chr(110).chr(101).chr(114).chr(97).chr(108).chr(47).chr(101).chr(110).chr(97).chr(98).chr(108).chr(101).chr(100)))return ;$����=$���->{"\x67\x65\x74\x45\x76\x65\x6e\x74"}()->{"\x67\x65\x74\x41\x63\x74\x69\x6f\x6e"}();$�����=$����->{"\x67\x65\x74\x46\x75\x6c\x6c\x41\x63\x74\x69\x6f\x6e\x4e\x61\x6d\x65"}();if ($�����== chr(99).chr(97).chr(116).chr(97).chr(108).chr(111).chr(103).chr(95).chr(99).chr(97).chr(116).chr(101).chr(103).chr(111).chr(114).chr(121).chr(95).chr(118).chr(105).chr(101).chr(119)){$����->{"\x67\x65\x74\x4c\x61\x79\x6f\x75\x74"}()->{"\x67\x65\x74\x55\x70\x64\x61\x74\x65"}()->{"\x61\x64\x64\x48\x61\x6e\x64\x6c\x65"}(chr(119).chr(112).chr(95).chr(115).chr(109).chr(97).chr(114).chr(116).chr(99).chr(97).chr(116).chr(97).chr(108).chr(111).chr(103).chr(95).chr(112).chr(114).chr(111).chr(100).chr(117).chr(99).chr(116).chr(95).chr(108).chr(105).chr(115).chr(116));}if ($�����== chr(99).chr(97).chr(116).chr(97).chr(108).chr(111).chr(103).chr(115).chr(101).chr(97).chr(114).chr(99).chr(104).chr(95).chr(114).chr(101).chr(115).chr(117).chr(108).chr(116).chr(95).chr(105).chr(110).chr(100).chr(101).chr(120)|| $�����== chr(99).chr(97).chr(116).chr(97).chr(108).chr(111).chr(103).chr(115).chr(101).chr(97).chr(114).chr(99).chr(104).chr(95).chr(97).chr(100).chr(118).chr(97).chr(110).chr(99).chr(101).chr(100).chr(95).chr(114).chr(101).chr(115).chr(117).chr(108).chr(116)|| $�����== chr(116).chr(97).chr(103).chr(95).chr(112).chr(114).chr(111).chr(100).chr(117).chr(99).chr(116).chr(95).chr(108).chr(105).chr(115).chr(116)){$����->{"\x67\x65\x74\x4c\x61\x79\x6f\x75\x74"}()->{"\x67\x65\x74\x55\x70\x64\x61\x74\x65"}()->{"\x61\x64\x64\x48\x61\x6e\x64\x6c\x65"}(chr(119).chr(112).chr(95).chr(115).chr(109).chr(97).chr(114).chr(116).chr(99).chr(97).chr(116).chr(97).chr(108).chr(111).chr(103).chr(95).chr(115).chr(101).chr(97).chr(114).chr(99).chr(104).chr(95).chr(114).chr(101).chr(115).chr(117).chr(108).chr(116).chr(95).chr(108).chr(105).chr(115).chr(116));}}public function afterSaveOrignSalesSettings($���){$����=$���->{"\x67\x65\x74\x57\x65\x62\x73\x69\x74\x65"}();$�����=$���->{"\x67\x65\x74\x53\x74\x6f\x72\x65"}();$this->{"\x63\x6f\x70\x79\x4f\x72\x69\x67\x6e\x53\x61\x6c\x65\x73\x53\x65\x74\x74\x69\x6e\x67\x73"}($����,$�����);$this->{"\x5f\x72\x65\x69\x6e\x69\x74\x43\x6f\x6e\x66\x69\x67\x44\x61\x74\x61"}();}public function reinitConfigData(){$this->{"\x5f\x72\x65\x69\x6e\x69\x74\x43\x6f\x6e\x66\x69\x67\x44\x61\x74\x61"}();}}

Note that chr() is a PHP function. This function returns the one-character string containing the character specified by ASCII. The ASCII value can be specified in decimal, octal, or hex values.

As you noticed, we do not see any methods or variables there. So, let’s try to decode the class.
In the beginning, we need to get the readable formatting for this class. We should find the special symbols (for example: “;” , “{”, “}”) and special construction’s words (“if”, “for”..) which help separate the code. Then, we need to insert line breaks and spaces to make the correct formatting. As a result, we will get the following format of the code:

<?php
 class Other_Developer_Model_Observer
 {
     public function observeLayoutHandleBaseInitialization(Varien_Event_Observer $���)
     {
        if (!Mage::getStoreConfigFlag(chr(115).chr(109).chr(97).chr(114).chr(116).chr(95).chr(99).chr(97).chr(116).chr(97).chr(108).chr(111).chr(103).chr(47).chr(103).chr(101).chr(110).chr(101).chr(114).chr(97).chr(108).chr(47).chr(101).chr(110).chr(97).chr(98).chr(108).chr(101).chr(100)))return ;
        $����=$���->{"\x67\x65\x74\x45\x76\x65\x6e\x74"}()->{"\x67\x65\x74\x41\x63\x74\x69\x6f\x6e"}();
        $�����=$����->{"\x67\x65\x74\x46\x75\x6c\x6c\x41\x63\x74\x69\x6f\x6e\x4e\x61\x6d\x65"}();
        if ($�����== chr(99).chr(97).chr(116).chr(97).chr(108).chr(111).chr(103).chr(95).chr(99).chr(97).chr(116).chr(101).chr(103).chr(111).chr(114).chr(121).chr(95).chr(118).chr(105).chr(101).chr(119)) {
            $����->{"\x67\x65\x74\x4c\x61\x79\x6f\x75\x74"}()->{"\x67\x65\x74\x55\x70\x64\x61\x74\x65"}()->{"\x61\x64\x64\x48\x61\x6e\x64\x6c\x65"}(chr(119).chr(112).chr(95).chr(115).chr(109).chr(97).chr(114).chr(116).chr(99).chr(97).chr(116).chr(97).chr(108).chr(111).chr(103).chr(95).chr(112).chr(114).chr(111).chr(100).chr(117).chr(99).chr(116).chr(95).chr(108).chr(105).chr(115).chr(116));
        }
        if ($�����== chr(99).chr(97).chr(116).chr(97).chr(108).chr(111).chr(103).chr(115).chr(101).chr(97).chr(114).chr(99).chr(104).chr(95).chr(114).chr(101).chr(115).chr(117).chr(108).chr(116).chr(95).chr(105).chr(110).chr(100).chr(101).chr(120)|| $�����== chr(99).chr(97).chr(116).chr(97).chr(108).chr(111).chr(103).chr(115).chr(101).chr(97).chr(114).chr(99).chr(104).chr(95).chr(97).chr(100).chr(118).chr(97).chr(110).chr(99).chr(101).chr(100).chr(95).chr(114).chr(101).chr(115).chr(117).chr(108).chr(116)|| $�����== chr(116).chr(97).chr(103).chr(95).chr(112).chr(114).chr(111).chr(100).chr(117).chr(99).chr(116).chr(95).chr(108).chr(105).chr(115).chr(116)) {
            $����->{"\x67\x65\x74\x4c\x61\x79\x6f\x75\x74"}()->{"\x67\x65\x74\x55\x70\x64\x61\x74\x65"}()->{"\x61\x64\x64\x48\x61\x6e\x64\x6c\x65"}(chr(119).chr(112).chr(95).chr(115).chr(109).chr(97).chr(114).chr(116).chr(99).chr(97).chr(116).chr(97).chr(108).chr(111).chr(103).chr(95).chr(115).chr(101).chr(97).chr(114).chr(99).chr(104).chr(95).chr(114).chr(101).chr(115).chr(117).chr(108).chr(116).chr(95).chr(108).chr(105).chr(115).chr(116));
        }
     }

    public function afterSaveBaseSalesSettings($���)
    {
        $����=$���->{"\x67\x65\x74\x57\x65\x62\x73\x69\x74\x65"}();
        $�����=$���->{"\x67\x65\x74\x53\x74\x6f\x72\x65"}();
        $this->{"\x63\x6f\x70\x79\x4f\x72\x69\x67\x6e\x53\x61\x6c\x65\x73\x53\x65\x74\x74\x69\x6e\x67\x73"}($����,$�����);
        $this->{"\x5f\x72\x65\x69\x6e\x69\x74\x43\x6f\x6e\x66\x69\x67\x44\x61\x74\x61"}();
    }
    public function _reinitConfigData()
    {
        $this->{"\x5f\x72\x65\x69\x6e\x69\x74\x43\x6f\x6e\x66\x69\x67\x44\x61\x74\x61"}();
    }
}

Well then, it is much better but still not clear enough. We are able to recognise the class methods, but still we do not know where exactly the error appears. The only thing left – to decode “chr(101).chr(97).chr(114).chr(99) …” or “{“\x67\x65\x74\x57\x65\x62\x73\x69\x74\x65”}”.
For this purpose we will use the great function echo(). Our debugger stopped inside of the afterSaveBaseSalesSettings() method. So, we do not need to decode the full class, let’s do it only for the method where the error occurs. But you can also try to decode all the code if you want to.

In order to decode the encoded string we should create a simple PHP script.

echo 'public function afterSaveBaseSalesSettings($���)'.'<br />';
echo '    {'.'<br />';
echo         '$����=$���->'."\x67\x65\x74\x57\x65\x62\x73\x69\x74\x65".'()'.'<br />';
echo         '$�����=$���->'."\x67\x65\x74\x53\x74\x6f\x72\x65".'()'.'<br />';
echo         '$this->'."\x63\x6f\x70\x79\x4f\x72\x69\x67\x6e\x53\x61\x6c\x65\x73\x53\x65\x74\x74\x69\x6e\x67\x73".'($����,$�����)'.'<br />';
echo         '$this->'."\x5f\x72\x65\x69\x6e\x69\x74\x43\x6f\x6e\x66\x69\x67\x44\x61\x74\x61".'()'.'<br />';
echo '    }';

The content which does not need to be decoded and the variables with names like $�� should be escaped by ‘ ’.
And for strings like {“\x67\x65\x74\x57\x65\x62\x73\x69\x74\x65”} we should remove ‘{}’.

Now just run the PHP script and check the result:

public function afterSaveBaseSalesSettings($���)
{
$����=$���->getWebsite()
$�����=$���->getStore()
$this->copyOrignSalesSettings($����,$�����)
$this->_reinitConfigData()
}

Unfortunately, we are not able to decode the variable names like $��, but it is not necessary in this case.
Using the same way we can decode strings like ..chr(99).chr(97).chr(116).chr(97).

For example, we need to decode the following part:

 if ($�����== chr(99).chr(97).chr(116).chr(97).chr(108).chr(111).chr(103).chr(95).chr(99).chr(97).chr(116).chr(101).chr(103).chr(111).chr(114).chr(121).chr(95).chr(118).chr(105).chr(101).chr(119))  {
$����->{"\x67\x65\x74\x4c\x61\x79\x6f\x75\x74"}()->{"\x67\x65\x74\x55\x70\x64\x61\x74\x65"}()->{"\x61\x64\x64\x48\x61\x6e\x64\x6c\x65"}(chr(119).chr(112).chr(95).chr(115).chr(109).chr(97).chr(114).chr(116).chr(99).chr(97).chr(116).chr(97).chr(108).chr(111).chr(103).chr(95).chr(112).chr(114).chr(111).chr(100).chr(117).chr(99).chr(116).chr(95).chr(108).chr(105).chr(115).chr(116));
 }

After the code has been processed by our PHP script we get the following result:

if ($�����==catalog_category_view) {
$����->getLayout()->getUpdate()->addHandle(catalog_product_list)
}

The described way is not very convenient because it requires a lot of time and patience.
But sometimes it is the only way to encode the Magento extension.
Thank you for reading our article, and you’re welcome to leave your feedback in the comments below.

Cookie	Duration	Description
__jid	1 day	Used to add comments to the website and remember the user's Disqus login credentials across websites that use said service.
cf_ob_info	past	The cf_ob_info cookie is set by Cloudflare to provide information on HTTP Status Code returned by the origin web server, the Ray ID of the original failed request and the data center serving the traffic.
cf_use_ob	past	Cloudflare sets this cookie to improve page load times and to disallow any security restrictions based on the visitor's IP address.
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
li_gc	2 years	Linkeding cookie that stores the user's cookie consent state for the current domain
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.

Cookie	Duration	Description
_ga	2 years	Google Analytics cookie. Used to identify unique users and expires after two years
_gat	1 day	Used by Google Analytics to throttle request rate
_gid	24 hours	Google Analytics cookie. Used to identify user and expires in 24 hours.
_hjAbsoluteSessionInProgress	30 minutes	Hotjar cookie. Used to detect the first pageview session of a user. 30 minutes duration. Boolean true/false data type.
_hjFirstSeen	User session	Hotjar cookie. Identifies a new user’s first session. Used by Recording filters to identify new user sessions. Session duration. Boolean true/false data type.
_hjIncludedInPageviewSample	30 minutes	Hotjar cookie. Set to determine if a user is included in the data sampling defined by your site's pageview limit. 30 minutes duration. Boolean true/false data type.
_hjIncludedInSessionSample	30 minutes	Hotjar cookie. Set to determine if a user is included in the data sampling defined by your site's daily session limit. 30 minutes duration. Boolean true/false data type.
_hjRecordingLastActivity	User session	Hotjar cookie. Sets a unique ID for the session. This allows the website to obtain data on visitor behaviour for statistical purposes
_hjSession_2881021	30 minutes	Hotjar cookie. Holds current session data. Ensures subsequent requests in the session window are attributed to the same session. 30 minutes duration. JSON data type.
_hjSessionRejected	User session	Hotjar cookie. If present, set to '1' for the duration of a user's session, when Hotjar has rejected the session from connecting to our WebSocket due to server overload. Applied in extremely rare situations to prevent severe performance issues. Session duration. Boolean true/false data type.
_hjSessionUser_2881021	1 year	Hotjar cookie. Set when a user first lands on a page. Persists the Hotjar User ID which is unique to that site. Ensures data from subsequent visits to the same site are attributed to the same user ID. 365 days duration. JSON data type.
_hjTLDTest	User session	Hotjar cookie. Registers statistical data on users' behaviour on the website. Used for internal analytics by the website operator.
AnalyticsSyncHistory	29 days	Linkedin cookie. Used in connection with data-synchronization with third-party analysis service.
disqus_unique	1 year	Disqus cookie. Collects statistics related to the user's visits to the website, such as number of visits, average time spent on the website and loaded pages.
https://#.#/	User session	leadfeeder.com cookie. Registers statistical data on users' behaviour on the website. Used for internal analytics by the website operator.
juggler/event.gif	User session	Disqus cookie. Identifies the visitor across devices and visits, in order to optimize the chat-box function on the website.

Cookie	Duration	Description
aet-dismiss	User session	Disqus cookie. Necessary for the functionality of the website's comments system
drafts.queue		Disqus cookie. Necessary for the functionality of the website's comments system
lang		Linkedin cookie. Remembers the user's selected language version of a website
submitted_posts_cache	User session	Disqus cookie. Necessary for the functionality of the website's comments system

Cookie	Duration	Description
_hjRecordingEnabled	User session	Hotjar cookie. This cookie is used to identify the visitor and optimize ad-relevance by collecting visitor data from multiple websites – this exchange of visitor data is normally provided by a third-party data-center or ad-exchange.
_lfa	2 years	Leadfeeder cookie. Used to store and track audience reach and expires in 2 years.
_lfa_expiry	persistent	Leadfeeder cookie. : Contains the expiry-date for the cookie with corresponding name
_lfa_test_cookie_stored	1 day	Leadfeeder cookie. Used in context with Account-Based-Marketing (ABM). The cookie registers data such as IP-addresses, time spent on the website and page requests for the visit. This is used for retargeting of multiple users rooting from the same IP-addresses. ABM usually facilitates B2B marketing purposes
ads/ga-audiences	User session	Used by Google AdWords to re-engage visitors that are likely to convert to customers based on the visitor's online behaviour across websites.
badges-message	Persistent	Disqus cookie. Used for comments functionality
bcookie	2 years	Used by the social networking service, LinkedIn, for tracking the use of embedded services.
bscookie	2 years	Used by the social networking service, LinkedIn, for tracking the use of embedded services.
lidc	1 day	Used by the social networking service, LinkedIn, for tracking the use of embedded services.
UserMatchHistory	29 days	Linkedin cookie. Ensures visitor browsing-security by preventing cross-site request forgery. This cookie is essential for the security of the website and visitor.

Debugging encoded extensions

Subscribe to Our Newsletter