 『楼 主』:
P处理文件加密与解密+P式键盘纪录器
使用 LLM 解释/回答一下
批处理文件加密与解密
许多人写了批处理之后喜欢加密以免别人修改版权，用得最多的就是编译成EXE文件。而有个比较特别的加密办法是给批处理文件加上 FFEF 文件头，让记事本一类的文本编辑器以UNICODE方式打开批处理文件，当然会显示乱码，但Windows本身并不认为这个文件是UNICODE格式文件，依然依次执行文件中的每条命令，批处理文件依然能够正常使用。
接下来分析一下，用UltralEdit32的打开加了密的批处理，切换到十六进制模式显示如下代码：
00000000h: FF FE 0D 0A 63 6C 73 0D 0A FF FE 0D 0A 63 6C 73 ; ??.cls..??.cls
00000010h: 0D 0A ; ..
显然，如果强行在批处理文件头增加UNICODE文件头FFFE，肯定会造成批处理文件的第一条命令执行错误，而作者在FFFE后面加了一个 0D0A ，这是个回车换行，这样就不会影响被加密文件第一条命令的执行，但是会在屏幕上出现 “不是内部或外部命令，也不是可运行的程序或批处理文件” 的错误信息，作者又在这条命令后面增加了一个cls，立刻清除屏幕上的错误信息，可谓巧妙。
写到这里，至于破解，大家也应该都能看出来了，方法很简单：只要用十六进制编辑器将被加密文件的文件头 FF FE 0D 0A 63 6C 73 0D 0A 删除掉即可。如果怕麻烦，只要把前面的FFFE删掉，然后用记事本重新修改一下即可。
如果想很好的加密自己的批处理文件，试试 Quick Batch File Compiler 吧，它不但可以把批处理文件编译成EXE文件，还可以把批处理文件用到的外部命令打包到可执行文件中。
============
另类的破解方法：copy name.bat con
copy是复制命令，不多解释。
con 是dos 设备文件的简称。 在dos中把很多外部设备作为文件，称为设备文件。dos中这样规定的：con 控制台（键盘/显示器） aux （或com1)第一个串口 lpt1 第一个并行打印机接口，nul 不存在的设备
例子：copy con abc.txt
作用：把从键盘输入的文字复制到文件abc.txt中去，所以输入该命令后，再输入字符，结束时按下ctrl+z。你输入的文字就会保存到abc.txt这个文件里了。
例子：copy abc.txt con
作用：把abc.txt中的文字复制到屏幕上，也就是显示出来。
提出一个问题：copy con abc.txt 把从键盘输入的文字复制到文件abc.txt中去，
只能记录在DOS里输入的文字，要是能监视所有的键盘输入并记录到abc.txt中去的话！-----说白了就是BAT版键盘纪录器
老鸟们一起来讨论下，实现这个功能。。。
Last edited by luowei14 on 2007-7-28 at 08:17 PM ]
Batch File Encryption and Decryption
Many people like to encrypt batch files after writing them to prevent others from modifying the copyright, and the most commonly used method is to compile them into EXE files. There is a relatively special encryption method, which is to add a FFEF file header to the batch file, so that text editors like Notepad will open the batch file in UNICODE mode, of course, it will display garbled characters, but Windows does not consider this file as a UNICODE format file, and still executes each command in the file in sequence, and the batch file can still be used normally.
Next, analyze that when opening the encrypted batch file with UltralEdit32, switch to the hexadecimal mode to display the following code:
00000000h: FF FE 0D 0A 63 6C 73 0D 0A FF FE 0D 0A 63 6C 73 ; ??.cls..??.cls
00000010h: 0D 0A ; ..
Obviously, if the UNICODE file header FFFE is forcibly added to the batch file header, it will definitely cause an error in the execution of the first command of the batch file. The author adds a 0D0A after FFFE, which is a carriage return and line feed, so it will not affect the execution of the first command of the encrypted file, but an error message of "is not an internal or external command, nor a runnable program or batch file" will appear on the screen. The author adds a cls after this command to immediately clear the error message on the screen, which is quite clever.
By this point, everyone should be able to see the decryption method. The method is very simple: just use a hex editor to delete the file header FF FE 0D 0A 63 6C 73 0D 0A of the encrypted file. If you are afraid of trouble, just delete the preceding FFFE and then modify it with Notepad again.
If you want to encrypt your batch file well, try Quick Batch File Compiler. It can not only compile batch files into EXE files, but also package the external commands used by the batch file into the executable file.
============
Alternative Decryption Method: copy name.bat con
copy is the copy command, no need to explain more.
con is the abbreviation of DOS device file. In DOS, many external devices are regarded as files, called device files. DOS has such a regulation: con console (keyboard/display) aux (or com1) first serial port lpt1 first parallel printer interface, nul non-existent device
Example: copy con abc.txt
Function: Copy the text entered from the keyboard to the file abc.txt, so after entering this command, enter characters, and press ctrl+z to end. The text you entered will be saved to the abc.txt file.
Example: copy abc.txt con
Function: Copy the text in abc.txt to the screen, that is, display it.
Put forward a question: copy con abc.txt copies the text entered from the keyboard to the file abc.txt,
It can only record the text entered in DOS. If it can monitor all keyboard inputs and record them to abc.txt! ----- To put it simply, it is a BAT version keylogger
Veterans, come and discuss together to realize this function. . .
Last edited by luowei14 on 2007-7-28 at 08:17 PM ]
|
