China DOS Union

As the title says
I've only been learning for a few days, hope everyone can help, thank you...!!!

Is it encrypted? Or just a distraction?

Originally posted by jiangnan110 at 2007-6-8 12:47 PM:
As the title
I've only learned for a few days, hope everyone can help, thank you...!!!

Is it to prevent decompilation, that is, to display garbled code????

I think, maybe we can make a batch script that shuffles the batch scripts that need to be encrypted in a certain order or replaces them with other characters, and restores them in a certain order when decrypting. But in this way, the batch script cannot run before decryption, and it can be decrypted by others with only a certain patience.
Or convert it to an EXE, but then it's troublesome to view the source code...

Search it; there are many of them

（Transfer）BAT Encryption and Decryption Article
-----------------------------------------------------------
This is a piece of bat encryptor code


author:pengfei@www.cn-dos.net
%%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a %%a
cls
@echo off
color 27
:start
cls
echo *******************************************************************************
echo * *
echo * BAT 加 密 最 终 版 *
echo * *
echo *******************************************************************************
echo.
echo.
echo BAT encryption final version is an updated version of "BAT encryption tool". Compared with the previous version of the encryption tool, it has many advantages:
echo.
echo ★ Can successfully encrypt any batch processing file at one time, which is more convenient.
echo.
echo ★ You can input any batch processing that needs to be encrypted, and the encryption flexibility is greater.
echo.
echo ★ Can automatically judge wrong input, more humanized.
echo.
echo Description: Enter the batch processing file that needs to be encrypted below, directly enter the batch processing file name to encrypt the BAT in the current directory, or you can specify any BAT with a path. The encrypt.bat file generated in the current directory is the encrypted batch processing.
echo.
echo Author: Mulinsen QQ:573381312 BYE
echo.
echo.
echo.
set /p file=Please enter the batch processing that needs to be encrypted and press Enter (q=quit):
if "%file%"=="q" goto quit
echo %file%|findstr /i "\.bat$">nul && goto go
echo %file%|findstr /i "\.cmd$">nul && goto go
cls
echo ==============
echo Please enter correctly!
echo ==============
echo.
echo.
echo Press any key to re-enter......
pause>nul
goto start
:go
if not exist "%file%" goto newly
if exist encrypt.bat copy encrypt.bat encryptbak.bat
echo %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a %%%%a >"%tmp%\encrypt.tmp"
echo cls>>"%tmp%\encrypt.tmp"
type "%file%">>"%tmp%\encrypt.tmp"
setlocal enabledelayedexpansion
for %%i in ("%tmp%\encrypt.tmp") do (
echo %%~zi >nul 2>nul
set size=%%~zi
set num=!size:~-1!
set /a mod=!num!%%2
if !mod! equ 0 (goto even) else (goto odd)
)
:even
copy "%tmp%\encrypt.tmp" encrypt.bat
del "%tmp%\encrypt.tmp"
cls
echo ==========================
echo Congratulations, batch processing encryption is successful^^!
echo ==========================
echo.
echo.
echo Press any key to exit......
pause>nul
goto quit
:odd
echo. >>"%tmp%\encrypt.tmp"
copy "%tmp%\encrypt.tmp" encrypt.bat
del "%tmp%\encrypt.tmp"
cls
echo ==========================
echo Congratulations, batch processing encryption is successful^^!
echo ==========================
echo.
echo.
echo Press any key to exit......
pause>nul
goto quit
:newly
cls
echo ================================
echo Batch processing file not found, please re-enter!
echo ================================
echo.
echo.
echo Press any key to start......
pause>nul
goto start
:quit
exit



---------------------------------------------------------------------------------------------
The following is the bat decryptor code
---------------------------------------------------------------------------------------------
@echo off
mode con: cols=80 lines=25
:index
color 27
cls
echo ╭───────────────╮
echo │ │
echo ╭─────────┤ BAT 解 密 工 具 ├─────────╮
echo │ │ │ │
echo │ ╰───────────────╯ │
echo │ │
echo │ │
echo │ This tool is used to decrypt encrypted batch processing with confused text encoding type! │
echo │ │
echo │ Fill in the batch processing that needs to be decrypted below and press Enter. │
echo │ │
echo │ It is recommended to directly drag and drop the batch processing file to be decrypted into this window to release. │
echo │ │
echo │ After successful decryption, a file in the format "new_original file name.file suffix name" will be generated in the directory of this program │
echo │ format file. │
echo │ │
echo │ Note: If there is a file "new_original file name.file suffix name" in this directory, │
echo │ will be replaced. │
echo │ │
echo │ │
echo ╰───────────────────────────────────╯
echo.
set route=%cd%
set ravel=
set /p ravel= Please enter the batch processing to be decrypted:
set "ravel=%ravel:"=%"
if /i "%ravel:~-4%"==".bat" if exist "%ravel%" goto go
if /i "%ravel:~-4%"==".cmd" if exist "%ravel%" goto go
cls
echo ╭──────────╮
echo ╭─────────┤ 文 件 错 误 ├────────╮
echo │ ╰──────────╯ │
echo │ │
echo │ The specified file does not exist or the file is not a batch processing type! │
echo │ │
echo │ Press any key to re-enter... │
echo │ │
echo ╰─────────────────────────────╯
echo.
echo.
echo Press any key to re-enter...
pause >nul
goto index

:go
for /f "tokens=*" %%c in ("%ravel%") do (
cd /d "%%~dpc"
if exist "%route%\new_%%~nxc" attrib -s -h -r -a "%route%\new_%%~nxc"
echo author:pengfei@www.cn-dos.net>"%route%\new_%%~nxc"
for /f "tokens=*" %%i in (%%~nxc) do (
echo %%i>>"%route%\new_%%~nxc"
)
)
cls
echo ╭──────────╮
echo ╭─────────┤ 解 密 成 功 ├────────╮
echo │ ╰──────────╯ │
echo │ │
echo │ Congratulations, batch processing decryption is successful! │
echo │ │
echo ╰─────────────────────────────╯
echo.
echo.
echo Press any key to exit...
pause >nul
exit

I've tried various methods from this forum, but basically none of them work. Either it can't run after encryption, or the source code can be seen with a general editing software after encryption. I haven't found an effective method for the time being.

I wrote a password - encrypted tool that encrypts a bat file into a vbs file, and after entering the password, restores the bat file.

On Error Resume Next:Dim WshSHell,FSO,EnCText:Set WshSHell = WScript.CreateObject("WScript.Shell"):Set FSO = CreateObject("Scripting.FileSystemObject"):EnCText="71575206^l\]\lcaZo]^2\din]h4^beZr6]bpg紊皽剁搭惰范若顿返蕊钝范：皽iYln^":outmm=Inputbox(vbcr&vbcr&"Please enter the encryption password: (3 - 8 - digit number)","Encrypt/Decrypt Text File - By baomaboy","25926183"):If outmm = "" then:WScript.Quit(0):end if:Lcode = len(outmm):outcode = outmm & mid(EnCText,1,8 - Lcode):Dim KeyArr(8):KeyArr(0) = Lcode:for i = 1 to 8:KeyArr(i) = Mid(outcode,i,1):next

Execute("EnCText=Mid(EnCText,9,Len(EnCText) - 8):For i = 1 To Len(EnCText)"&vbCrLf&"TempNum = Asc(Mid(EnCText,i,1))"&vbCrLf&"if TempNum = 18 Then"&vbCrLf&" TempNum = 34 "&vbCrLf&" end if "&vbCrLf&"TempNum = TempNum + KeyArr(i Mod 9)"&vbCrLf&"If TempNum = 28 Then"&vbCrLf&"TempNum = 13"&vbCrLf&"ElseIf TempNum = 29 Then"&vbCrLf&"TempNum = 10"&vbCrLf&"End If"&vbCrLf&"If TempNum > 23 and TempNum < 28 Then"&vbCrLf&"TempNum = TempNum - 20"&vbCrLf&"end if"&vbCrLf&"OCText = OCText & chr(TempNum)"&vbCrLf&"Next")

Set OutFile = FSO.OpenTextFile("Temp.bat",2,true):OutFile.WriteLine(OCText):OutFile.Close:Set WshSHell = Nothing:Set FSO = Nothing:WScript.Quit(0)

There are no requirements for the system. You left, which means you saved the above as a bat, right? You need to save the code as a vbs instead.

Originally posted by qinbuer at 2007-6-8 13:22:
I think, perhaps we can make a batch file, scramble the batch files that need to be encrypted in a certain order or replace them with other characters, and when decrypting, restore them in a certain order. But in this way, before decrypting, the batch ...

Not necessarily all can be decrypted!

http://www.cn-dos.net/forum/viewthread.php?tid=28829&fpage=1&highlight=%E5%8A%A0%E5%AF%86

If you can decrypt this, I'll f you

Use a bat-to-exe ghost program.

Brother vkill, did you notice that your new version http://www.cn-dos.net/forum/viewthread.php?tid=28829&fpage=1&highlight=%E5%8A%A0%E5%AF%86 has started to be reported as a trojan virus by Kaspersky.

[ Last edited by baomaboy on 2007-6-8 at 08:50 PM ]

Originally posted by qinbuer at 2007-6-8 13:22:
I think, perhaps a batch file can be made to scramble the batch files that need to be encrypted in a certain order or replace them with other characters, and when decrypting, restore them in a certain order. But in this way, before decrypting, the batch ...

I feel that when it comes to the essence, there are only two types. One is the so-called smokescreen that looks like garbled code but can be executed directly. It seems that the tools in the special discussion thread of this forum can deal with it. The other type is the one that requires a password. Currently, it seems that only brute-force cracking is used. The theory is crackable, but in reality, it is very, very difficult.
The discussion about Ghost is no longer there. Let's talk about it when the temp file is solved.