China DOS Union

Originally posted by chenall at 2008-12-14 10:14:
There seems to be some problems with the find and replace function..
Content of file A.TXT

Exe =$1\TEST

Exe =$1\TEST2

strw a.txt 0 0 /r /asc:$1 /asc:j: /a
The resulting result is garbled and characters are lost

Correct...

Has been corrected, see the attachment on the first floor

I said why it didn't work when I renamed grldr a few days ago, the file size changed after renaming. The corrected one is okay now.

#17
It is no problem to rename with grubutil now.

Hero, there's an error when writing 0.
str 1.exe 0x03 0 /e /hex:0011

When encountering 00, it can't be written.
Urgent need, can it be corrected as soon as possible?

[ Last edited by goli2008 on 2008-12-18 at 14:06 ]

If you execute the command: str 1.txt 0 0 /f /asc:0000 /a
Then the execution result is:
Find string At:
0 0x0
4 0x4

How is this output achieved?

Originally posted by chenall at 2008-12-14 09:43:
Well, the above can be achieved, but if it is placed in a batch file, calculating the character length will be more troublesome.

Another question, does the program return an error level value?
For example, for a search, what is returned on success? What is returned on failure?

#define SUCCESS 0
#define COMMON_USE_ERROR 1
#define OPEN_FILE_ERROR 2
#define PRG_MODIFIED 3
#define FILE_READ_ERROR 4
#define PARAMETER_ERROR 5
#define CREATE_FILE_ERROR 6
#define FILE_WRITE_ERROR 7
#define SRCFILE_DSTFILE_SAME 8
#define USER_CANCEL 9
#define FILE_NOT_EXIST 10
#define FILE_SEEK_ERROR 11
#define STRING_NOT_FOUND 12

Accepted, updated, it's convenient to use the return value for batch processing.

Can the antivirus software improve the issue of reporting viruses further?

Anti-virus engine Version Last update Scan result
Panda 9.0.0.4 2008.12.23 Suspicious file
eSafe 7.0.17.0 2008.12.23 Suspicious File
CAT-QuickHeal 10.00 2008.12.23 (Suspicious) - DNAScan
TrendMicro 8.700.0.1004 2008.12.23 PAK_Generic.001

Originally posted by lianjiang2004 at 2008-12-24 12:46:
Can the problem of antivirus software reporting viruses be further improved?


Antivirus engine version Last update Scanning result
Panda 9.0.0.4 2008.12.23 Suspicious file
eSafe 7.0.17.0 2 ...

Is it a DOS version or a Win32 version?

Upload a re-compiled Win32 version and see if it still reports.

[ Last edited by 19951001 on 2008-12-24 at 23:59 ]

It's the Win32 version. There are still 4 false positives in the new version.

Refer to the result:
http://www.virustotal.com/zh-cn/analisis/b9c3a770b58c752acffa461f01a8ff3f

Originally posted by lianjiang2004 at 2008-12-25 09:00:
It's the win32 version, and the new version still has 4 false positives.

For the result, please refer to:
http://www.virustotal.com/zh-cn/analisis/b9c3a770b58c752acffa461f01a8ff3f

Here, it is compiled with 3 compilers: vc6, vc2005, watcom_c_c++. Let's see if it still reports.

I checked it myself, and here are the results:

VC6 version
http://www.virustotal.com/zh-cn/analisis/5b64b8f4f16b18888f3f99d8f67405e0

VC2005 version
http://www.virustotal.com/zh-cn/analisis/55bbdb7349a1e2b9d13bfcfcb02c61f9

Watcom_c_c++ version
http://www.virustotal.com/zh-cn/analisis/55eed4217d9b87f75aa497a3a946fb57

It seems that the false positive is likely the smallest when compiled with Watcom_c_c++.

It's hard work. It seems this problem is a bit difficult to handle. Then there's no way, it can only be like this.

Finally solved the false positive, and used gcc to compile the program.
http://www.virustotal.com/zh-cn/analisis/de61cb640445ca8bb89b41affc255e91

Originally posted by 19951001 at 2008-12-26 22:10:
Finally solved the false positive, using gcc to compile the program.
http://www.virustotal.com/zh-cn/analisis/de61cb640445ca8bb89b41affc255e91

Great, so there won't be someone reporting it as a virus. Thanks.
If it's convenient, please recompile dspt and diskrw as well, as I need to use them in my GGhost.