China DOS Union

Yesterday in the group, ☆弦★ posted an address asking us to take a look, and it turned out to be "Batch Processing Program System Maintenance".

I registered an ID and downloaded three versions of exe files: System Maintenance wv1.4.0.0 Trial Version, System Maintenance wv1.4.1.2 Trial Version, and System Maintenance wv1.4.2.0 Official Version. Upon seeing it, I realized it was compiled with QBFC, so I thought of checking the released batch processing program in %tmp%, but it was actually a bunch of encrypted garbled code, which seemed familiar. Suddenly, I remembered the heated discussion about batch processing encryption in the forum a while ago . Batch processing encrypted in this way seems irreversible and cannot be restored to its original form. But the author's instruction file is too alluring: system garbage cleaning, killing malicious programs, finding suspicious DLL call programs, searching for file or virus paths, forcibly terminating suspicious programs, deleting hidden attribute viruses... It can even get rid of viruses, which is really powerful.

After fumbling for a long time, I finally found a way to crack it and completely restored the batch processing file. When I read the code of the official version, I couldn't help but get angry:

1. The code is almost pieced together from online content (among which there is a segment that I modified), and several segments have almost the same function. I don't know why the author put them together. Could it be that setting multiple times would make the system more secure? This detail also exposes the author's plagiarism behavior;

2. Created 1 folder in C:\WINDOWS. If the password is entered incorrectly three times, two more folders and a bunch of files will be generated. The folders are hidden + system + read-only attributes, which generates a lot of garbage and is a kind of ravaging of the user's system;

3. The official authorized version is sold for: 10 yuan RMB. - This is the most infuriating part: plagiarizing online things and actually selling them for money is too excessive.

Now I am attaching his official version for everyone to read this author's great work - if we can draw on his encryption ideas, it can be regarded as an unexpected gain, which can also be regarded as a little originality of the author.

1. Batch Processing Program System Maintenance http://www.xz0792.com/bbs/dispbbs.asp?boardID=32&ID=868&page=1
2. Non-compiled Batch Processing Encryption Scheme and Code http://www.cn-dos.net/forum/viewthread.php?tid=22254&fpage=1&highlight=%E5%8A%A0%E5%AF%86

[ Last edited by namejm on 2006-8-27 at 03:16 ]

Actually, this kind of cracking is very simple:
Just use a hexadecimal software like WinHex to handle it and it's done.

This batch encryption is for the script I posted earlier where "FFFE0D0A636C730D0A" is added at the beginning of the file, which is the script for encrypting files by the moderator willsort.

[ Last edited by zxcv on 2006-8-27 at 13:16 ]

I directly dragged it into the garbled text viewer to make it reveal itself.

[ Last edited by namejm on 2006-8-27 at 13:24 ]

Beat him and block the forum's IP

The DOS platform is a place for mutual learning, where the knowledgeable teach the unknowledgeable. I think the original poster probably posted in the wrong place.

The original poster is a bit excessive. I don't know where your stuff came from? I also downloaded and studied it, thinking it was my own? Hiding things that others don't understand, deleting them is a mistake. Modifying the registry entries is correct, but double-clicking to import the registry is wrong. What did you modify? It's a bunch of fancy stuff. Making useless detours, and also setting registry entries that don't exist at all to hide things from people, could it be your patent? As a platform for mutual learning, what's there to be unbalanced about? If you're a "expert", be more magnanimous.

The correct commands using batch processing should be:

Turn off default shares
---------------------
echo Windows Registry Editor Version 5.00 > c:\qcmrgx.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters] >> c:\qcmrgx.reg
echo "AutoShareServer"=dword:00000000 >> c:\qcmrgx.reg
echo "AutoSharewks"=dword:00000000 >> c:\qcmrgx.reg
regedit /s c:\qcmrgx.reg
del c:\qcmrgx.reg

------------------------

If you want to turn on default shares again

echo Windows Registry Editor Version 5.00 > c:\qcmrgx.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters] >> c:\qcmrgx.reg
echo "AutoShareServer"=dword:00000001 >> c:\qcmrgx.reg
echo "AutoSharewks"=dword:00000001 >> c:\qcmrgx.reg
regedit /s c:\qcmrgx.reg
del c:\qcmrgx.reg

---------------------------

What else can be used to generate files besides echo?

Originally posted by ZJHJ at 2006-9-28 10:37:
The DOS platform is a place for mutual learning, where those who know teach those who don't. I think the original poster probably posted in the wrong place.
The original poster is a bit excessive. I don't know where your thing came from? I also downloaded and studied it, thinking it was my own?
Hiding things from those who don't understand and deleting them is a mistake. Modifying the registry entries is correct, but double-clicking to import the registry is wrong. What did you modify? It's a lot of fancy stuff. Making useless detours and setting up registry entries that don't exist at all to fool people. Could it be your patent? As a platform for mutual learning, what's unbalanced? If you are a "master", be more magnanimous?

　　Did I say it was my thing? Please pay attention to my wording in the top floor. Modify = write? There is no intention of arguing about copyright with others.

　　As a batch processing, the code is all open source, there is no need to encrypt for money. Moreover, most of the code inside is directly copied from the Internet. Actually, it is used to make money. I accused such behavior. Is it me who is excessive or him who is excessive?

　　As for saying that paragraph of code is a fancy stuff, there is no need to put the hat on my head. What I did was just add the function of judging whether the partition exists, add some comments, and slightly change some code.

　　Saying that I am unbalanced, there is indeed a little bit: most of them are copied things, and actually used to exchange money, this is the first; generated N many files, and put it in the system directory, which is simply a kind of ravaging the user's system, this is the second.

　　I hope you will read my analysis in the top floor again, and you will know why I accused this plagiarist. Please don't avoid the key issue of using plagiarized code to make money. You can also consider the practice of generating garbage files by the way.

A large part of that code is copied.

I don't use things that are encrypted and I can't see the source code, heh, because I'm afraid

If this code is his own optimized work, there's nothing to say. But it looks like it's copied at first glance. For example, cleaning up garbage, system being optimized, etc. are all available online. Why sell it then?
If I give him money, heh, it feels like I've been cheated.
It's not developed by himself. But it's good to crack it and learn from it.
See if the password path is C:\WINDOWS\twscsye\PASSWORD.PWD
The password I saw is: Sichuan Hejiang QQ363693851
The password code is as follows
@ECHO Enter the initial password:
@ECHO OFF
SET /P PASSWORD=
FOR /F %%I IN (C:\WINDOWS\twscsye\PASSWORD.PWD) DO SET MY-PWD=%%I
IF "%PASSWORD%" == "%MY-PWD%" GOTO PWD0
CLS
echo Incorrect password!!!
ECHO Please correct and re-enter the initial password:
@ECHO OFF
SET /P PASSWORD=
FOR /F %%I IN (C:\WINDOWS\twscsye\PASSWORD.PWD) DO SET MY-PWD=%%I
IF "%PASSWORD%" == "%MY-PWD%" GOTO PWD0
CLS
echo Incorrect initial password!!!
ECHO You should enter the password provided to you when you purchased the program:
@ECHO OFF

Hehe, this thing still costs money to buy,郁闷. Others who made better ones didn't say anything!

Thanks for sharing! Learning

The script is well - written. Support. If I need to register, I still choose Super Rabbit Shareware.