China DOS Union
-- Unite DOS · Advance DOS · Grow DOS --Union site: www.cn-dos.net Forum site: www.cn-dos.net/forum
|
China DOS Union-- Unite DOS · Advance DOS · Grow DOS --Union site: www.cn-dos.net Forum site: www.cn-dos.net/forum |
| Guest | Log in | Register | Members | Search | China DOS Union |
|
中国DOS联盟论坛 The time now is 2026-08-03 07:27 |
48,038 topics / 350,123 posts / today 1 new / 48,251 members |
| DOS批处理 & 脚本技术（批处理室） » [Help] Decrypt Batch Script |
| Printable Version 2,098 / 14 |
| Floor1 tashaxin | Posted 2007-01-26 10:41 |
| 初级用户 Posts 30 Credits 99 | |
|
The kill.bat in the attachment is encrypted and cannot be learned or studied.
I hope someone can help decrypt it. Thank you ──────────────── Moderator's Note ──────────────── This attachment is the special killing tool for Panda Burning Incense virus. The kill.bat in it is not a real batch processing file, but a PE format exe executable file. It is impractical to operate in the way of decrypting batch processing files. ──────────────── Moderator's Note ──────────────── [ Last edited by namejm on 2007-1-26 at 10:24 AM ] Attachments xmzsbz.rar (94.98 KiB) |
|
| Floor2 chenall | Posted 2007-01-26 13:26 |
| 银牌会员 Posts 469 Credits 1,276 From 福建泉州 | |
|
This KILL.BAT is not a batch file. It is an executable file. Renaming it to KILL.EXE can still make it run.
|
|
| Floor3 yywd | Posted 2007-01-26 22:47 |
| 中级用户 Posts 130 Credits 358 | |
|
Yes, it is an executable file
|
|
| Floor4 tashaxin | Posted 2007-01-26 23:16 |
| 初级用户 Posts 30 Credits 99 | |
|
Oh! It's too dark! You tricked me so badly!
Thanks to the third floor and the two brothers on the second floor! |
|
| Floor5 zhclvip | Posted 2007-01-28 10:51 |
| 初级用户 Posts 50 Credits 138 | |
|
This is to prevent being infected as soon as downloaded. EXE files can also run when renamed to BAT.
|
|
| Floor6 aspirer | Posted 2007-01-29 01:32 |
| 初级用户 Posts 35 Credits 72 | |
|
At that time, I also thought there was such an amazing encryption method, and I even wanted to learn about the encryption method.
|
|
| Floor7 hngaoshou | Posted 2007-02-01 02:05 |
| 社区乞丐 Posts 77 Credits -16 | |
| Floor8 cdzjf | Posted 2007-02-04 06:44 |
| 新手上路 Posts 4 Credits 10 | |
| Floor9 jackyggt | Posted 2007-03-16 07:48 |
| 初级用户 Posts 38 Credits 76 | |
|
Bump
|
|
| Floor10 maya0su | Posted 2007-10-20 21:58 |
| 中级用户 Posts 131 Credits 241 | |
|
Hehe, today I found the same file in Yongyou's Financial Messenger. A file named "MSDEStp2000.bat" is actually an executable program. The execution environments of.exe and.bat are different. Why can they achieve the effect of being able to execute after changing the suffixes? What's the reason?
|
|
| Floor11 nd371 | Posted 2008-05-23 22:17 |
| 新手上路 Posts 1 Credits 2 | |
|
Not bad, not bad,,, very powerful! I like it.
|
|
| Floor12 PPdos | Posted 2008-05-24 04:53 |
| 高级用户 Posts 268 Credits 783 | |
Originally posted by maya0su at 2007-10-20 09:58 PM: After looking at the following display results, I believe everyone can understand a little bit ftype|find "batfile" By the same token, changing the exe to the following file types with the same extension should also be able to run
Extension: If you run the following lines of commands: Even if you change that kill.exe to kill.cn-dos or kill.ppdos, it can still run |
|
| Floor13 bjjgq | Posted 2009-12-01 14:56 |
| 初级用户 Posts 27 Credits 39 | |
|
I wonder if the code mentioned by the person upstairs already exists in the file. It can modify the file type association by itself. Before opening, modify:
ftype|find "batfile" batfile="%1" %* After using, change it back: ftype|find "exefile" exefile="%1" %* |
|
| Floor14 21336721 | Posted 2009-12-01 21:06 |
| 新手上路 Posts 5 Credits 8 | |
|
Hey there, upstairs. If it's really like this, the antivirus software will go wild.
|
|
| Floor15 echolueng | Posted 2009-12-02 21:31 |
| 新手上路 Posts 2 Credits 2 From 山东 | |
|
[ Contact the Union admin team -
中国DOS联盟 -
Standard version ] Sponsored by ifanr Inc | © 2001–2023 |