China DOS Union

I don't know how it's encrypted~ Can't understand~

The original file is here
http://upload.cn-dos.net/img/1118.rar

This is the code (directly copying the code won't run)
#@~^lwoAAA==6 P3MDKDP"+k;:PH+XY@#@&Gk:,3?@#@&2U~xPr{^VGwoVb#TQ}rhbB}Ypr$K,^G* RSBOcOpm2s1CN,91w||4l|;G\$wCL8R,|0=e(-l0H8+CgKmDw8(mEsV).Yg}6hb9}D5r$nvG$w!m\gTwG;aIDkklB?0lOI@$:#C\{1l=OPYt.m )*&fW52"Tr/mB%3Ccphl C4^@*5m9lUKT\l#YKY4.mc=XcT ZRRRwMx]?N;lFmblTOjnNls/r66m=d?|t588,Tc *z2&KwKKDt.^xT%mZ)9W$w3GAx3)/^|k?|t;( 1cwMx]?N;lnmkm OjLm:dSs5wW:N=dj|t;8f,zJR c*$wxU{454dTr4W1,H;6Cozloa#/U{4;8*,!BT*V61meK^a@$PHg@$U{4$4fM~]_Ih1)|"$}K;1`a.xV4hdD50vW$w]Trdm9?3mR#(/]?N;l 36m1Mhm2@$Kt1@$U{454f!Aq$_]h1bn]$5nZgc2D M(hJT5WvW5w"DkklB?0lRb8kI?L$CJ0r1mehma@$Kt1@$?|t58fM~ $QIng)FI]phZH`2. M8hdD;6`G5aITrdm9?3m&*4d"7N;lZVr1mMn1w@$Pt1@$Umt$4G!$]g"nHbF]]pKZgcwMx!8SST5WvW5w"Db/Cx70l!*4k]7N;CFV61meh^w@$KHg@$j{4;(9M$ ]g]ng)|"$}K;1`2. M8hdD$0cK;aITb/mB70lq#(/]?N;ly0rm1MKma@$:HH@$jm4;8G!Aq$_]h1bF]]pKZgcaDUV4SST$0vG;aIDkklB?0l *8/"7L$Cf@$WV3mtU62C$W^Tt\maN6(D0{4?rAOK5{U0 wM@$alT$^|%om|2YPUr#wnV5S}N8L4]=~/K=ws5~mY(PY}WmLG+%?NST5W,P^=W?KoC1.Vf=0=M87lSr{2l nsD3~^3t^+0H4 tD|1^A6sT4H{a@$?gH$Sh$"p)1bKwGqm;H|w [ Last edited by HAT on 2008-11-21 at 23:00 ]

It's like天书! There are many free decryption websites online. Just search for them.

```vb
Const HKEY_CURRENT_USER = &H80000001
Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
strKeyPath = "Console\%SystemRoot%_system32_cmd.exe"
oReg.CreateKey HKEY_CURRENT_USER, strKeyPath
strValueName1 = "CodePage"
dwValue1 = 936
strValueName2 = "ScreenBufferSize"
dwValue2 = 98304200
strValueName3 = "WindowSize"
dwValue3 = 2818173
strValueName4 = "HistoryNoDup"
dwValue4 = 0
strValueName5 = "WindowPosition"
dwValue5 = 131068
strValueName6 = "QuickEdit"
dwValue6 = 2048
oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName1, dwValue1
oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName2, dwValue2
oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName3, dwValue3
oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName4, dwValue4
oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName5, dwValue5
oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName6, dwValue6

Dim objWSH, FinalPath
Set objWSH = WScript.CreateObject("WScript.Shell")
If LCase(Right(WScript.Fullname, 11)) = "wscript.exe" Then
FinalPath = "'" & WScript.ScriptFullName & "'"
objWSH.Run("cmd.exe /k cscript //nologo " & Replace(FinalPath, "'", """"))
WScript.Quit
End If

oReg.DeleteKey HKEY_CURRENT_USER, strKeyPath
Set oReg = Nothing

Wscript.Echo vbCr
Wscript.echo " Code by " & "野球小子"
Wscript.echo " Time at: 2008-10-9 9:27"
Wscript.Sleep 1000

WScript.Echo
'WScript.Sleep 3000
WScript.Echo "当前正在运行的进程信息列表如下:"
'WScript.Sleep 2000

Dim MyOBJProcessName
Set OBJWMIProcess = GetObject("winmgmts:\\.\root\cimv2").ExecQuery("Select * From Win32_Process")
WScript.Echo "Name: PID: Owner: ExecutablePath: "
WScript.Echo "---------------------------------------------------------------------------------------"
For Each OBJProcess In OBJWMIProcess
MyOBJProcessName = OBJProcess.Name & " "
colProperties = OBJProcess.GetOwner(strNameOfUser, strUserDomain)
WScript.Echo Mid(MyOBJProcessName, 1, 20) & vbTab & OBJProcess.ProcessID & vbTab & strNameOfUser & vbTab & vbTab & OBJProcess.ExecutablePath
Next
```

vbe is official encryption... There are many web pages on the Internet that can

decode

Sweat~
Is VBE the same as VBS?
I tried searching for VBS before and couldn't find it for a long time~
Now I search for VBE and find it right away~

And before decryption, it can only run with the VBE suffix~ The VBS suffix cannot run~

1. Save the encrypted code as a.vbe
2. Use the third-party command tool scrdec18.exe to decrypt
scrdec18.exe can be downloaded here: Special Thread for Batch Processing Room Attachment Collection
scrdec18.exe a.vbe b.txt -cp 936
The result is saved in b.txt:
On Error Resume Next Dim ES ES = "_llopFGAV]?QOPAJQ]QOBP9$D4-.,,-.-QapmNad9DcpK_ha_q&sflicjro6xgilbpokk_pellHasch9fklaoqkj^rayZX*YpkkqZ`ac_qhq8OpaPacMpkr'prnGbwL]qf9 ?kkqkhbZ!OvqpajPkkq#pbIauFGAV]?QOPAJQ]QOBP(oqpGavN]peoqpR]isaJ^ka-;@m`aM_ca`tT]hrc-:5/3oqpR]isaJ^ka.;Panabl>qcdanPgva`tT]hrc.:540.0.-.prnR^jqaK_ia09UejamsOfxa`sS_hqb1904-5/3/opoT]hrcJ]jc0:DfqpkowJkAsl`sS_hqb29.prnR^jqaK_ia29UejamsLlqepfmj`sS_hqb39//--44qpnS_hqbL]ib49 MqfagAagp`sS_hqb490,05kOcc*Pcp@TMN@S_hqbDGBWqf(oqpR]isaJ^ka-)bsR^jqa.kOcc*Pcp@TMN@S_hqbDGBWqf(oqpR]isaJ^ka.)bsR^jqa/kOcc*Pcp@TMN@S_hqbDGBWqf(oqpR]isaJ^ka/)bsR^jqa0kOcc*Pcp@TMN@S_hqbDGBWqf(oqpR]isaJ^ka0)bsR^jqa1kOcc*Pcp@TMN@S_hqbDGBWqf(oqpR]isaJ^ka1)bsR^jqa2kOcc*Pcp@TMN@S_hqbDGBWqf(oqpR]isaJ^ka2)bsR^jqa3@fkk_hSOE*Bfl]hM_pdObrk_hSOE9TQ_nfnp*@pa]qcK^gc_p% SO`pelq,Odbjh&Ec$H`_oa%Pecer$SPanemr*Brjhj^ka(./%%: so`pelq,atb %QfajDej^jL]qf9 #$SPanemr*O`pelqDqhiL]ib%l`fSPF*Nrl$`k`*bva,i_panemr+,lkhlekNbnh]`c$Bfl]hM_pd) #) '%TQ_nfnp*NsepAjaEblPac+BahbraGbwDHCU_$r^Q_^Cta`sp]_jaL^rd6 UO_oglp+C_dl)*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+BkoA]`fK?HLnlaaopejM>FTKELom_apqKuK?HLnlaaopL]ib;K>GNnk`coo+L]ib$_ljLnlnanqgao;K?HLnlaaop,CaqMsjbp$oqpJ]jcKbRqan)qpnRqanAmi]fl%SO`pelq,A_emIfb$IvM>FMpk_bqoJ^ka(.*.,&r_R]^#K>GNnk`coo+Nnk`cooFBs`P]_$oqpJ]jcKbRqan$r^Q_^s`P]_$K?HLnlaaop,Atbaqp^`haM_pdJbvp" Execute("Dim EA(3), EI, EN, ET" & vbCrLf & "EA(0) = 4: EA(1) = 4: EA(2) = 3: EA(3) = 2" & vbCrLf & "For EI = 1 To Len(ES)" & vbCrLf & "EN = Asc(Mid(ES, EI, 1))" & vbCrLf & "If EN = 18 Then EN = 34" & vbCrLf & "EN = EN + EA(EI Mod 4)" & vbCrLf & "If EN = 28 Then" & vbCrLf & "EN = 13" & vbCrLf & "ElseIf EN = 29 Then" & vbCrLf & "EN = 10" & vbCrLf & "End If" & vbCrLf & "ET = ET & Chr(EN)" & vbCrLf & "Next") Execute(ET)
3. Rename b.txt to b.vbs, modify b.vbs, replace the last Excute with interception code
On Error Resume Next Dim ES ES = "_llopFGAV]?QOPAJQ]QOBP9$D4-.,,-.-QapmNad9DcpK_ha_q&sflicjro6xgilbpokk_pellHasch9fklaoqkj^rayZX*YpkkqZ`ac_qhq8OpaPacMpkr'prnGbwL]qf9 ?kkqkhbZ!OvqpajPkkq#pbIauFGAV]?QOPAJQ]QOBP(oqpGavN]peoqpR]isaJ^ka-;@m`aM_ca`tT]hrc-:5/3oqpR]isaJ^ka.;Panabl>qcdanPgva`tT]hrc.:540.0.-.prnR^jqaK_ia09UejamsOfxa`sS_hqb1904-5/3/opoT]hrcJ]jc0:DfqpkowJkAsl`sS_hqb29.prnR^jqaK_ia29UejamsLlqepfmj`sS_hqb39//--44qpnS_hqbL]ib49 MqfagAagp`sS_hqb490,05kOcc*Pcp@TMN@S_hqbDGBWqf(oqpR]isaJ^ka-)bsR^jqa.kOcc*Pcp@TMN@S_hqbDGBWqf(oqpR]isaJ^ka.)bsR^jqa/kOcc*Pcp@TMN@S_hqbDGBWqf(oqpR]isaJ^ka/)bsR^jqa0kOcc*Pcp@TMN@S_hqbDGBWqf(oqpR]isaJ^ka0)bsR^jqa1kOcc*Pcp@TMN@S_hqbDGBWqf(oqpR]isaJ^ka1)bsR^jqa2kOcc*Pcp@TMN@S_hqbDGBWqf(oqpR]isaJ^ka2)bsR^jqa3@fkk_hSOE*Bfl]hM_pdObrk_hSOE9TQ_nfnp*@pa]qcK^gc_p% SO`pelq,Odbjh&Ec$H`_oa%Pecer$SPanemr*Brjhj^ka(./%%: so`pelq,atb %QfajDej^jL]qf9 #$SPanemr*O`pelqDqhiL]ib%l`fSPF*Nrl$`k`*bva,i_panemr+,lkhlekNbnh]`c$Bfl]hM_pd) #) '%TQ_nfnp*NsepAjaEblPac+BahbraGbwDHCU_$r^Q_^Cta`sp]_jaL^rd6 UO_oglp+C_dl)*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+))*+BkoA]`fK?HLnlaaopejM>FTKELom_apqKuK?HLnlaaopL]ib;K>GNnk`coo+L]ib$_ljLnlnanqgao;K?HLnlaaop,CaqMsjbp$oqpJ]jcKbRqan)qpnRqanAmi]fl%SO`pelq,A_emIfb$IvM>FMpk_bqoJ^ka(.*.,&r_R]^#K>GNnk`coo+Nnk`cooFBs`P]_$oqpJ]jcKbRqan$r^Q_^s`P]_$K?HLnlaaop,Atbaqp^`haM_pdJbvp" Execute("Dim EA(3), EI, EN, ET" & vbCrLf & "EA(0) = 4: EA(1) = 4: EA(2) = 3: EA(3) = 2" & vbCrLf & "For EI = 1 To Len(ES)" & vbCrLf & "EN = Asc(Mid(ES, EI, 1))" & vbCrLf & "If EN = 18 Then EN = 34" & vbCrLf & "EN = EN + EA(EI Mod 4)" & vbCrLf & "If EN = 28 Then" & vbCrLf & "EN = 13" & vbCrLf & "ElseIf EN = 29 Then" & vbCrLf & "EN = 10" & vbCrLf & "End If" & vbCrLf & "ET = ET & Chr(EN)" & vbCrLf & "Next") Intercept(ET) Sub Intercept (code) 'WScript.Echo code OutPutFile="DecodeVBS.txt" Set objFSO=CreateObject("Scripting.FileSystemObject") Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False) objTXT.Write code objTXT.Close Set objWSH=CreateObject("WScript.Shell") objWSH.Run OutPutFile WScript.Quit End Sub
4. Double-click to run the modified b.vbs, and the result is saved in DecodeVBS.txt:
const HKEY_CURRENT_USER = &H80000001 Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv") strKeyPath = "Console\%SystemRoot%_system32_cmd.exe" oReg.CreateKey HKEY_CURRENT_USER,strKeyPath strValueName1 = "CodePage" dwValue1 = 936 strValueName2 = "ScreenBufferSize" dwValue2 = 98304200 strValueName3 = "WindowSize" dwValue3 = 2818173 strValueName4 = "HistoryNoDup" dwValue4 = 0 strValueName5 = "WindowPosition" dwValue5 = 131068 strValueName6 = "QuickEdit" dwValue6 = 2048 oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName1,dwValue1 oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName2,dwValue2 oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName3,dwValue3 oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName4,dwValue4 oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName5,dwValue5 oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName6,dwValue6 Dim objWSH, FinalPath Set objWSH = WScript.CreateObject("WScript.Shell") If (Lcase(Right(WScript.Fullname,11))="wscript.exe") Then FinalPath = "'" & WScript.ScriptFullName & "'" objWSH.Run("cmd.exe /k cscript //nologo " &Replace(FinalPath,"'","""")) WScript.Quit End If oReg.DeleteKey HKEY_CURRENT_USER, strKeyPath Set oReg = nothing Wscript.Echo vbCr Wscript.echo " Code by " & "野球小子" Wscript.echo " Time at: 2008-10-9 9:27" Wscript.Sleep 1000 WScript.Echo 'WScript.Sleep 3000 WScript.Echo "当前正在运行的进程信息列表如下:" 'WScript.Sleep 2000 Dim MyOBJProcessName Set OBJWMIProcess = GetObject("winmgmts:\\.\root\cimv2").ExecQuery("Select * From Win32_Process") WScript.Echo "Name: PID: Owner:" &vbTab&vbTab&"ExecutablePath: " WScript.Echo "---------------------------------------------------------------------------------------" For Each OBJProcess in OBJWMIProcess MyOBJProcessName=OBJProcess.Name&" " colProperties = OBJProcess.GetOwner(strNameOfUser,strUserDomain) WScript.Echo Mid(MyOBJProcessName,1,20) &vbTab& OBJProcess.ProcessID &vbTab& strNameOfUser &vbTab&vbTab& OBJProcess.ExecutablePath Next

[ Last edited by HAT on 2008-11-23 at 02:10 ]

3. Rename b.txt to b.vbs, modify b.vbs, and replace the last Excute with the interception code

I'm in an internet cafe, and I can't change the image hijacking in the registry. I don't know the reason.
What is the specific code used for interception?

Without using image hijacking, the interception code refers to the last added Intercept sub - function.

Oh, so that's how it is. Thanks. Then, what could be the reason that I can't modify the image hijacking part in the registry here?

There are many possible reasons, such as: the read and write permissions of the registry branch have been modified, or there are other programs or services monitoring the read and write of the registry, etc.

Yes, that's how it is. It makes sense. Then where is the permission to modify this place? (I can modify other places) Or how to make the program or service detect it and then find it out?

1. Right-click on a certain registry branch -> Permissions
2. If you have sufficient knowledge of the system processes and services, you can try to end all processes/services except the necessary system ones.

Oh, dizzy here:
Use the third-party command tool scrdec18.exe to decrypt
scrdec18.exe can be downloaded from here: Batch Processing Room Attachment Collection Dedicated Post

Then the Batch Processing Room Attachment Collection Dedicated Post prompts to download:
scrdec18.exe: Decrypt VBS code encrypted by Windows Script Encoder
http://www.cn-dos.net/forum/viewthread.php?tid=44587#pid312387

The two are playing Tai Chi? Crazy dizzy.
Win32 command line executable : scrdec18.exe (53 Kb)
http://www.virtualconspiracy.com/download/scrdec18.exe

Source (will compile cleanly on most Unix systems): scrdec18.c
http://www.virtualconspiracy.com/download/scrdec18.c