插入代码到“画图”程序 - 中国DOS联盟论坛

此bat对“画图”程序的副本进行修改，使其运行时先打开cmd。（不会破坏原“画图”程序）

::Insert Codes Into Mspaint	{s11ss@www.cn-dos.net 2008-3-24}
@echo off&setlocal&set m="%systemroot%\system32\mspaint.exe"
if not exist %m% echo Error occurs!&exit/b
for /f "usebackq" %%a in (%m%) do if %%~za neq 332288 echo Error occurs!&exit/b

pushd %tmp%&set m2="%systemdrive%\m.exe"&set t=%random%^>nul
copy %m% %t%

(echo e2e8 00 be&echo e210 64 cc&echo w&echo q)|debug %t%

(echo a100&echo mov ax,ds&echo add ax,3000&echo.&echo g105&echo q)|debug|find "AX">ds&set/p ds=<ds
set ds=%ds:~3,4%
(echo e%ds%:c164 EB 04 63 6D 64 00 6A 01 6A 00 6A 00 68 66 CC 03&echo e%ds%:c174 01 6A 00 6A 00 E8 62 42 5D 7C E9 3C 7F FF FF&echo w&echo q)|debug %t%

erase ds&move %t% %m2%&popd&echo %m2% has been created!
set/p r=Run it?(Y/N)
if /i "%r%" neq "N" start "" %m2%

第1楼　s11ss	发表于 2008-03-24 13:45
银牌会员　发帖 566　积分 2,098
[原创]插入代码到“画图”程序此bat对“画图”程序的副本进行修改，使其运行时先打开cmd。（不会破坏原“画图”程序） ::Insert Codes Into Mspaint {s11ss@www.cn-dos.net 2008-3-24} @echo off&setlocal&set m="%systemroot%\system32\mspaint.exe" if not exist %m% echo Error occurs!&exit/b for /f "usebackq" %%a in (%m%) do if %%~za neq 332288 echo Error occurs!&exit/b pushd %tmp%&set m2="%systemdrive%\m.exe"&set t=%random%^>nul copy %m% %t% (echo e2e8 00 be&echo e210 64 cc&echo w&echo q)\|debug %t% (echo a100&echo mov ax,ds&echo add ax,3000&echo.&echo g105&echo q)\|debug\|find "AX">ds&set/p ds=<ds set ds=%ds:~3,4% (echo e%ds%:c164 EB 04 63 6D 64 00 6A 01 6A 00 6A 00 68 66 CC 03&echo e%ds%:c174 01 6A 00 6A 00 E8 62 42 5D 7C E9 3C 7F FF FF&echo w&echo q)\|debug %t% erase ds&move %t% %m2%&popd&echo %m2% has been created! set/p r=Run it?(Y/N) if /i "%r%" neq "N" start "" %m2%

第2楼　HAT	发表于 2008-03-24 15:40
版主　发帖 5,017　积分 9,023
问个菜鸟问题：这跟在注册表中进行映象劫持有什么区别？

第3楼　seek334335	发表于 2008-03-24 16:00
新手上路　发帖 4　积分 8
支持谢谢分享

第4楼　s11ss	发表于 2008-03-24 18:50
银牌会员　发帖 566　积分 2,098
Originally posted by HAT at 2008-3-24 03:40 PM: 问个菜鸟问题：这跟在注册表中进行映象劫持有什么区别？一个修改注册表，一个直接修改PE文件，孰难孰易还用明说么？

第5楼　dikex	发表于 2008-03-24 22:36
高级用户　发帖 366　积分 788
这样就是感染了，小心被杀软报了，呵呵