Phân tích tính chất vài trận DDoS HVA vừa qua.

//---------------------------------------------------------------------------

#pragma hdrstop

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

#pragma argsused

//---------------------------------------------------------------------------

int GetOneXorByte(LPINT arrXor)
{
    int value1 = (arrXor[256] + 1) % 256;
    arrXor[256] = value1;

    int value2 = (arrXor[260] + arrXor[value1]) % 256;
    arrXor[260] = value2;

    int value3 = arrXor[value1];
    arrXor[value1] = arrXor[value2];
    arrXor[value2] = value3;
    return arrXor[(arrXor[arrXor[256]] + arrXor[arrXor[260]]) % 256];
}

int main(int argc, char* argv[])
{
    FILE *fIn = NULL;
    FILE *fOut = NULL;

    LPBYTE pJPGContent = NULL;
    LPBYTE pszData = NULL;
    BOOL bRetVal = FALSE;

    char szFileOut[MAX_PATH] = { '\0' };
    int arrXor[261] = { 0 };

    const char szKey[] = "0fb6f2f2dac443fd8beb5df3be320d36";
    int keyLen = strlen(szKey);

    printf("//-----------------------------------------------------------------------------------------\n");
    printf("// DecodeJPG: Decode the JPG files which are STL's DDOS C&C files\n");
    printf("// JPG files downloaded from the http://net.iadze.com/xxx.jpg and http://find.instu.net/xxx.jpg\n");
    printf("// RCE and coding by TQN (ThangCuAnh) - HVA Online Forum: www.hvaonline.net\n");
    printf("//-----------------------------------------------------------------------------------------\n\n");

    if (argc < 2)
    {
        printf("Usage: DecodeJPG JPGFile [Output File]");
        return EXIT_FAILURE;
    }

    char *szFileIn = argv[1];
    if (argc == 2)
    {
        char szDrive[_MAX_DRIVE] = { 0 };
        char szDir[_MAX_DIR] = { 0 } ;
        char szFName[_MAX_FNAME] = { 0 };
        _splitpath(szFileIn, szDrive, szDir, szFName, NULL);
        _makepath(szFileOut, szDrive, szDir, szFName, ".gz");
    }
    else
    {
        strncpy(szFileOut, argv[2], MAX_PATH);
    }

    fIn = fopen(szFileIn, "rb");
    if (NULL == fIn)
    {
        printf("Can not open input file: %s\n", szFileIn);
        return EXIT_FAILURE;
    }

    do
    {
        int i, value1, value2;

        fOut = fopen(szFileOut, "wb");
        if (NULL == fOut)
        {
            printf("Can not open output file %s\n", szFileOut);
            break;
        }

        fseek(fIn, 0, SEEK_END);
        int iJPGSize = ftell(fIn);
        fseek(fIn, 0, SEEK_SET);

        pJPGContent = (LPBYTE) malloc(iJPGSize);
        if (NULL != pJPGContent)
        {
            fread(pJPGContent, iJPGSize, 1, fIn);
        }
        else
        {
            printf("Not enought memory !\n");
            break;
        }

        pszData = (LPBYTE) malloc(iJPGSize);
        if (NULL == pszData)
        {
            printf("Nout enought memory for output buffer\n");
            break;
        }

        // Init arrXor
        for (i = 0; i < 256; ++i)
        {
            arrXor[i] = i;
        }
        arrXor[256] = arrXor[260] = 0;

        // Shuffle arr256
        while (1)
        {
            i = arrXor[256];
            if (i >= 256)
                break;
            value1 = (arrXor[260] + arrXor[i] + szKey[i % keyLen]) % 256;
            arrXor[260] = value1;
            value2 = arrXor[i];
            arrXor[i] = arrXor[value1];
            arrXor[value1] = value2;
            ++arrXor[256];
        }
        arrXor[256] = arrXor[260] = 0;

        // Xor loop
        for (i = 0; i < iJPGSize; ++i)
        {
            value1 = GetOneXorByte(arrXor);
            value2 = pJPGContent[i] ^ value1;
            pszData[i] = value2;
        }

        fwrite(pszData, iJPGSize, 1, fOut); // ghi lai noi dung da giai ma

        printf("Decode and extract data from JPG file %s to %s OK !\n", szFileIn, szFileOut);

        bRetVal = TRUE;
    } while (0);


    fclose(fIn);
    if (NULL != fOut)
    {
        fclose(fOut);
    }

    if (NULL != pJPGContent)
    {
        free(pJPGContent);
    }

    if (NULL != pszData)
    {
        free(pszData);
    }

    return bRetVal ? EXIT_SUCCESS : EXIT_FAILURE;
}
//---------------------------------------------------------------------------
Users currently in here
3 Anonymous