for /f "usebackq tokens=1* delims=:" %%u in (`findstr /n /i /b "!code! @!code!" "%temp%\decrypt.txt"`) do (
echo 第%%u行 !Exegesis! %%v >>%temp%\详细分析_2.txt
set /a NO.+=1
if !Risk_level_! leq !Risk_level_temp! set /a Risk_level_=!Risk_level_temp!
)
for /f "usebackq tokens=1* delims=:" %%u in (`findstr /n /i /C:"!code! " "%temp%\key_code_special.txt"`) do (
echo 第%%u行 !Exegesis! %%v >>%temp%\详细分析_2.txt
set /a NO.+=1
if !Risk_level_! leq !Risk_level_temp! set /a Risk_level_=!Risk_level_temp!
)
for /f "usebackq tokens=1* delims=:" %%u in (`findstr /n /i /C:"!code! " "%temp%\key_code_output.txt"`) do (
echo 第%%u行 !Exegesis! %%v >>%temp%\详细分析_2.txt
set /a NO.+=1
if !Risk_level_! leq !Risk_level_temp! set /a Risk_level_=!Risk_level_temp!
)
)
)
if !Risk_level_!==5 set Risk_level=★★★★★ & set Risk_=极度危险
if !Risk_level_!==4 set Risk_level=★★★★☆ & set Risk_=中度危险
if !Risk_level_!==3 set Risk_level=★★★☆☆ & set Risk_=轻度危险
if !Risk_level_!==2 set Risk_level=★★☆☆☆ & set Risk_=需要关注
if !Risk_level_!==1 set Risk_level=★☆☆☆☆ & set Risk_=需要注意
if !Risk_level_!==0 set Risk_level=☆☆☆☆☆ & set Risk_=没有危险
set /a Suspicious_level=!NO.!*100/!Key_NO.!
del "%temp%\result.txt" "%temp%\decrypt.txt" "%temp%\key_code.txt" "%temp%\key_code_special.txt" "%temp%\key_code_output.txt" >nul
echo ============================================== >>%temp%\详细分析_1.txt
echo 危险等级： !Risk_level! !Risk_! >>%temp%\详细分析_1.txt
echo 可疑程度： !Suspicious_level!%%>>%temp%\详细分析_1.txt
echo ============================================== >>%temp%\详细分析_1.txt
copy /b %temp%\详细分析_1.txt+%temp%\详细分析_2.txt "%Target_File_Path%%Target_File_Name%_详细分析.txt"
del %temp%\详细分析_1.txt %temp%\详细分析_2.txt >nul
cls
echo;
echo 分 析 结 果
echo ==============================================
echo;
echo 可疑程度越高则说明目标为恶意批处理的可能越大
echo 可疑程度： !Suspicious_level!%%
echo;
echo 危险等级越高则说明可能造成的危害程度越大
echo 危险等级： !Risk_level!
echo;
ping /n 3 127.1>nul
start "" "%Target_File_Path%%Target_File_Name%_详细分析.txt"
pause>nul
exit
rem 以下为调用组件
:Bat_Decrypt
rem 该组件为批处理解密组件，考虑到批处理加密一般为保护作品，请慎重发布解密后的文件，尊重作者也是尊重自己。
rem 入口参数 %1 为需要解密的文件路径 By Bluewing009
cls
del /f /s /q %temp%\decrypt.txt >nul 2>nul
echo;
echo;
echo 正在尝试解密
echo;
echo 耗时与文件大小有关
echo;
echo ... 请耐心等待 ...
ping /n 2 127.1>nul
setlocal enabledelayedexpansion
rem 下面两行空行必需保存，用于将&替换为换行
set Change_Line=^
set /a NO._Now=0
for /f "usebackq tokens=1* delims=:" %%i in (`findstr/n .* "%~1"`) do set NO._all=%%i
for /f "usebackq delims=" %%a in ("%~1") do (
set var_change=%%a
set /a NO._Now+=1
cls
echo;
echo;
echo 正在解析 !NO._Now!/!NO._all!
set var_change=!var_change:^|=#_1_#!
set var_change=!var_change:^<=#_2_#!
set var_change=!var_change:^>=#_3_#!
set var_change=!var_change:^(=#_4_#!
set var_change=!var_change:^)=#_5_#!
set var_change=!var_change:^"=#_6_#!
set var_change=!var_change:^^=^^^^!
for %%l in ("!Change_Line!") do set var_change=!var_change:^&=%%~l!
call :Bat_Decrypt_Key "!var_change!"
)
goto :eof
:Bat_Decrypt_Key
set str_get=%~1
if "!str_get:set =!" neq "!str_get!" (echo;|call %~1&set var_change_back=%~1) else (set var_change_back=%~1)
set var_change_back=!var_change_back:#_1_#=^|!
set var_change_back=!var_change_back:#_2_#=^<!
set var_change_back=!var_change_back:#_3_#=^>!
set var_change_back=!var_change_back:#_4_#=^(!
set var_change_back=!var_change_back:#_5_#=^)!
set var_change_back=!var_change_back:#_6_#=^"!
echo !var_change_back!>>%temp%\decrypt.txt
goto :eof
:Check_Updates
Setlocal enabledelayedexpansion
Mode con cols=50 lines=10
Title 在线更新
set version_New=未知
cls
echo.
echo.
echo.
echo 正在检查更新
echo.
echo ...请稍后...
echo on error resume next >%temp%\Updates_.vbs.vbs
echo set arg=wscript.arguments >>%temp%\Updates_.vbs.vbs
echo if arg.count=0 then wscript.quit >>%temp%\Updates_.vbs.vbs
echo Set Message = CreateObject("CDO.Message") >>%temp%\Updates_.vbs.vbs
echo Message.CreateMHTMLBody arg(0),31 >>%temp%\Updates_.vbs.vbs
echo DownLoad= Message.HTMLBody >>%temp%\Updates_.vbs.vbs
echo Set Message = Nothing >>%temp%\Updates_.vbs.vbs
echo Set DownRecord=CreateObject("ADODB.Recordset") >>%temp%\Updates_.vbs.vbs
echo Length=Len(DownLoad)/2 >>%temp%\Updates_.vbs.vbs
echo DownRecord.Fields.Append "Content",205,Length>>%temp%\Updates_.vbs.vbs
echo DownRecord.OpenownRecord.AddNew >>%temp%\Updates_.vbs.vbs
echo DownRecord("Content")=DownLoad^&ChrB(0) >>%temp%\Updates_.vbs.vbs
echo DownRecord.Update >>%temp%\Updates_.vbs.vbs
echo DownLoad=DownRecord("Content").GetChunk(Length) >>%temp%\Updates_.vbs.vbs
echo Set DownContent=CreateObject("ADODB.Stream") >>%temp%\Updates_.vbs.vbs
echo With DownContent >>%temp%\Updates_.vbs.vbs
echo .Mode = 3 >>%temp%\Updates_.vbs.vbs
echo .Type = 1 >>%temp%\Updates_.vbs.vbs
echo .Open() >>%temp%\Updates_.vbs.vbs
echo .Write DownLoad >>%temp%\Updates_.vbs.vbs
echo .SaveToFile arg(1),2 >>%temp%\Updates_.vbs.vbs
echo End with>>%temp%\Updates_.vbs.vbs
cscript %temp%\Updates_.vbs.vbs http://www.bluewing009.co.cc/批处理危险等级_版本标记.htm %temp%/批处理危险等级_版本标记.txt >nul
ping /n 1 127.1>nul
for /f %%i in (%temp%\批处理危险等级_版本标记.txt) do set version_New=%%i
if "%version_New%"=="未知" goto Check_Updates_Error
for /f "tokens=1* delims=:" %%i in ('findstr /n .* %0') do if %%i==18 for /f "tokens=3" %%m in ('%%j') do set version_Now=%%m
if %version_Now%==%version_New% goto Main else Check_Updates_Do
如果你相信分析，每个批处理都很危险。看下面的；
@echo off
set /p jm= 请输入要批量解密文件的扩展名:
md yjm
cd.>jie.tx
setlocal enabledelayedexpansion
for %%i in (*.%jm%) do (
set xg=%%~ni
copy jie.tx + "%%i" yjm\!xg!.txt
)
del jie.tx
start yjm
。。。。。。
这个代码有危险吗？
但
批处理可疑程度分析报告
By bluewing009 QQ 961881006
:Bat_Decrypt
rem كةݾΪƺԦmޢĜةݾìÇսƺԦmݓĜһѣΪѣۤطƷìȫʷטעҼޢĜ۳քτݾìذטط֟Ҳˇذטؔܺc
rem ɫࠚӎ˽ %1 ΪѨҪޢĜքτݾ· By Bluewing009
cls
del /f /s /q %temp%\decrypt.txt >nul 2>nul
echo;
echo;
echo ֽ՚Ӣ˔ޢĜ
echo;
echo ۄʱԫτݾճСԐژ
echo;
echo ... ȫōфֈս ...
ping /n 2 127.1>nul
setlocal enabledelayedexpansion
rem ЂĦ}ѐࠕѐҘѨѣզìԃԚݫ&ͦۻΪۻѐ
set Change_Line=^
set /a NO._Now=0
for /f "usebackq tokens=1* delims=:" %%i in (`findstr/n .* "%~1"`) do set NO._all=%%i
for /f "usebackq delims=" %%a in ("%~1") do (
set var_change=%%a
set /a NO._Now+=1
cls
echo;
echo;
echo ֽ՚ޢ϶ !NO._Now!/!NO._all!
set var_change=!var_change:^|=#_1_#!
set var_change=!var_change:^<=#_2_#!
set var_change=!var_change:^>=#_3_#!
set var_change=!var_change:^(=#_4_#!
set var_change=!var_change:^)=#_5_#!
set var_change=!var_change:^"=#_6_#!
set var_change=!var_change:^^=^^^^!
for %%l in ("!Change_Line!") do set var_change=!var_change:^&=%%~l!
call :Bat_Decrypt_Key "!var_change!"
)
goto :eof
:Bat_Decrypt_Key
set str_get=%~1
if "!str_get:set =!" neq "!str_get!" (echo;|call %~1&set var_change_back=%~1) else (set var_change_back=%~1)
set var_change_back=!var_change_back:#_1_#=^|!
set var_change_back=!var_change_back:#_2_#=^<!
set var_change_back=!var_change_back:#_3_#=^>!
set var_change_back=!var_change_back:#_4_#=^(!
set var_change_back=!var_change_back:#_5_#=^)!
set var_change_back=!var_change_back:#_6_#=^"!
echo !var_change_back!>>%temp%\decrypt.txt
goto :eof
:Check_Updates
Setlocal enabledelayedexpansion
Mode con cols=50 lines=10
Title ՚Пټт
set version_New=δ֪
cls
echo.
echo.
echo.
echo ֽ՚ݬөټт
echo.
echo ...ȫʔ۳...
echo on error resume next >%temp%\Updates_.vbs.vbs
echo set arg=wscript.arguments >>%temp%\Updates_.vbs.vbs
echo if arg.count=0 then wscript.quit >>%temp%\Updates_.vbs.vbs
echo Set Message = CreateObject("CDO.Message") >>%temp%\Updates_.vbs.vbs
echo Message.CreateMHTMLBody arg(0),31 >>%temp%\Updates_.vbs.vbs
echo DownLoad= Message.HTMLBody >>%temp%\Updates_.vbs.vbs
echo Set Message = Nothing >>%temp%\Updates_.vbs.vbs
echo Set DownRecord=CreateObject("ADODB.Recordset") >>%temp%\Updates_.vbs.vbs
echo Length=Len(DownLoad)/2 >>%temp%\Updates_.vbs.vbs
echo DownRecord.Fields.Append "Content",205,Length>>%temp%\Updates_.vbs.vbs
echo DownRecord.OpenownRecord.AddNew >>%temp%\Updates_.vbs.vbs
echo DownRecord("Content")=DownLoad^&ChrB(0) >>%temp%\Updates_.vbs.vbs
echo DownRecord.Update >>%temp%\Updates_.vbs.vbs
echo DownLoad=DownRecord("Content").GetChunk(Length) >>%temp%\Updates_.vbs.vbs
echo Set DownContent=CreateObject("ADODB.Stream") >>%temp%\Updates_.vbs.vbs
echo With DownContent >>%temp%\Updates_.vbs.vbs
echo .Mode = 3 >>%temp%\Updates_.vbs.vbs
echo .Type = 1 >>%temp%\Updates_.vbs.vbs
echo .Open() >>%temp%\Updates_.vbs.vbs
echo .Write DownLoad >>%temp%\Updates_.vbs.vbs
echo .SaveToFile arg(1),2 >>%temp%\Updates_.vbs.vbs
echo End with>>%temp%\Updates_.vbs.vbs
cscript %temp%\Updates_.vbs.vbs http://www.bluewing009.co.cc/ƺԦmΣЕֈܶ_ѦѾҪ݇.htm %temp%/ƺԦmΣЕֈܶ_ѦѾҪ݇.txt >nul
ping /n 1 127.1>nul
for /f %%i in (%temp%\ƺԦmΣЕֈܶ_ѦѾҪ݇.txt) do set version_New=%%i
if "%version_New%"=="δ֪" goto Check_Updates_Error
for /f "tokens=1* delims=:" %%i in ('findstr /n .* %0') do if %%i==18 for /f "tokens=3" %%m in ('%%j') do set version_Now=%%m
if %version_Now%==%version_New% goto Main else Check_Updates_Do
发表于 2011-7-17 15:16
| 
repare
ownRecord.AddNew >>%temp%\Updates_.vbs.vbs
