引用:
Ailio寫到:
一堆人在問原理
其實原理就是那是特殊字串而已
就像光碟有autorun.ini 電腦就會去抓他的內容 來作執行
(也因此被隨身碟病毒拿來利用)
算是一個制定內的 測試字串
印象中 部份防毒軟體 官方都有提供測試用的病毒檔
裡面應該都是這類的特殊字串吧
錯!
那不是甚麼特殊字串,字串本身一點也沒甚麼特殊
用autorun.ini來比喻也完全不對題
那是個真正能執行的.com執行檔(但執行了也不會發生任何事情)
只不過是程式碼的每個byte都完全符合ASCII碼罷了
這種將原本的.com執行檔轉成"內容符合ASCII碼的執行檔(換說法就是內容是文字檔)"
的東西很久以前就玩過了
各位可以把以下內容存成"test.com"檔,然後執行看看...
(在xp執行應該會跳出小算盤)
T_OOWW3=XXWXPY50PPZ5jQP_-ys,A1Ea5y852cP4Z4PP-pV40P-BOu
com2txt/Nide5UqPWX,wP500-MQP4UP-wx4XP5rjP5Z2P-jC,JP=
5O4,APRX5BZP-pJPPQX42P-r=PRX55aP59DHHP-99,UP-lt,mP-uq=
P5_VHP-4A40PTZ,TPP_RX__zYHCVCQ8Bogx44444p44444F4444444
4gHC8OWQR.OqN1CL7SgEtKhC8OwPk.Op61Bf45DItIxC8RgPeOPAK1
BL7HrUtHStbIWP_OPAD1Av1Ko8nSPkkZ0fI40gA4ne14ngK4ng.4ng
h4ng94ndO4uAQUe2FG._8b5jp4Kf44OJncWW5Kblvj.hNA96pBbzKC
jhJ8zXGWuyYVGVtKl2Fhph44B9GAjTJ44ASmDV9A4CMHUlnhz2JUXo
l.FXH5ev1suEVUpXNAxoro94JKhlNj.jCzPO88zYtGP1_WefC6QMt4
6ek5xOAAB9vAaXA.WTCzUw5zThKKh46jPh414Oiv.4n5.ZiB.1_UpY
SGaxNGxC8SgTImB5MHXu5GnlCcWtl6kzpBbxCMjhJL8g7kCq21A48N
gPLOB7tBDFA5j8J10qNRTYF5ONdLlBjApx_mCCMHStCEgTH6hotMhy
DDOn634khN4XFIhmu6RZK__tvc.RKMeTJIh2ubSy_BhpFXPjIMfLJA
9y9Bn.RAbZKQ_ZcYPhfbtWzhutJAnaeAhd6VPjLAelJA5XFE.DB1Bv
62Pkhz.Tf.SvNGgPCQ6ovIhmu4bZK_PXvc.Pfb.Tf.BW6bSyhBhpFZ
.jbYph_Vp1_WedspNgS5bx9Gj2J14zC6RAuAb9FAjHJ4NeW5eERUe1
UAax0Ca8s9XOyHGPCQ0lv.syWBo7uD4ZNAfDJbsyeBbZKAZMWB.04O
jHJ4X4Vh.h4.szVBo7tCkc55x2Fe.kDOedJIhdEAuNK6nbmAUAR48F
Ct.49EaLA1PP9AaDAVearAhlNDPDkr4DNhpjCEjTJ4MGJt2kQrmGJB
8AyAxGB44b4yG8CA.TAAP4AehsX47BNvhoAVpom1QocAX48FgTTTE2
FKlP6WphnhVLJIhdEAu7XzpG88zP_Auu_WeiYz_g7OOyuDxO95wQI.
5o61PfFwrzJEaTAz6XnNqzgBgPCzWG7O4EtBG2Mb8JKt0lZTuKhApW
kBuMRKjDQ4RzKEaLAVpOCD7FKtulnhzLJKhdViPkkj6LEn4D4zrZ9U
PjLrng45bx9Gj2J1P2nqpZgBo55zzuPcL4nNPYUBeauhk.H4EVK9HA
NB4E1g28n7.XV4XEtc0e3BR9vAaXADGPKTHsXKcdFepeX1BOizOpn7
.XV4QAt7RzCOi2I4GTEKhp0epgkybx9Gj2J118stndl5R95KddJKo8
nTPk8n44VsR6h_wPE.4xV4PbKEaLAhQDAAP84.7H4nq4475NShPTA7
.XV4XAtA4LFP.pEEpFqAMOh47btRlta2pbztpghz.Gk3nas4K.4M8t
abAZmBn.V46c844ZxHsWMHXd0RPjLAdlJnl4A7.XV4QAu49jKANcX4
KcwM2tabQyQBhpFTpjzd4Rx7rWMHP_hapD0qQYIBnbw4B9EEeDJnO2
esRD_zCTA7.XV4TAtBKQIc.Xl4LtamDwMH3QLsRGzlqB5oPkvAaXAA
GPiGhx0K4B6557F.sp41_jCq.R5l4js459CkJhJpGWxG81E5DIAqtW
6UBBJCh44T_9AmPB6.PCsiEdBrx.Nk4j4zpPr5xd0j.j4O.dA4GPpb
sXE4XGF44FKKaLAbpxQ4Q9cFZprpPQ0bDS5B5YyBxsXAP4HcmbAyo7
5xn1M00P_VKp44UC9p9.cI2tapp3vAaXAPGTHmDfNAbp4sRGhgpBIG
dtJc4YOBgTilNhfN4XF4GP.6bZbA.4fqpXG4A.AIhpNBP4fq4XL4JM
MBhpFSpk9zsx0T9QHnpD4sRE3hyPJcmbpzjHK4Hd0C4BLA.x4h.X4q
pXG4A.Ac4xI4K.aI3hF4LtaG.2_oi.JL56yA.Csi4_CzBd41QRLpDb
NvHpN4PBxHRTfqQXL4LtapzFTBdbNvJLA4DBNvL2FA.Ck48NxHSWMH
SO5oi.JnPX48z3C.CxU4PAuLxp0M.h0ot4JzM.42pd_nk.Im4gMH2N
KuklrBk.4R8taGwLJnidIz6ghw.Eu42Nz9pgkwk.nM2tac4ZWBRZAO
rzO10lfbu8CIo8wIo7w4b351pQSohTJzK4A1PtfbwtIIhhEIlXE4Nl
Qoh4JzKk5Ihm7AbZJARZ4I_uPU9zJBnbg5rZK_PPspBZGAUAWoh8Jz
I35Ihm7Ab35MU2fqpWp5pZIIhtIojpJb.Pl4tYFb4SMKhsHcm4nbrZ
MBQ7_cpU_VH2EB8AtAh94mDgMHU7Xb4U3ct2Dct2Bcp2NG5XFE.DB1
4CCL8fK7tFlBlAu6dfNGeTJL5Z4O4AtDxoFTU_sie7Y14jK8JpJpGW
9z6cyp9.nM2tacL474LAsJ3QRsRDfcd_6IjDA4HsCPrX9AbX41PX9p
wTB6LLf.Cx44EiuA9.nM2ta62Lf4qxC4H9Cz7QSAoXFE.DH1BrNAaX
4IhlVK4BLpDbNpBZKG.L447aCclM4IclF4PAuBBZ4Oa444GTab7kkP
nbH5wL3Ihl0K4CkMhsCPrXCG.L4clLfNpXA4GWoP6lbIhlNO4CczBX
CG.L4clLfNpXA4GTKIh46D4441NiCb8nKvXd0UPjIGcHJAuoCTEFqA
MKhV0.A4E.dCspJGFdobmBt4ltap6.14GP7SkhCBn.25kdE4JshuO5
b6khUBn.M5kQLsRGtTXl6h4jy4DBl8jyuEEEVUxlNg.ksie70VWPHQ
xOy4WOhV2MWb8Z644DkqboxnQ848zY_.NDP.ODPV2LnhZLJKhlViPk
CTuDspH94IhxFb.BLpRXyCaX41AVNpBZNAiH4cLDfNPxV4GPEKhxFE
.4FmCCMHSpETGHXnP4PnB95opDASz5.5BZK_PDfqDTPhz4Jq.Z0B.N
61.khQ_5FAixJAL2Fh4h44E.8AXOW5sOIOPLV1QH0Ihm1ArZNGrZKW
PnKCq6CqpdfbwtEA6LBclEYV8L4444A44444444444MBdMa3fyo1BA
e0FUc1WQeHDMOSTuASdPnPt7MCPhdCPiCXVyn3wP.Yf7u3fP.HdMOS
UMPQTLbCPhdCPiMYVuo2gd.PVql3vMa1Feo3bAE2gIo2.tJI4tJQWI
r3wH.ZVx.RTyTHCIECPhdCPiCXVyn3wP.Qf7u3fP.Nb4dCPiP3FUa2
vT.2fUb3v7tHFD.3VEcZFenYRPMBbP44JpJ4444444444444DMOSUM
PQTL7444444444444444444HE5555555555844444444444444444L
5Z4O4BjRSpM13QMsRDn4A6x4DHJpGPEKkQIsRFIsREX7pYLsRDNGp4
4557BPUQCTBDD4444444444C55p44444oPrABPUQCTEQMTByBPUP.4
444444444444444444444444444444444444444444444444444444
444444444444444444444444444444444444444444444444444444
444444444444444444444444444444444444444444444444444444
444444444444444444444444444444444444444444444444444444
4444444444444444444444444444444444444AcXVqcCPh: