• 26-09-2022, 15:02:04
    #1
    Öncelikle merhabalar sorunumu yazıyorum çözebilen kişiye cuzi miktarda olsa ödemesini vereceğim.

    Bir yazılım kurulumu sırasında token ve key sistemi yapılmış tokeni alıp x bir websitesinde 1 kredi karşılığında token keyini farklı bir key'e dönüştürüyor ve bizde yazılımı kurmak için olan yere keyi giriyoruz kurulum devam ediyor.

    Bana bu key'in nasıl verildiğini anlayacak ve bunu söyleyecek birisine ihtiyacım var bu bilgiye nazaran ödeme yapacağımdan şüpheniz olmasın. Aşağıya .bat dosyasındaki kodları yazacağım.

    Setlocal EnableDelayedExpansion
    Set _RNDLength=8
    Set _Alphanumeric=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
    Set _Str=%_Alphanumeric%987654321
    :_LenLoop
    IF NOT "%_Str:~18%"=="" SET _Str=%_Str:~9%& SET /A _Len+=9& GOTO :_LenLoop
    SET _tmp=%_Str:~9,1%
    SET /A _Len=_Len+_tmp
    Set _count=
    SET _RndAlphaNum=
    :a
    Set /a _count+=1
    SET _RND=%Random%
    Set /A _RND=_RND%%%_Len%
    SET _RndAlphaNum=!_RndAlphaNum!!_Alphanumeric:~%_RND%,1!
    If !_count! lss %_RNDLength% goto a
    for /f "tokens=1-2 delims=/:" %%a in ("%TIME%") do (set mytime=%%a)
    for /F "skip=1 delims=" %%F in ('
        wmic PATH Win32_LocalTime GET Day^,Month^,Year /FORMAT:TABLE
    ') do (
        for /F "tokens=1-3" %%L in ("%%F") do (
            set CurrDay=0%%L
            set CurrMonth=0%%M
            set CurrYear=%%N
        )
    )
    set CurrDay=%CurrDay:~-2%
    set CurrMonth=%CurrMonth:~-2%
    
    
    for /f "tokens=1-2" %%i in ('fastboot.exe devices') do (set devices=%%i)
    echo Your Key : !_RndAlphaNum!%devices%
    
    :loop
    set /p input="Enter key: "
    echo -------------------------------------------------
    
    echo WScript.Echo StrReverse("%input%"^) >reverse.vbs
    for /f "delims=" %%a in ('cscript //nologo reverse.vbs') do set "reversed=%%a"
    >nul del reverse.vbs
    
    
    for /F "tokens=* USEBACKQ" %%F in (`call abc.bat -decode %reversed%`) do (set key=%%F)
    set day=%key:~0,2%
    set mth=%key:~2,2%
    set yrs=%key:~4,4%
    set expire=%key:~6,2%
    set keydevice=%key:~22%
    
    for /F "tokens=* USEBACKQ" %%F in (`call calday.exe %day% %mth% %yrs% %CurrDay% %CurrMonth% %CurrYear% `) do (set period=%%F)
    set /a expire1=%expire% - %period%
    
    if %keydevice%==%devices% (
    
        if %expire1% GTR 0 (call:install) else (
        ehco Key expired , please use new key !
        pause    
    )
    )
    
    echo Wrong key, do again !
    
    goto loop
    Bu .bat dosyasının içerisinde abc.bat diye bir dosya ile yol gösterilmiş onuda alta yazıyorum.

    @if (@X)==(@Y) @end /* JScript comment
        @echo off
        
    
        cscript //E:JScript //nologo "%~f0"  %*
    
        exit /b %errorlevel%
        
    @if (@X)==(@Y) @end JScript comment */
    
    
    var toCall=null;
    var input=null;
    var ev=false;
    
    function parseArgs(){
        var args=WScript.Arguments;
        if(args.Length==0){
            printHelp();
            WScript.Quit(0);
        }
        
        var help = [
            "-h",
            "-help",
            "-?",
            "/h",
            "/help",
            "/?"    
        ];
        
        for(var i=0;i<help.length;i++){
            if(args.Item(0).toLowerCase()==help[i]){
                printHelp();
                WScript.Quit(0);
            }
        }
        
        if(args.Length%2!=0){
            WScript.Echo("Wrong number of arguments");
            WScript.Quit(1);
        }
        
        for(var i=0;i<args.Length-1;i+=2){
            switch(args.Item(i).toLowerCase()){
                case "-decode":
                    toCall=Base64.decode;
                    input=args.Item(i+1);
                    //return;
                    break;
                case "-encode":
                    toCall=Base64.encode;
                    input=args.Item(i+1);
                    //return;
                    break;
                case "-eval":
                    if(args.Item(i+1).toLowerCase()=="yes" || args.Item(i+1).toLowerCase()=="true"){
                        ev=true;
                    }
                    break;
                    
                default:
                    WScript.Echo("Wrong argument: "+args.Item(i));
                    WScript.Quit(2);
                    break;
            }
        }
        
        if(toCall==null || input==null){
            WScript.Echo("Wrong arguments");
            WScript.Quit(1);
        }
        
    }
    
    //http://stackoverflow.com/a/24294348/388389
    
    var jsEscapes = {
      'n': '\n',
      'r': '\r',
      't': '\t',
      'f': '\f',
      'v': '\v',
      'b': '\b'
    };
    
    function decodeJsEscape(_, hex0, hex1, octal, other) {
      var hex = hex0 || hex1;
      if (hex) { return String.fromCharCode(parseInt(hex, 16)); }
      if (octal) { return String.fromCharCode(parseInt(octal, 8)); }
      return jsEscapes[other] || other;
    }
    
    function decodeJsString(s) {
      return s.replace(
          // Matches an escape sequence with UTF-16 in group 1, single byte hex in group 2,
          // octal in group 3, and arbitrary other single-character escapes in group 4.
          /\\(?:u([0-9A-Fa-f]{4})|x([0-9A-Fa-f]{2})|([0-3][0-7]{0,2}|[4-7][0-7]?)|(.))/g,
          decodeJsEscape);
    }
    
    function printHelp(){
        WScript.Echo(WScript.ScriptName + "  decodes or encodes base64 strings");
        WScript.Echo("");
        WScript.Echo("Usage:");
        WScript.Echo("");
        WScript.Echo(WScript.ScriptName + "{-decode|-encode} input [-eval {yes|no}]");
        WScript.Echo("    -eval - evaluate the special characters input");
        WScript.Echo("");
        WScript.Echo("Examples:");
        WScript.Echo("");
        WScript.Echo(WScript.ScriptName + " -encode \"\\u0022Hello\\u0022\" -eval yes " );
        WScript.Echo(WScript.ScriptName + " -decode \"SGVsbG8=\"");
    }
    
    
    //http://www.webtoolkit.info/javascript-base64.html#.WMpLPzuGOqk
    var Base64 = {
    
    // private property
    _keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
    
    // public method for encoding
    encode : function (input) {
        var output = "";
        var chr1, chr2, chr3, enc1, enc2, enc3, enc4;
        var i = 0;
    
        input = Base64._utf8_encode(input);
    
        while (i < input.length) {
    
            chr1 = input.charCodeAt(i++);
            chr2 = input.charCodeAt(i++);
            chr3 = input.charCodeAt(i++);
    
            enc1 = chr1 >> 2;
            enc2 = ((chr1 & 3) << 4) | (chr2 >> 4);
            enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);
            enc4 = chr3 & 63;
    
            if (isNaN(chr2)) {
                enc3 = enc4 = 64;
            } else if (isNaN(chr3)) {
                enc4 = 64;
            }
    
            output = output +
            this._keyStr.charAt(enc1) + this._keyStr.charAt(enc2) +
            this._keyStr.charAt(enc3) + this._keyStr.charAt(enc4);
    
        }
    
        return output;
    },
    
    // public method for decoding
    decode : function (input) {
        var output = "";
        var chr1, chr2, chr3;
        var enc1, enc2, enc3, enc4;
        var i = 0;
    
        input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
    
        while (i < input.length) {
    
            enc1 = this._keyStr.indexOf(input.charAt(i++));
            enc2 = this._keyStr.indexOf(input.charAt(i++));
            enc3 = this._keyStr.indexOf(input.charAt(i++));
            enc4 = this._keyStr.indexOf(input.charAt(i++));
    
            chr1 = (enc1 << 2) | (enc2 >> 4);
            chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
            chr3 = ((enc3 & 3) << 6) | enc4;
    
            output = output + String.fromCharCode(chr1);
    
            if (enc3 != 64) {
                output = output + String.fromCharCode(chr2);
            }
            if (enc4 != 64) {
                output = output + String.fromCharCode(chr3);
            }
    
        }
    
        output = Base64._utf8_decode(output);
    
        return output;
    
    },
    
    // private method for UTF-8 encoding
    _utf8_encode : function (string) {
        string = string.replace(/\r\n/g,"\n");
        var utftext = "";
    
        for (var n = 0; n < string.length; n++) {
    
            var c = string.charCodeAt(n);
    
            if (c < 128) {
                utftext += String.fromCharCode(c);
            }
            else if((c > 127) && (c < 2048)) {
                utftext += String.fromCharCode((c >> 6) | 192);
                utftext += String.fromCharCode((c & 63) | 128);
            }
            else {
                utftext += String.fromCharCode((c >> 12) | 224);
                utftext += String.fromCharCode(((c >> 6) & 63) | 128);
                utftext += String.fromCharCode((c & 63) | 128);
            }
    
        }
    
        return utftext;
    },
    
    // private method for UTF-8 decoding
    _utf8_decode : function (utftext) {
        var string = "";
        var i = 0;
        var c = c1 = c2 = 0;
    
        while ( i < utftext.length ) {
    
            c = utftext.charCodeAt(i);
    
            if (c < 128) {
                string += String.fromCharCode(c);
                i++;
            }
            else if((c > 191) && (c < 224)) {
                c2 = utftext.charCodeAt(i+1);
                string += String.fromCharCode(((c & 31) << 6) | (c2 & 63));
                i += 2;
            }
            else {
                c2 = utftext.charCodeAt(i+1);
                c3 = utftext.charCodeAt(i+2);
                string += String.fromCharCode(((c & 15) << 12) | ((c2 & 63) << 6) | (c3 & 63));
                i += 3;
            }
    
        }
    
        return string;
    }
    
    }
    
    parseArgs();
    
    if(ev && toCall==Base64.encode) {
        input=decodeJsString(input);
    }
    //Why is this not working?
    //WScript.Echo(toCall(input));
    
    if(toCall==Base64.encode){
        WScript.Echo(Base64.encode(input));
    } else {
        WScript.Echo(Base64.decode(input));
    }
    Detaylar için dm'den veya konu altında yazabilirsiniz
  • 26-09-2022, 15:47:24
    #2
    Farklı bir siteden yardım istedim böyle bir mesaj yazıldı anlamını bilmiyorum


    • That is a batch/JScript hybrid. JScript executed by the Windows Script Host %SystemRoot%System32wscript.exe (Windows GUI version) or %SystemRoot%System32cscript.exe (console version) is similar to JavaScript, but is not JavaScript. The script file to interpret by the Windows Script Host is given the wrong extension .vbs instead of the correct extension .js which is compensated by using the option //E:JScript described on running wscript /? or cscript /? in a command prompt window.
    • 1

      The applied encoding/decoding is Base64 which is used for example by any email application to transfer attachments and is supported by many programs including text editors like UltraEdit. SGVsbG8= is the character stream Hello Base64 encoded. u0022Hellou0022 is the character stream "Hello" with using JScript string syntax referencing " with the hexadecimal Unicode value because of an argument string enclosed in " containing itself " cannot be passed from a batch file interpreted by cmd.exe to an executable like cscript.exe.