{"id":78,"date":"2013-11-28T12:30:12","date_gmt":"2013-11-28T08:30:12","guid":{"rendered":"http:\/\/sasablog.ru\/prof\/?p=78"},"modified":"2018-11-02T14:19:51","modified_gmt":"2018-11-02T10:19:51","slug":"wbotho","status":"publish","type":"post","link":"http:\/\/sasablog.ru\/prof\/wbotho\/","title":{"rendered":"\u0420\u0430\u0431\u043e\u0442\u0430 \u0441 \u043a\u0440\u0438\u043f\u0442\u043e\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 \u0421\u041a\u0417\u0418 \u00ab\u0412\u0435\u0440\u0431\u0430\u00bb \u0447\u0435\u0440\u0435\u0437 wbotho.dll"},"content":{"rendered":"

\u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 wbotho.dll (wboth.dll) \u0435\u0441\u0442\u044c \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0435 \u0412\u0435\u0440\u0431\u044b. Wboth.pas \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 \u0438\u0437 Delphi (Lazarus) \u0432\u044b \u043c\u043e\u0436\u0435\u0442\u0435 \u0441\u043a\u0430\u0447\u0430\u0442\u044c =>> \u0442\u0443\u0442 <<=<\/a> (\u0432\u0435\u0440\u0441\u0438\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438 \u043d\u0435 \u0441\u0430\u043c\u0430\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f, \u043d\u043e \u0437\u0430\u0442\u043e \u0440\u0430\u0431\u043e\u0447\u0430\u044f)<\/p>\n

\u041f\u0440\u0438\u043c\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f:<\/p>\n

<\/p>\n

1.<\/strong> \u0418\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0434\u0430\u0442\u0447\u0438\u043a\u0430 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b:<\/p>\n

\u0421\u043f\u043e\u0441\u043e\u0431 1. \u041d\u0435\u0432\u0438\u0434\u0438\u043c\u044b\u0439 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0447\u0435\u0440\u0435\u0437 \u0444\u0430\u0439\u043b asrkeyw.exe:
\n


\nprocedure InitAsrKey;
\nvar HWind, H1: HWND;
\n    Wind: String;
\nbegin
\n   Wind:='asrkeyw';
\n   if ShellExecute(0,'open', PChar(Wind+'.exe'), nil, nil, SW_SHOWMINNOACTIVE) > 31 then begin
\n      HWind:=0;
\n      Repeat
\n         HWind:=FindWindow(nil, PChar(Wind));
\n      Until HWind<>0; \/\/\u0416\u0434\u0435\u043c\u0441
\n      While not IsWindowVisible(HWind) do Application.ProcessMessages;
\n      \/\/ \u0415\u0441\u043b\u0438 \u043d\u0435 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d \u0434\u0430\u0442\u0447\u0438\u043a \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b, \u0442\u043e \u0434\u0435\u043b\u0430\u0435\u043c \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e
\n      Repeat
\n         H1:=FindWindowEx(HWind, 0, 'Static', '\u041d\u0410\u0416\u0418\u041c\u0410\u0419\u0422\u0415 \u041b\u042e\u0411\u042b\u0415 \u041a\u041b\u0410\u0412\u0418\u0428\u0418 \u0418\u041b\u0418 \u041f\u041e\u0414\u0412\u0418\u0413\u0410\u0419\u0422\u0415  \u041c\u042b\u0428\u042c\u042e ...');
\n      Until H1<>0;
\n      while IsWindowVisible(H1) do begin
\n         SendMessage(HWind,WM_LButtonDown,1,1);
\n         SendMessage(HWind,WM_LButtonUp  ,1,1);
\n         Application.ProcessMessages;
\n      end;
\n      SendMessage (HWind, WM_CLOSE, 0, 0);
\n   end;
\nend;
\n<\/code><\/pre><\/p>\n
\u0421\u043f\u043e\u0441\u043e\u0431 2. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043e\u043a\u043e\u0448\u043a\u043e \u0412\u0435\u0440\u0431\u044b:
\n

\nfunction InitVerbaKey: string;
\nvar err_code: Word;
\nbegin
\n   err_code:=InitRndm(PChar('A:\\'), 1);
\n   Result:=GetVerbaErrorStr(err_code));
\nend;
\n<\/code><\/pre><\/p>\n
2.<\/strong> \u041f\u043e\u0434\u043f\u0438\u0441\u044c \u0444\u0430\u0439\u043b\u0430:
\n

\nfunction Sign(WorkFile: String): Boolean;
\nvar err_code: Word;
\nbegin
\n   Result:=True;
\n   \/\/ \u0418\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043b\u044e\u0447\u0430
\n   InitKey(Pointer('A:'), '');
\n   err_code := SignInit(PChar('A:\\'), PChar('\u041f\u0443\u0442\u044c_\u0434\u043e_\u0441\u043f\u0440\u0430\u0432\u043e\u0447\u043d\u0438\u043a\u043e\u0432'));
\n   if err_code = 0 then begin
\n      \/\/ \u041f\u043e\u0434\u043f\u0438\u0441\u044c \u0444\u0430\u0439\u043b\u0430
\n      \/\/ SignKey \u044d\u0442\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043a\u043b\u044e\u0447\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044f \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 XXXX SSSSSS 01
\n      err_code := SignFile(PChar(WorkFile), PChar(WorkFile), PChar(SignKey));
\n      if (err_code <> 0) then Result:=True;
\n   end else
\n      \/\/ \u043d\u0435 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043f\u043e \u043a\u0430\u043a\u043e\u0439 \u0442\u043e \u043f\u0440\u0438\u0447\u0438\u043d\u0435
\n      Result:=False;
\n   \/\/ \u0417\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435
\n   SignDone;
\n   ResetKeyEx(PChar(SignKey), 1);
\nend;
\n<\/code><\/pre><\/p>\n
3.<\/strong> \u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u0430:
\n

\nfunction TForm1.Crypto(WorkFile, CryptoAbonent, CryptoKey: String): Boolean;
\nvar err_code, from: Word;
\n    CAbonent: array [0..1] of word;
\nbegin
\n   Result:=True;
\n   \/\/ \u0418\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043b\u044e\u0447\u0430
\n   InitKey(Pointer('A:'), '');
\n   err_code := CryptoInit(PChar('A:\\'), PChar('\u041f\u0443\u0442\u044c_\u0434\u043e_\u0441\u043f\u0440\u0430\u0432\u043e\u0447\u043d\u0438\u043a\u043e\u0432'));
\n   if err_code = 0 then begin
\n      \/\/ \u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u0430
\n      \/\/ CryptoAbonent = \u041d\u0430 \u043a\u043e\u0433\u043e \u0448\u0438\u0444\u0440\u0443\u0435\u043c
\n      \/\/ CryptoKey = \u044d\u0442\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043a\u043b\u044e\u0447\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u044f \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 XXXX SSSSSS
\n      CAbonent[0]:=StrToInt(CryptoAbonent); CAbonent[1]:=0; from:=StrToInt(copy(CryptoKey, 1, 4));
\n      Result := EnCryptFile(PChar(WorkFile), PChar(WorkFile), from, @CAbonent, PChar(copy(CryptoKey, 5, 6)));
\n   end else
\n      \/\/ \u043d\u0435 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043f\u043e \u043a\u0430\u043a\u043e\u0439 \u0442\u043e \u043f\u0440\u0438\u0447\u0438\u043d\u0435
\n      Result:=False;
\n   \/\/ \u0417\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435
\n   CryptoDone;
\n   ResetKeyEx(PChar(CryptoKey), 1);
\nend;
\n<\/code><\/pre><\/p>\n
5.<\/strong> \u0420\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0430 \u0444\u0430\u0439\u043b\u0430:
\n

\nprocedure pDeCryptFile (mFile, CryptoAbonent: String);
\nvar err_code: Word;
\n    sender_key: array [0..SERTIFICAT_LENGTH] of byte;
\nbegin
\n   sender_id:='           ';
\n   \/\/ \u0418\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0434\u0430\u0442\u0447\u0438\u043a\u0430 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b
\n   err_code:=InitRndm(PChar('A:\\'), 1);
\n   if err_code = 0 then begin
\n      \/\/ \u0418\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u0440\u0438\u043f\u0442\u043e\u043a\u043b\u044e\u0447\u0430
\n      err_code:=CryptoInit(PChar('A:'), '\u041f\u0443\u0442\u044c_\u0434\u043e_\u0441\u043f\u0440\u0430\u0432\u043e\u0447\u043d\u0438\u043a\u043e\u0432'));
\n      if err_code = 0 then begin
\n         \/\/ \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 ID \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044f
\n         err_code:=GetFileSenderID(PChar(mFile), PChar(sender_id));
\n         if err_code = 0 then begin
\n            \/\/ \u0418\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u043a\u043b\u044e\u0447\u0430
\n            err_code:=ExtractKey(PChar(ExtractFileDir('\u041f\u0443\u0442\u044c_\u0434\u043e_\u0441\u043f\u0440\u0430\u0432\u043e\u0447\u043d\u0438\u043a\u043e\u0432'), pchar(sender_ID), @sender_key);
\n            if err_code = 0 then begin
\n               \/\/ \u0420\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0430 \u0444\u0430\u0439\u043b\u0430
\n               \/\/ CryptoAbonent = \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043a\u043b\u044e\u0447\u0430  \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u044f(\"XXXXSSSSSS\")
\n               err_code := DeCryptFileEx (PChar(mFile), PChar(mFile), PChar(CryptoAbonent), @sender_key);
\n            end;
\n         end;
\n      end;
\n      \/\/ \u0417\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435 \u0440\u0430\u0431\u043e\u0442\u044b
\n      CryptoDone;
\n   end;
\nend;
\n<\/code><\/pre><\/p>\n
6.<\/strong> \u0423\u0431\u0438\u0440\u0430\u0435\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u0441 \u0444\u0430\u0439\u043b\u0430, \u043f\u043e\u043f\u0443\u0442\u043d\u043e \u043f\u044b\u0442\u0430\u044f\u0441\u044c \u0435\u0433\u043e \u0440\u0430\u0437\u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 mpacker.dll:
\n

\nfunction DeCompressFile (infile, outfile: LPSTR):WORD; cdecl external 'mpacker.dll' name 'DeCompressFile';
\nprocedure pDeSignFile (mFile: String);
\nvar err_code: Word;
\nbegin
\n   \/\/ \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0440\u0430\u0437\u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0444\u0430\u0439\u043b
\n   DeCompressFile (PChar(mFile), PChar(mFile));
\n   \/\/ \u0418\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0434\u0430\u0442\u0447\u0438\u043a\u0430 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0445 \u0447\u0438\u0441\u0435\u043b
\n   err_code:=InitRndm(PChar('A:\\'), 1);
\n   \/\/ \u0418\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u0440\u0438\u043f\u0442\u043e\u043a\u043b\u044e\u0447\u0430
\n   if err_code = 0 then begin
\n      \/\/ \u0418\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043b\u044e\u0447\u0430 \u043f\u043e\u0434\u043f\u0438\u0441\u0438
\n      err_code:=SignInit(PChar('A:'), PChar('\u041f\u0443\u0442\u044c_\u0434\u043e_\u0441\u043f\u0440\u0430\u0432\u043e\u0447\u043d\u0438\u043a\u043e\u0432'));
\n      if err_code = 0 then
\n         \/\/ \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u043f\u0438\u0441\u0438
\n         err_code := DelSign(PChar(mFile), 255);
\n      \/\/ \u0417\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435 \u0440\u0430\u0431\u043e\u0442\u044b
\n      SignDone;
\n   end;
\n<\/code><\/pre><\/p>\n
7.<\/strong> \u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u0427\u0442\u043e \u0431\u044b \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u0438\u0441\u043a\u043e\u0432\u043e\u0434 \u0438 \u0434\u0438\u0441\u043a \u0410:, \u0432\u044b \u043c\u043e\u0436\u0435\u0442\u0435 \u0441\u043c\u0430\u043f\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043b\u044e\u0431\u0443\u044e \u043f\u0430\u043f\u043a\u0443 \u0436\u0435\u0441\u0442\u043a\u043e\u0433\u043e \u0434\u0438\u0441\u043a\u0430 \u0438\u043b\u0438 \u0444\u043b\u0435\u0448\u043a\u0438 \u043d\u0430 \u0434\u0438\u0441\u043a B:. \u041f\u043e\u0434\u043f\u0438\u0441\u044c \u0431\u0443\u0434\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c\u0441\u044f \u0432 \u0440\u0430\u0437\u044b \u0431\u044b\u0441\u0442\u0440\u0435\u0435:
\n

\nfunction MapDisk(PathMap: String): Boolean;
\nvar CurrentMap: String;
\n   function DiskPresent(Letter : Char) : Boolean;
\n   Begin
\n     Result:= ((GetLogicalDrives AND (Ord(Letter)-64)) > 0);
\n   End;
\n   function Subst: Boolean;
\n   begin
\n      Result:=True;
\n      if (not DefineDosDevice(0, PChar(DiskForSign + ':'), PChar(PathMap))) then begin
\n         AddLog('\u041d\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0438\u0441\u043a [' + PathMap + '].');
\n         Result:=False;
\n      end else
\n         AddLog('\u041d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e ' + DiskForSign + ' \u0441\u043c\u0430\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u043e ' + PathMap);
\n   end;
\n   function SubstQuery: string;
\n   var buff: array[0..256] of char;
\n   begin
\n      buff[0] := #0;
\n      QueryDosDevice(PChar(DiskForSign + ':'), buff, 256);
\n      Result := StrPas(buff);
\n      if Copy(Result,1,4) = '\\??\\' then Result := Copy(Result, 5, Length(Result)) else Result:='';
\n   end;
\nbegin
\n   Result:=False;
\n   if DiskPresent(DiskForSign[1]) then begin
\n      CurrentMap := SubstQuery;
\n      if PathMap = CurrentMap then Result:=True
\n      else
\n         if (DefineDosDevice(DDD_REMOVE_DEFINITION, PChar(DiskForSign + ':'), PChar(CurrentMap))) then
\n            Result:=Subst
\n   end else Result:=Subst;
\nend;
\n<\/code><\/pre><\/p>\n","protected":false},"excerpt":{"rendered":"
\u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 wbotho.dll (wboth.dll) \u0435\u0441\u0442\u044c \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0435 \u0412\u0435\u0440\u0431\u044b. Wboth.pas \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 \u0438\u0437 Delphi (Lazarus) \u0432\u044b \u043c\u043e\u0436\u0435\u0442\u0435 \u0441\u043a\u0430\u0447\u0430\u0442\u044c =>> \u0442\u0443\u0442<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13],"tags":[31,29,30],"_links":{"self":[{"href":"http:\/\/sasablog.ru\/prof\/wp-json\/wp\/v2\/posts\/78"}],"collection":[{"href":"http:\/\/sasablog.ru\/prof\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/sasablog.ru\/prof\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/sasablog.ru\/prof\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/sasablog.ru\/prof\/wp-json\/wp\/v2\/comments?post=78"}],"version-history":[{"count":1,"href":"http:\/\/sasablog.ru\/prof\/wp-json\/wp\/v2\/posts\/78\/revisions"}],"predecessor-version":[{"id":203,"href":"http:\/\/sasablog.ru\/prof\/wp-json\/wp\/v2\/posts\/78\/revisions\/203"}],"wp:attachment":[{"href":"http:\/\/sasablog.ru\/prof\/wp-json\/wp\/v2\/media?parent=78"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/sasablog.ru\/prof\/wp-json\/wp\/v2\/categories?post=78"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/sasablog.ru\/prof\/wp-json\/wp\/v2\/tags?post=78"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}