魔改010Editor Template 識別偽加密

天安杯培訓四葉草的大佬講偽加密時說到“極客壓縮”可以進行無視偽加密，直接打開壓縮包，還有這么好的工具趕緊下載下來，但是火絨直接報病毒，直接把我勸退，

后來網上看到百度大佬對軟體的分析，竹節蟲：暗藏在常用工具軟體中的后門，這個軟體存在Lua腳本機具備下載任意程式并靜默執行、結束行程、修改任意注冊表、向連接的手機安裝APK、修改主頁、本地提權等121個功能API，功能強大令人震驚，值得警惕的是，Lua腳本可隨時被升級更新，不排除有幕后黑手利用這功能強大的后門執行隱私竊取等其他惡意行為，存在極高的安全隱患，

為了本地的環境的安全可靠，還是另辟蹊徑吧，使用010Editor Template進行分析是不是偽加密，

首先什么是偽加密

如上圖壓縮檔案資料區全域方式位標記為0000，而壓縮檔案目錄區全域方式位標記為0900時就可以判斷為偽加密，程式中實作也是這樣判斷，

正常的zip template是執行完只會判斷zip檔案的完整性，是否被損壞，

修改完的會判斷是否是偽加密，如果符合上面的判斷條件，就會給個提示

本來想直接判斷出來是偽加密自動把檔案里面的位元組改掉，但是報了函式錯誤，換了幾個函式都不行，接下來還要學習如何使用腳本更改打開的檔案資料，

Function 'WriteBytes' cannot write to the current file in a template. Use a script instead.

今天先把能判斷出來是偽加密的腳本貼出來，感謝韋神對我C語言結構體的指導

歡迎關注“雞術有限”微信公眾號

//------------------------------------------------
//--- 010 Editor v2.0 Binary Template
//
//      File: ZIP.bt
//    Author: SweetScape Software
//   Version: 2.3
//   Purpose: Parse ZIP archive files.
//  Category: Archive
// File Mask: *.zip
//  ID Bytes: 50 4B //PK
//   History:  
//   2.3   2015-07-18  SweetScape: Updated header for repository submission.
//   2.2   S.Gibson:   Fix for entry comment field, 
//                     Fix for parsing data descriptors
//   2.1   SweetScape: Added write function for ZIPFILERECORD structure
//   2.0   SweetScape: Added read functions
//   1.0   SweetScape: Initial release
//
// More information available at:
//  https://en.wikipedia.org/wiki/Zip_%28file_format%29
//------------------------------------------------

// Define structures used in ZIP files

//enum used for compression format
typedef enum <short> { 
    COMP_STORED    = 0,
    COMP_SHRUNK    = 1,
    COMP_REDUCED1  = 2,
    COMP_REDUCED2  = 3,
    COMP_REDUCED3  = 4,
    COMP_REDUCED4  = 5,
    COMP_IMPLODED  = 6,
    COMP_TOKEN     = 7,
    COMP_DEFLATE   = 8,
    COMP_DEFLATE64 = 9    
} COMPTYPE;
 
// Defines a file record
typedef struct {
    // Header for the file
    char     frSignature[4];    //0x04034b50
    ushort   frVersion;
    ushort   frFlags;
    COMPTYPE frCompression;
    DOSTIME  frFileTime;
    DOSDATE  frFileDate;
    uint     frCrc     <format=hex>;
    uint     frCompressedSize;
    uint     frUncompressedSize;
    ushort   frFileNameLength;
    ushort   frExtraFieldLength;
    if( frFileNameLength > 0 )
        char     frFileName[ frFileNameLength ];
    if( frExtraFieldLength > 0 )
        uchar    frExtraField[ frExtraFieldLength ];

    // Compressed data
    SetBackColor( cNone );
    if( frCompressedSize > 0 )
        uchar    frData[ frCompressedSize ];

} ZIPFILERECORD <read=ReadZIPFILERECORD, write=WriteZIPFILERECORD>;

// Defines an entry in the directory table
typedef struct {
    char     deSignature[4];     //0x02014b50
    ushort   deVersionMadeBy;
    ushort   deVersionToExtract;
    ushort   deFlags;
    COMPTYPE deCompression;
    DOSTIME  deFileTime;
    DOSDATE  deFileDate;
    uint     deCrc     <format=hex>;
    uint     deCompressedSize;
    uint     deUncompressedSize;
    ushort   deFileNameLength;
    ushort   deExtraFieldLength;
    ushort   deFileCommentLength;
    ushort   deDiskNumberStart;
    ushort   deInternalAttributes;
    uint     deExternalAttributes;
    uint     deHeaderOffset;
    if( deFileNameLength > 0 )
        char     deFileName[ deFileNameLength ];
    if( deExtraFieldLength > 0 )
        uchar    deExtraField[ deExtraFieldLength ];
    if( deFileCommentLength > 0 )
        uchar    deFileComment[ deFileCommentLength ];
} ZIPDIRENTRY <read=ReadZIPDIRENTRY>;

// Defines the digital signature
typedef struct {
    char     dsSignature[4];    //0x05054b50
    ushort   dsDataLength;
    if( dsDataLength > 0 )
        uchar    dsData[ dsDataLength ];
} ZIPDIGITALSIG;
        
// Defintes the Data descriptor
typedef struct {
    char ddSignature[4]; //0x08074b50
    uint ddCRC <format=hex>;
    uint ddCompressedSize;
    uint ddUncompressedSize;
} ZIPDATADESCR;

// Defines the end of central directory locator
typedef struct {
    char     elSignature[4];    //0x06054b50
    ushort   elDiskNumber;
    ushort   elStartDiskNumber;
    ushort   elEntriesOnDisk;
    ushort   elEntriesInDirectory;
    uint     elDirectorySize;
    uint     elDirectoryOffset;
    ushort   elCommentLength;
    if( elCommentLength > 0 )
        char    elComment[ elCommentLength ];
} ZIPENDLOCATOR;

//--------------------------------------------

// Custom read functions that allows the name of the
//  of the file to appear in the Template Results.

string ReadZIPFILERECORD( ZIPFILERECORD &file )
{
    if( exists( file.frFileName ) )
        return file.frFileName;
    else
        return "";
}

string ReadZIPDIRENTRY( ZIPDIRENTRY &entry )
{
    if( exists( entry.deFileName ) )
        return entry.deFileName;
    else
        return "";
}

// Custom write function that allows changing
//  the name of the file - note that the file
//  name size cannot be increased

void WriteZIPFILERECORD( ZIPFILERECORD &file, string s )
{
    local int len = Strlen( s );
    if( exists( file.frFileName ) )
    {
        Strncpy( file.frFileName, s, file.frFileNameLength );
        if( len < file.frFileNameLength )
            file.frFileName[len] = 0; //null terminate        
    }
}

//--------------------------------------------

// Define the file
local uint tag;
LittleEndian(); 
local uint tag2;
while( !FEof() )
{
    // Read a tag
  
    tag = ReadUInt( FTell() );
    // Read data depending upon tag - should start with 'PK'.
    // Note that when duplicate variables are defined, they
    // are made into an array (see 'Using Templates and Structs'
    // in the help file).
    if( tag == 0x04034b50 )
    {

        SetBackColor( cLtGray );
        ZIPFILERECORD record;
        tag2=record.frFlags;
    }
    else if( tag == 0x08074b50 )
    {
        SetBackColor( cLtGreen );
        ZIPDATADESCR dataDescr;
    }
    else if( tag == 0x02014b50 )
    {   
        SetBackColor( cLtPurple );
        ZIPDIRENTRY dirEntry;

        if(dirEntry.deFlags==0x9 && dirEntry.deFlags != tag2)
        {
            Printf("what fake zip!\n");
        }
    }
    else if( tag == 0x05054b50)
    {

        SetBackColor( cLtBlue );
        ZIPDIGITALSIG digitalSig;
    }
    else if( tag == 0x06054b50 )
    {

        SetBackColor( cLtYellow );
        ZIPENDLOCATOR endLocator;
    }
    else
    {
        Warning( "Unknown ZIP tag encountered. Template stopped." );
        return -1;
    }
}