无忧启动论坛

标题: PECMD.INI CMPS/CMPA 加密求破解 [打印本页]
作者: hhkj2015    时间: 2015-12-25 14:46
标题: PECMD.INI CMPS/CMPA 加密求破解
PECMD.INI CMPS/CMPA 加密求破解
PECMD加密求破解.part1.rar (400 KB, 下载次数: 44)

PECMD加密求破解.part2.rar (269.04 KB, 下载次数: 38)

作者: ge    时间: 2015-12-25 15:13
http://bbs.wuyou.net/forum.php?m ... d=372368&extra=
作者: hhkj2015    时间: 2015-12-25 15:25
本帖最后由 hhkj2015 于 2015-12-25 16:34 编辑
ge 发表于 2015-12-25 15:13
http://bbs.wuyou.net/forum.php?m ... d=372368&extra=


黑屏，重启电脑，无法解密
作者: ge    时间: 2015-12-25 18:33
我下载测试正常！刚才我下载我的网盘的也没有问题！是不是你的机器或是什么有关！在我这好用！
作者: hhkj2015    时间: 2015-12-26 01:34
ge 发表于 2015-12-25 18:33
我下载测试正常！刚才我下载我的网盘的也没有问题！是不是你的机器或是什么有关！在我这好用！

那麻烦你帮我解密看看？
作者: ge    时间: 2015-12-26 08:15
hhkj2015 发表于 2015-12-26 01:34
那麻烦你帮我解密看看？

可以被PECMD运行吗？我这也解不了！如果，可以被PECMD运行无论用什么方法加密的，都可以解密！https://github.com/liberize/pecmd-decrypt
作者: ge    时间: 2016-11-22 16:00
hhkj2015 发表于 2015-12-26 01:34
那麻烦你帮我解密看看？

我用他提供的方法无法解开！
作者: nianyueriPE    时间: 昨天 21:46
用od解密
FIND MEM<384,FBWF P40 L96 H192!FBWF P50 L160 H299
TEAM ENVI W=%WinDir%|ENVI $WS=%WinDir%\SYSTEM32|ENVI WSD=%WS%\Drivers
TEAM LOGO %WS%\DND1.JPG |DISP B32|WAIT 169
TEAM FILE %W%\TXTSETUP.SI*|PATH #%WS%\CONFIG|FILE %WS%\*.*_|FILE %WSD%\*.SY_
TEAM PATH %SystemDrive%\TEMP|INIT U,3690|EXEC @PECMD.EXE CALL $SHELL32.DLL,DllInstall,#1,U
TEAM ENVI V0=HKLM\System\CurrentControlSet\Services|ENVI V1=System32\Drivers
REGI %V0%\USBHUB\ImagePath=%V1%\USBHUB.SYS
REGI %V0%\USBCCGP\ImagePath=%V1%\USBCCGP.SYS
REGI %V0%\USBEHCI\ImagePath=%V1%\USBEHCI.SYS
REGI %V0%\USBOHCI\ImagePath=%V1%\USBOHCI.SYS
REGI %V0%\USBSTOR\ImagePath=%V1%\USBSTOR.SYS
REGI %V0%\USBUHCI\ImagePath=%V1%\USBUHCI.SYS
REGI %V0%\HIDUSB\ImagePath=%V1%\HIDUSB.SYS
REGI %V0%\MOUCLASS\ImagePath=%V1%\MOUCLASS.SYS
REGI %V0%\MOUHID\ImagePath=%V1%\MOUHID.SYS
REGI %V0%\KBDCLASS\ImagePath=%V1%\KBDCLASS.SYS
REGI %V0%\KBDHID\ImagePath=%V1%\KBDHID.SYS
REGI %V0%\CDROM\ImagePath=%V1%\CDROM.SYS
REGI %V0%\AMDHUB30\ImagePath=%V1%\AMDHUB30.SYS
REGI %V0%\AMDXHC\ImagePath=%V1%\AMDXHC.SYS
REGI %V0%\USBFILTER\ImagePath=%V1%\USBFILTER.SYS
REGI %V0%\ASMTHUB3\ImagePath=%V1%\ASMTHUB3.SYS
REGI %V0%\ASMTXHCI\ImagePath=%V1%\ASMTXHCI.SYS
REGI %V0%\ETRONHUB3\ImagePath=%V1%\ETRONHUB3.SYS
REGI %V0%\ETRONXHCI\ImagePath=%V1%\ETRONXHCI.SYS
REGI %V0%\NUSB3HUB\ImagePath=%V1%\NUSB3HUB.SYS
REGI %V0%\NUSB3XHC\ImagePath=%V1%\NUSB3XHC.SYS
REGI %V0%\RUSB3HUB\ImagePath=%V1%\RUSB3HUB.SYS
REGI %V0%\RUSB3XHC\ImagePath=%V1%\RUSB3XHC.SYS
REGI %V0%\nusb3xhc\ImagePath=%V1%\ViaHub3.sys
REGI HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D20EA4E1-3957-11d2-A40B-0C5020524153}\!
REGI HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}\!  `删除任务计划
REGI HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{450D8FBA-AD25-11D0-98A8-0800361B1103}\!   `删除桌面我的文档
REGI HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\!`删除共享文档
TEAM EXEC =!%WinDir%\SYSTEM32\SHOWDRIVE.EXE|EXEC =!%WinDir%\SYSTEM32\FIXUSB.EXE U
FIND MEM<384,TEAM LINK %Desktop%\设置临时文件,%WS%\PECMD.EXE,LOAD %WS%\NEI,SHELL32.DLL#12,设置虚拟内存和临时文件！|CALL ASK
_SUB PAGEFILE_SET
BROW Tag,*D:\,请选择一个硬盘分区用来设置虚拟内存，默认选择D:\
FIND $%TAG%=,ENVI DRIVE=D:!FDRV DRIVE=%TAG%
TEAM PAGE %DRIVE%\Pagefile.sys 384 768|FILE %Desktop%\设置临时文件.LNK
_END
_SUB ASK
forx \pagefile.sys,pagefile,0,file %pagefile%  `清理掉上次启动 PE 或 Windows 时留下的虚拟内存页面文件
mess+top 发现物理内存不足512M，\n\n是否设置虚拟内存？\n\n等待5秒,默认为:YES @设置虚拟内存 #YN *5000 $Y
FIND $%YESNO%=YES,CALL PAGEFILE_SET
_END
EXEC *=%WS%\7z.EXE x %WSD%\IntelRaid.sys -p亿维凌DND15553676811 -y -aoa -o"%Windir%\System32\"
FIND MEM>384,RAMD ImDisk,L125,NTFS,Z:,虚拟盘!RAMD ImDisk,L35,NTFS,Z:,虚拟盘
PATH Z:\Temp\
PATH Z:\TOOLS\
WAIT 300
TEAM LOGO %WS%\DND2.JPG|WAIT 169
CALL U+_PELOAD
_SUB U+_PELOAD
FORX !\IDND\PELOAD\*.*,PELOAD,0,TEAM FILE %PELOAD%=>%WinDir%\SYSTEM32\|WAIT 100
IFEX [ %WinDir%\SYSTEM32\DNDGHOST.EXE | %WinDir%\SysWOW64\DNDGHOST.EXE ],EXIT 1!CALL UD_PELOAD
_END
_SUB UD_PELOAD
IFEX $%bX64%>0,TEAM EXEC @=dnd.exe (ud) output "idnd/peload/*" PELOAD\%~nx|WAIT 100|FILE %WinDir%\SysWOW64\PELOAD\*.*->%WinDir%\SYSTEM32\!TEAM EXEC @=dnd.exe (ud) output "idnd/peload/*" %WS%\%~nx|WAIT 100
IFEX [ %WinDir%\SYSTEM32\DNDGHOST.EXE | %WinDir%\SysWOW64\DNDGHOST.EXE ],EXIT 1!CALL U+H_PELOAD
_END
_SUB U+H_PELOAD
TEAM EXEC @=bootpart.exe -mount -readonly -driveletter V:|WAIT 100|FILE V:\IDND\PELOAD\*.*=>%WinDir%\SYSTEM32\|WAIT 100
IFEX [ %WinDir%\SYSTEM32\DNDGHOST.EXE | %WinDir%\SysWOW64\DNDGHOST.EXE ],EXIT 1
FORX !\PELOAD\*.*,PELOAD,0,TEAM FILE %PELOAD%=>%WinDir%\SYSTEM32\|WAIT 100
_END
IFEX $%bX64%>0,TEAM FILE %WinDir%\SYSTEM32\DNDGHOST.EXE->%WinDir%\SysWOW64\|FILE %WinDir%\SYSTEM32\DND*.EXE=>%WinDir%\SysWOW64\|WAIT 100
TEAM EXEC @=dnd.exe (ud) output "IDND/TOOLS/Basic.wim" Z:/TOOLS/%~nx|WAIT 365
TEAM EXEC @=dnd.exe (ud) output "IDND/TOOLS/DND3.7Z" Z:/TOOLS/%~nx|WAIT 365
IFEX Z:\TOOLS\DND3.7Z,EXEC @=%WS%\7z.exe x Z:\TOOLS\DND3.7Z -p亿维凌DND15553676811 -y -aoa -o"%WinDir%\"!CALL U+_DND3
IFEX Z:\TOOLS\Basic.wim,TEAM MOUN Z:\TOOLS\Basic.wim,Y:\基本外置\,1,%TEMP%|WAIT 365|ENVI OPDir=Y:\基本外置|WAIT 100!CALL U+_Basic
_SUB U+_DND3
FORX !\IDND\TOOLS\DND3.7z,DND37Z,1,EXEC *=%WS%\7z.exe x %DND37Z% -p亿维凌DND15553676811 -y -aoa -o"%WinDir%\"
WAIT 100
IFEX %WS%\我的工具.exe,!CALL U+H_DND3
_END
_SUB U+H_DND3
TEAM EXEC @=bootpart.exe -mount -readonly -driveletter V:|WAIT 100
FORX !\IDND\TOOLS\DND3.7z,DND37Z,1,EXEC *=%WS%\7z.exe x %DND37Z% -p亿维凌DND15553676811 -y -aoa -o"%WinDir%\"
_END
_SUB U+_Basic
FORX !\IDND\TOOLS\Basic.wim,OPT,1,TEAM FILE %OPT%=>Z:\TOOLS\|WAIT 100
IFEX Z:\TOOLS\Basic.wim,!CALL U+H_Basic
_END
_SUB U+H_Basic
TEAM EXEC @=bootpart.exe -mount -readonly -driveletter V:|WAIT 100
FORX !\IDND\TOOLS\Basic.wim,OPT,1,TEAM FILE %OPT%=>Z:\TOOLS\|WAIT 100
_END
IFEX Z:\TOOLS\Basic.wim,TEAM MOUN Z:\TOOLS\Basic.wim,Y:\基本外置\,1,%TEMP%|WAIT 365
TEAM ENVI OPDir=Y:\基本外置|WAIT 100
TEAM ENVI DFUR=X:\Documents and Settings\Default User\|WAIT 365
NUMK 0
RUNS PECMD.EXE EXEC !%WS%\INTERNAT.EXE,输入法指示器
EXEC !%WinDir%\SYSTEM32\MMC.CMD
EXEC =!CMD.EXE /C "REGSVR32 /S X:\WXPE\SYSTEM32\SEND.DLL"
EXEC *=%WS%\7z.exe x %OPDir%\输入工具\FREEWB.7z -y -aoa -o"%ProgramFiles%\FreeWB"
EXEC *%ProgramFiles%\FreeWB\REGISTRY.EXE /S
EXEC *!%WS%\MSIEXEC.EXE /REGSERVER
EXEC @%OPDir%\输入工具\ZG.EXE
EXEC *=%WS%\LOADSYS.EXE
TEAM FILE %WS%\LOADSYS.EXE|FILE %WSD%\IntelRaid.sys
WAIT 365
LINK %Desktop%\GHOST克隆  【Alt+G 】,%OPDir%\GHOST32\GHOST32.EXE,,,使用GHOST进行分区备份和还原！
LINK %Desktop%\Win系统安装 【Alt+W】,%OPDir%\系统安装\WinNTSetup.exe,,,安装Windows系统！
LINK %Desktop%\DG分区工具  【Alt+D】,%OPDir%\磁盘管理\diskgenius.exe,,,对磁盘进行分区操作！
LINK %Desktop%\Win引导修复【Alt+F】,%OPDir%\系统维护\NTBOOTautofix.exe,,,修复Windows启动引导！
LINK %Desktop%\登录密码清除【Alt+E】,%OPDir%\密码管理\NTPWEDIT.exe,,,修改Windows登录密码！
LINK %Programs%\磁盘管理\识别苹果分区,PECMD.EXE,LOAD %WS%\Nei*DND_Apple,Apple.ico,识别苹果系统分区，也可以用来显示硬盘隐藏分区！
LINK %Desktop%\虚拟磁盘,%WinDir%\System32\imdisk.cpl,,imdisk.cpl#0
LINK %Programs%\我的工具,%WinDir%\SYSTEM32\我的工具.exe,,,搜索并加载【我的工具】到程序菜单！
HOTK #112,PECMD.EXE        `注册热键：F1 帮助
HOTK #120,PECMD EXEC !%WinDir%\SYSTEM32\SL.CMD
HOTK #121,PECMD EXEC !%WinDir%\SYSTEM32\CLEANTEMP.CMD
HOTK #122,%OPDir%\图形图像\WINSNAP.EXE
HOTK Alt+T,PECMD.EXE EXEC Taskmgr.exe
HOTK Alt+C,PECMD.EXE EXEC CMD.exe
HOTK Alt+R,TEAM MESS+top+icon2  【是否立即重启电脑？】@ALT+R键重启确认！#YN *8000 $N|FIND $%YESNO%=YES,PECMD.EXE SHUT R
HOTK Alt+D,%OPDir%\磁盘管理\Diskgenius.EXE
HOTK Alt+G,%OPDir%\GHOST32\GHOST32.EXE
HOTK Alt+W,%OPDir%\系统安装\WinNTSetup.EXE
HOTK Alt+F,%OPDir%\系统维护\NTBOOTautofix.EXE
HOTK Alt+E,%OPDir%\密码管理\NTPWEDIT.EXE
HOTK Alt+Z,%WS%\DNDGhost.EXE
HOTK Alt+P,Y:\扩展外置\密码管理\dialupass.exe
LINK %QuickLaunch%\截图工具(F11),%OPDir%\图形图像\WINSNAP.EXE
LINK !%QuickLaunch%\临时文件清除,%WinDir%\SYSTEM32\CLEANTEMP.CMD,,%WinDir%\SYSTEM32\CLEANTEMP.ICO
LINK %QuickLaunch%\资源管理器,%W%\EXPLORER.EXE,/E,EXPLORER.EXE#1
LINK !%StartMenu%\刷新系统 [F9],%WinDir%\SYSTEM32\SL.CMD,,%WinDir%\SYSTEM32\CLEANTEMP.ICO,刷新系统和桌面！
LINK %StartMenu%\设置临时文件,%WS%\PECMD.EXE,LOAD %WS%\NEI,SHELL32.DLL#12,设置虚拟内存和临时文件！
TEXT
EXEC =%WS%\DNDSET.EXE PUTSPT
IFEX %WS%\DNDGHOST.EXE,EXEC %WS%\DNDGHOST.EXE /AUTO
TEAM LOGO %WS%\DND3.JPG |WAIT 966
TEAM TEXT |DISP W1024 H768 B32|WAIT 166
WALL %WS%\DESK.JPG
FIND Explorer.EXE,!TEAM SHEL %WinDir%\EXPLORER.EXE|WAIT 1366|LOGO
EXEC !%WinDir%\SYSTEM32\NUMLOCK.EXE
FONT %WinDir%\FONTS
WAIT 669
SITE %USERPROFILE%\「开始」菜单\程序\启动,+H
EXEC =!%WinDir%\SYSTEM32\OEM.CMD
USER 中国电脑店行业门户,电脑店-www.diannaodian.com
FILE Z:\TOOLS\DND3.7Z
CALL DND3_OP
_SUB DND3_OP
LINK %Programs%\GHOST32\Ghost32 11.0.2,%OPDir%\GHOST32\GHOST32.EXE
LINK %Programs%\GHOST32\GhostExp镜像浏览器,%OPDir%\GHOST32\ghostexp.exe
LINK %Programs%\GHOST32\GhoHash密码查看器,%OPDir%\GHOST32\ghohash.exe
LINK !%Programs%\WIM工具\启用Wimtool,%OPDir%\ISWIM.CMD,,%OPDir%\WIM工具\WIMTOOL.EXE
LINK !%Programs%\WIM工具\启用WimNT,%OPDir%\ISWIMT.CMD,,%OPDir%\WIM工具\WIMNT.EXE
LINK %Programs%\文件工具\WinRar,%OPDir%\WINRAR\WINRAR.EXE
EXEC @*%OPDir%\WINRAR\SETUP.CMD
LINK %Programs%\磁盘管理\DiskGenius磁盘分区,%OPDir%\磁盘管理\diskgenius.exe
LINK %Programs%\磁盘管理\Bootice引导扇区管理,%OPDir%\磁盘管理\bootice.exe
LINK %Programs%\磁盘管理\ImDisk虚拟磁盘驱动器,%WinDir%\System32\imdisk.cpl,,imdisk.cpl#0
LINK %Programs%\光盘工具\虚拟光驱,%OPDir%\光盘工具\虚拟光驱\vdm.exe
LINK %Programs%\光盘工具\ULTRAISO,%OPDir%\光盘工具\ULTRAISO\UltraISO.exe
EXEC @*%OPDir%\光盘工具\ULTRAISO\SETUP.CMD
LINK %Programs%\密码管理\Windows密码清除器,%OPDir%\密码管理\NTPWEDIT.exe
LINK %Programs%\系统维护\系统启动引导修复,%OPDir%\系统维护\NTBOOTautofix.exe
LINK %Programs%\图形图像\ACDSEE图片编辑,%OPDir%\图形图像\ACDSEE\ACDSEE.exe
LINK %Programs%\图形图像\WINSNAP截图,%OPDir%\图形图像\WINSNAP.exe
LINK %Programs%\系统安装\NT6系统安装器gui,%OPDir%\系统安装\NT6快捷安装器.exe
LINK %Programs%\系统安装\Windows通用安装器,%OPDir%\系统安装\WinNTSetup.exe
LINK %Programs%\附件工具\记事本,%WS%\NOTEPAD.EXE
LINK %Programs%\附件工具\命令提示符,%WS%\CMD.EXE
LINK %Programs%\附件工具\注册表编辑器,%W%\REGEDIT.EXE
LINK %Programs%\附件工具\资源管理器,%W%\EXPLORER.EXE,,EXPLORER.EXE#1
LINK %Programs%\系统微调\显示隐藏分区,%WS%\PECMD.EXE,SHOW -1:-1,SHELL32.DLL#101
LINK %Programs%\系统微调\分配磁盘盘符,%WS%\SHOWDRIVE.EXE,,Shell32.dll#8
LINK %Programs%\系统微调\设置临时文件,%WS%\PECMD.EXE,LOAD %WS%\NEI,SHELL32.DLL#12,设置虚拟内存和临时文件！
LINK %Programs%\附件工具\查看.详细方式,%WS%\XX.CMD,,Shell32.dll#19
LINK %Programs%\附件工具\查看.平铺方式,%WS%\PP.CMD,,Shell32.dll#19
LINK %Programs%\附件工具\查看.图标方式,%WS%\TB.CMD,,Shell32.dll#19
LINK %Programs%\附件工具\计算器,%WS%\CALC.EXE
LINK %Programs%\附件工具\画图,%WS%\MSPAINT.EXE
LINK !%Programs%\附件工具\清除临时文件 F10,%WS%\CLEANTEMP.CMD,,%WS%\CLEANTEMP.ICO
LINK !%Programs%\附件工具\加入 UltraISO 关联,%OPDir%\光盘工具\ULTRAISO\SETUP.CMD,,%OPDir%\光盘工具\ULTRAISO\ULTRAISO.exe
LINK %Programs%\附件工具\清除所有热键,PECMD.EXE,TEAM HOTK --DELALL|MESS+top+icon2  【所有热键清理完毕！】@电脑店WinPE提示！#OK *3000,SHELL32.DLL#70
_END
IFEX %Desktop%\设置临时文件.LNK,!LOAD %WS%\NEI*EXT_TOOLS
REGI HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\=DVD/CD-ROM 驱动器
REGI HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\=磁盘驱动器
REGI HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\=显示卡
REGI HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\=软盘控制器
REGI HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\=IDE ATA/ATAPI 控制器
REGI HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\=键盘
REGI HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96C-E325-11CE-BFC1-08002BE10318}\=声音、视频和游戏控制器
REGI HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96F-E325-11CE-BFC1-08002BE10318}\=鼠标和其它指针设备
REGI HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\=网络适配器
REGI HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E97D-E325-11CE-BFC1-08002BE10318}\=系统设备
REGI HKLM\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}\=存储卷
REGI HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView=#1
REGI HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FindExtensions\Static\WebSearch\!
REGI HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SmallIcons\SmallIcons=no
TEAM EXEC =PECMD SERV !AudioSrv|EXEC =PECMD SERV AudioSrv|SERV EVENTLOG
TEAM WAIT 1000|KILL SMSS.EXE|KILL WINLOGON.EXE|FILE %WS%\SMSS.EXE|FILE %WS%\WINLOGON.EXE|FILE %WS%\WIN32K.SYS
TEAM WAIT 1000|FILE %WS%\ORDERDRV.CMD|FILE %WS%\MBRFIX.EXE|FILE %WS%\MOUNTVOL.EXE|FILE %WS%\DND*.JPG
TEAM WAIT 1000|FILE %WinDir%\TEMP\*.*|FILE %WS%\INSTALLIME.EXE|FILE Z:\DND3.7Z|TEXT |ENVI
FORX !\DND\DNDPlus,DNDINI,1,LOAD %DNDINI%*电脑店_UpDateSub
CALL Ewayling_DND
_SUB Ewayling_DND
TEAM DATE *space0 CurDate|MSTR Y1,M2,D3=<1><2><3>%CurDate%|ENVI DNDate=%Y1%%M2%%D3%
FIND $%DNDate%>20160606,CALL DNDL_HASH
_END
_SUB DNDL_HASH
IFEX %DESKTOP%\电脑店*.LNK,EXIT!CALL BU_FU
_END
_SUB BU_FU
MESS+top+icon6  电脑店PE系统被篡改或者核心未成功加载！\n\n 官方网站重新下载【u.diannaodian.com】\n\n 电脑店论坛反馈【bbs.diannaodian.com】@电脑店PE提示！#OK *30000
_END
FILE DND*.JPG
FILE %CurFile%



欢迎光临 无忧启动论坛 (http://wuyou.net/) Powered by Discuz! X3.3