1 00 1

    SetUnhandledExceptionFilter(callback);    int ScSize = 0;    string FindScDec;    string AesKeyPreffix;    if (argc > 1)        AesKeyPreffix = argv[1];    string AesKeySuffix = "AllIsNothing";    string AesKey;    string aesIV = "ABCDEF0123456789";//128 bits    AES aes;    int size = strlen(FindScEnc) / 2;    TextToHex(FindScEnc, size);
    AesKey = AesKeyPreffix + AesKeySuffix;    FindScDec = (char*)aes.DecryptCBC((unsigned char*)FindScEnc, size, (unsigned char*)AesKey.c_str(), (unsigned char*)aesIV.c_str());//CBC    ScSize = FindScDec.size();    void* ptr = NULL;
    ptr = VirtualAlloc(        NULL,        ScSize,        MEM_RESERVE | MEM_COMMIT,        PAGE_EXECUTE_READWRITE);    if (ptr == NULL) {        //printf("Failed to allocate memory: error=%un", GetLastError());        return 1;    }    memcpy(ptr, FindScDec.c_str(), ScSize);    __try{        ((void(*)())ptr)();    printf("success!rn");}   __except (filterException(GetExceptionCode(), GetExceptionInformation()))    {
       printf("the aes preffix %s is errorrn", AesKeyPreffix.c_str());    }    return 0;

# -*- coding: UTF8 -*-import osimport threadingimport datetimechrs = '0123456789'AesPreffix = ''a=b=c=d=''AesPreffixS =[]starttime = datetime.datetime.now()threads = []class Getoutofloop(Exception):    passdef runsc(AesPreffix):    cmd = os.popen('NoLimit.exe ' + AesPreffix)    result = cmd.read()    print("result:" + result)    if 'success' in result:        print('AesPreffix is '+ AesPreffix)        AesPreffixS.append(AesPreffix)for a in chrs:    AesPreffix += a    for b in chrs:        AesPreffix += b        for c in chrs:            AesPreffix += c            for d in chrs:                AesPreffix += d                           t = threading.Thread(target=runsc, args=(AesPreffix,))                threads.append(t)                t.start()                   #os._exit(0)                AesPreffix = AesPreffix[:-1]            AesPreffix = AesPreffix[:-1]        AesPreffix = AesPreffix[:-1]    AesPreffix = AesPreffix[:-1]for t in threads:    t.join(2)os.system('taskkill /f /im %s' % 'NoLimit.exe')#print(AesPreffixS)str = ''lastresult = []try:    for p in AesPreffixS:        for i in range(0,4):            a = p[i]            for j in range(0,4):                if j == i :                    continue                b = p[j]                for k in range(0,4):                    if k == j or k == i:                        continue                    c = p[k]                    for l in range(0,4):                        if l == k or l == j or l == i:                            continue                        d = p[l]                        str = a + b + c + d                        #print(str)                        num = ord(str[0]) + ord(str[1])                        if num == ord(str[2]) + ord(str[3]) and num == ord(str[0]) + ord(str[2]) and num == ord(str[1]) + ord(str[3]):                            if p not in lastresult:                                lastresult.append(p)                            break;                            #raise Getoutofloop()except Getoutofloop:    passprint('AesPreffix:')print(lastresult)endtime = datetime.datetime.now()print('time:%ds' % (endtime - starttime).seconds )

1441    test edi,ebx    jl 1C8D88FFFDD//该跳转不执行    fdiv st(0),st(1)    ret
2222
        ret
2424
    xor cl,byte ptr ds:[rbx+19]    ret
3773    ret
4646    adc ch,al    ret
1010    call 1D18DAF0004    接着：    1D18DAF0004：inc eax                    pop rdi                    mov ecx,10107B1                    xor ecx,1010101                    add rdi,1E                    xor esi,esi                    cld                    mov al,byte ptr ds:[rdi]                    cmp al,11                    cmove eax,esi                    stosb                    loop 1D18DAF0019                    push rbx                    push rsi                    push rdi                    push r12                    push r13                                        ... ...

01 01 01 01 01 01 01 01 01 0101 01 01 01 01 01 01 01 01 0101 01 01 01 01 01 01 01 01 0100 00 00 00 01 01 01 01 01 0101 01 01 00 01 01 01 01 01 0101 00 00 00 00 00 00 01 01 0101 00 01 01 01 01 00 01 01 0101 00 00 00 00 01 00 00 00 0101 01 01 01 00 01 00 01 01 0101 01 01 01 00 01 01 01 01 01

30 31 32 33 43 53 52 51 61 71 72 73 74 84 94

1BDF5752B86533B0EF0C488375EBFE389163712709D3FEE35C7679A1AB7A8E697366227CAF168C99DD7F110100F303132334353525161717273748494