[COLOR=blue][FONT=courier new]
/**
* 这是我在LIDA中找到的加密算法特征码
*/
int CryptSignatures(struct Crypt_Signature **CSigs)
{
int i=0;
unsigned long L1[] = { 0x4787C62A, 0xA8304613, 0xD76AA478, 0xE8C7B756, 0x242070DB, 0xC1BDCEEE, 0xF57C0FAF, 0xFD469501 };
CSigs[i++] = NewCryptSig("md5", L1 , 8, NULL, 0, -4, 0, CRYPT_SIG_DWORD);
unsigned long L2[] = { 0xEFCDAB89, 0x67452301, 0x6ED9EBA1, 0x98BADCFE, 0x5A827999, 0x10325476 };
CSigs[i++] = NewCryptSig("md4", L2 , 6, NULL, 0, -4, 0, CRYPT_SIG_DWORD);
unsigned long L3[] = { 0xEFCDAB89, 0x10325476, 0x67452301, 0xC3D2E1F0, 0x98BADCFE, 0x000C5361 };
CSigs[i++] = NewCryptSig("ripemd160", L3 , 6, NULL, 0, -106, 0, CRYPT_SIG_DWORD);
unsigned long L4[] = { 0x03707344, 0xA4093822, 0x243F6A88, 0x85A308D3, 0x13198A2E, 0x299F31D0, 0x082EFA98 };
CSigs[i++] = NewCryptSig("blowfish", L4 , 7, NULL, 0, -4, 0, CRYPT_SIG_DWORD);
unsigned long L5[] = { 0xAD6EA6B0, 0x49A7DF7D, 0x4B7A70E9, 0xB5B32944, 0xDB75092E, 0xC4192623, 0x9CEE60B8, 0x8FEDB266 };
CSigs[i++] = NewCryptSig("blowfish", L5 , 8, NULL, 0, -4, 0, CRYPT_SIG_DWORD);
unsigned long L6[] = { 0x3F258C7A, 0x1E213F2F, 0x30FB40D4, 0x9FA0FF0B, 0x6BECCD2F, 0x9C004DD3, 0x6003E540 };
CSigs[i++] = NewCryptSig("cast", L6 , 7, NULL, 0, -4, 0, CRYPT_SIG_DWORD);
unsigned long L7[] = { 0x7789F8B7, 0xE6C1121B, 0xE216300D, 0xBBDDFFFC, 0xA7EBDABD, 0x35648095, 0x0E241600 };
CSigs[i++] = NewCryptSig("cast", L7 , 7, NULL, 0, -4, 0, CRYPT_SIG_DWORD);
unsigned long L8[] = { 0x000000D2, 0x000000D3, 0x000000D4, 0x000000D5, 0x000000D6, 0x000000D7, 0x000000D8, 0x000000D9,
0x000000DA, 0x000000DB, 0x000000DC, 0x000000DD, 0x000000DE, 0x000000DF, 0x000000E0, 0x000000E1,
0x000000E2, 0x000000E3, 0x000000E4, 0x000000E5, 0x000000E6, 0x000000E7, 0x000000E8, 0x000000E9,
0x000000EA, 0x000000EB, 0x000000EC, 0x000000ED, 0x000000EE, 0x000000EF, 0x000000F0, 0x000000F1,
0x000000F2, 0x000000F3, 0x000000F4, 0x000000F5, 0x000000F6, 0x000000F7, 0x000000F8, 0x000000F9,
0x000000FA, 0x000000FB, 0x000000FC, 0x000000FD, 0x000000FE, 0x000000FF, 0x00000000, 0x00000001,
0x00000002, 0x00000003, 0x00000004, 0x00000005, 0x00000006, 0x00000007, 0x00000008, 0x00000009,
0x0000000A, 0x0000000B, 0x00000005, 0x00000006, 0x00000007, 0x00000008, 0x00000009, 0x0000000A,
0x0000000B, 0x0000000C, 0x0000000D, 0x0000000E, 0x0000000F, 0x00000010, 0x00000011, 0x00000012,
0x00000013, 0x00000014, 0x00000015, 0x00000016, 0x00000017, 0x00000018, 0x00000019, 0x0000001A,
0x0000001B, 0x0000001C, 0x0000001D, 0x0000001E, 0x0000001F, 0x00000020, 0x00000021, 0x00000022,
0x00000023, 0x00000024, 0x00000025, 0x00000020, 0x00000021, 0x00000022, 0x00000023, 0x00000024,
0x00000025, 0x00000026, 0x00000027, 0x00000028, 0x00000029, 0x0000002A, 0x0000002B, 0x0000002C,
0x0000002D, 0x0000002E, 0x0000002F, 0x00000030, 0x00000031, 0x00000032, 0x00000033, 0x00000034,
0x00000035, 0x00000036, 0x00000037, 0x00000038, 0x00000039, 0x0000003A, 0x0000003B, 0x0000003C,
0x0000003D, 0x0000003E, 0x0000003F, 0x00000040, 0x00000041, 0x00000042, 0x00000043, 0x00000044 };
CSigs[i++] = NewCryptSig("des", L8 , 128, NULL, 0, -4, 0, CRYPT_SIG_DWORD);
unsigned long L9[] = { 0x0000002E, 0x0000002F, 0x00000030, 0x00000031, 0x00000032, 0x00000033, 0x00000034, 0x00000035,
0x00000036, 0x00000037, 0x00000038, 0x00000039, 0x00000041, 0x00000042, 0x00000043, 0x00000044,
0x00000045, 0x00000046, 0x00000047, 0x00000048, 0x00000049, 0x0000004A, 0x0000004B, 0x0000004C,
0x0000004D, 0x0000004E, 0x0000004F, 0x00000050, 0x00000051, 0x00000052, 0x00000053, 0x00000054,
0x00000055, 0x00000056, 0x00000057, 0x00000058, 0x00000059, 0x0000005A, 0x00000061, 0x00000062,
0x00000063, 0x00000064, 0x00000065, 0x00000066, 0x00000067, 0x00000068, 0x00000069, 0x0000006A,
0x0000006B, 0x0000006C, 0x0000006D, 0x0000006E, 0x0000006F, 0x00000070, 0x00000071, 0x00000072,
0x00000073, 0x00000074, 0x00000075, 0x00000076, 0x00000077, 0x00000078, 0x00000079, 0x0000007A };
CSigs[i++] = NewCryptSig("des", L9, 64, NULL, 0, -4, 0, CRYPT_SIG_DWORD);
unsigned long L10[] = { 0x02080800, 0x00080000, 0x02000002, 0x02080802, 0x00000802,
0x40108010, 0x40000010, 0x00008000, 0x00108010, 0x40008010,
0x40108010, 0x40000010, 0x00008000, 0x00108010, 0x40008010,
0x20800080, 0x20820080, 0x00820000, 0x01004004, 0x01004204 };
CSigs[i++] = NewCryptSig("des", L10, 10, NULL, 0, -4, 0, CRYPT_SIG_DWORD);
unsigned long L11[] = { 0x00000029, 0x0000002E, 0x00000043, 0x000000C9, 0x000000A2, 0x000000D8, 0x0000007C, 0x00000001,
0x0000003D, 0x00000036, 0x00000054, 0x000000A1, 0x000000EC, 0x000000F0, 0x00000006, 0x00000013,
0x00000062, 0x000000A7, 0x00000005, 0x000000F3, 0x000000C0, 0x000000C7, 0x00000073, 0x0000008C,
0x00000098, 0x00000093, 0x0000002B, 0x000000D9, 0x000000BC, 0x0000004C, 0x00000082, 0x000000CA,
0x0000001E, 0x0000009B, 0x00000057, 0x0000003C, 0x000000FD, 0x000000D4, 0x000000E0, 0x00000016,
0x00000067, 0x00000042, 0x0000006F, 0x00000018, 0x0000008A, 0x00000017, 0x000000E5, 0x00000012,
0x000000BE, 0x0000004E, 0x000000C4, 0x000000D6, 0x000000DA, 0x0000009E, 0x000000DE, 0x00000049,
0x000000A0, 0x000000FB, 0x000000F5, 0x0000008E, 0x000000BB, 0x0000002F, 0x000000EE, 0x0000007A,
0x000000A9, 0x00000068, 0x00000079, 0x00000091, 0x00000015, 0x000000B2, 0x00000007, 0x0000003F,
0x00000094, 0x000000C2, 0x00000010, 0x00000089, 0x0000000B, 0x00000022, 0x0000005F, 0x00000021,
0x00000080, 0x0000007F, 0x0000005D, 0x0000009A, 0x0000005A, 0x00000090, 0x00000032, 0x00000027,
0x00000035, 0x0000003E, 0x000000CC, 0x000000E7, 0x000000BF, 0x000000F7, 0x00000097, 0x00000003,
0x000000FF, 0x00000019, 0x00000030, 0x000000B3, 0x00000048, 0x000000A5, 0x000000B5, 0x000000D1,
0x000000D7, 0x0000005E, 0x00000092, 0x0000002A, 0x000000AC, 0x00000056, 0x000000AA, 0x000000C6,
0x0000004F, 0x000000B8, 0x00000038, 0x000000D2, 0x00000096, 0x000000A4, 0x0000007D, 0x000000B6,
0x00000076, 0x000000FC, 0x0000006B, 0x000000E2, 0x0000009C, 0x00000074, 0x00000004, 0x000000F1,
0x00000045, 0x0000009D, 0x00000070, 0x00000059, 0x00000064, 0x00000071, 0x00000087, 0x00000020,
0x00000086, 0x0000005B, 0x000000CF, 0x00000065, 0x000000E6, 0x0000002D, 0x000000A8, 0x00000002,
0x0000001B, 0x00000060, 0x00000025, 0x000000AD, 0x000000AE, 0x000000B0, 0x000000B9, 0x000000F6,
0x0000001C, 0x00000046, 0x00000061, 0x00000069, 0x00000034, 0x00000040, 0x0000007E, 0x0000000F,
0x00000055, 0x00000047, 0x000000A3, 0x00000023, 0x000000DD, 0x00000051, 0x000000AF, 0x0000003A,
0x000000C3, 0x0000005C, 0x000000F9, 0x000000CE, 0x000000BA, 0x000000C5, 0x000000EA, 0x00000026,
0x0000002C, 0x00000053, 0x0000000D, 0x0000006E, 0x00000085, 0x00000028, 0x00000084, 0x00000009,
0x000000D3, 0x000000DF, 0x000000CD, 0x000000F4, 0x00000041, 0x00000081, 0x0000004D, 0x00000052,
0x0000006A, 0x000000DC, 0x00000037, 0x000000C8, 0x0000006C, 0x000000C1, 0x000000AB, 0x000000FA,
0x00000024, 0x000000E1, 0x0000007B, 0x00000008, 0x0000000C, 0x000000BD, 0x000000B1, 0x0000004A,
0x00000078, 0x00000088, 0x00000095, 0x0000008B, 0x000000E3, 0x00000063, 0x000000E8, 0x0000006D,
0x000000E9, 0x000000CB, 0x000000D5, 0x000000FE, 0x0000003B, 0x00000000, 0x0000001D, 0x00000039,
0x000000F2, 0x000000EF, 0x000000B7, 0x0000000E, 0x00000066, 0x00000058, 0x000000D0, 0x000000E4,
0x000000A6, 0x00000077, 0x00000072, 0x000000F8, 0x000000EB, 0x00000075, 0x0000004B, 0x0000000A,
0x00000031, 0x00000044, 0x00000050, 0x000000B4, 0x0000008F, 0x000000ED, 0x0000001F, 0x0000001A,
0x000000DB, 0x00000099, 0x0000008D, 0x00000033, 0x0000009F, 0x00000011, 0x00000083, 0x00000014 };
CSigs[i++] = NewCryptSig("md2", L11, 256, NULL, 0, -4, 0, CRYPT_SIG_DWORD);
unsigned long L12[] = { 0x000000d9, 0x00000078, 0x000000f9, 0x000000c4, 0x00000019, 0x000000dd, 0x000000b5, 0x000000ed,
0x00000028, 0x000000e9, 0x000000fd, 0x00000079, 0x0000004a, 0x000000a0, 0x000000d8, 0x0000009d,
0x000000c6, 0x0000007e, 0x00000037, 0x00000083, 0x0000002b, 0x00000076, 0x00000053, 0x0000008e,
0x00000062, 0x0000004c, 0x00000064, 0x00000088, 0x00000044, 0x0000008b, 0x000000fb, 0x000000a2,
0x00000017, 0x0000009a, 0x00000059, 0x000000f5, 0x00000087, 0x000000b3, 0x0000004f, 0x00000013,
0x00000061, 0x00000045, 0x0000006d, 0x0000008d, 0x00000009, 0x00000081, 0x0000007d, 0x00000032,
0x000000bd, 0x0000008f, 0x00000040, 0x000000eb, 0x00000086, 0x000000b7, 0x0000007b, 0x0000000b,
0x000000f0, 0x00000095, 0x00000021, 0x00000022, 0x0000005c, 0x0000006b, 0x0000004e, 0x00000082,
0x00000054, 0x000000d6, 0x00000065, 0x00000093, 0x000000ce, 0x00000060, 0x000000b2, 0x0000001c,
0x00000073, 0x00000056, 0x000000c0, 0x00000014, 0x000000a7, 0x0000008c, 0x000000f1, 0x000000dc,
0x00000012, 0x00000075, 0x000000ca, 0x0000001f, 0x0000003b, 0x000000be, 0x000000e4, 0x000000d1,
0x00000042, 0x0000003d, 0x000000d4, 0x00000030, 0x000000a3, 0x0000003c, 0x000000b6, 0x00000026,
0x0000006f, 0x000000bf, 0x0000000e, 0x000000da, 0x00000046, 0x00000069, 0x00000007, 0x00000057,
0x00000027, 0x000000f2, 0x0000001d, 0x0000009b, 0x000000bc, 0x00000094, 0x00000043, 0x00000003,
0x000000f8, 0x00000011, 0x000000c7, 0x000000f6, 0x00000090, 0x000000ef, 0x0000003e, 0x000000e7,
0x00000006, 0x000000c3, 0x000000d5, 0x0000002f, 0x000000c8, 0x00000066, 0x0000001e, 0x000000d7,
0x00000008, 0x000000e8, 0x000000ea, 0x000000de, 0x00000080, 0x00000052, 0x000000ee, 0x000000f7,
0x00000084, 0x000000aa, 0x00000072, 0x000000ac, 0x00000035, 0x0000004d, 0x0000006a, 0x0000002a,
0x00000096, 0x0000001a, 0x000000d2, 0x00000071, 0x0000005a, 0x00000015, 0x00000049, 0x00000074,
0x0000004b, 0x0000009f, 0x000000d0, 0x0000005e, 0x00000004, 0x00000018, 0x000000a4, 0x000000ec,
0x000000c2, 0x000000e0, 0x00000041, 0x0000006e, 0x0000000f, 0x00000051, 0x000000cb, 0x000000cc,
0x00000024, 0x00000091, 0x000000af, 0x00000050, 0x000000a1, 0x000000f4, 0x00000070, 0x00000039,
0x00000099, 0x0000007c, 0x0000003a, 0x00000085, 0x00000023, 0x000000b8, 0x000000b4, 0x0000007a,
0x000000fc, 0x00000002, 0x00000036, 0x0000005b, 0x00000025, 0x00000055, 0x00000097, 0x00000031,
0x0000002d, 0x0000005d, 0x000000fa, 0x00000098, 0x000000e3, 0x0000008a, 0x00000092, 0x000000ae,
0x00000005, 0x000000df, 0x00000029, 0x00000010, 0x00000067, 0x0000006c, 0x000000ba, 0x000000c9,
0x000000d3, 0x00000000, 0x000000e6, 0x000000cf, 0x000000e1, 0x0000009e, 0x000000a8, 0x0000002c,
0x00000063, 0x00000016, 0x00000001, 0x0000003f, 0x00000058, 0x000000e2, 0x00000089, 0x000000a9,
0x0000000d, 0x00000038, 0x00000034, 0x0000001b, 0x000000ab, 0x00000033, 0x000000ff, 0x000000b0,
0x000000bb, 0x00000048, 0x0000000c, 0x0000005f, 0x000000b9, 0x000000b1, 0x000000cd, 0x0000002e,
0x000000c5, 0x000000f3, 0x000000db, 0x00000047, 0x000000e5, 0x000000a5, 0x0000009c, 0x00000077,
0x0000000a, 0x000000a6, 0x00000020, 0x00000068, 0x000000fe, 0x0000007f, 0x000000c1, 0x000000ad };
CSigs[i++] = NewCryptSig("rc2", L12, 256, NULL, 0, -4, 0, CRYPT_SIG_DWORD);
unsigned long L13[] = { 0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA, 0x076DC419, 0x706AF48F, 0xE963A535, 0x9E6495A3,
0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988, 0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91 };
CSigs[i++] = NewCryptSig("crc32", L13, 16, NULL, 0, -4, 0, CRYPT_SIG_DWORD);
unsigned long L14[] = { 0xEFCDAB89, 0x10325476, 0x67452301, 0x98BADCFE, 0xC3D2E1F0 };
CSigs[i++] = NewCryptSig("sha", L14 , 5, NULL, 0, -4, 0, CRYPT_SIG_DWORD);
unsigned long L15[] = { 0x00000001, 0x52525252, 0x52525252, 0x25252525, 0x25252525 };
CSigs[i++] = NewCryptSig("mdc2", L15 , 5, NULL, 0, -4, 0, CRYPT_SIG_DWORD);
CSigs[i++] = NULL;
}
[/FONT][/COLOR]
有人补充吗?
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课