註冊碼差異比較

註冊碼差異比較

由上次的Sandbox Demo所想到的功能之一,首先以Windows系列

開機必要載入Registry的部分,比較常見的病毒很多都會寫在啟動區

讓病毒開機時順便啟動載入........

使用條件就是先備份一個乾淨的Registry部分

再跟感染病毒後的註冊碼進行比較。

 

當然很多人會問哪個註冊碼比較重要,因為某些因素測試很多工具

發現了一個工具(Comodo還不錯用,再說就有打廣告嫌疑了XD)

Comodo有把保護的部分秀出來那也順便跟大家一起分享.....

image

 

介面

 image

 

後台部分(比對可以依照想備份自己調整)

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.IO;
using System.Collections;
using System.Linq;
using Microsoft.VisualBasic;
namespace registbackup
{
public partial class Form1 : Form
{
public Form1()
{
InitializeComponent();
}

private void button1_Click(object sender, EventArgs e)
{
string ModernTechBU="C:\\";
string CurrentUser = @"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\";
//string CurrentUser = @"
HKEY_LOCAL_MACHINE\SOFTWARE";可調整想備份部分位置。
string Command = ("
/C regedit.exe /e " + @"""" + ModernTechBU + DateTime.Now.ToString("yyyyMMddhhmmss")+".reg" + @"""" + CurrentUser);

if (Directory.Exists(ModernTechBU) == false)
{
Directory.CreateDirectory(ModernTechBU);
}
System.Diagnostics.Process.Start("
CMD.exe", Command);

}

private void button2_Click(object sender, EventArgs e)
{
OpenFileDialog fDilag = new OpenFileDialog();
fDilag.Title = "
Please You Choose The Path Of The Modified DataBase!";
fDilag.InitialDirectory = @"
c:\";
fDilag.Filter = "
All files (*.*)|*.*|All files (*.*)|*.*";
fDilag.FilterIndex = 2;
fDilag.RestoreDirectory = true;
if (fDilag.ShowDialog() == DialogResult.OK )
{
textBox1.Text = fDilag.FileName;
}
}

private void button3_Click(object sender, EventArgs e)
{
OpenFileDialog fDilag = new OpenFileDialog();
fDilag.Title = "
Please You Choose The Path Of The Modified DataBase!";
fDilag.InitialDirectory = @"
c:\";
fDilag.Filter = "
All files (*.*)|*.*|All files (*.*)|*.*";
fDilag.FilterIndex = 2;
fDilag.RestoreDirectory = true;
if (fDilag.ShowDialog() == DialogResult.OK)
{
textBox2.Text = fDilag.FileName;
}

}

private void compare_Click(object sender, EventArgs e)
{
List<string> arrText = new List<string>();
List<string> arrText2 = new List<string>();
#region 進行比對........
try
{
StreamReader objReader = new StreamReader(textBox1.Text.ToString());
string sLine = "
";

while (sLine != null)
{
sLine = objReader.ReadLine();
if (sLine != null)
arrText.Add(sLine);
}
objReader.Close();

StreamReader objReader1 = new StreamReader(textBox2.Text.ToString());
string sLine1 = "
";

while (sLine1 != null)
{
sLine1 = objReader1.ReadLine();
if (sLine1 != null)
arrText2.Add(sLine1);
}
objReader1.Close();
}
catch (Exception ex)
{
MessageBox.Show("
請確定檔案是否存在");
}

double total = 0;

// 此段秒速計算可以拿掉@@純屬個人想看
System.Diagnostics.Stopwatch swt = new System.Diagnostics.Stopwatch();//引用stopwatch物件
swt.Reset();
swt.Start();
int num = 0;
// List<string> arrText3 = new List<string>();//測試用

try
{
//開起要存的檔案
string filename = DateTime.Now.ToString("
yyyy_MM_dd_hh_mm_ss").ToString();
StreamWriter sw = new StreamWriter("
C:\\compare_" + DateTime.Now.ToString("yyyy_MM_dd_hh_mm_ss") + ".txt", true, Encoding.ASCII);

foreach (string sOutput in arrText2)
{
if (sOutput.Split('_')[0].ToString() == "
[HKEY")
{
sw.WriteLine(sOutput);
}
if (arrText.Count() == num)
{
sw.WriteLine(sOutput);
}
else if (sOutput != arrText[num].ToString())
{
// arrText3.Add(sOutput); //測試用
sw.WriteLine(sOutput);
}
num++;
}
swt.Stop();
total += swt.Elapsed.TotalSeconds;
sw.Close();
MessageBox.Show("
輸出檔案為"+filename+"比對完成花費時間" + total.ToString());

}
catch (Exception ex)
{

}
#endregion
}
}
}


測試

 

 

image image

 

 

 

 

大家一起加入blogads 賺零用錢!!