<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>SYSREVEAL</title>
	<atom:link href="http://www.sysreveal.com/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.sysreveal.com</link>
	<description>Reveal the Dark Side of Windows</description>
	<lastBuildDate>Wed, 21 Mar 2012 20:54:54 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.2</generator>
		<item>
		<title>去除有道词典5.0广告的办法</title>
		<link>http://www.sysreveal.com/youdao-remove-ad/</link>
		<comments>http://www.sysreveal.com/youdao-remove-ad/#comments</comments>
		<pubDate>Wed, 21 Mar 2012 20:52:46 +0000</pubDate>
		<dc:creator>niucool</dc:creator>
				<category><![CDATA[ReverseIt]]></category>
		<category><![CDATA[去广告]]></category>
		<category><![CDATA[有道]]></category>
		<category><![CDATA[网易]]></category>
		<category><![CDATA[词典]]></category>

		<guid isPermaLink="false">http://www.sysreveal.com/?p=573</guid>
		<description><![CDATA[有道字典越做越好，但是既然是免费的，少不了广告的骚扰，上面文字的就算了，下面还有一长条图片广告，看着让人觉得烦躁。 去除的方法很简单： 找到一个PE资源编辑工具，我用的是PE Explorer。 打开有道的可执行文件YodaoDict.exe，找到如图的资源： 将红框处的资源由sObj.style.display=&#34;block&#34; 改成 sObj.style.display=&#34;none&#34; 保存覆盖原来的YoudaoDict.exe即可。 现在的执行效果：]]></description>
			<content:encoded><![CDATA[<p>有道字典越做越好，但是既然是免费的，少不了广告的骚扰，上面文字的就算了，下面还有一长条图片广告，看着让人觉得烦躁。</p>
<p><img style="background-image: none; border-bottom: 0px; border-left: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top: 0px; border-right: 0px; padding-top: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2012/03/image3.png" width="584" height="461" /></p>
<p>去除的方法很简单：</p>
<ol>
<li>找到一个PE资源编辑工具，我用的是PE Explorer。 </li>
<li>打开有道的可执行文件YodaoDict.exe，找到如图的资源：     <br /><a href="http://www.sysreveal.com/wp-content/uploads/2012/03/image4.png" rel="lightbox[573]"><img style="background-image: none; border-bottom: 0px; border-left: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top: 0px; border-right: 0px; padding-top: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2012/03/image_thumb1.png" width="564" height="404" /></a> </li>
<li>将红框处的资源由sObj.style.display=&quot;block&quot; 改成 sObj.style.display=&quot;none&quot; </li>
<li>保存覆盖原来的YoudaoDict.exe即可。 </li>
</ol>
<p>现在的执行效果：</p>
<p><img style="background-image: none; border-bottom: 0px; border-left: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top: 0px; border-right: 0px; padding-top: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2012/03/image5.png" width="584" height="461" /></p>
]]></content:encoded>
			<wfw:commentRss>http://www.sysreveal.com/youdao-remove-ad/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>VB magazines will no longer be published for legal issues</title>
		<link>http://www.sysreveal.com/vb-magazines-will-no-longer-be-published-for-legal-issues/</link>
		<comments>http://www.sysreveal.com/vb-magazines-will-no-longer-be-published-for-legal-issues/#comments</comments>
		<pubDate>Thu, 01 Mar 2012 18:50:03 +0000</pubDate>
		<dc:creator>niucool</dc:creator>
				<category><![CDATA[Virus Bulletin]]></category>

		<guid isPermaLink="false">http://www.sysreveal.com/?p=564</guid>
		<description><![CDATA[FYI]]></description>
			<content:encoded><![CDATA[<p>FYI</p>
]]></content:encoded>
			<wfw:commentRss>http://www.sysreveal.com/vb-magazines-will-no-longer-be-published-for-legal-issues/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>SysTracer更新至v1.0.0.11</title>
		<link>http://www.sysreveal.com/systracer-history/</link>
		<comments>http://www.sysreveal.com/systracer-history/#comments</comments>
		<pubDate>Mon, 16 Jan 2012 05:58:00 +0000</pubDate>
		<dc:creator>mayin</dc:creator>
				<category><![CDATA[SysTracer]]></category>
		<category><![CDATA[history]]></category>
		<category><![CDATA[修改历史]]></category>

		<guid isPermaLink="false">http://www.sysreveal.com/systracer%e6%9b%b4%e6%96%b0%e8%87%b3v1-0-0-4/</guid>
		<description><![CDATA[v1.0.0.11更新日志 (2011.1.16) 启动时不自动运行全局监控模式 合并连续的相同日志 修改驱动几个可能导致蓝屏的问题 v1.0.0.10更新日志 修改一个退出时可能导致蓝屏的BUG v1.0.0.9 更新日志 这个版本优化了R0和R3的通讯协议，并没有做界面上的修改，所以对于用户使用来说感觉和上版没有区别，不过对于SysTracer来说也算是大的改动了，放上来希望大家能帮忙测试一下，多提宝贵意见！ ：） v1.0.0.8 更新日志 1.     在界面显示中增加了内核HOOK的详细信息 2.    增加了对网络共享目录中运行程序的监控支持 v1.0.0.7 更新日志 修改了界面显示的问题 修改了跟踪单个进程不显示的问题 修改了若干驱动的问题 v1.0.0.6更新日志：（2011-04-25） 重新编写界面程序，提供更友好的日志查看。 驱动增加了HOOK检查。 修改REPORT文件格式。 修改了一些BUG。 v1.0.0.5更新日志：(2011-03-11) SysTracer新添加了报告显示功能，用户可以通过&#8221;文件&#8221;菜单中的&#8221;查看报告&#8221;菜单项或者工具栏中的&#8221;查看&#8221;按键来根据监控日志生成并显示报告，报告将会更直观的给用户呈现出监控的信息。新的界面：输出的HTML格式的日志： &#8220;选项&#8221;菜单中的&#8221;设置选项&#8221;卡新增了设置字体功能，用户可以根据自己的需要来调整。 v1.0.0.4更新日志：(From v1.0.0.3) 1.将日志显示区进行了汉化处理 SysTracer汉化后的主界面如下： 请点这里下载SysTracer的最新版本！]]></description>
			<content:encoded><![CDATA[<p>v1.0.0.11更新日志 (2011.1.16)</p>
<ol>
<li>启动时不自动运行全局监控模式</li>
<li>合并连续的相同日志</li>
<li>修改驱动几个可能导致蓝屏的问题</li>
</ol>
<p>v1.0.0.10更新日志</p>
<p>修改一个退出时可能导致蓝屏的BUG</p>
<p>v1.0.0.9 更新日志</p>
<p>这个版本优化了R0和R3的通讯协议，并没有做界面上的修改，所以对于用户使用来说感觉和上版没有区别，不过对于SysTracer来说也算是大的改动了，放上来希望大家能帮忙测试一下，多提宝贵意见！ ：）</p>
<p>v1.0.0.8 更新日志</p>
<p>1.     在界面显示中增加了内核HOOK的详细信息</p>
<p>2.    增加了对网络共享目录中运行程序的监控支持</p>
<p>v1.0.0.7 更新日志</p>
<ol>
<li>修改了界面显示的问题</li>
<li>修改了跟踪单个进程不显示的问题</li>
<li>修改了若干驱动的问题</li>
</ol>
<p>v1.0.0.6更新日志：（2011-04-25）</p>
<p><a href="http://www.sysreveal.com/wp-content/uploads/2011/04/image1.png" rel="lightbox"><img style="background-image: none; padding-left: 0px; padding-right: 0px; display: inline; padding-top: 0px; border-width: 0px;" title="image" src="http://www.sysreveal.com/wp-content/uploads/2011/04/image_thumb1.png" alt="image" width="508" height="321" border="0" /></a></p>
<ol>
<li>重新编写界面程序，提供更友好的日志查看。</li>
<li>驱动增加了HOOK检查。</li>
<li>修改REPORT文件格式。</li>
<li>修改了一些BUG。</li>
</ol>
<p><span id="more-418"></span>v1.0.0.5更新日志：(2011-03-11)</p>
<ol>
<li>SysTracer新添加了报告显示功能，用户可以通过&#8221;文件&#8221;菜单中的&#8221;查看报告&#8221;菜单项或者工具栏中的&#8221;查看&#8221;按键来根据监控日志生成并显示报告，报告将会更直观的给用户呈现出监控的信息。新的界面：<a href="http://www.sysreveal.com/wp-content/uploads/2011/03/image.png" rel="lightbox"><img style="background-image: none; padding-left: 0px; padding-right: 0px; display: inline; padding-top: 0px; border-width: 0px;" title="image" src="http://www.sysreveal.com/wp-content/uploads/2011/03/image_thumb.png" alt="image" width="504" height="374" border="0" /></a>输出的HTML格式的日志：<a href="http://www.sysreveal.com/wp-content/uploads/2011/03/image1.png" rel="lightbox"><img style="background-image: none; padding-left: 0px; padding-right: 0px; display: block; float: none; margin-left: auto; margin-right: auto; padding-top: 0px; border-width: 0px;" title="image" src="http://www.sysreveal.com/wp-content/uploads/2011/03/image_thumb1.png" alt="image" width="504" height="475" border="0" /></a></li>
<li>&#8220;选项&#8221;菜单中的&#8221;设置选项&#8221;卡新增了设置字体功能，用户可以根据自己的需要来调整。</li>
</ol>
<p>v1.0.0.4更新日志：(From v1.0.0.3)</p>
<p>1.将日志显示区进行了汉化处理</p>
<p>SysTracer汉化后的主界面如下：</p>
<p><img src="http://www.sysreveal.com/wp-content/uploads/2011/02/021811_0233_SysTracerv114.jpg" alt="" /></p>
<p><span style="color: yellow;"><strong>请点<a href="http://www.sysreveal.com/download/SysTracer.zip">这里下载</a>SysTracer的最新版本！</strong></span></p>
]]></content:encoded>
			<wfw:commentRss>http://www.sysreveal.com/systracer-history/feed/</wfw:commentRss>
		<slash:comments>12</slash:comments>
		</item>
		<item>
		<title>DirMon updated to v1.0.1</title>
		<link>http://www.sysreveal.com/dirmon-history/</link>
		<comments>http://www.sysreveal.com/dirmon-history/#comments</comments>
		<pubDate>Fri, 05 Aug 2011 17:15:26 +0000</pubDate>
		<dc:creator>niucool</dc:creator>
				<category><![CDATA[System Research]]></category>
		<category><![CDATA[DirMon]]></category>
		<category><![CDATA[download]]></category>
		<category><![CDATA[下载]]></category>
		<category><![CDATA[工具]]></category>
		<category><![CDATA[监控]]></category>
		<category><![CDATA[目录]]></category>

		<guid isPermaLink="false">http://www.sysreveal.com/dirmon-history/</guid>
		<description><![CDATA[Actually in most cases, we don’t need to use the mighty sword like SysTracer or FileMon to know what’s happening in your file system. So why not choose the very light weight tool DirMon? Major features: Support all Windows NT platforms: Windows 2000 ~ windows 7 both 32-bit and 64-bit Light weight and easy to [...]]]></description>
			<content:encoded><![CDATA[<p>Actually in most cases, we don’t need to use the mighty sword like SysTracer or FileMon to know what’s happening in your file system. So why not choose the very light weight tool DirMon?</p>
<p><img style="background-image: none; padding-left: 0px; padding-right: 0px; display: inline; padding-top: 0px; border: 0px;" title="image" src="http://www.sysreveal.com/wp-content/uploads/2011/08/image.png" alt="image" width="566" height="464" border="0" /></p>
<p>Major features:</p>
<ul>
<li>Support all Windows NT platforms: Windows 2000 ~ windows 7 both 32-bit and 64-bit</li>
<li>Light weight and easy to use, no administrator privilege needed.</li>
<li>Monitor all changes in a directory with flexible options.</li>
</ul>
<p>Change history:</p>
<p>v1.0.1 (2011-08-05)</p>
<ul>
<li>Support both Chinese and English</li>
</ul>
<p>Please download the latest version of DirMon <a href="http://www.sysreveal.com/download/dirmon.zip" target="_blank">here</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.sysreveal.com/dirmon-history/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Exception Handler in Windows 64-bit</title>
		<link>http://www.sysreveal.com/seh-win64/</link>
		<comments>http://www.sysreveal.com/seh-win64/#comments</comments>
		<pubDate>Tue, 19 Jul 2011 00:49:32 +0000</pubDate>
		<dc:creator>niucool</dc:creator>
				<category><![CDATA[System Research]]></category>
		<category><![CDATA[SEH]]></category>
		<category><![CDATA[windows]]></category>
		<category><![CDATA[x64]]></category>

		<guid isPermaLink="false">http://www.sysreveal.com/seh-win64/</guid>
		<description><![CDATA[Structured Exception Handling (SEH) is a very important mechanism in Windows operating system. The most famous article describing SEH in Windows 32 bits is from Windows wizard Matt Pietrek: A Crash Course on the Depths of Win32™ Structured Exception Handling . On the x64, Microsoft changes its way to handle exception. You could still use [...]]]></description>
			<content:encoded><![CDATA[<p>Structured Exception Handling (SEH) is a very important mechanism in Windows operating system. The most famous article describing SEH in Windows 32 bits is from Windows wizard Matt Pietrek: <a href="http://www.microsoft.com/msj/0197/exception/exception.aspx" target="_blank">A Crash Course on the Depths of Win32™ Structured Exception Handling</a> .</p>
<p>On the x64, Microsoft changes its way to handle exception. You could still use <strong>__try</strong> and <strong>__except </strong>to catch and handle exceptions, but the internal implements are totally changed by Microsoft. There are still some good articles talking about the x64 SEH:</p>
<p>A good article for major concepts:  <a href="http://www.osronline.com/article.cfm?article=469" target="_blank">Exceptional Behavior &#8211; x64 Structured Exception Handling</a></p>
<p>Series of articles in depth:  <a href="http://www.nynaeve.net/?p=113" target="_blank">Programming against the x64 exception handling support</a></p>
<p>So why should we learn these details if we could still use __try and __except to handle all exceptions? The answer is: when you port your code from 32-bit to 64-bit, your SEH might not work if your code is dynamically generated. You have to use new Win64 APIs <strong>RtlInstallFunctionTableCallback</strong> and <strong>RtlAddFunctionTable </strong>to manually handle your code exceptions. Furthermore, some PE packers might not work when processing Win64 PE files since they could not take advantage of Win32 SEH tricks any more.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.sysreveal.com/seh-win64/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>iAppleTracker&#8212;&#8212;Windows下查看iPhone/iPad记录的GPS信息</title>
		<link>http://www.sysreveal.com/iappletracker/</link>
		<comments>http://www.sysreveal.com/iappletracker/#comments</comments>
		<pubDate>Mon, 25 Apr 2011 16:46:58 +0000</pubDate>
		<dc:creator>niucool</dc:creator>
				<category><![CDATA[System Research]]></category>
		<category><![CDATA[iAppleTracker]]></category>
		<category><![CDATA[iPhoneTracker]]></category>
		<category><![CDATA[windows]]></category>
		<category><![CDATA[水果追踪器]]></category>

		<guid isPermaLink="false">http://www.sysreveal.com/iappletracker/</guid>
		<description><![CDATA[&#160; 这是一个在Windows下运行的iPhone/iPad GPS日志查看器，开发这个小东西花了我两个晚上。原始想法来源于iPhoneTracker，关于这个软件的实现原理和常见问题都可以在前面那个网址上查到。区别在于iPhoneTracker是运行在MAC OS上的，我这个程序是运行在Windows下的，当然前提是您曾经使用过iTunes进行了备份。 iAppleTracker的下载地址请点这里。 程序主界面： 查询后的结果： 使用方法请参考下图：]]></description>
			<content:encoded><![CDATA[<p>&#160;</p>
<p>这是一个在Windows下运行的iPhone/iPad GPS日志查看器，开发这个小东西花了我两个晚上。原始想法来源于<a href="http://petewarden.github.com/iPhoneTracker/" target="_blank">iPhoneTracker</a>，关于这个软件的实现原理和常见问题都可以在前面那个网址上查到。区别在于iPhoneTracker是运行在MAC OS上的，我这个程序是运行在Windows下的，当然前提是您曾经使用过iTunes进行了备份。</p>
<p>iAppleTracker的<a href="http://www.sysreveal.com/download/iAppleTracker.zip">下载地址请点这里</a>。</p>
<p>程序主界面：</p>
<p><img style="background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2011/04/image2.png" width="452" height="360" /></p>
<p>查询后的结果：</p>
<p><a href="http://www.sysreveal.com/wp-content/uploads/2011/04/image3.png" rel="lightbox"><img style="background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2011/04/image_thumb2.png" width="508" height="269" /></a></p>
<p><span id="more-478"></span>
<p>使用方法请参考下图：</p>
<p><img style="background-image: none; border-bottom: 0px; border-left: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top: 0px; border-right: 0px; padding-top: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2011/04/image4.png" width="452" height="360" /></p>
]]></content:encoded>
			<wfw:commentRss>http://www.sysreveal.com/iappletracker/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>SysReveal 更新至 v1.0.0.72</title>
		<link>http://www.sysreveal.com/sysreveal-history/</link>
		<comments>http://www.sysreveal.com/sysreveal-history/#comments</comments>
		<pubDate>Fri, 25 Mar 2011 07:51:00 +0000</pubDate>
		<dc:creator>niucool</dc:creator>
				<category><![CDATA[SysReveal]]></category>
		<category><![CDATA[Version History]]></category>
		<category><![CDATA[change log]]></category>

		<guid isPermaLink="false">http://www.sysreveal.com/?p=48</guid>
		<description><![CDATA[SysReveal开发日志]]></description>
			<content:encoded><![CDATA[<p><strong><span style="color: #ffff00; font-size: medium">SysReveal的最新版本请点击本网站右侧的</span><a href="http://www.sysreveal.com/download/SysReveal.zip" target="_blank"><span style="color: #ffff00; font-size: medium"><img alt="" src="http://www.sysreveal.com/wp-content/themes/pixel/view/drain-hole/icons/wordpress-1.5-only.png" /></span></a><span style="color: #ffff00; font-size: medium">图标或文字链接下载。</span></strong></p>
<p>以下是SysReveal的版本更新历史：</p>
<p>v1.0.0.72(2011-03-28)</p>
<p>Fix bugs from <a href="http://bbs.kafan.cn/" target="_blank">kafan</a><br/></p>
<ol>
<li>* Fix bug: Process list view refresh problem</li>
<li>* Fix bug: Driver list view will crash when driver&#8217;s refreshed in other views</li>
<li>* Fix bug: Driver status view is not correct.</li>
</ol>
<p>v1.0.0.71(2011-03-25)</p>
<ol>
<li>+Add process module view      <br /><a href="http://www.sysreveal.com/wp-content/uploads/2011/03/image2.png" rel="lightbox"><img style="background-image: none; border-bottom: 0px; border-left: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top: 0px; border-right: 0px; padding-top: 0px" title="SysReveal module view" border="0" alt="SysReveal module view" src="http://www.sysreveal.com/wp-content/uploads/2011/03/image_thumb2.png" width="544" height="393" /></a> </li>
<li>*Fix bug: checking API hook return false results </li>
<li>*Fix bug: Restoring API hook does not work </li>
<li>*Fix bug: Failed to parse autorun entries if they are not standard command line format. (Thanks to 单身熟男) </li>
<li>*Fix bug: Failed to get shadow SSDT in console version</li>
<li>*Other minor bugs fixed. </li>
</ol>
<p><span id="more-48"></span>
<p>v1.0.0.70(2011-02-22)</p>
<p>一晃快五个月了，江湖中又崛起了诸多rootkit工具，真是江山代有才人出啊。SysReveal小更新一把。</p>
<ol>
<li>*修改了启动慢和假死问题 </li>
<li>+注册表部分加上了KEY修改时间的显示 </li>
<li>+重写了注册表搜索功能      <br /><img style="background-image: none; border-right-width: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; padding-top: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2011/02/image.png" width="542" height="301" /> </li>
<li>*驱动修改了若干BUG </li>
<li>*修改了若干功能上的BUG </li>
</ol>
<p>v1.0.0.68(2010-09-28)&#160; 其兴也勃，其亡也忽 </p>
<p>这是一个BUG修正版，改完这个版本国庆休大假啦。以下是修改日志：</p>
<ol>
<li>+增加了驱动详细信息的显示。 （驱动页面，list右键菜单-&gt;详细信息）      <br /><a href="http://www.sysreveal.com/wp-content/uploads/2010/09/image.png" rel="lightbox[48]"><img style="border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2010/09/image_thumb.png" width="304" height="330" /></a> </li>
<li>*修正了启动项检测，服务项检测的一些BUG。 (Thanks to <span style="color: #ffff00"><strong>bottlebox</strong></span>) </li>
<li>+网络页面增加了PID列。 </li>
<li>*修正了删除畸形文件、文件夹失败的BUG。（Thanks to <span style="color: #ffff00"><strong>freesoft00, molicn</strong></span>） </li>
<li>*修正了WIN7下任务栏图标显示不正确的BUG。 </li>
</ol>
<p>另外，进程实时刷新的问题我改好了，但是因为对进程的检测采用了诸多算法，实时刷新有严重的CPU问题，目前已经屏蔽。</p>
<p>v1.0.0.66 (2010-09-10)</p>
<p>本想出个最终版，但是有些功能迟迟不能完工，先出个改进版本吧。以下是修改日志：</p>
<ol>
<li>+进程模块窗口的右键菜单增加：“仅显示可疑文件”选项 </li>
<li>+进程句柄窗口的右键菜单增加：“仅显示有名字的句柄”选项 </li>
<li>+进程窗口增加了一列：“进程启动时间” </li>
<li>+服务窗口增加了创建时间和修改时间 </li>
<li>*增强了文件强制复制功能，可通过直接解析文件系统复制文件 </li>
<li>*修改了SysReveal不能从只读介质如光盘运行的BUG </li>
<li>*优化了启动速度 </li>
<li>*修改了驱动若干会导致BSOD的BUG </li>
<li>*增强了钩子的检查 </li>
<li>*释放驱动改成动态命名，通讯进行了简单加密，以防止被病毒利用 </li>
<li>*代码整理及其他BUG修改 </li>
</ol>
<p>v1.0.0.65(2010-07-06) 时过于期，否终则泰</p>
<p>SysReveal像个乌龟一样缓慢的前行，终点似乎就在不远的前方，但是又似乎很遥远，喜欢SysReveal的同志们给我加加油吧。这个版本增加了两大功能并修改了若干BUG，以下是修改日志：</p>
<ol>
<li>+ 增加了DISPATCH HOOK的检查（暂不支持恢复，只用于查找rootkit）<a href="http://www.sysreveal.com/wp-content/uploads/2010/07/image.png" rel="lightbox[48]"><img style="border-right-width: 0px; display: block; float: none; border-top-width: 0px; border-bottom-width: 0px; margin-left: auto; border-left-width: 0px; margin-right: auto" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2010/07/image_thumb.png" width="504" height="369" /></a> </li>
<li>+ 增加了ATTACH DEVICE的检查 </li>
<li>*修改了NTFS解析不正确的BUG（Thanks to <span style="color: #ffff00">曲中求</span>） </li>
<li>*修改了模块路径解析不正确的BUG（Thanks to <span style="color: #ffff00">liulangzhecgr</span>） </li>
<li>*加强了驱动模块检查 </li>
</ol>
<p>以下BUG尚未修改：</p>
<ul>
<li>文件页面的所有BUG尚未修复，如删除畸形目录（freesoft00），计划在下一版本统一修改。 </li>
<li>进程页面的自动刷新(freesoft00)，目前尚未实现。 </li>
</ul>
<p>&#160;</p>
<p>v1.0.0.62(2010-06-20)</p>
<p>v1.0.0.62是v1.0.0.61的BUG修正版，修正以下BUG：</p>
<ol>
<li>*修改了SSDT,SHADOW SSDT显示钩子不正确的问题 </li>
<li>*修改了结束进程树显示不正确的问题 </li>
<li>*修改了MBR HOOK视图以及文件视图提示信息不正确的问题 </li>
<li>*修改了启动项显示的问题 </li>
</ol>
<p>以下BUG尚未修改：</p>
<ul>
<li>在某些情况下解析NTFS文件系统有问题 </li>
<li>在某些情况下解析模块路径有问题 </li>
</ul>
<p>v1.0.0.61(2010-06-18) 见贤思齐，见不贤而思内省</p>
<p>由于众所周知的原因（<strong><span style="color: #00ff00">vuvuzela</span></strong>），SysReveal不能按照我的计划正常发布了，v1.0.0.61是我计划发布版本的精简版。以下是修改历史：</p>
<ol>
<li>+增加了MBR HOOK检测 </li>
<li>+增加了SYSENTER检测和恢复（在Driver Hook页） </li>
<li>+增加了IDT的恢复 </li>
<li>+增加了查看指定内核地址的内存（在驱动页） </li>
<li>*修改了结束进程的刷新问题（Thanks to freesoft00） </li>
<li>*修改了多个导致BSOD的驱动BUG </li>
<li>*修改了由于内存越界导致查看启动项异常的BUG </li>
</ol>
<p><a href="http://www.sysreveal.com/wp-content/uploads/2010/06/image.png" rel="lightbox[48]"><img style="border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2010/06/image_thumb.png" width="504" height="370" /></a></p>
<p>&#160;</p>
<p>v1.0.0.57(2010-05-07)</p>
<p>这个版本只修改了新发布的v1.0.0.52的BUG，没有引入新的功能，进程部分的显示优化问题因时间原因暂时没有修改，预计在月底的版本中会统一修改。</p>
<ol>
<li>*修改了进程模块路径显示不正确的问题 (Thanks to beetea) </li>
<li>*修改了文件窗口无法在线查毒的问题 (Thanks to 小岐) </li>
<li>*修改了注册表窗口几个菜单无响应的问题 </li>
<li>*修改了由于权限不足导致无法删除注册表项的问题 (非最终版) </li>
<li>*修改了句柄窗口无法显示进程名的问题 </li>
</ol>
<p>v1.0.0.53 (2010-05-02)</p>
<p>貌似v1.0.0.52有问题，全部重新编译了一下。</p>
<p>v1.0.0.52 (2010-05-02) 已所不欲，勿施于人</p>
<p>主要修改了一直提示升级的BUG。更新日志：</p>
<ol>
<li>修改了程序版本不正确导致重复提示需要升级的问题 （Thanks to freesoft00） </li>
<li>修改了Startup中存在简体中文字符导致繁体下显示乱码的问题（Thanks to NG） </li>
<li>修改了进程名称显示乱码的问题 （Thanks to freesoft00） </li>
</ol>
<p>v1.0.0.51 (2010-04-30)&#160; 丰碑无语，行胜于言</p>
<p>v1.0.0.51离上个版本的发布有将近两个月的时间，这个版本做了多个重要的改动，并修改若干处BUG。以下是更新日志：</p>
<ol>
<li>+自定义可信文件（白名单），这是这个版本引入的非常重要的功能，目的是通过交互的方式来进一步排查可疑文件，辅助病毒检测。 </li>
<li>*文件系统浏览采用磁盘文件系统解析的方式代替原来的IRP发包方式，目前从检测的强度上来说，SysReveal已经不输于其他同类产品。 </li>
<li>进程显示采纳了freesoft00和云览的建议，改成了wsyscheck的显示方式，并做了增强。
<ul>
<li>黑色表示微软进程 </li>
<li>蓝色表示非微软进程，但是有数字签名，或者被用户设置为可信程序 </li>
<li>红色表示非微软进程 </li>
<li>粉红色表示虽然进程是微软进程或有数字签名，但模块中有非可信的模块 </li>
</ul>
<p><a href="http://www.sysreveal.com/wp-content/uploads/2010/04/image.png" rel="lightbox[48]"><img style="border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2010/04/image_thumb.png" width="504" height="370" /></a></p>
</li>
<li>+在线文件名称搜索。 </li>
<li>+在线可疑文件检测，目前使用<a href="http://www.virustotal.com" target="_blank">VIRUSTOTAL</a>的在线服务 <a href="http://www.sysreveal.com/wp-content/uploads/2010/04/image1.png" rel="lightbox[48]"><img style="border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2010/04/image_thumb1.png" width="404" height="342" /></a> </li>
<li>+内存查看部分增加字符串搜索功能 </li>
<li>+增加字符串搜索的相关配置 </li>
<li>+启动部分增加修复页面 </li>
<li>+增加签名文件显示 </li>
<li>+自动保存界面的配置信息（如显示的列，列宽，当前排序列等） </li>
<li>+文件浏览和注册表浏览的下拉列表可定制，定制方法是修改sysreveal.ini中相关的配置项。 </li>
<li>+内置启动项和可修复项，用户可按照<a title="SysReveal启动项XML文件说明" href="http://www.sysreveal.com/sysreveal-startup-xml/">SysReveal启动项XML文件说明</a>的格式进行扩展。具体使用方法是在SysReveal.exe所在目录下建立startups.xml用于检测SysReveal缺省以外的启动项以及fixreg.xml用于SysReveal缺省以外的可修复项。 </li>
<li>修改了导出到HTML的模板格式。 </li>
</ol>
<p>驱动修改日志</p>
<ol>
<li>+增加了线程SSDT与原始SSDT的比对 </li>
<li>*修改了SSDT函数在VISTA SP1下显示不正确的问题 </li>
<li>*修改了WINDOW 7下枚举进程模块可能导致CRASH的问题 </li>
<li>*枚举进程模块时过滤非PE文件 </li>
<li>+部分移植到64位操作系统 </li>
</ol>
<p>以下BUG因时间原因暂时还没有修改：</p>
<ol>
<li>SysReveal在只读介质上运行会CRASH （by freesoft00） </li>
<li>… </li>
</ol>
<p>v1.0.0.27 (2010-03-08)&#160; 美好发现，从来不晚</p>
<p>v1.0.0.27是我向最终版本进发过程中一个非常重要的版本，我对代码做了适当的调整，为即将到来的最终版本打下基础，同时增加了启动项检查以及若干实用的功能。以下是更新日志：</p>
<ol>
<li>+增加了启动项扫描以及服务扫描，启动项组织严重参考了经典的Autoruns，服务项支持过滤显示以及诸多常用操作。 <a href="http://www.sysreveal.com/wp-content/uploads/2010/03/image.png" rel="lightbox[48]"><img style="border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2010/03/image_thumb.png" width="244" height="179" /></a> <a href="http://www.sysreveal.com/wp-content/uploads/2010/03/image1.png" rel="lightbox[48]"><img style="border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2010/03/image_thumb1.png" width="244" height="179" /></a> </li>
<li>+在所有窗口增加复制操作，可选中一行或者多行，然后点鼠标右键（或者按Ctrl+C）复制选中行的某列或者所有列的信息到剪贴板。<a href="http://www.sysreveal.com/wp-content/uploads/2010/03/image2.png" rel="lightbox[48]"><img style="border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2010/03/image_thumb2.png" width="244" height="179" /></a> </li>
<li>+工具条可定制（在按钮上按右键） </li>
<li>+增强了搜索文件的选项（感谢来自SysReveal群的云览）<a href="http://www.sysreveal.com/wp-content/uploads/2010/03/image3.png" rel="lightbox[48]"><img style="border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2010/03/image_thumb3.png" width="244" height="190" /></a> </li>
<li>*修正了进程树状视图显示的BUG </li>
<li>*修正了注册表直接输入跳转可能失败的BUG </li>
<li>*修正了文件窗口删除目录时视图不刷新的BUG </li>
</ol>
<p>v1.0.0.21 (2010-02-22)</p>
<p>主要改了几个用户上报的严重BUG，启动项部分会在下个版本加上。顺便说一下关于文件管理里的粉碎功能。 SysReveal的文件粉碎功能是通过调用底层驱动来实现的，如果文件曾经被打开，由于系统缓存的原因，那么很可能文件被粉碎以后，通过notepad或者其他文件查看工具读出来的文件仍然是被粉碎以前的文件，而实际上文件已经被清零了。这时候您可以重启后再看一下，或者用WinHex打开物理磁盘的方式来查看确认。</p>
<p>文件粉碎的主要用途有两个：</p>
<ul>
<li>对于病毒文件，如果病毒文件被病毒的进程或者驱动占用，无法直接访问或者修改文件时，可以强制使用SysReveal进行粉碎，这样保证重启后病毒无法正常启动以达到清除的目的。 </li>
<li>对于用户重要的隐私文件，通过文件粉碎功能来清除文件内容，以防止被恢复而导致泄密。 </li>
</ul>
<p>更新日志：</p>
<ol>
<li>*修改了批量删除文件只能删除一半文件的BUG。 </li>
<li>*修改了注册表在VISTA下打开有问题的BUG。 </li>
<li>*修改了WINDOWS 7下粉碎文件有问题的BUG。 </li>
<li>*修改了API HOOK/DRIVER HOOK比对会导致CRASH的BUG。 </li>
</ol>
<p><a href="http://www.sysreveal.com/sysreveal-1-0-0-20/" target="_blank">v1.0.0.20 (2010-02-08)</a></p>
<ol>
<li>+增加了驱动接口进行进程和线程操作，现在基本不会出现进程打不开的情况了。 </li>
<li>+增加了网络连接查看和管理。 </li>
<li>+增加了进程窗口查看和管理。 </li>
<li>+修改进程视图，缺省为树状视图。 </li>
<li>+绝大多数界面支持多选操作。 </li>
<li>*文件部分支持多选操作，增加文件粉碎功能。目前仍然采用发IRP方式，强度上略有欠缺，解决方法当然是采用NTFS解析，春节前没有时间和精力做了。 </li>
<li>*注册表部分我已经重新设计过了，在实现搜索算法和处理NTREG的UNICODE的问题上花了很多功夫，目前强度上应该没有问题了，当然由于测试不充分，可能还有潜在的BUG。 </li>
<li>*修正了v1.0.0.18 alpha导致Windows Server 2003 BSOD的BUG </li>
<li>*修正了v1.0.0.18 alpha网络界面刷新会CRASH的BUG </li>
</ol>
<p><a href="http://www.sysreveal.com/sysreveal-1-0-0-13/" target="_blank">v1.0.0.13 (2010-01-12)</a></p>
<ol>
<li>* Fix bug: Driver hook symbol is not correct. (Thanks to <a href="http://www.xuetr.com">linxer</a>) </li>
<li>* Fix bug: memory view could not goto certain address </li>
<li>* Fix bug: Display windows hook dialog will cause sysreveal crash under windows 2003 </li>
</ol>
<p><a href="http://www.sysreveal.com/sysreveal-1-0-0-12/" target="_blank">v1.0.0.12 (2010-01-11)</a></p>
<ol>
<li>+ Add IAT hook detection.      <br />Driver hook result comparision between SysReveal and XueTr </li>
<li>* Fix bug: terminate process does not refresh the process dialog </li>
<li>* Fix driver bugs for VISTA SP2 (6200) </li>
</ol>
<p><span style="color: #eeeeee"><a href="http://www.sysreveal.com/sysreveal-1-0-0-11/" target="_blank">v1.0.0.11 (2010-01-08)</a></span></p>
<ol>
<li>+Support loading symbol files for disassemble      <br /><strong><em>Note: SysReveal needs dbghelp.dll (A Microsoft dynamic link library) to enable this feature, if SysReveal could not startup, please download dbghelp <a href="http://www.sysreveal.com/download/dbghelp.zip">here</a> and extract to your SysReveal directory.</em></strong> </li>
<li>+Support asm code modification      <br />Unlock memory first, then press spacebar to modify the asm code. <em><strong><span style="color: #ffff00">Note: it is dangerous to write to memory directly via SysReveal, it might cause process crash, even BSOD, please be careful when proceeding.</span></strong></em> </li>
<li>*Optimize the startup speed </li>
<li>*Minor bugs fix of memory view dialog </li>
</ol>
<p><a href="http://www.sysreveal.com/sysreveal-1-0-0-10/" target="_blank">v1.0.0.10 (2010-01-04)</a></p>
<ol>
<li>+Real time memory editing, both ring 3 memory and ring 0 memory(<strong>Beta!</strong>).<span style="color: #ffff00"> <em><strong>Note: it is dangerous to write to memory directly via SysReveal, it might cause process crash, even BSOD, please be careful when proceeding.</strong></em> </span></li>
<li>*Fix bug: disassmble not correct. (Thanks to <a href="http://bbs.pediy.com/member.php?u=9382">71190838</a> from <a href="http://bbs.pediy.com/">PEDIY</a>) </li>
</ol>
<p><span style="color: #eeeeee"><a href="http://www.sysreveal.com/sysreveal-1-0-0-9/" target="_blank">v1.0.0.9 (2009-12-29)</a></span></p>
<ol>
<li>+Use VAD to detect hidden module </li>
<li>+Add disasm entry code to most of the view </li>
<li>+Add keyboard hook view </li>
<li>*Fix some process view bugs in Windows 7 </li>
<li>*Fix driver bugs in VISTA SP1 </li>
</ol>
<p><a href="http://www.sysreveal.com/sysreveal-1-0-0-8/" target="_blank">v1.0.0.8 (2009-12-24)</a></p>
<ol>
<li>+在大部分窗口增加了数据导出的功能 </li>
<li>+ListCtrl增加了搜索功能(Ctrl+F) </li>
<li>+驱动页面增加了查看完整内核内存的功能 </li>
<li>+驱动页面增加了指定区域转储的功能 </li>
<li>+内存查看窗口二进制视图增加了右键菜单 </li>
<li>+文件页面增加了被占用文件强制复制的功能 </li>
<li>+文件页面增加了简单快捷键（回车键和退格键）。 </li>
<li>+注册表页面增加了查看注册表引用功能 </li>
<li>+驱动增加了文件强制读取的功能 </li>
<li>+增加了英语支持 </li>
<li>*修正了几个可能导致驱动CRASH的问题 </li>
<li>*修正了ListCtrl显示不正确的问题 </li>
<li>*修正了内存查看窗口搜索结果不正确的问题 </li>
<li>*修正了驱动页面刷新导致死循环的问题 </li>
<li>*修正了文件页面右键查看时可能会CRASH的问题 </li>
<li>*修正了状态栏显示不正确的问题 </li>
<li>*修正了驱动文件厂商可能无法显示的问题 </li>
</ol>
<p>v1.0.0.7 (2009-10-16)</p>
<ol>
<li>+增加了文件句柄查询和文件搜索功能 </li>
<li>*修改了广受诟病的文件管理部分 </li>
<li>*修正了枚举文件导致CRASH的问题 </li>
<li>*修改了ListCtrl刷新的问题 </li>
<li>+增加了ListCtrl结果导出到HTML文件的功能 </li>
</ol>
<p>v1.0.0.6 (2009-09-29)</p>
<p>1. 增加了DPC timer,System thread, Flt minifilter, registry callback的枚举。    <br />2. Fix bug: crash when running driver hook detection.</p>
<p>v1.0.0.3 (2009-09-25)</p>
<p>第一个公开发布的版本，尚不稳定，发布于<a href="http://bbs.pediy.com/" target="_blank">看雪论坛</a>。</p>
<p>1. 增加了Ring 0内存的查看，反汇编和转储。    <br />2. 增加了Windows钩子的查看，可自动区分全局钩子和局部钩子。     <br />3. 内核部分修改了部分数据在Windows 7下显示不正常的问题。</p>
<p>开始开发(2009-06-05)</p>
<p>Niucool建立SysReveal工程，开始代码开发。</p>
]]></content:encoded>
			<wfw:commentRss>http://www.sysreveal.com/sysreveal-history/feed/</wfw:commentRss>
		<slash:comments>113</slash:comments>
		</item>
		<item>
		<title>Decrypt mysterious KIS dat files in Windows driver directory</title>
		<link>http://www.sysreveal.com/dec-kis-dat-file/</link>
		<comments>http://www.sysreveal.com/dec-kis-dat-file/#comments</comments>
		<pubDate>Wed, 23 Mar 2011 09:39:42 +0000</pubDate>
		<dc:creator>niucool</dc:creator>
				<category><![CDATA[System Research]]></category>
		<category><![CDATA[dat file]]></category>
		<category><![CDATA[decrypt]]></category>
		<category><![CDATA[Kaspersky]]></category>

		<guid isPermaLink="false">http://www.sysreveal.com/dec-kis-dat-file/</guid>
		<description><![CDATA[If you have Kaspersky Internet Security installed in your PCs or Laptops, Some KIS files will be put in your $(WINDOWS)\System32\Drivers directory. Some of them are obviously kernel driver files with .sys extension, like kl1.sys, kl2.sys etc., there still exist other strange files with .dat extension, like klin.dat, klick.dat, klopp.dat etc. After my research, they [...]]]></description>
			<content:encoded><![CDATA[<p>If you have Kaspersky Internet Security installed in your PCs or Laptops, Some KIS files will be put in your $(WINDOWS)\System32\Drivers directory. Some of them are obviously kernel driver files with .sys extension, like kl1.sys, kl2.sys etc., there still exist other strange files with .dat extension, like klin.dat, klick.dat, klopp.dat etc. <strong><font color="#ffff00">After my research, they are not data files which are used by KIS drivers, they are also driver files but are encypted by Kaspersky!</font></strong> I think the major reason is for security purpose.</p>
<p>After examine the KIS code, I write a simple program to decrypt these dat files, here is the source code.</p>
<p><span id="more-461"></span></p>

<div class="wp_syntax"><table><tr><td class="line_numbers"><pre>1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
</pre></td><td class="code"><pre class="c" style="font-family:monospace;"><span style="color: #666666; font-style: italic;">// dekis.cpp : Defines the entry point for the console application.</span>
<span style="color: #666666; font-style: italic;">//</span>
&nbsp;
<span style="color: #339933;">#include &amp;quot;stdafx.h&amp;quot;</span>
&nbsp;
<span style="color: #339933;">#define KL1_KEY_SIZE    256</span>
<span style="color: #339933;">#define KL1_KEY \
{ \
	0x42, 0xA3, 0x53, 0x04, 0x4D, 0x4B, 0xA3, 0xC4, 0xEC, 0xF8, 0xE5, 0x41, 0x9D, 0xEF, 0xAE, 0x46, \
	0x95, 0x59, 0x7D, 0xF3, 0x98, 0xBD, 0xDC, 0xD4, 0x1F, 0xE9, 0xC1, 0xD9, 0xFB, 0xF1, 0xE9, 0x8D, \
	0x85, 0x0B, 0x7B, 0x14, 0x56, 0x12, 0x33, 0xCC, 0xFD, 0x47, 0x48, 0xF5, 0x0C, 0x4C, 0x24, 0xC2, \
	0x3D, 0x2F, 0xB6, 0xC4, 0x66, 0xD3, 0xDD, 0x73, 0x54, 0xAE, 0xE4, 0x4F, 0xF1, 0x1B, 0x94, 0xFC, \
	0xBC, 0x4E, 0x7C, 0x66, 0xF4, 0x90, 0xCD, 0xA1, 0xA2, 0xF7, 0xB6, 0xDD, 0x83, 0x57, 0x04, 0x7C, \
	0x10, 0x14, 0x20, 0x10, 0xF4, 0x3C, 0x2C, 0x7A, 0x87, 0x30, 0xAB, 0x3C, 0xDE, 0x86, 0x31, 0xCE, \
	0x4D, 0x63, 0xAD, 0xCB, 0xB3, 0x13, 0x94, 0xFA, 0x5B, 0xD5, 0x88, 0x98, 0x06, 0x29, 0xEB, 0xA0, \
	0x20, 0x3A, 0xDB, 0x7A, 0x80, 0xBD, 0x1D, 0x08, 0xC3, 0x05, 0x56, 0xCA, 0x44, 0xA1, 0xAB, 0x3A, \
	0x41, 0x43, 0x6A, 0x2C, 0x64, 0x27, 0x53, 0xCD, 0xE9, 0x09, 0x45, 0x16, 0x46, 0xAF, 0xBE, 0xB8, \
	0x0D, 0x8D, 0xBA, 0x1B, 0xE1, 0xF3, 0xD2, 0x50, 0xAA, 0xD1, 0x3C, 0xCA, 0xEA, 0x8D, 0x10, 0xE5, \
	0x59, 0x2C, 0xA1, 0x21, 0x9B, 0x08, 0xDB, 0x2E, 0x2C, 0x62, 0x6E, 0xFF, 0xB1, 0xEB, 0xAA, 0x2D, \
	0x90, 0xFF, 0x0C, 0x59, 0x7B, 0x3A, 0x08, 0xEC, 0x0A, 0xC9, 0xC3, 0x4C, 0x63, 0x4F, 0x73, 0xC1, \
	0xC8, 0x4E, 0xA5, 0x9C, 0xB0, 0xEE, 0xF4, 0xEE, 0x4D, 0x93, 0x13, 0x67, 0x9E, 0x3D, 0x4D, 0xA6, \
	0x01, 0x5F, 0x1F, 0x61, 0x8F, 0x9E, 0x57, 0xAC, 0x44, 0xB5, 0xFB, 0x40, 0x1E, 0xFC, 0x00, 0xAE, \
	0xDA, 0x36, 0xEA, 0x49, 0x64, 0x05, 0x1A, 0x1B, 0x4E, 0xD4, 0x29, 0x4D, 0xBB, 0x81, 0x7D, 0x6B, \
	0xC4, 0xF2, 0x39, 0x98, 0xC9, 0x2F, 0xB7, 0xCB, 0xBD, 0x6D, 0xFC, 0x3E, 0xC9, 0x3E, 0x20, 0xAB, \
}</span>
&nbsp;
<span style="color: #993333;">int</span> dec_kis_file<span style="color: #009900;">&#40;</span>LPCTSTR infile<span style="color: #339933;">,</span> LPCTSTR outfile<span style="color: #009900;">&#41;</span>
<span style="color: #009900;">&#123;</span>
	FILE <span style="color: #339933;">*</span>fin <span style="color: #339933;">=</span> _tfopen<span style="color: #009900;">&#40;</span>infile<span style="color: #339933;">,</span> _T<span style="color: #009900;">&#40;</span><span style="color: #339933;">&amp;</span>quot<span style="color: #339933;">;</span>rb<span style="color: #339933;">&amp;</span>quot<span style="color: #339933;">;</span><span style="color: #009900;">&#41;</span><span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span>
	<span style="color: #b1b100;">if</span><span style="color: #009900;">&#40;</span><span style="color: #339933;">!</span>fin<span style="color: #009900;">&#41;</span>
		<span style="color: #b1b100;">return</span> <span style="color: #339933;">-</span><span style="color: #0000dd;">1</span><span style="color: #339933;">;</span>
	FILE <span style="color: #339933;">*</span>fout <span style="color: #339933;">=</span> _tfopen<span style="color: #009900;">&#40;</span>outfile<span style="color: #339933;">,</span> _T<span style="color: #009900;">&#40;</span><span style="color: #339933;">&amp;</span>quot<span style="color: #339933;">;</span>wb<span style="color: #339933;">&amp;</span>quot<span style="color: #339933;">;</span><span style="color: #009900;">&#41;</span><span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span>
	<span style="color: #b1b100;">if</span><span style="color: #009900;">&#40;</span><span style="color: #339933;">!</span>fout<span style="color: #009900;">&#41;</span>
	<span style="color: #009900;">&#123;</span>
		fclose<span style="color: #009900;">&#40;</span>fin<span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span>
		<span style="color: #b1b100;">return</span> <span style="color: #339933;">-</span><span style="color: #0000dd;">1</span><span style="color: #339933;">;</span>
	<span style="color: #009900;">&#125;</span>
&nbsp;
	fseek<span style="color: #009900;">&#40;</span>fin<span style="color: #339933;">,</span> <span style="color: #0000dd;">0</span><span style="color: #339933;">,</span> SEEK_END<span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span>
	size_t FileSize <span style="color: #339933;">=</span> ftell<span style="color: #009900;">&#40;</span>fin<span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span>
	<span style="color: #993333;">void</span> <span style="color: #339933;">*</span>pin <span style="color: #339933;">=</span> malloc<span style="color: #009900;">&#40;</span>FileSize<span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span>
	<span style="color: #666666; font-style: italic;">//void *pout = malloc(FileSize);</span>
	fseek<span style="color: #009900;">&#40;</span>fin<span style="color: #339933;">,</span> <span style="color: #0000dd;">0</span><span style="color: #339933;">,</span> SEEK_SET<span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span>
	fread<span style="color: #009900;">&#40;</span>pin<span style="color: #339933;">,</span> <span style="color: #0000dd;">1</span><span style="color: #339933;">,</span> FileSize<span style="color: #339933;">,</span> fin<span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span>
&nbsp;
	<span style="color: #666666; font-style: italic;">// unXOR loaded file</span>
	<span style="color: #993333;">static</span> <span style="color: #993333;">unsigned</span> <span style="color: #993333;">char</span> KL1Key<span style="color: #009900;">&#91;</span><span style="color: #009900;">&#93;</span> <span style="color: #339933;">=</span> KL1_KEY<span style="color: #339933;">;</span>
	<span style="color: #b1b100;">for</span> <span style="color: #009900;">&#40;</span><span style="color: #993333;">unsigned</span> <span style="color: #993333;">long</span> i <span style="color: #339933;">=</span> <span style="color: #0000dd;">0</span><span style="color: #339933;">;</span> i <span style="color: #339933;">&amp;</span>lt<span style="color: #339933;">;</span> FileSize<span style="color: #339933;">;</span> <span style="color: #339933;">++</span>i<span style="color: #009900;">&#41;</span>
	<span style="color: #009900;">&#123;</span>
		<span style="color: #009900;">&#40;</span><span style="color: #009900;">&#40;</span><span style="color: #993333;">char</span><span style="color: #339933;">*</span><span style="color: #009900;">&#41;</span>pin<span style="color: #009900;">&#41;</span><span style="color: #009900;">&#91;</span>i<span style="color: #009900;">&#93;</span> <span style="color: #339933;">^=</span> KL1Key<span style="color: #009900;">&#91;</span>i <span style="color: #339933;">%</span> KL1_KEY_SIZE<span style="color: #009900;">&#93;</span><span style="color: #339933;">;</span>
	<span style="color: #009900;">&#125;</span>
&nbsp;
	fwrite<span style="color: #009900;">&#40;</span>pin<span style="color: #339933;">,</span> <span style="color: #0000dd;">1</span><span style="color: #339933;">,</span> FileSize<span style="color: #339933;">,</span> fout<span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span>
&nbsp;
	free<span style="color: #009900;">&#40;</span>pin<span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span>
	fclose<span style="color: #009900;">&#40;</span>fin<span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span>
	fclose<span style="color: #009900;">&#40;</span>fout<span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span>
&nbsp;
	<span style="color: #b1b100;">return</span> <span style="color: #0000dd;">0</span><span style="color: #339933;">;</span>
<span style="color: #009900;">&#125;</span>
&nbsp;
&nbsp;
<span style="color: #993333;">int</span> _tmain<span style="color: #009900;">&#40;</span><span style="color: #993333;">int</span> argc<span style="color: #339933;">,</span> _TCHAR<span style="color: #339933;">*</span> argv<span style="color: #009900;">&#91;</span><span style="color: #009900;">&#93;</span><span style="color: #009900;">&#41;</span>
<span style="color: #009900;">&#123;</span>
	<span style="color: #b1b100;">if</span><span style="color: #009900;">&#40;</span>argc <span style="color: #339933;">!=</span> <span style="color: #0000dd;">3</span><span style="color: #009900;">&#41;</span>
	<span style="color: #009900;">&#123;</span>
		<span style="color: #000066;">printf</span><span style="color: #009900;">&#40;</span><span style="color: #339933;">&amp;</span>quot<span style="color: #339933;">;</span>Usage<span style="color: #339933;">:</span> deckis <span style="color: #009900;">&#91;</span>encrypted kis file<span style="color: #009900;">&#93;</span> <span style="color: #009900;">&#91;</span>file to decrypt<span style="color: #009900;">&#93;</span>\r\n<span style="color: #339933;">&amp;</span>quot<span style="color: #339933;">;</span><span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span>
		<span style="color: #b1b100;">return</span> <span style="color: #0000dd;">0</span><span style="color: #339933;">;</span>
	<span style="color: #009900;">&#125;</span>
	dec_kis_file<span style="color: #009900;">&#40;</span>argv<span style="color: #009900;">&#91;</span><span style="color: #0000dd;">1</span><span style="color: #009900;">&#93;</span><span style="color: #339933;">,</span> argv<span style="color: #009900;">&#91;</span><span style="color: #0000dd;">2</span><span style="color: #009900;">&#93;</span><span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span>
	<span style="color: #b1b100;">return</span> <span style="color: #0000dd;">0</span><span style="color: #339933;">;</span>
<span style="color: #009900;">&#125;</span></pre></td></tr></table></div>

<p>You could also download the executable file <a href="http://www.sysreveal.com/uploads/dekis.zip">here</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.sysreveal.com/dec-kis-dat-file/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Steps to translate KIS code</title>
		<link>http://www.sysreveal.com/ktrans-for-kis/</link>
		<comments>http://www.sysreveal.com/ktrans-for-kis/#comments</comments>
		<pubDate>Fri, 04 Mar 2011 10:30:03 +0000</pubDate>
		<dc:creator>niucool</dc:creator>
				<category><![CDATA[System Research]]></category>
		<category><![CDATA[comments]]></category>
		<category><![CDATA[Kaspersky]]></category>
		<category><![CDATA[source code]]></category>
		<category><![CDATA[translate]]></category>
		<category><![CDATA[代码]]></category>
		<category><![CDATA[卡巴斯基]]></category>
		<category><![CDATA[注释]]></category>
		<category><![CDATA[翻译]]></category>

		<guid isPermaLink="false">http://www.sysreveal.com/ktrans-for-kis/</guid>
		<description><![CDATA[Here is my steps to translate the code: Please make sure that you have install ActivePython in your computer first. Download google-api-python-client Modify code $(google-api-python-client)\apiclient\model.py,comment line 132 129 130 131 132 133 for key, value in params.iteritems&#40;&#41;: if type&#40;value&#41; == type&#40;&#91;&#93;&#41;: for x in value: x = x.encode&#40;'utf-8'&#41; astuples.append&#40;&#40;key, x&#41;&#41; Change to: 129 130 131 [...]]]></description>
			<content:encoded><![CDATA[<p>Here is my steps to translate the code:</p>
<p>Please make sure that you have install <a href="www.activestate.com/activepython" target="_blank">ActivePython</a> in your computer first.</p>
<ol>
<li>Download <a href="http://code.google.com/p/google-api-python-client/" target="_blank">google-api-python-client</a> </li>
<li>
<p>Modify code $(google-api-python-client)\apiclient\model.py,comment line 132</p>

<div class="wp_syntax"><table><tr><td class="line_numbers"><pre>129
130
131
132
133
</pre></td><td class="code"><pre class="python" style="font-family:monospace;">    <span style="color: #ff7700;font-weight:bold;">for</span> key, value <span style="color: #ff7700;font-weight:bold;">in</span> params.<span style="color: black;">iteritems</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>:
      <span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: #008000;">type</span><span style="color: black;">&#40;</span>value<span style="color: black;">&#41;</span> == <span style="color: #008000;">type</span><span style="color: black;">&#40;</span><span style="color: black;">&#91;</span><span style="color: black;">&#93;</span><span style="color: black;">&#41;</span>:
        <span style="color: #ff7700;font-weight:bold;">for</span> x <span style="color: #ff7700;font-weight:bold;">in</span> value:
          x = x.<span style="color: black;">encode</span><span style="color: black;">&#40;</span><span style="color: #483d8b;">'utf-8'</span><span style="color: black;">&#41;</span>
          astuples.<span style="color: black;">append</span><span style="color: black;">&#40;</span><span style="color: black;">&#40;</span>key, x<span style="color: black;">&#41;</span><span style="color: black;">&#41;</span></pre></td></tr></table></div>

<p>Change to:</p>

<div class="wp_syntax"><table><tr><td class="line_numbers"><pre>129
130
131
132
133
134
</pre></td><td class="code"><pre class="python" style="font-family:monospace;">    <span style="color: #ff7700;font-weight:bold;">for</span> key, value <span style="color: #ff7700;font-weight:bold;">in</span> params.<span style="color: black;">iteritems</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>:
      <span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: #008000;">type</span><span style="color: black;">&#40;</span>value<span style="color: black;">&#41;</span> == <span style="color: #008000;">type</span><span style="color: black;">&#40;</span><span style="color: black;">&#91;</span><span style="color: black;">&#93;</span><span style="color: black;">&#41;</span>:
        <span style="color: #ff7700;font-weight:bold;">for</span> x <span style="color: #ff7700;font-weight:bold;">in</span> value:
<span style="color: #808080; font-style: italic;">#Jim: User must encode himself</span>
<span style="color: #808080; font-style: italic;">#          x = x.encode('utf-8')</span>
          astuples.<span style="color: black;">append</span><span style="color: black;">&#40;</span><span style="color: black;">&#40;</span>key, x<span style="color: black;">&#41;</span><span style="color: black;">&#41;</span></pre></td></tr></table></div>

</li>
<li>Install google api python client </li>
<li>Download my script ktrans.py: <a href="http://www.sysreveal.com/uploads/ktrans.zip" target="_blank">ktrans.zip</a> </li>
<li>Start a command line window, and run ktrans.py by:<br />
    <br />ktrans.py &lt;path to your KIS code&gt; </li>
</ol>
<p>Notice:</p>
<ul>
<li><font color="#ffff00">Please change the google api key to your own key before run the script.</font>

<div class="wp_syntax"><table><tr><td class="line_numbers"><pre>52
</pre></td><td class="code"><pre class="python" style="font-family:monospace;">p = build<span style="color: black;">&#40;</span><span style="color: #483d8b;">'translate'</span>, <span style="color: #483d8b;">'v2'</span>, developerKey=<span style="color: #483d8b;">'AIzaSyD9K3qrSzFaJsU2mAPUPDsnZDueTTzDwXk'</span><span style="color: black;">&#41;</span></pre></td></tr></table></div>

</li>
<li>Due to the limitation of google translation api, only 10,000 words could be translated per day. ktrans.py will throw an exception when it could not translate the code, so please copy the path of the file, and modify ktrans.py line 29 and 30:

<div class="wp_syntax"><table><tr><td class="line_numbers"><pre>26
27
28
29
30
</pre></td><td class="code"><pre class="python" style="font-family:monospace;"><span style="color: #808080; font-style: italic;">#Set ResumeTask=False and StartFile='file to be the first of being translated'</span>
<span style="color: #808080; font-style: italic;">#to resume the last section</span>
<span style="color: #808080; font-style: italic;">#If ResumeTask == True, StartFile is ignored.</span>
ResumeTask = <span style="color: #008000;">True</span>
StartFile = r<span style="color: #483d8b;">'d:<span style="color: #000099; font-weight: bold;">\s</span>vn<span style="color: #000099; font-weight: bold;">\k</span>av8<span style="color: #000099; font-weight: bold;">\c</span>s adminkit<span style="color: #000099; font-weight: bold;">\d</span>evelopment2<span style="color: #000099; font-weight: bold;">\i</span>nclude<span style="color: #000099; font-weight: bold;">\b</span>uild<span style="color: #000099; font-weight: bold;">\k</span>lcsc.h'</span></pre></td></tr></table></div>

</li>
</ul>
<p><span id="more-438"></span>
<p>Full source code of ktrans.py v1.0</p>

<div class="wp_syntax"><table><tr><td class="line_numbers"><pre>1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
</pre></td><td class="code"><pre class="python" style="font-family:monospace;"><span style="color: #808080; font-style: italic;"># Copyright 2011 SysReveal. All Rights Reserved.</span>
<span style="color: #808080; font-style: italic;">#</span>
<span style="color: #808080; font-style: italic;"># Licensed under the Apache License, Version 2.0 (the &quot;License&quot;);</span>
<span style="color: #808080; font-style: italic;"># you may not use this file except in compliance with the License.</span>
<span style="color: #808080; font-style: italic;"># You may obtain a copy of the License at</span>
<span style="color: #808080; font-style: italic;">#</span>
<span style="color: #808080; font-style: italic;">#      http://www.apache.org/licenses/LICENSE-2.0</span>
<span style="color: #808080; font-style: italic;">#</span>
<span style="color: #808080; font-style: italic;"># Unless required by applicable law or agreed to in writing, software</span>
<span style="color: #808080; font-style: italic;"># distributed under the License is distributed on an &quot;AS IS&quot; BASIS,</span>
<span style="color: #808080; font-style: italic;"># WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.</span>
<span style="color: #808080; font-style: italic;"># See the License for the specific language governing permissions and</span>
<span style="color: #808080; font-style: italic;"># limitations under the License.</span>
&nbsp;
__author__ = <span style="color: #483d8b;">'epocsoft@gmail.com'</span>
&nbsp;
<span style="color: #ff7700;font-weight:bold;">from</span> apiclient.<span style="color: black;">discovery</span> <span style="color: #ff7700;font-weight:bold;">import</span> build
&nbsp;
<span style="color: #ff7700;font-weight:bold;">import</span> <span style="color: #dc143c;">sys</span>, <span style="color: #dc143c;">fnmatch</span>
<span style="color: #ff7700;font-weight:bold;">import</span> <span style="color: #dc143c;">os</span>
<span style="color: #ff7700;font-weight:bold;">import</span> win32con, win32api
<span style="color: #ff7700;font-weight:bold;">import</span> <span style="color: #dc143c;">re</span>
<span style="color: #ff7700;font-weight:bold;">import</span> <span style="color: #dc143c;">pprint</span>
<span style="color: #ff7700;font-weight:bold;">import</span> httplib2
&nbsp;
<span style="color: #808080; font-style: italic;">#Set ResumeTask=False and StartFile='file to be the first of being translated'</span>
<span style="color: #808080; font-style: italic;">#to resume the last section</span>
<span style="color: #808080; font-style: italic;">#If ResumeTask == True, StartFile is ignored.</span>
ResumeTask = <span style="color: #008000;">True</span>
StartFile = r<span style="color: #483d8b;">'d:<span style="color: #000099; font-weight: bold;">\s</span>vn<span style="color: #000099; font-weight: bold;">\k</span>av8<span style="color: #000099; font-weight: bold;">\c</span>s adminkit<span style="color: #000099; font-weight: bold;">\d</span>evelopment2<span style="color: #000099; font-weight: bold;">\i</span>nclude<span style="color: #000099; font-weight: bold;">\b</span>uild<span style="color: #000099; font-weight: bold;">\k</span>lcsc.h'</span>
&nbsp;
<span style="color: #808080; font-style: italic;"># Uncomment the next line to get very detailed logging</span>
<span style="color: #808080; font-style: italic;">#httplib2.debuglevel = 0</span>
&nbsp;
<span style="color: #ff7700;font-weight:bold;">def</span> is_ascii<span style="color: black;">&#40;</span>s<span style="color: black;">&#41;</span>:
	<span style="color: #ff7700;font-weight:bold;">return</span> <span style="color: #008000;">all</span><span style="color: black;">&#40;</span><span style="color: #008000;">ord</span><span style="color: black;">&#40;</span>c<span style="color: black;">&#41;</span> <span style="color: #66cc66;">&lt;</span> <span style="color: #ff4500;">128</span> <span style="color: #ff7700;font-weight:bold;">for</span> c <span style="color: #ff7700;font-weight:bold;">in</span> s<span style="color: black;">&#41;</span>
&nbsp;
<span style="color: #ff7700;font-weight:bold;">def</span> translate<span style="color: black;">&#40;</span>s<span style="color: black;">&#41;</span>:
	<span style="color: #ff7700;font-weight:bold;">if</span> is_ascii<span style="color: black;">&#40;</span>s<span style="color: black;">&#41;</span>:
		<span style="color: #808080; font-style: italic;">#print 'skip '+ s</span>
		<span style="color: #ff7700;font-weight:bold;">return</span> s
	copyright = <span style="color: #483d8b;">' '</span> + <span style="color: #008000;">chr</span><span style="color: black;">&#40;</span>0xa9<span style="color: black;">&#41;</span> + <span style="color: #483d8b;">' '</span>
	<span style="color: #ff7700;font-weight:bold;">if</span> s.<span style="color: black;">find</span><span style="color: black;">&#40;</span>copyright<span style="color: black;">&#41;</span> <span style="color: #66cc66;">&gt;</span>= <span style="color: #ff4500;">0</span>:
		s = s.<span style="color: black;">replace</span><span style="color: black;">&#40;</span>copyright, <span style="color: #483d8b;">' (c) '</span><span style="color: black;">&#41;</span>
		<span style="color: #ff7700;font-weight:bold;">if</span> is_ascii<span style="color: black;">&#40;</span>s<span style="color: black;">&#41;</span>:
			<span style="color: #ff7700;font-weight:bold;">return</span> s
	bak = s
	<span style="color: #ff7700;font-weight:bold;">try</span>:
		s = s.<span style="color: black;">decode</span><span style="color: black;">&#40;</span><span style="color: #483d8b;">'cp1251'</span><span style="color: black;">&#41;</span>
		s = s.<span style="color: black;">encode</span><span style="color: black;">&#40;</span><span style="color: #483d8b;">'utf-8'</span><span style="color: black;">&#41;</span>
		<span style="color: #808080; font-style: italic;"># you should replace this key with your own!!!</span>
		p = build<span style="color: black;">&#40;</span><span style="color: #483d8b;">'translate'</span>, <span style="color: #483d8b;">'v2'</span>, developerKey=<span style="color: #483d8b;">'AIzaSyD9K3qrSzFaJsU2mAPUPDsnZDueTTzDwXk'</span><span style="color: black;">&#41;</span>
		content = p.<span style="color: black;">translations</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>.<span style="color: #008000;">list</span><span style="color: black;">&#40;</span>
			source=<span style="color: #483d8b;">'ru'</span>,
			target=<span style="color: #483d8b;">'en'</span>,
			q=<span style="color: black;">&#91;</span>s<span style="color: black;">&#93;</span>
		  <span style="color: black;">&#41;</span>.<span style="color: black;">execute</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>
&nbsp;
		s = content<span style="color: black;">&#91;</span><span style="color: #483d8b;">'translations'</span><span style="color: black;">&#93;</span><span style="color: black;">&#91;</span><span style="color: #ff4500;">0</span><span style="color: black;">&#93;</span><span style="color: black;">&#91;</span><span style="color: #483d8b;">'translatedText'</span><span style="color: black;">&#93;</span>
		<span style="color: #808080; font-style: italic;">#print s</span>
		<span style="color: #ff7700;font-weight:bold;">return</span> s
	<span style="color: #ff7700;font-weight:bold;">except</span>:
		<span style="color: #ff7700;font-weight:bold;">print</span> <span style="color: #483d8b;">&quot;Exception!!!&quot;</span>
		<span style="color: #ff7700;font-weight:bold;">return</span> bak
&nbsp;
<span style="color: #ff7700;font-weight:bold;">def</span> replacer<span style="color: black;">&#40;</span>match<span style="color: black;">&#41;</span>:
	s = match.<span style="color: black;">group</span><span style="color: black;">&#40;</span><span style="color: #ff4500;">0</span><span style="color: black;">&#41;</span>
	<span style="color: #ff7700;font-weight:bold;">if</span> s.<span style="color: black;">startswith</span><span style="color: black;">&#40;</span><span style="color: #483d8b;">'//'</span><span style="color: black;">&#41;</span>:
		s = translate<span style="color: black;">&#40;</span>s<span style="color: black;">&#91;</span><span style="color: #ff4500;">2</span>:<span style="color: black;">&#93;</span><span style="color: black;">&#41;</span>
		s = <span style="color: #483d8b;">'//'</span> + s
	<span style="color: #ff7700;font-weight:bold;">elif</span> s.<span style="color: black;">startswith</span><span style="color: black;">&#40;</span><span style="color: #483d8b;">'/*'</span><span style="color: black;">&#41;</span>:
		slist = s<span style="color: black;">&#91;</span><span style="color: #ff4500;">2</span>:-<span style="color: #ff4500;">2</span><span style="color: black;">&#93;</span>.<span style="color: black;">split</span><span style="color: black;">&#40;</span><span style="color: #483d8b;">'<span style="color: #000099; font-weight: bold;">\n</span>'</span><span style="color: black;">&#41;</span>
		ts = <span style="color: #483d8b;">'/*'</span>
		<span style="color: #ff7700;font-weight:bold;">for</span> line <span style="color: #ff7700;font-weight:bold;">in</span> slist:
			ts = ts + translate<span style="color: black;">&#40;</span>line<span style="color: black;">&#41;</span> + <span style="color: #483d8b;">'<span style="color: #000099; font-weight: bold;">\n</span>'</span>
		s = ts + <span style="color: #483d8b;">'*/'</span>
	<span style="color: #ff7700;font-weight:bold;">return</span> s
&nbsp;
<span style="color: #ff7700;font-weight:bold;">def</span> convertfile<span style="color: black;">&#40;</span>destfile, srcfile<span style="color: black;">&#41;</span>:
	pattern = <span style="color: #dc143c;">re</span>.<span style="color: #008000;">compile</span><span style="color: black;">&#40;</span> r<span style="color: #483d8b;">'//.*?$|/<span style="color: #000099; font-weight: bold;">\*</span>.*?<span style="color: #000099; font-weight: bold;">\*</span>/|<span style="color: #000099; font-weight: bold;">\'</span>(?:<span style="color: #000099; font-weight: bold;">\\</span>.|[^<span style="color: #000099; font-weight: bold;">\\</span><span style="color: #000099; font-weight: bold;">\'</span>])*<span style="color: #000099; font-weight: bold;">\'</span>|&quot;(?:<span style="color: #000099; font-weight: bold;">\\</span>.|[^<span style="color: #000099; font-weight: bold;">\\</span>&quot;])*&quot;'</span>, <span style="color: #dc143c;">re</span>.<span style="color: black;">DOTALL</span> | <span style="color: #dc143c;">re</span>.<span style="color: black;">MULTILINE</span><span style="color: black;">&#41;</span>
	f = <span style="color: #008000;">open</span><span style="color: black;">&#40;</span>srcfile, <span style="color: #483d8b;">&quot;r+&quot;</span><span style="color: black;">&#41;</span>
	text = f.<span style="color: black;">read</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>
<span style="color: #808080; font-style: italic;">#	print text</span>
	<span style="color: #ff7700;font-weight:bold;">try</span>:
		text = <span style="color: #dc143c;">re</span>.<span style="color: black;">sub</span><span style="color: black;">&#40;</span>pattern, replacer, text<span style="color: black;">&#41;</span>
		f.<span style="color: black;">seek</span><span style="color: black;">&#40;</span><span style="color: #ff4500;">0</span><span style="color: black;">&#41;</span>
		f.<span style="color: black;">write</span><span style="color: black;">&#40;</span>text.<span style="color: black;">encode</span><span style="color: black;">&#40;</span><span style="color: #483d8b;">&quot;utf-8&quot;</span><span style="color: black;">&#41;</span><span style="color: black;">&#41;</span>
		f.<span style="color: black;">truncate</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>
		f.<span style="color: black;">close</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>
		<span style="color: #ff7700;font-weight:bold;">return</span> <span style="color: #008000;">True</span>
	<span style="color: #ff7700;font-weight:bold;">except</span>:
		<span style="color: #ff7700;font-weight:bold;">print</span> <span style="color: #483d8b;">'error translate: '</span>+ srcfile
		f.<span style="color: black;">close</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>
		<span style="color: #ff7700;font-weight:bold;">return</span> <span style="color: #008000;">False</span>
<span style="color: #808080; font-style: italic;">#	print text</span>
<span style="color: #808080; font-style: italic;">#	f = open(destfile, &quot;w&quot;)</span>
<span style="color: #808080; font-style: italic;">#	f.write(text)</span>
<span style="color: #808080; font-style: italic;">#	f.close()</span>
&nbsp;
<span style="color: #ff7700;font-weight:bold;">def</span> walk<span style="color: black;">&#40;</span>path<span style="color: black;">&#41;</span>:
	<span style="color: #ff7700;font-weight:bold;">global</span> ResumeTask
	<span style="color: #ff7700;font-weight:bold;">global</span> StartFile
&nbsp;
	<span style="color: #ff7700;font-weight:bold;">for</span> root, dirs, files <span style="color: #ff7700;font-weight:bold;">in</span> <span style="color: #dc143c;">os</span>.<span style="color: black;">walk</span><span style="color: black;">&#40;</span>path<span style="color: black;">&#41;</span>:
		<span style="color: #ff7700;font-weight:bold;">for</span> name <span style="color: #ff7700;font-weight:bold;">in</span> files:
			<span style="color: #ff7700;font-weight:bold;">if</span> name.<span style="color: black;">endswith</span><span style="color: black;">&#40;</span><span style="color: #483d8b;">'.h'</span><span style="color: black;">&#41;</span> <span style="color: #ff7700;font-weight:bold;">or</span> name.<span style="color: black;">endswith</span><span style="color: black;">&#40;</span><span style="color: #483d8b;">'.c'</span><span style="color: black;">&#41;</span> <span style="color: #ff7700;font-weight:bold;">or</span> name.<span style="color: black;">endswith</span><span style="color: black;">&#40;</span><span style="color: #483d8b;">'.cpp'</span><span style="color: black;">&#41;</span>:
				fname = <span style="color: #dc143c;">os</span>.<span style="color: black;">path</span>.<span style="color: black;">join</span><span style="color: black;">&#40;</span>root, name<span style="color: black;">&#41;</span>
				<span style="color: #ff7700;font-weight:bold;">print</span> fname
				<span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: #008000;">cmp</span><span style="color: black;">&#40;</span>StartFile, fname.<span style="color: black;">lower</span><span style="color: black;">&#40;</span><span style="color: black;">&#41;</span><span style="color: black;">&#41;</span> == <span style="color: #ff4500;">0</span>:
					ResumeTask = <span style="color: #008000;">True</span>
				<span style="color: #ff7700;font-weight:bold;">if</span> ResumeTask:
          win32api.<span style="color: black;">SetFileAttributes</span><span style="color: black;">&#40;</span>fname, win32con.<span style="color: black;">FILE_ATTRIBUTE_NORMAL</span><span style="color: black;">&#41;</span>
          convertfile<span style="color: black;">&#40;</span>fname, fname<span style="color: black;">&#41;</span>
&nbsp;
<span style="color: #808080; font-style: italic;"># Main function, run when invoked as a stand-alone Python program.</span>
<span style="color: #ff7700;font-weight:bold;">def</span> main<span style="color: black;">&#40;</span><span style="color: black;">&#41;</span>:
	<span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: #008000;">len</span><span style="color: black;">&#40;</span><span style="color: #dc143c;">sys</span>.<span style="color: black;">argv</span><span style="color: black;">&#41;</span> <span style="color: #66cc66;">!</span>= <span style="color: #ff4500;">2</span>:
		<span style="color: #ff7700;font-weight:bold;">print</span> <span style="color: #483d8b;">'Usage: ktrans &lt;path to kav&gt;'</span>
		<span style="color: #ff7700;font-weight:bold;">return</span>
	<span style="color: #ff7700;font-weight:bold;">if</span> <span style="color: #ff7700;font-weight:bold;">not</span> <span style="color: #dc143c;">os</span>.<span style="color: black;">path</span>.<span style="color: black;">isdir</span><span style="color: black;">&#40;</span><span style="color: #dc143c;">sys</span>.<span style="color: black;">argv</span><span style="color: black;">&#91;</span><span style="color: #ff4500;">1</span><span style="color: black;">&#93;</span><span style="color: black;">&#41;</span>:
		<span style="color: #ff7700;font-weight:bold;">print</span> <span style="color: #dc143c;">sys</span>.<span style="color: black;">argv</span><span style="color: black;">&#91;</span><span style="color: #ff4500;">1</span><span style="color: black;">&#93;</span>+<span style="color: #483d8b;">' is not a path!'</span>
		<span style="color: #ff7700;font-weight:bold;">return</span>
	path = <span style="color: #dc143c;">sys</span>.<span style="color: black;">argv</span><span style="color: black;">&#91;</span><span style="color: #ff4500;">1</span><span style="color: black;">&#93;</span>
	walk<span style="color: black;">&#40;</span>path<span style="color: black;">&#41;</span>
&nbsp;
<span style="color: #ff7700;font-weight:bold;">if</span> __name__ == <span style="color: #483d8b;">'__main__'</span>:
		main<span style="color: black;">&#40;</span><span style="color: black;">&#41;</span></pre></td></tr></table></div>

]]></content:encoded>
			<wfw:commentRss>http://www.sysreveal.com/ktrans-for-kis/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Translate the comment of KIS source code</title>
		<link>http://www.sysreveal.com/translate-comment-of-kis-source-code/</link>
		<comments>http://www.sysreveal.com/translate-comment-of-kis-source-code/#comments</comments>
		<pubDate>Wed, 23 Feb 2011 14:40:52 +0000</pubDate>
		<dc:creator>niucool</dc:creator>
				<category><![CDATA[System Research]]></category>
		<category><![CDATA[comments]]></category>
		<category><![CDATA[Kaspersky]]></category>
		<category><![CDATA[source code]]></category>
		<category><![CDATA[translate]]></category>
		<category><![CDATA[代码]]></category>
		<category><![CDATA[卡巴斯基]]></category>
		<category><![CDATA[注释]]></category>
		<category><![CDATA[翻译]]></category>

		<guid isPermaLink="false">http://www.sysreveal.com/translate-comment-of-kis-source-code/</guid>
		<description><![CDATA[As we all know, comments are very important for us to understand the source code. If you get a copy of KIS source code, you might be confused since most of comments are written in Russian. I spent a whole afternoon to write a tool to translate comments of KIS source code files from Russian [...]]]></description>
			<content:encoded><![CDATA[<p>As we all know, comments are very important for us to understand the source code. If you get a copy of KIS source code, you might be confused since most of comments are written in Russian. I spent a whole afternoon to write a tool to translate comments of KIS source code files from Russian to English, including all *.h, *.c and *.cpp files.</p>
<p>For example:</p>
<p>$(KAV8)\include\CKAH\ckahdefs.h</p>
<p>Original file:</p>
<p><img style="background-image: none; border-bottom: 0px; border-left: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top: 0px; border-right: 0px; padding-top: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2011/02/image3.png" width="564" height="341" /></p>
<p>Translated file:</p>
<p><img style="background-image: none; border-bottom: 0px; border-left: 0px; padding-left: 0px; padding-right: 0px; display: inline; border-top: 0px; border-right: 0px; padding-top: 0px" title="image" border="0" alt="image" src="http://www.sysreveal.com/wp-content/uploads/2011/02/image4.png" width="564" height="341" /></p>
<p>  <span id="more-434"></span>
<p>I use awesome Python and <a href="http://code.google.com/apis/language/translate/v2/getting_started.html" target="_blank">Google Translate API</a> to perform this task. Since I’m not a Python master, I wrote all the code in two hours, and spent three more hours for debugging and enhancing. </p>
<p>Further steps will be provided later.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.sysreveal.com/translate-comment-of-kis-source-code/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
	</channel>
</rss>

