Tag: Kaspersky
Decrypt mysterious KIS dat files in Windows driver directory
by niucool on Mar.23, 2011, under System Research
If you have Kaspersky Internet Security installed in your PCs or Laptops, Some KIS files will be put in your $(WINDOWS)\System32\Drivers directory. Some of them are obviously kernel driver files with .sys extension, like kl1.sys, kl2.sys etc., there still exist other strange files with .dat extension, like klin.dat, klick.dat, klopp.dat etc. After my research, they are not data files which are used by KIS drivers, they are also driver files but are encypted by Kaspersky! I think the major reason is for security purpose.
After examine the KIS code, I write a simple program to decrypt these dat files, here is the source code.
Steps to translate KIS code
by niucool on Mar.04, 2011, under System Research
Here is my steps to translate the code:
Please make sure that you have install ActivePython in your computer first.
- Download google-api-python-client
-
Modify code $(google-api-python-client)\apiclient\model.py,comment line 132
129 130 131 132 133
for key, value in params.iteritems(): if type(value) == type([]): for x in value: x = x.encode('utf-8') astuples.append((key, x))
Change to:
129 130 131 132 133 134
for key, value in params.iteritems(): if type(value) == type([]): for x in value: #Jim: User must encode himself # x = x.encode('utf-8') astuples.append((key, x))
- Install google api python client
- Download my script ktrans.py: ktrans.zip
- Start a command line window, and run ktrans.py by:
ktrans.py <path to your KIS code>
Notice:
- Please change the google api key to your own key before run the script.
52
p = build('translate', 'v2', developerKey='AIzaSyD9K3qrSzFaJsU2mAPUPDsnZDueTTzDwXk')
- Due to the limitation of google translation api, only 10,000 words could be translated per day. ktrans.py will throw an exception when it could not translate the code, so please copy the path of the file, and modify ktrans.py line 29 and 30:
26 27 28 29 30
#Set ResumeTask=False and StartFile='file to be the first of being translated' #to resume the last section #If ResumeTask == True, StartFile is ignored. ResumeTask = True StartFile = r'd:\svn\kav8\cs adminkit\development2\include\build\klcsc.h'
Translate the comment of KIS source code
by niucool on Feb.23, 2011, under System Research
As we all know, comments are very important for us to understand the source code. If you get a copy of KIS source code, you might be confused since most of comments are written in Russian. I spent a whole afternoon to write a tool to translate comments of KIS source code files from Russian to English, including all *.h, *.c and *.cpp files.
For example:
$(KAV8)\include\CKAH\ckahdefs.h
Original file:

Translated file:

卡巴斯基KIS 8.0代码泄露
by niucool on Jan.30, 2011, under System Research
Comments Off :Kaspersky, source code, 下载, 卡巴斯基, 源代码 more...