SYSREVEAL

Tag: Kaspersky

Decrypt mysterious KIS dat files in Windows driver directory

by on Mar.23, 2011, under System Research

If you have Kaspersky Internet Security installed in your PCs or Laptops, Some KIS files will be put in your $(WINDOWS)\System32\Drivers directory. Some of them are obviously kernel driver files with .sys extension, like kl1.sys, kl2.sys etc., there still exist other strange files with .dat extension, like klin.dat, klick.dat, klopp.dat etc. After my research, they are not data files which are used by KIS drivers, they are also driver files but are encypted by Kaspersky! I think the major reason is for security purpose.

After examine the KIS code, I write a simple program to decrypt these dat files, here is the source code.

(continue reading…)

Comments Off :, , more...

Steps to translate KIS code

by on Mar.04, 2011, under System Research

Here is my steps to translate the code:

Please make sure that you have install ActivePython in your computer first.

  1. Download google-api-python-client
  2. Modify code $(google-api-python-client)\apiclient\model.py,comment line 132

    129
    130
    131
    132
    133
    
        for key, value in params.iteritems():
          if type(value) == type([]):
            for x in value:
              x = x.encode('utf-8')
              astuples.append((key, x))

    Change to:

    129
    130
    131
    132
    133
    134
    
        for key, value in params.iteritems():
          if type(value) == type([]):
            for x in value:
    #Jim: User must encode himself
    #          x = x.encode('utf-8')
              astuples.append((key, x))
  3. Install google api python client
  4. Download my script ktrans.py: ktrans.zip
  5. Start a command line window, and run ktrans.py by:

    ktrans.py <path to your KIS code>

Notice:

  • Please change the google api key to your own key before run the script.
    52
    
    p = build('translate', 'v2', developerKey='AIzaSyD9K3qrSzFaJsU2mAPUPDsnZDueTTzDwXk')
  • Due to the limitation of google translation api, only 10,000 words could be translated per day. ktrans.py will throw an exception when it could not translate the code, so please copy the path of the file, and modify ktrans.py line 29 and 30:
    26
    27
    28
    29
    30
    
    #Set ResumeTask=False and StartFile='file to be the first of being translated'
    #to resume the last section
    #If ResumeTask == True, StartFile is ignored.
    ResumeTask = True
    StartFile = r'd:\svn\kav8\cs adminkit\development2\include\build\klcsc.h'

(continue reading…)

Comments Off :, , , , , , , more...

Translate the comment of KIS source code

by on Feb.23, 2011, under System Research

As we all know, comments are very important for us to understand the source code. If you get a copy of KIS source code, you might be confused since most of comments are written in Russian. I spent a whole afternoon to write a tool to translate comments of KIS source code files from Russian to English, including all *.h, *.c and *.cpp files.

For example:

$(KAV8)\include\CKAH\ckahdefs.h

Original file:

image

Translated file:

image

(continue reading…)

3 Comments :, , , , , , , more...

卡巴斯基KIS 8.0代码泄露

by on Jan.30, 2011, under System Research

卡巴斯基新年送大礼,KIS 8.0的代码被泄露(2008年的版本),已经在网络上开始传播。

本站备有BT下载链接。有兴趣的朋友可以下来看看。

点此下载

Comments Off :, , , , more...

Looking for something?

Use the form below to search the site:

Still not finding what you're looking for? Drop a comment on a post or contact us so we can take care of it!

Blogroll

A few highly recommended websites...