#ifndef?CETC
ALLERT!?DO?NOT?PUT?THIS?FILE?IN?THE?STANDARD?CE?DISTRIBUTION
#endif

#include?“ntifs.h“
#include?“extraimports.h“
#include?“memscan.h“
#include?“tdiwrapper.h“
#include?
#include?“rootkit.h“

VOID?CETC_CORE（IN?PVOID?StartContext）
{
	KLOCK_QUEUE_HANDLE?lqh;
	PEPROCESS?ActivePEPROCESS=NULL;

	InitServer（）;


	if?（FileobjectConnection!=NULL）
	{
		StopListener=FALSE;

		while?（!StopListener）
		{
			AddressListEntries=0;

			DbgPrint（“Start?listening\n“）;
			if?（Listen（））
			{
				ULONG?DataSent=0;
				BOOLEAN?PasswordCorrect=FALSE;
				int?i;
				unsigned?char?command;
				char?a;				
				char?*buffer;
				char?defaultpass[9]=“defaultpw“;
				DbgPrint（“Listen=success\n“）;

				connected=TRUE;

				DbgPrint（“Waiting?for?password\n“）;				

				while?（（!PasswordCorrect）?&&?（connected））
				{
					if?（Receive（&command1））
					{		


						if?（command==CS_PASSWORD）?//only?one?possible?so?use?a?if
						{							
							if?（Receive（&a1））?//length
							{
								if?（a!=0）
								{
									buffer=ExAllocatePoolWithTag（NonPagedPool（ULONG）a0）;
									
									DbgPrint（“received?passsize=%d\n“a）;
									//allocate?a?buffer?big?enough?to?receive?the?password
									if?（Receive（buffera））
									{
										if?（a<=9）
										{
		????????????????????????????????????for?（i=0;?i												if?（buffer[i]!=defaultpass[i]）
													break;
		
											PasswordCorrect=（i==9）;
										}								
		
										if?（PasswordCorrect）
											DbgPrint（“Password?correct\n“）;
										else
											DbgPrint（“Password?incorrect\n“）;
									}							
		
									ExFreePool（buffer）;
								}						
							}
						}
					}
				}

				if?（!connected）
					continue;

						
				DataSent=0;

				while?（connected）
				{
					DbgPrint（“Going?to?read?a?new?command\n“）;
					if?（Receive（&command1））
					{
						DbgPrint（“command=%d\n“command）;
						switch?（command）
						{

							case?CS_SetTimerSpeed:?//（freezeinterval:word）
							{
								WORD?fi;
								DbgPrint（“Set?Timer?Speed\n“）;
????????????????????????????????Receive（&fi2）;

								FreezeInterval.QuadPart=fi*-10000;

								//-50000000=5?seconds=5000?ms
								//-5000000=500?ms
								break;
							}

							case?CS_KERNELDATA:
							{
								DbgPrint（“Kerneldata?received\n“）;
								Receive（&ActivelinkOffset4）;
								Receive（&ProcessNameOffset4）;
								Receive（&DebugportOffset4）;
								Receive（&PIDOffset4）;
								break;
							}

							case?CS_SetConfig:
							{
								//UseDebugRegs:byte;UseDBKQueryMemoryRegion:byte;UseDBKReadWriteMemory:byte;UseDBKOpenProcess:byte）
								DbgPrint（“SetConfig\n“）;
								
								Receive（&MemscanOptions.ShowAsSigned1）;
								Receive（&MemscanOptions.BinariesAsDecimal1）;
								Receive（&MemscanOptions.max2）;
								Receive（&MemscanOptions.buffersize4）;
								Receive（&

?屬性????????????大小?????日期????時(shí)間???名稱
-----------?---------??----------?-----??----

?????文件??????33111??2008-01-13?13:23??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\.svn\all-wcprops

?????文件??????39912??2008-01-13?13:23??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\.svn\entries

?????文件??????????2??2008-01-01?04:07??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\.svn\format

?????文件???????6780??2008-11-27?19:48??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\aboutunit.dcu

?????文件??????26707??2008-01-01?04:08??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\aboutunit.dfm

?????文件???????5398??2008-11-27?19:48??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\aboutunit.obj

?????文件???????3242??2008-01-01?04:08??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\aboutunit.pas

?????文件??????20528??2008-11-27?19:48??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\AddAddress.dcu

?????文件???????6238??2008-01-01?04:08??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\AddAddress.dfm

?????文件??????17220??2008-11-27?19:48??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\AddAddress.obj

?????文件??????17974??2008-01-01?04:08??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\AddAddress.pas

?????文件???????6407??2008-11-27?19:48??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\addressparser.dcu

?????文件???????5901??2008-11-27?19:48??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\addressparser.obj

?????文件???????6463??2008-01-01?04:08??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\addressparser.pas

?????文件??????29706??2008-11-27?19:48??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\AdvancedOptionsUnit.dcu

?????文件???????6977??2008-01-01?04:08??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\AdvancedOptionsUnit.dfm

?????文件??????24769??2008-11-27?19:48??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\AdvancedOptionsUnit.obj

?????文件??????27520??2008-01-01?04:08??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\AdvancedOptionsUnit.pas

?????文件???????3999??2008-11-27?19:48??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\APIhooktemplatesettingsfrm.dcu

?????文件???????2041??2008-01-01?04:08??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\APIhooktemplatesettingsfrm.dfm

?????文件???????3863??2008-11-27?19:48??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\APIhooktemplatesettingsfrm.obj

?????文件????????566??2008-01-01?04:08??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\APIhooktemplatesettingsfrm.pas

?????文件??????50290??2008-01-01?04:08??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\apl.txt

?????文件????????125??2008-01-01?04:08??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\assembler?paramguide.txt

?????文件?????????56??2008-01-01?04:08??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\Assembler.pas

?????文件??????87423??2008-11-27?19:48??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\Assemblerunit.dcu

?????文件??????72561??2008-11-27?19:48??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\Assemblerunit.obj

?????文件?????186639??2008-01-01?04:08??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\Assemblerunit.pas

?????文件??????34612??2008-11-27?19:48??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\autoassembler.dcu

?????文件??????31417??2008-11-27?19:48??ce5.4學(xué)習(xí)注解\ce54學(xué)習(xí)注解\autoassembler.obj

............此處省略2115個(gè)文件信息