本帖最后由 lzh173 于 2025-11-26 21:59 编辑
lzh173 发表于 2025-11-14 21:42
终于有空来更新了
今天看到助手12.0更新了，我们来看看到底更新了什么
三个点：
自动从服务器下载网址黑名单
加强密码保护
禁止游戏、视频网站
我们来一个一个看：
自动下载黑名单：
函数this.UpdateWatcher
[C#] 纯文本查看 复制代码 private void UpdateWatcher(string fileUrl, string mode)
{
try
{
// 检查网络连接
if (!LogoutWatcher("223.5.5.5", 1500))
{
adapterInterpreter = false;
return;
}
// 下载文件到临时位置
string tempFile = Path.GetTempFileName();
using (WebClient webClient = new WebClient())
{
webClient.DownloadFile(fileUrl, tempFile);
}
// 读取文件内容
string[] lines = File.ReadAllLines(tempFile);
// 验证文件格式
if (Strings.InStr(lines[0], "www.", CompareMethod.Binary) == 0)
{
adapterInterpreter = false;
return;
}
// 解析文件结构
int videoStartIndex = -1;
int videoEndIndex = -1;
int productStartIndex = -1;
int productEndIndex = -1;
for (int i = 0; i < lines.Length; i++)
{
string line = lines[i];
if (line == "视频网站：")
{
videoStartIndex = i - 1;
videoEndIndex = i + 1;
}
else if (line == "产品名：")
{
productStartIndex = i - 1;
productEndIndex = i + 1;
}
}
int totalLines = lines.Length;
// 准备修改hosts文件
File.SetAttributes(stateInterpreter, FileAttributes.Normal);
string hostsContent = File.ReadAllText(stateInterpreter);
HashSet<string> existingDomains = new HashSet<string>();
// 解析现有hosts文件中的域名
string[] hostsLines = hostsContent.Split(new string[] { Environment.NewLine }, StringSplitOptions.None);
foreach (string hostLine in hostsLines)
{
string trimmedLine = hostLine.Trim();
if (trimmedLine.StartsWith("127.0.0.1"))
{
string[] parts = trimmedLine.Split(new char[] { ' ' }, StringSplitOptions.RemoveEmptyEntries);
if (parts.Length > 1)
{
existingDomains.Add(parts[1].ToLower());
}
}
}
// 构建新的hosts内容
StringBuilder newHostsContent = new StringBuilder(hostsContent);
newHostsContent.AppendLine();
// 添加视频网站域名
for (int i = 0; i <= videoStartIndex; i++)
{
if (!string.IsNullOrEmpty(lines[i].Trim()))
{
string domain = ExtractDomain(lines[i]);
if (!existingDomains.Contains(domain))
{
newHostsContent.AppendLine($"127.0.0.1 {domain}");
}
}
}
// 如果模式不是"off"，添加产品域名
if (mode != "off")
{
for (int i = videoEndIndex; i <= productStartIndex; i++)
{
if (!string.IsNullOrEmpty(lines[i].Trim()))
{
string domain = ExtractDomain(lines[i]);
if (!existingDomains.Contains(domain))
{
newHostsContent.AppendLine($"127.0.0.1 {domain}");
}
}
}
}
// 保存产品信息到测试数组
int productInfoIndex = merchantInterpreter + 1;
for (int i = productEndIndex; i < totalLines; i++)
{
testInterpreter[productInfoIndex] = lines[i];
productInfoIndex++;
}
// 写入新的hosts文件
File.WriteAllText(stateInterpreter, newHostsContent.ToString());
adapterInterpreter = true;
// 设置hosts文件为只读、隐藏、系统属性
File.SetAttributes(stateInterpreter,
File.GetAttributes(stateInterpreter) |
FileAttributes.ReadOnly |
FileAttributes.Hidden |
FileAttributes.System);
// 执行系统命令
ExecuteSystemCommands();
}
catch (Exception ex)
{
adapterInterpreter = false;
// 记录异常或处理错误
throw;
}
}
/// 从URL中提取域名
private string ExtractDomain(string url)
{
return url.Trim()
.Split('/')[0]
.Replace("http://", "")
.Replace("https://", "")
.ToLower();
}
/// 执行系统命令
private void ExecuteSystemCommands()
{
// 启用CMD
object shell = Interaction.CreateObject("wscript.shell", "");
NewLateBinding.LateCall(shell, null, "regwrite", new object[]
{
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System\\DisableCMD",
0,
"REG_DWORD"
}, null, null, null, true);
// 刷新DNS缓存
Interaction.Shell("cmd /c ipconfig /flushdns", AppWinStyle.MinimizedFocus, false, -1);
}
加强密码保护：
（其实并没有）
禁止视频、游戏网站：
[C#] 纯文本查看 复制代码
/// 监控用户浏览行为，检测是否访问了禁止的网站
private void MonitorBrowserActivity(object sender, EventArgs e)
{
if (!IsBrowserActive())
return;
string windowTitle = GetActiveWindowTitle();
if (string.IsNullOrEmpty(windowTitle))
return;
// 如果是相同的窗口标题，增加计数器
if (windowTitle == _currentWindowTitle)
{
_sameTitleCounter += 1;
// 连续5次检测到相同标题，重置监控
if (_sameTitleCounter > 5)
{
_currentWindowTitle = "-1";
}
return;
}
// 新的窗口标题，重置计数器
_sameTitleCounter = 0;
_currentWindowTitle = windowTitle;
string url = GetCurrentUrlFromBrowser();
if (string.IsNullOrEmpty(url))
{
_currentWindowTitle = "-1";
return;
}
// 检查URL是否包含禁止的域名
CheckForbiddenWebsite(url);
}
/// 检查URL是否访问了禁止的网站
private void CheckForbiddenWebsite(string url)
{
foreach (string forbiddenDomain in _forbiddenDomains)
{
// 检查URL是否包含禁止的域名（以.开头或//开头）
bool containsForbiddenDomain = url.Contains("." + forbiddenDomain) ||
url.Contains("//" + forbiddenDomain);
if (containsForbiddenDomain)
{
// 如果是相同的URL，触发违规处理
if (url == _lastForbiddenUrl)
{
_isRepeatedViolation = true;
}
else
{
_isRepeatedViolation = false;
_lastForbiddenUrl = url;
}
_currentWindowTitle = "-1";
HandleViolation();
break;
}
}
}
/// 处理违规访问行为
private void HandleViolation()
{
// 模拟按下Alt+F4关闭窗口
SimulateAltF4();
Thread.Sleep(100);
if (_isRepeatedViolation)
{
// 发送Alt+F4组合键关闭窗口
KeybdEvent(18, 0, 0, 0); // ALT key down
KeybdEvent(115, 0, 0, 0); // F4 key down
KeybdEvent(115, 0, 2, 0); // F4 key up
KeybdEvent(18, 0, 2, 0); // ALT key up
Thread.Sleep(500);
// 重置状态并显示警告
ResetMonitoringState();
ShowWarningDialog();
}
}
/// 从浏览器获取当前URL（通过Ctrl+L, Ctrl+C快捷键）
private string GetCurrentUrlFromBrowser()
{
try
{
// 模拟按下Ctrl+L（地址栏）和Ctrl+C（复制）
SimulateCtrlL();
Thread.Sleep(100);
SimulateCtrlC();
Thread.Sleep(100);
// 从剪贴板获取URL
if (Clipboard.ContainsText())
{
return Clipboard.GetText();
}
}
catch (Exception ex)
{
// 记录日志（在实际应用中应该记录异常）
}
return string.Empty;
}
/// 重置监控状态
private void ResetMonitoringState()
{
_isRepeatedViolation = false;
_lastForbiddenUrl = "";
_currentWindowTitle = "";
Clipboard.Clear();
}
/// 显示警告对话框
private void ShowWarningDialog()
{
ConnectionInterpreter.CalcWatcher.Form3.shuoming.Text = "你连续两次打开机房禁止网站！";
ConnectionInterpreter.CalcWatcher.Form3.shuoming2.Text = "健康上网 学有所成";
ConnectionInterpreter.CalcWatcher.Form3.Show();
}
这已经是十分明显的病毒特征了。
11.26更新：
今天回来看到助手更新了12.1版本，来看看增加了什么
禁止压缩软件？（不排除有些学校会教解压缩的）
原因可想而知：一位制作破解助手软件的作者，由于禁止浏览器下载，所以他想到了使用在图片后添加zip数据来下载文件（图片可以直接拖拽出来），打开这样的文件需要压缩软件
我们直接贴出代码：
[C#] 纯文本查看 复制代码
/// 显示违规软件警告对话框
private void ShowViolationWarning()
{
InterpreterHelper.ComputeHelper.Form3.shuoming.Text = "你运行的软件违规！如有误判，请老师拍照与作者QQ联系。";
// 根据违规类型显示不同的警告信息
switch (_violationType)
{
case ViolationType.TaskManager:
InterpreterHelper.ComputeHelper.Form3.shuoming.Text = "注：电脑死机时，不能用任务管理器，可同时按ctrl+alt+del三个键，点注销，电脑不会自动还原。";
break;
case ViolationType.CompressionSoftware:
InterpreterHelper.ComputeHelper.Form3.shuoming.Text = "你运行了360压缩软件或该软件现在升级，请卸载该软件，它带有杀毒功能会清除小助手。";
break;
case ViolationType.ExtractionSoftware:
InterpreterHelper.ComputeHelper.Form3.shuoming.Text = "禁止解压软件是为了防止学生使用非法工具，老师要使用先退出小助手。";
break;
}
// 生成违规报告标识
string violationReport = GenerateViolationReport(_violatedProcessName);
InterpreterHelper.ComputeHelper.Form3.shuoming3.Text = violationReport;
InterpreterHelper.ComputeHelper.Form3.Show();
}
/// 显示杀毒软件/虚拟机类软件警告
private void ShowSecuritySoftwareWarning()
{
InterpreterHelper.ComputeHelper.Form2.shuoming.Text = "你运行了杀毒类、虚拟机类的软件！危害电子教室运行，如有误判，请老师拍照与作者QQ联系。";
string violationReport = GenerateViolationReport(_violatedProcessName);
InterpreterHelper.ComputeHelper.Form2.shuoming3.Text = violationReport;
InterpreterHelper.ComputeHelper.Form2.Show();
_warningTimer.Enabled = true;
}
/// 生成违规报告标识
private string GenerateViolationReport(string processName)
{
string cleanProcessName = processName.Replace(".exe", "");
return $"grbrewyhrw4yw4ywnsxjeswtygqw3yhqhrtewyhrw4yw4y3tq3yszz{cleanProcessName}mmfnfxhghrts";
}
/// 进程监控事件处理 - 检测违规软件运行
private void ProcessMonitor_EventArrived(object sender, EventArrivedEventArgs e)
{
ManagementBaseObject targetInstance = (ManagementBaseObject)e.NewEvent["TargetInstance"];
int processId = Convert.ToInt32(targetInstance["ProcessId"]);
string processName = targetInstance["Name"].ToString();
Process process = Process.GetProcessById(processId);
string filePath = process.MainModule.FileName;
bool isForbiddenProcess = false;
bool isDangerousTool = false;
if (!string.IsNullOrEmpty(filePath))
{
FileVersionInfo versionInfo = FileVersionInfo.GetVersionInfo(filePath);
string productName = versionInfo.ProductName;
string fileDescription = versionInfo.FileDescription;
string combinedInfo = productName + fileDescription;
// 检查是否为禁止的进程
isForbiddenProcess = CheckForbiddenProcess(processName, combinedInfo);
// 检查是否为危险工具
isDangerousTool = CheckDangerousTool(combinedInfo);
// 根据检测结果采取相应措施
HandleViolationResponse(process, isForbiddenProcess, isDangerousTool, filePath, processName);
}
}
/// 检查是否为禁止的进程
private bool CheckForbiddenProcess(string processName, string productInfo)
{
// 根据配置模式决定检查级别
int checkLevel = (_securityCheckMode == "off") ? 11 : 1;
// 检查进程黑名单
while (!string.IsNullOrEmpty(_processBlacklist[checkLevel]))
{
string forbiddenPattern = _processBlacklist[checkLevel];
if (processName.ToUpper().Contains(forbiddenPattern.ToUpper()))
{
return true;
}
checkLevel++;
}
return false;
}
/// 检查是否为危险工具
private bool CheckDangerousTool(string productInfo)
{
// 根据配置模式决定检查级别
int checkLevel = (_commandCheckMode == "off") ? 2 : 1;
// 检查工具黑名单
while (!string.IsNullOrEmpty(_toolBlacklist[checkLevel]))
{
string toolPattern = _toolBlacklist[checkLevel];
if (productInfo.Contains(toolPattern))
{
return true;
}
checkLevel++;
}
return false;
}
/// 处理违规响应
private void HandleViolationResponse(Process process, bool isForbiddenProcess, bool isDangerousTool,
string filePath, string processName)
{
if (isForbiddenProcess)
{
if (_currentCheckLevel <= 10)
{
// 低风险违规 - 显示警告
BeginInvoke(new MethodInvoker(ShowSecuritySoftwareWarning));
}
else if (_currentCheckLevel <= 20)
{
// 中风险违规 - 终止进程
process.Kill();
BeginInvoke(new MethodInvoker(ShowViolationWarning));
}
else
{
// 高风险违规 - 终止进程并删除文件
process.Kill();
BeginInvoke(new MethodInvoker(ShowViolationWarning));
process.WaitForExit(1000);
File.Delete(filePath);
}
}
if (isDangerousTool)
{
HandleDangerousToolViolation(process, processName);
}
}
/// 处理危险工具违规
private void HandleDangerousToolViolation(Process process, string processName)
{
_violatedProcessName = processName;
switch (_violationLevel)
{
case 1: // 低风险工具
break;
case 2: // 命令行工具
Thread.Sleep(2000);
process.Kill();
break;
case 3: // 任务管理器类
BeginInvoke(new MethodInvoker(ShowViolationWarning));
Thread.Sleep(500);
process.Kill();
break;
case 4: // 注册表编辑器类
Thread.Sleep(2000);
process.Kill();
break;
case 5: // 系统管理工具
BeginInvoke(new MethodInvoker(ShowViolationWarning));
Thread.Sleep(2000);
process.Kill();
break;
case 43: // 特殊工具 - 仅终止进程
process.Kill();
break;
default: // 其他高风险工具
if (_violationLevel > 50)
{
process.Kill();
BeginInvoke(new MethodInvoker(ShowViolationWarning));
process.WaitForExit(1000);
File.Delete(process.MainModule.FileName);
}
else
{
process.Kill();
BeginInvoke(new MethodInvoker(ShowViolationWarning));
}
break;
}
}
/// 违规类型枚举
private enum ViolationType
{
General,
TaskManager,
CompressionSoftware,
ExtractionSoftware
}
这些是工具黑名单：
[C#] 纯文本查看 复制代码 private void InitializeToolBlacklist()
{
_toolBlacklist = new string[80];
// 系统管理工具
_toolBlacklist[1] = "Windows 命令处理程序"; // cmd.exe
_toolBlacklist[2] = "Windows PowerShell"; // PowerShell
_toolBlacklist[3] = "任务管理器"; // 任务管理器
_toolBlacklist[4] = "注册表编辑器"; // regedit.exe
_toolBlacklist[5] = "Microsoft 管理控制台"; // MMC
_toolBlacklist[6] = "Registry Workshop"; // 注册表工作室
_toolBlacklist[7] = "PC Hunter"; // 系统维护工具
_toolBlacklist[8] = "IceSword"; // 冰刃
_toolBlacklist[9] = "Wsyscheck"; // 系统检测工具
_toolBlacklist[10] = "SnipeSword"; // 狙剑
_toolBlacklist[11] = "Process Explorer"; // 进程浏览器
_toolBlacklist[12] = "狡兔二窟"; // 系统工具
_toolBlacklist[13] = "Process-X"; // 进程管理
_toolBlacklist[14] = "Process Master"; // 进程大师
_toolBlacklist[15] = "PrcView"; // 进程查看器
_toolBlacklist[16] = "Process Viewer"; // 进程查看器
_toolBlacklist[17] = "PowerTool"; // 系统维护工具
_toolBlacklist[18] = "Windows Kernel Explorer"; // 内核浏览器
_toolBlacklist[19] = "FTCleaner"; // 系统清理工具
_toolBlacklist[20] = "Process Lasso"; // 进程优化工具
// 进程管理工具
_toolBlacklist[21] = "process manager";
_toolBlacklist[22] = "Process Hacker";
_toolBlacklist[23] = "ProcessOVER";
// 虚拟桌面工具
_toolBlacklist[24] = "Dexpot";
_toolBlacklist[25] = "Deskman";
_toolBlacklist[26] = "iDesktop";
_toolBlacklist[27] = "YtMDesk";
_toolBlacklist[28] = "DexpotProPortable";
_toolBlacklist[29] = "Desktops";
_toolBlacklist[30] = "Wise Desktop";
_toolBlacklist[31] = "VDesktop";
_toolBlacklist[32] = "MagicDesktop";
_toolBlacklist[33] = "MultiDesk";
_toolBlacklist[34] = "小宝虚拟桌面";
// 系统配置工具
_toolBlacklist[35] = "系统配置实用程序"; // msconfig
_toolBlacklist[36] = "资源和性能监视器"; // perfmon
_toolBlacklist[37] = "Special Setting Program";
_toolBlacklist[38] = "瑞星防火墙";
_toolBlacklist[39] = "火绒剑";
_toolBlacklist[40] = "超级进程王";
_toolBlacklist[41] = "OpenArk";
_toolBlacklist[42] = "Procmon";
_toolBlacklist[43] = "GameBar";
// 压缩软件
_toolBlacklist[44] = "360压缩";
_toolBlacklist[45] = "Bandizip";
_toolBlacklist[46] = "WinRAR";
_toolBlacklist[47] = "7-Zip";
_toolBlacklist[48] = "WinZip";
_toolBlacklist[49] = "暂 时 备 用";
_toolBlacklist[50] = "暂 时 备 用";
// 极域电子教室破解工具
_toolBlacklist[51] = "极域杀手";
_toolBlacklist[52] = "极域墓地制造器";
_toolBlacklist[53] = "极域杀死";
_toolBlacklist[54] = "翘课";
_toolBlacklist[55] = "夕颜若雪工具箱";
_toolBlacklist[56] = "学生机房Hack助手";
_toolBlacklist[57] = "再见极域";
_toolBlacklist[58] = "KillControl";
_toolBlacklist[59] = "去除控制";
_toolBlacklist[60] = "MsgFlood";
_toolBlacklist[61] = "极域工具包";
_toolBlacklist[62] = "Astrum For Online Classroom";
_toolBlacklist[63] = "JiYu Trainer";
_toolBlacklist[64] = "掌控课堂";
_toolBlacklist[65] = "FuckMythware";
_toolBlacklist[66] = "Hello Teacher";
_toolBlacklist[67] = "JIYUPLUS";
_toolBlacklist[68] = "极域Tool";
_toolBlacklist[69] = "微机课救星";
_toolBlacklist[70] = "极域X";
_toolBlacklist[71] = "UnMythware";
_toolBlacklist[72] = "The curl executable";
_toolBlacklist[73] = "BITS管理实用程序";
_toolBlacklist[74] = "DzjsTools";
_toolBlacklist[75] = "SkiesKiller";
_toolBlacklist[76] = ClientHelper._ParserHelper;
_toolBlacklist[77] = "MultiDeskTop应用程序";
_toolBlacklist[78] = "极域电子教室克星";
_toolBlacklist[79] = ClientHelper.configHelper;
}
给出助手12.1下载地址，当个C#crackme玩一下吧
https://github.com/lzh173/jfglzs-update_lookup/releases/download/release-20251126-111503-19701812413/jfgl2_20251126_111604.zip | 
[复制链接]
发表于 2025-11-12 18:50
|
发表于 2025-11-14 21:42
厉害，期待后续。