Alex_Qwerty
Silver Member | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
Патч для тестовой версии против удаления read-only файлов:
Код: IrfanView v4.66 test version 2024-02-26
Don't delete read-only files
I_VIEW32.EXE
0007DD1F: 6A 56
0007DD20: 20 FF
0007DD21: 56 15
0007DD22: FF 98
0007DD23: 15 22
0007DD24: C0 55
0007DD25: 22 00
0007DD26: 55 A8
0007DD27: 00 01
0007DD28: B9 75
0007DD29: 04 49
0007DD2A: 01 B9
0007DD2B: 00 04
0007DD2C: 00 01
0007DD2D: 33 00
0007DD2E: C0 00
0007DD2F: 8D 31
0007DD30: 7C C0
0007DD31: 24 8D
0007DD32: 08 7C
0007DD33: 56 24
0007DD34: F3 08
0007DD35: AB 56
0007DD36: 8D 57
0007DD37: 4C F3
0007DD38: 24 AB
0007DD39: 0C 59
|
Найти и заменить , возможно будет работать и для следующей версии:
Код:
< 6A 20 56 FF 15 C0 22 55 00 B9 04 01 00 00 33 C0 8D 7C 24 08 56 F3 AB 8D 4C 24 0C
> 56 FF 15 98 22 55 00 A8 01 75 49 B9 04 01 00 00 31 C0 8D 7C 24 08 56 57 F3 AB 59
= i_view32.exe
|
---------------------------
Я сделяль патчер:
Код:
#Irfan_View_no_del_read-only_patcher.ps1 v1
#copy Irfan_View_no_del_read-only_patcher.ps1 and i_view32.exe in same dir
#run this command:
# powershell.exe -ExecutionPolicy RemoteSigned -File Irfan_View_no_del_read-only_patcher.ps1
#replace i_view32.exe with i_view32.exe.patched
$ErrorActionPreference = "Stop"
$attributesMask = 7 # 1: RO, 2: hidden, 4: system, 7:RO+hidden+system
#https://devblogs.microsoft.com/scripting/use-powershell-and-regular-expressions-to-search-binary-data/
filter ConvertTo-String
{
[OutputType([String])]
Param (
[Parameter( Mandatory = $True,
Position = 0,
ValueFromPipeline = $True )]
[ValidateScript( { -not (Test-Path $_ -PathType Container) } )]
[String]
$Path
)
$Stream = New-Object IO.FileStream -ArgumentList (Resolve-Path $Path), 'Open', 'Read'
# Note: Codepage 28591 returns a 1-to-1 char to byte mapping
$Encoding = [Text.Encoding]::GetEncoding(28591)
$StreamReader = New-Object IO.StreamReader -ArgumentList $Stream, $Encoding
$BinaryText = $StreamReader.ReadToEnd()
$StreamReader.Close()
$Stream.Close()
Write-Output $BinaryText
}
$BinaryString = ConvertTo-String i_view32.exe
$funcOffset = 0
$importRegex = [Regex] '\x0F\x03SetFileAttributesW(\x00).*(\x59\x01GetFileAttributesW\x00)'
if ($BinaryString -cmatch $importRegex) {
$offset = 0
while ($offset -lt $matches[0].Length){
if ($matches[0].substring($offset, $matches[2].length-1) -eq $matches[2]) { break }
$offset = $matches[0].indexOf($matches[1], $offset+2) + 1
$offset += $offset % 2
$funcOffset++
}
if ($offset -ge $matches[0].Length) { throw "WTF"}
} else { throw "import not found"}
write-output "funcOffset=$funcOffset"
# SetFileAttributesW mov ecx,counter
$signature = [Regex] '\x6A\x20\x56\xFF\x15(...\x00)\xB9(...\x00)\x33\xC0\x8D\x7C\x24\x08\x56\xF3\xAB\x8D\x4C\x24\x0C'
$sigData = [regex]::Match($BinaryString, $signature)
if (-not $sigData.Success) { throw "signature not found" }
write-output "signature offset=$('0x{0:X8}' -f $sigData.index)"
$enc = [Text.Encoding]::GetEncoding(28591)
$GFAoffset = [BitConverter]::ToUInt32($enc.getBytes($sigData.Groups[1].Value), 0) - $funcOffset*4
$repl1 = $enc.GetString([byte[]]@(0x56, 0xFF, 0x15) +
[BitConverter]::GetBytes($GFAoffset) +
[byte[]]@(0xA8, $attributesMask, 0x75, 0x49, 0xB9)) +
$sigData.Groups[2].Value +
$enc.GetString([byte[]]@(0x31, 0xC0, 0x8D, 0x7C, 0x24, 0x08, 0x56, 0x57, 0xF3, 0xAB, 0x59))
$patchedName = "i_view32.exe.patched"
$patched = New-Object IO.StreamWriter($patchedName, $false, $enc)
$patched.write($BinaryString, 0, [int]$sigData.index)
$patched.write($repl1)
$patched.write($BinaryString, ($sigData.index+$sigData.length), [int]($BinaryString.length-($sigData.index+$sigData.length)))
$patched.Close()
write-output "Done: $patchedName"
|
|
Всего записей: 2342 | Зарегистр. 09-09-2006 | Отправлено: 17:15 02-03-2024 | Исправлено: Alex_Qwerty, 11:02 02-04-2024 |
|
