#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
// These strings are never used maliciously but will appear in the binary
const char *FAKE_C2 = "http://e...content-available-to-author-only...e.com/login.php";
const char *FAKE_KEY = "1234-5678-ABCD-EFGH";
const char *CMD = "cmd.exe /c del C:\\Windows\\System32\\important.dll";
 
void suspicious_function() {
    // This function does nothing but references the strings
    printf("Simulating malicious behavior...\n");
    printf("Connecting to: %s\n", FAKE_C2);
}
 
int main() {
    printf("This is a benign program for educational analysis.\n"); 
    printf("It performs no harmful actions.\n");
 
    // To ensure the compiler doesn't optimize the strings away, we reference them
    if (strcmp(FAKE_KEY, "0000") == 0) {
        suspicious_function();
    }
 
    return 0;
}
 

I2luY2x1ZGUgPHN0ZGlvLmg+CiNpbmNsdWRlIDxzdGRsaWIuaD4KI2luY2x1ZGUgPHN0cmluZy5oPgoKLy8gVGhlc2Ugc3RyaW5ncyBhcmUgbmV2ZXIgdXNlZCBtYWxpY2lvdXNseSBidXQgd2lsbCBhcHBlYXIgaW4gdGhlIGJpbmFyeQpjb25zdCBjaGFyICpGQUtFX0MyID0gImh0dHA6Ly9lLi4uY29udGVudC1hdmFpbGFibGUtdG8tYXV0aG9yLW9ubHkuLi5lLmNvbS9sb2dpbi5waHAiOwpjb25zdCBjaGFyICpGQUtFX0tFWSA9ICIxMjM0LTU2NzgtQUJDRC1FRkdIIjsKY29uc3QgY2hhciAqQ01EID0gImNtZC5leGUgL2MgZGVsIEM6XFxXaW5kb3dzXFxTeXN0ZW0zMlxcaW1wb3J0YW50LmRsbCI7Cgp2b2lkIHN1c3BpY2lvdXNfZnVuY3Rpb24oKSB7CiAgICAvLyBUaGlzIGZ1bmN0aW9uIGRvZXMgbm90aGluZyBidXQgcmVmZXJlbmNlcyB0aGUgc3RyaW5ncwogICAgcHJpbnRmKCJTaW11bGF0aW5nIG1hbGljaW91cyBiZWhhdmlvci4uLlxuIik7CiAgICBwcmludGYoIkNvbm5lY3RpbmcgdG86ICVzXG4iLCBGQUtFX0MyKTsKfQoKaW50IG1haW4oKSB7CiAgICBwcmludGYoIlRoaXMgaXMgYSBiZW5pZ24gcHJvZ3JhbSBmb3IgZWR1Y2F0aW9uYWwgYW5hbHlzaXMuXG4iKTsgCiAgICBwcmludGYoIkl0IHBlcmZvcm1zIG5vIGhhcm1mdWwgYWN0aW9ucy5cbiIpOwogICAgCiAgICAvLyBUbyBlbnN1cmUgdGhlIGNvbXBpbGVyIGRvZXNuJ3Qgb3B0aW1pemUgdGhlIHN0cmluZ3MgYXdheSwgd2UgcmVmZXJlbmNlIHRoZW0KICAgIGlmIChzdHJjbXAoRkFLRV9LRVksICIwMDAwIikgPT0gMCkgewogICAgICAgIHN1c3BpY2lvdXNfZnVuY3Rpb24oKTsKICAgIH0KCiAgICByZXR1cm4gMDsKfQo=

LyogIEJlcmVjaG51bmcgZGVzIEhhbW1pbmctQWJzdGFuZGVzIHp3aXNjaGVuIHp3ZWkgMTI4LUJpdCBXZXJ0ZW4gaW4gCSovCi8qCWVpbmVyIFRleHRkYXRlaS4gCQkJCQkJCQkJCQkJCSovCi8qICBEaWUgV2VydGUgbSZ1dW1sO3NzZW4gYXVmIGVpbmVyIHNlcGFyYXRlbiBaZWlsZSBnZXNwZWljaGVydCBzZWluCQkJKi8KLyogCQkJCQkJCQkJCQkJCQkJCQkJKi8KLyoJRXJzdGVsbHQ6IDE3LjUuMjAxMAkJCQkJCQkJCQkJCQkqLwovKiAgQXV0b3I6IFRob21hcyBTY2hlZmZsZXIJCQkJCQkJCQkJCQkqLwoKI2luY2x1ZGUgJmx0O3N0ZGlvLmgmZ3Q7CiNpbmNsdWRlICZsdDtzdGRsaWIuaCZndDsKCiNkZWZpbmUgQVJSQVlfU0laRSAzMgoKdW5zaWduZWQgSGFtZGlzdCh1bnNpZ25lZCB4LCB1bnNpZ25lZCB5KQp7CiAgdW5zaWduZWQgZGlzdCA9IDAsIHZhbCA9IHggXiB5OwogCiAgLy8gQ291bnQgdGhlIG51bWJlciBvZiBzZXQgYml0cwogIHdoaWxlKHZhbCkKICB7CiAgICArK2Rpc3Q7IAogICAgdmFsICZhbXA7PSB2YWwgLSAxOwogIH0KIAogIHJldHVybiBkaXN0Owp9CgoKCmludCBtYWluICh2b2lkKQp7CgljaGFyIGhleDsKCWludCBpOwoJaW50IGFbQVJSQVlfU0laRV07CglpbnQgYltBUlJBWV9TSVpFXTsKCWludCBoYW1EaXN0ID0gMDsKCUZJTEUqIGZwOwoJCgkvL0FycmF5cyBtaXQgMCBpbml0aWFsaXNpZXJlbgoJZm9yIChpID0gMDsgaSAmbHQ7IEFSUkFZX1NJWkU7ICsraSkKCXsKICAJCWFbaV0gPSAwOwogIAkJYltpXSA9IDA7Cgl9CgoJCglmcCA9IGZvcGVuKCZxdW90O2hleC50eHQmcXVvdDssJnF1b3Q7ciZxdW90Oyk7CglpZiAoZnAgPT0gTlVMTCkgCgl7CgkJcHJpbnRmKCZxdW90O0RpZSBEYXRlaSBoZXgudHh0IHd1cmRlIG5pY2h0IGdlZnVuZGVuISZxdW90Oyk7CgkJZXhpdChFWElUX0ZBSUxVUkUpOwoJfQoKCWk9MDsKCXByaW50ZigmcXVvdDsxLlplaWxlIGVpbmxlc2VuLlxuJnF1b3Q7KTsKCiAJd2hpbGUoKGhleD1mZ2V0YyhmcCkpIT0nXG4nICZhbXA7JmFtcDsgaGV4ICE9IEVPRikKICAgIHsKICAgICAgICBhW2ldPXN0cnRvbCgmYW1wO2hleCwwLDE2KTsKCQlpKys7CiAgICB9CglpPTA7CglwcmludGYoJnF1b3Q7Mi5aZWlsZSBlaW5sZXNlbi5cbiZxdW90Oyk7CgogCXdoaWxlKChoZXg9ZmdldGMoZnApKSE9J1xuJyAmYW1wOyZhbXA7IGhleCAhPSBFT0YpCiAgICB7CiAgICAJYltpXT1zdHJ0b2woJmFtcDtoZXgsMCwxNik7CiAgICAgICAgaSsrOwogICAgfQoJZmNsb3NlKGZwKTsKCglwcmludGYoJnF1b3Q7SGFtbWluZy1BYndlaWNodW5nIHBybyBOaWJibGU6XG4mcXVvdDspOwoJZm9yIChpID0gMDsgaSAmbHQ7IEFSUkFZX1NJWkU7ICsraSkKCXsKCQlwcmludGYgKCZxdW90OyVpXHQlaVx0JWlcbiZxdW90OyxhW2ldLGJbaV0sSGFtZGlzdChhW2ldLGJbaV0pKTsKCQloYW1EaXN0ICs9IEhhbWRpc3QoYVtpXSxiW2ldKTsKCX0KCXByaW50ZiAoJnF1b3Q7XG5IYW1taW5nLUFid2VpY2h1bmcgZGVyIEhhc2gtV2VydGU6JWRcbiZxdW90OyxoYW1EaXN0KTsKfQoK

/*  Berechnung des Hamming-Abstandes zwischen zwei 128-Bit Werten in 	*/
/*	einer Textdatei. 													*/
/*  Die Werte müssen auf einer separaten Zeile gespeichert sein			*/
/* 																		*/
/*	Erstellt: 17.5.2010													*/
/*  Autor: Thomas Scheffler												*/

#include <stdio.h>
#include <stdlib.h>

#define ARRAY_SIZE 32

unsigned Hamdist(unsigned x, unsigned y)
{
  unsigned dist = 0, val = x ^ y;
 
  // Count the number of set bits
  while(val)
  {
    ++dist; 
    val &= val - 1;
  }
 
  return dist;
}



int main (void)
{
	char hex;
	int i;
	int a[ARRAY_SIZE];
	int b[ARRAY_SIZE];
	int hamDist = 0;
	FILE* fp;
	
	//Arrays mit 0 initialisieren
	for (i = 0; i < ARRAY_SIZE; ++i)
	{
  		a[i] = 0;
  		b[i] = 0;
	}

	
	fp = fopen("hex.txt","r");
	if (fp == NULL) 
	{
		printf("Die Datei hex.txt wurde nicht gefunden!");
		exit(EXIT_FAILURE);
	}

	i=0;
	printf("1.Zeile einlesen.\n");

 	while((hex=fgetc(fp))!='\n' && hex != EOF)
    {
        a[i]=strtol(&hex,0,16);
		i++;
    }
	i=0;
	printf("2.Zeile einlesen.\n");

 	while((hex=fgetc(fp))!='\n' && hex != EOF)
    {
    	b[i]=strtol(&hex,0,16);
        i++;
    }
	fclose(fp);

	printf("Hamming-Abweichung pro Nibble:\n");
	for (i = 0; i < ARRAY_SIZE; ++i)
	{
		printf ("%i\t%i\t%i\n",a[i],b[i],Hamdist(a[i],b[i]));
		hamDist += Hamdist(a[i],b[i]);
	}
	printf ("\nHamming-Abweichung der Hash-Werte:%d\n",hamDist);
}