自定义博客皮肤VIP专享

*博客头图:

格式为PNG、JPG,宽度*高度大于1920*100像素,不超过2MB,主视觉建议放在右侧,请参照线上博客头图

请上传大于1920*100像素的图片!

博客底图:

图片格式为PNG、JPG,不超过1MB,可上下左右平铺至整个背景

栏目图:

图片格式为PNG、JPG,图片宽度*高度为300*38像素,不超过0.5MB

主标题颜色:

RGB颜色,例如:#AFAFAF

Hover:

RGB颜色,例如:#AFAFAF

副标题颜色:

RGB颜色,例如:#AFAFAF

自定义博客皮肤

-+

你连心爱的女人的大便都不敢吃, 还敢说爱她

将研究过的物体轮廓或其他经思考而理解的事物,运用想象回忆一遍时,有助于将事物更加深刻地牢记. 当回忆几十次上百次时, 对这个事物就可以算是了如指掌了

  • 博客(16)
  • 资源 (3)
  • 收藏
  • 关注

原创 sality感染文件恢复算法

实习期的一个任务, 写sality专杀.首先逆向了ag的母体, 因为之前没接触该病毒, 就把ag详细看了遍, 之后开始看其他的变种.其中ag,bh较复杂, bh是ag的一种特殊情况, 即那两个key均为0的情况.相关代码:这代码中的startVM为一个指令模拟虚拟机, 用于模拟指令执行并得到病毒跳转出口值(push reg/ret, jmp reg这两种情况), 这虚拟机代码是公司的所以就...

2019-01-01 16:08:00 3285 3

原创 virut文件感染算法

文章目录随便词汇大流程感染过程大流程按照流程顺序---几个重要的点附录is_junk标志方式病毒块1分块指令块变形复制结构其他零碎函数声明rand_mul的返回值为rax突然增加一个变量,而且从来没有赋值?随便该变种+0x20处的值为0x2b845b00根据IDA F5代码的反人类程度, 可以确定virut肯定是作者用汇编写的. 然后IDA F5先转成IL, 简化后生成C代码, 只有这样生成...

2019-01-01 16:07:56 940 1

原创 virut感染文件恢复算法

接上一篇:virut文件感染算法上一篇是在我阅读完virut感染代码后立刻写的, 然后这几天我在写恢复算法, 今天差不多完成了, 写的同时, 发现有的地方我理解地不准确. 例如, 当直接修改oep而不通过hook点1来跳转到病毒代码时, 是没有那两句c6 05/ c7 05的, 此时就通过计算来得到oep值, 也就是我源代码中的backvalue1和backvalue2.源代码VS2017解...

2019-01-01 16:07:51 1288 1

原创 意识流

有关复杂度.一个东西复不复杂, 看这个东西有多少个变量.变量几个的, 基本看一下就明白了.变量几十个的, 就需要好好看了.变量再多的, 那就跟需要好好看了…然而随着变量的增多, 变量并不是总那么多, 因为一多, 就可以分类, 看成一个单元, 那么变量的数目又变少了.而且随着变量的增多, 那么这个东西本身也必定是很大的, 那么取这个东西的一部分来看, 变量还是不多的…有的时候一看一个东...

2019-06-21 17:33:12 846

原创 lnk文件木马

最早出现是几年前, 最近几年貌似蛮流行的.微软官方对lnk文件的介绍phrozen的三篇文章:shortcut as entrypoint of malware part1shortcut as entrypoint of malware part2shortcut as entrypoint of malware part2主要内容概括:第一篇讲到建立快捷方式, 然后在快捷方式目标...

2019-01-29 15:16:37 1714

转载 223

==Phrack Inc.== Issue XIV, File 3 of 9=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=The following file is ...

2019-01-18 10:19:40 1366

转载 123

Stereopticon lanterns were the3d printers of the 1860s.I will pay $25 for a picture of youngRobert Graham with peanut butter on his face.Who’s got one?Ugh. It looks like the MD380 can putenough...

2019-01-18 07:32:41 672

原创 NtQueryInformationThread 0x9 ThreadQuerySetWin32StartAddress 问题

根据MSDNIf this parameter is the ThreadQuerySetWin32StartAddress value of the THREADINFOCLASS enumeration, the function returns the start address of the thread. Note that on versions of Windows prior t...

2018-11-23 16:38:37 1086

原创 一次失败的关于随机数的尝试

对随机数, 因为多次碰到随机数的重复问题, 即对同一个种子调用srand, 那么rand出来的序列都会是相同的, 所以想到了如果一个程序编写者使用这套组合来生成密钥, 那么密钥应该是可以破译的.如果是int num[100] = {0};srand(GetTickCount());for(int i=0;i<100;++i){ num[i] = rand();}那么必...

2018-10-22 16:09:24 254

原创 ida使用时碰到的一些问题

#1 IDA F5 write access to constant memory detected. output maybe wrong.这个就shift+F7后选定对应地址所在区段(具体出问题的内存地址在output可以看到), 然后ctrl+e打开编辑器在segment permissions里面对应属性加上, 另外segment class如果是code/rdata的, 也改成d...

2018-10-16 17:22:11 3559

原创 服务无法启动提示没有权限err:5

右键, 属性, 安全, 添加everyone组.

2018-09-18 16:40:30 1041

原创 两种进程遍历方式

病毒样本MD5: 642A393A5C65D202180DF5AF06F29C5A#include <windows.h>#include <stdio.h>//通过HKEY_PERFORMANCE_DATA遍历进程. ----- 从nimda病毒中发现的这种方式.//https://docs.microsof

2018-09-10 15:49:11 465

原创 SHA1:3670e86d024ccecc39c2a237d550b2ce7e7d95b1

一个避免启发式扫描的方式 bj_sub_403140_registerclass(hInstance); if ( bj_sub_4031A0_createwindow(hInstance, nShowCmd) ) { v4 = CreateThread(0, 0, StartAddress, 0, 0, 0); if ( v4 ) { ...

2018-09-06 18:19:45 262

原创 爆破过office宏工程密码验证方法

OFFICE2003 32 C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6 sub_6511f3a4 OFFICE2007 32 C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\VBE6.DLL sub_6510ae73 OFFICE2...

2018-09-04 17:12:38 684

原创 SHA-1:bde53ddafa82ed4266ada13488af219736b766e2

检测vmware虚拟机的两种方式1mov dx, 5658hin eax, dxcmp ebx,564d5868hsetz altest al,aljnz DIE ;br=1 死ALIVE2ip地址存在192.168.100.*该病毒内的一个代码结构抽象int v1=0, v2=0, v3=0;int v4=0xa, v5=3;char *n=...

2018-09-04 17:04:48 247

原创 Vmware Hyper-v Credential Guard Device Guard

VMWARE提示hyper-v冲突, 但实际上是与win10系统上Credential Guard或Device Guard冲突. 解决方法: https://kb.vmware.com/s/article/2146361?lang=zh_CN

2018-09-03 09:53:27 204

windows research kernel (1).7z

wrk最全版本,解压密码: EEy4NBT*a@VsFltwfSTO!1bumAekYnXNbXWeXWA5Rxc#U%n3@S2L!W$N2%ColFLUB&ShzVyT2Eq4d3IBkAbL%4QEMy^HystyEP&

2020-01-03

Windows 10 Inside Out, Third Edition.pdf

Microsoft Windows has been around for more than three decades. During that time, it has grown to become a mainstay of business and personal computing, running on some 1.5 billion devices worldwide. The authors of this book began working together in 2001 with the very first title in the Inside Out series, covering Windows XP. Like many of you, we took a break a few years ago, watching from the sidelines as Microsoft released Windows 8 and Windows 8.1. We returned for Windows 10 because, quite frankly, we were excited by the possibilities of “Windows as a service.” As we predicted in the first edition of this book, published shortly after the initial release of Windows 10 in 2015, Windows 10 is evolving rapidly. That evolution has been a key part of our experience over the past three years, as we researched and wrote what turned out to be a very significant revision to the original edition and then did a series of ebook-only updates. This third edition incorporates all that learning and covers the two editions of Windows 10 released in 2018. One bedrock fact we’ve discovered over the past three years is that the core features of Windows 10 are familiar and change very slowly. The fundamentals of NTFS security and the registry, for example, have remained reassuringly consistent throughout many generations of Windows. But there’s also plenty that’s new in Windows 10, some of it obvious (the new Start experience) and some not so obvious (Windows Hello). The challenge of writing a book like this one is that Microsoft keeps updating Windows 10, releasing new features twice each year instead of every few years, as in the past. To our great relief, we’ve found that most of the changes in these semi-annual Windows 10 feature updates are evolutionary, not revolutionary. You might notice small changes in a dialog box or in the appearance of a feature, but its fundamental workings remain the same as before. Our goal in this edition is to help you accomplish those familiar tasks using a new set of tools.

2019-09-11

programming_principles_and_practice_using_cpp_2nd_ed.rar

An Introduction to Programming by the Inventor of C++ Preparation for Programming in the Real World The book assumes that you aim eventually to write non-trivial programs, whether for work in software development or in some other technical field. Focus on Fundamental Concepts and Techniques T

2019-07-11

空空如也

TA创建的收藏夹 TA关注的收藏夹

TA关注的人

提示
确定要删除当前文章?
取消 删除