Archive for 12 月, 2011

天书夜读2.2思考与练习

星期六, 24 12 月, 2011
int a, b, d;
d = a + b;
int i = 1, c = 0;
while(c < 0x64)
{
	c += i;
}
switch(c)
{
	case 0:
		d = 1;
	case 1:
		d = c;
		break;
	default:
		d = 0;
}
return d;

0xCC

星期六, 24 12 月, 2011

经常在debug模式下看到有如下汇编代码用0xCC填充栈空间:

mov ecx, 30h

mov eax, 0CCCCCCCCh

rep stos dword ptr es:[edi]

今天才知道0xCC是int 3调试中断的机器码,恍然大悟。

ln

星期六, 24 12 月, 2011

ln (List Nearest Symbols)
The ln command displays the symbols at or near the given address.

Syntax
ln Address

Parameters
Address
Specifies the address where the debugger should start to search for symbols. The nearest symbols, either before or after Address, are displayed. For more information about the syntax, see Address and Address Range Syntax.

OpenProcessToken

星期三, 21 12 月, 2011

OpenProcessToken

【分享】利用系统Hotpatch加载驱动的一种比较取巧的方法

DLL转发

星期二, 20 12 月, 2011

动态链接库的静态链接导致程序的DLL劫持漏洞-借助QQ程序xGraphic32.dll描述

[编程交流]DLL转发技术,实现程序隐藏与自启动(下)