**- Bits 0-54 : physical frame number if present.** - Bit 55 : page table entry is soft-dirty. - Bit 56 : page exclusively mapped. - Bits 57-60 : zero - Bit 61 : page is file-page or shared-anon. - Bit 62 : page is swapped. - Bit 63 : page is present.
/* check if this is the last frame */ if (tcp_send_offset + tcp_chunk_size >= tcp_data_len) { is_last_frame = 1; chunk_size = tcp_data_len - tcp_send_offset; }
def GetAddr(func_name): func_list = Functions() for func in func_list: name = GetFunctionName(func) if func_name == name: print(name,hex(func)) func_addr=func return func_addr
import idautils for seg in idautils.Segments(): if SegName(seg) == '.data': start = idc.SegStart(seg) end = idc.SegEnd(seg) print idc.SegName(seg),start,end while(start!=end): key = GetString(Dword(start)) if key != None and key != '0': start += 4 val = GetString(Dword(start)) if 'upnp' in key: print('%s=%s'%(key,val)) start += 4
def GetAddr(func_name): func_list = Functions() for func in func_list: name = GetFunctionName(func) if func_name == name: print(name,hex(func)) func_addr=func return func_addr
import idautils for seg in idautils.Segments(): if SegName(seg) == '.data': start = idc.SegStart(seg) end = idc.SegEnd(seg) print idc.SegName(seg),start,end while(start!=end): key = GetString(Dword(start)) if key != None and key != '0': start += 4 val = GetString(Dword(start)) if 'upnp' in key: print('%s=%s'%(key,val)) start += 4
Malice是政府机构的数据库管理员，为公民提供犯罪记录。 Malice最近被判犯有欺诈罪，并决定滥用她的特权，并通过运行DELETE FROM Record WHERE name = ‘Malice’来删除她的犯罪记录。 但是，她知道数据库操作需要定期审核，以检测对机构存储的高度敏感数据的篡改。为了覆盖她的操作，Malice在运行DELETE操作之前停用审计日志，然后再次激活日志。因此，在数据库中没有她的非法操纵的日志跟踪。 但是，磁盘上的数据库存储仍将包含已删除行的证据。 作者的方法检测已删除的痕迹和过期的记录版本，并将它们与审核日志进行匹配，以检测此类攻击，并提供数据库操作方式的证据。 作者将检测已删除的行，因为它与审计日志中的任何操作都不对应，我们会将其标记为篡改的潜在证据。
typedef struct _IMAGE_IMPORT_DESCRIPTOR { union { DWORD Characteristics; // 0 for terminating null import descriptor DWORD OriginalFirstThunk; // RVA to original unbound IAT (PIMAGE_THUNK_DATA) }; DWORD TimeDateStamp; // 0 if not bound, // -1 if bound, and real datetime stamp // in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND) // O.W. date/time stamp of DLL bound to (Old BIND)
DWORD ForwarderChain; // -1 if no forwarders DWORD Name; DWORD FirstThunk; // RVA to IAT (if bound this IAT has actual addresses) } IMAGE_IMPORT_DESCRIPTOR;
typedef struct _IMAGE_IMPORT_DESCRIPTOR { union { DWORD Characteristics; // 0 for terminating null import descriptor DWORD OriginalFirstThunk; // RVA to original unbound IAT (PIMAGE_THUNK_DATA) }; DWORD TimeDateStamp; // 0 if not bound, // -1 if bound, and real datetime stamp // in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND) // O.W. date/time stamp of DLL bound to (Old BIND)
DWORD ForwarderChain; // -1 if no forwarders DWORD Name; DWORD FirstThunk; // RVA to IAT (if bound this IAT has actual addresses) } IMAGE_IMPORT_DESCRIPTOR;
Malice是政府机构的数据库管理员，为公民提供犯罪记录。 Malice最近被判犯有欺诈罪，并决定滥用她的特权，并通过运行DELETE FROM Record WHERE name = ‘Malice’来删除她的犯罪记录。 但是，她知道数据库操作需要定期审核，以检测对机构存储的高度敏感数据的篡改。为了覆盖她的操作，Malice在运行DELETE操作之前停用审计日志，然后再次激活日志。因此，在数据库中没有她的非法操纵的日志跟踪。 但是，磁盘上的数据库存储仍将包含已删除行的证据。 作者的方法检测已删除的痕迹和过期的记录版本，并将它们与审核日志进行匹配，以检测此类攻击，并提供数据库操作方式的证据。 作者将检测已删除的行，因为它与审计日志中的任何操作都不对应，我们会将其标记为篡改的潜在证据。
struct pcap_file_header { bpf_u_int32 magic; u_short version_major; u_short version_minor; bpf_int32 thiszone; /* gmt to local correction */ bpf_u_int32 sigfigs; /* accuracy of timestamps */ bpf_u_int32 snaplen; /* max length saved portion of each pkt */ bpf_u_int32 linktype; /* data link type (LINKTYPE_*) */ };
1. do { 2. status = pcap_loop(pd, cnt, callback, pcap_userdata); 3. if (WFileName == NULL) { 4. /* 5. * We're printing packets. Flush the printed output, 6. * so it doesn't get intermingled with error output. 7. */ 8. if (status == -2) { 9. /* 10. * We got interrupted, so perhaps we didn't 11. * manage to finish a line we were printing. 12. * Print an extra newline, just in case. 13. */ 14. putchar('n'); 15. } 16. (void)fflush(stdout); 17. }
-
设置断点之后查看一下该函数的执行结果
-
pcap_loop通过callback指向print_packet,来看一下它的源码
1. static void 2. print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 3. { 4. struct print_info *print_info; 5. u_int hdrlen; 6. ++packets_captured; 7. ++infodelay; 8. ts_print(&h->ts); 9. print_info = (struct print_info *)user; 10. /* 11. * Some printers want to check that they're not walking off the 12. * end of the packet. 13. * Rather than pass it all the way down, we set this global. 14. */ 15. snapend = sp + h->caplen; 16. if(print_info->ndo_type) { 17. hdrlen = (*print_info->p.ndo_printer)(print_info->ndo, h, sp);<==== 18. } else { 19. hdrlen = (*print_info->p.printer)(h, sp); 20. } 21. putchar('n'); 22. --infodelay; 23. if (infoprint) 24. info(0);}
struct pcap_file_header { bpf_u_int32 magic; u_short version_major; u_short version_minor; bpf_int32 thiszone; /* gmt to local correction */ bpf_u_int32 sigfigs; /* accuracy of timestamps */ bpf_u_int32 snaplen; /* max length saved portion of each pkt */ bpf_u_int32 linktype; /* data link type (LINKTYPE_*) */ };
1. do { 2. status = pcap_loop(pd, cnt, callback, pcap_userdata); 3. if (WFileName == NULL) { 4. /* 5. * We're printing packets. Flush the printed output, 6. * so it doesn't get intermingled with error output. 7. */ 8. if (status == -2) { 9. /* 10. * We got interrupted, so perhaps we didn't 11. * manage to finish a line we were printing. 12. * Print an extra newline, just in case. 13. */ 14. putchar('n'); 15. } 16. (void)fflush(stdout); 17. }
+
设置断点之后查看一下该函数的执行结果
+
pcap_loop通过callback指向print_packet,来看一下它的源码
1. static void 2. print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 3. { 4. struct print_info *print_info; 5. u_int hdrlen; 6. ++packets_captured; 7. ++infodelay; 8. ts_print(&h->ts); 9. print_info = (struct print_info *)user; 10. /* 11. * Some printers want to check that they're not walking off the 12. * end of the packet. 13. * Rather than pass it all the way down, we set this global. 14. */ 15. snapend = sp + h->caplen; 16. if(print_info->ndo_type) { 17. hdrlen = (*print_info->p.ndo_printer)(print_info->ndo, h, sp);<==== 18. } else { 19. hdrlen = (*print_info->p.printer)(h, sp); 20. } 21. putchar('n'); 22. --infodelay; 23. if (infoprint) 24. info(0);}
**- Bits 0-54 : physical frame number if present.** - Bit 55 : page table entry is soft-dirty. - Bit 56 : page exclusively mapped. - Bits 57-60 : zero - Bit 61 : page is file-page or shared-anon. - Bit 62 : page is swapped. - Bit 63 : page is present.
/* check if this is the last frame */ if (tcp_send_offset + tcp_chunk_size >= tcp_data_len) { is_last_frame = 1; chunk_size = tcp_data_len - tcp_send_offset; }
+ 
+ 
