diff --git a/2000/01/01/hello-world/index.html b/2000/01/01/hello-world/index.html
index 4b41adcf..3c0236dc 100644
--- a/2000/01/01/hello-world/index.html
+++ b/2000/01/01/hello-world/index.html
@@ -657,7 +657,7 @@
- 15.5k
+ 15.8k
diff --git a/2018/11/16/BIBA访问控制模型实现(python)/index.html b/2018/11/16/BIBA访问控制模型实现(python)/index.html
index 0e178466..95054296 100644
--- a/2018/11/16/BIBA访问控制模型实现(python)/index.html
+++ b/2018/11/16/BIBA访问控制模型实现(python)/index.html
@@ -845,7 +845,7 @@
- 15.5k
+ 15.8k
diff --git a/2018/12/15/miio-control/index.html b/2018/12/15/miio-control/index.html
index 1986fcad..8914bccf 100644
--- a/2018/12/15/miio-control/index.html
+++ b/2018/12/15/miio-control/index.html
@@ -747,7 +747,7 @@
- 15.5k
+ 15.8k
diff --git a/2018/12/23/基于规则引擎发现IOT设备/index.html b/2018/12/23/基于规则引擎发现IOT设备/index.html
index 64de1153..d53a3d98 100644
--- a/2018/12/23/基于规则引擎发现IOT设备/index.html
+++ b/2018/12/23/基于规则引擎发现IOT设备/index.html
@@ -747,7 +747,7 @@
- 15.5k
+ 15.8k
diff --git a/2018/12/25/TCPDUMP拒绝服务攻击漏洞/index.html b/2018/12/25/TCPDUMP拒绝服务攻击漏洞/index.html
index cc29d52a..e54fd486 100644
--- a/2018/12/25/TCPDUMP拒绝服务攻击漏洞/index.html
+++ b/2018/12/25/TCPDUMP拒绝服务攻击漏洞/index.html
@@ -752,7 +752,7 @@
- 15.5k
+ 15.8k
diff --git a/2019/01/16/wifi半双工侧信道攻击学习笔记/index.html b/2019/01/16/wifi半双工侧信道攻击学习笔记/index.html
index 31344173..6fb1d1c3 100644
--- a/2019/01/16/wifi半双工侧信道攻击学习笔记/index.html
+++ b/2019/01/16/wifi半双工侧信道攻击学习笔记/index.html
@@ -875,7 +875,7 @@ Server -------wire----------|
- 15.5k
+ 15.8k
diff --git a/2019/02/22/qq数据库的加密解密/index.html b/2019/02/22/qq数据库的加密解密/index.html
index d7d972f4..49ba8177 100644
--- a/2019/02/22/qq数据库的加密解密/index.html
+++ b/2019/02/22/qq数据库的加密解密/index.html
@@ -724,7 +724,7 @@
- 15.5k
+ 15.8k
diff --git a/2019/03/16/小米固件工具mkxqimage/index.html b/2019/03/16/小米固件工具mkxqimage/index.html
index 2f7c674f..65063ca6 100644
--- a/2019/03/16/小米固件工具mkxqimage/index.html
+++ b/2019/03/16/小米固件工具mkxqimage/index.html
@@ -731,7 +731,7 @@
- 15.5k
+ 15.8k
diff --git a/2019/03/23/auto-send-WX/index.html b/2019/03/23/auto-send-WX/index.html
index 7e42186c..3c1d5b9c 100644
--- a/2019/03/23/auto-send-WX/index.html
+++ b/2019/03/23/auto-send-WX/index.html
@@ -741,7 +741,7 @@
- 15.5k
+ 15.8k
diff --git a/2019/03/25/Samba-CVE/index.html b/2019/03/25/Samba-CVE/index.html
index a67b28b7..4c68cec2 100644
--- a/2019/03/25/Samba-CVE/index.html
+++ b/2019/03/25/Samba-CVE/index.html
@@ -766,7 +766,7 @@
- 15.5k
+ 15.8k
diff --git a/2019/03/28/逆向工程实验/index.html b/2019/03/28/逆向工程实验/index.html
index 481c6459..c344826a 100644
--- a/2019/03/28/逆向工程实验/index.html
+++ b/2019/03/28/逆向工程实验/index.html
@@ -93,7 +93,7 @@
-
+
@@ -414,7 +414,7 @@
- 845 字
+ 1.1k 字
@@ -506,7 +506,7 @@
使调试器窗口不可用
终止调试器进程
-PE文件格式基础
实验1:软件破解
对象
crack.exe,28.0 KB
+PE文件格式基础
加壳脱壳
实验1:软件破解
对象
crack.exe,28.0 KB
- 无保护措施:无壳、未加密、无反调试措施
- 用户名至少要5个字节
@@ -518,19 +518,32 @@
修改程序跳转
- 现在关闭IDA,换用OllyDbg进行动态调试来看看程序时如何分支跳转的Ctrl+G直接跳到由IDA得到的VA:004010F9处查看那条引起程序分支的关键指令
- 选中这条指令,按F2设置断点,再按F9运行程序,这时候控制权会回到程序,OllyDbg暂时挂起。到程序提示输入名字和序列号,随意输入(名字大于五个字节),点击ok后,OllyDbg会重新中断程序,收回控制权,如图:
-- 验证函数的返回值存于EAX寄存器中,if语句通过以下两条指令执行
-
+验证函数的返回值存于EAX寄存器中,if语句通过以下两条指令执行
-
也就是说,当序列号输入错误时,EAX中的值为0,跳转将被执行。
如果我们把jnz这条指令修改为jz,那么整个程序的逻辑就会反过来。
双击jnz这条指令,将其改为jz,单击”汇编”将其写入内存
可以看到此时程序执行了相反的路径
上面只是在内存中修改程序,我们还需要在二进制文件中也修改相应的字节,这里考察VA与文件地址之间的关系
-- 用LordPE打开.exe文件,查看PE文件的节信息
+- 用LordPE打开.exe文件,查看PE文件的节信息
根据VA与文件地址的换算公式:1 2 3
| 文件偏移地址 = VA - Image Base - 节偏移 = 0x004010F9 - 0x00400000 - 0 = 0x10F9
|
+
-根据VA与文件地址的换算公式:
1 2 3
| 文件偏移地址 = VA - Image Base - 节偏移 = 0x004010F9 - 0x00400000 - 0 = 0x10F9
|
也就是说,这条指令在PE文件中位于10F9字节处,使用010Editer打开crack.exe,将这一字节的75(JNZ)改为74(JZ),保存后重新执行,破解成功!
-编写注册机
1. 查找显示注册结果相关代码
2. 查找注册码验证相关代码
3. 根据注册码验证代码编写注册机
+编写注册机
查找显示注册结果相关代码
查找注册码验证相关代码
根据注册码验证代码编写注册机
实验二:软件反动态调试技术分析
对象
CrackMe1.exe 1641.0 KB
无保护措施:无壳、未加密、无反调试措施
使用OllyDbg对该程序进行调试时,程序会自动退出
+要求
+- 分析CrackMe1.exe是如何通过父进程检测实现反OllyDbg调试的
+- 分析除父进程检测外,该程序用到的反动态调试技术
+
+实验三:加花加密反调试技术分析
对象
CrackMe2.exe 9.00 KB
保护措施:部分加花、部分加密、简单反调试
根据(提示)[https://res.cloudinary.com/dozyfkbg3/raw/upload/v1553779403/%E8%BD%AF%E4%BB%B6%E7%A0%B4%E8%A7%A3/Crackme2%E6%8F%90%E7%A4%BA.docx]分析该程序
+内容
+- 加壳脱壳深入理解
+- 尝试手动脱壳
+- 分析CrackMe2.exe中花指令
+- 分析CrackMe2.exe中的被加密的函数的功能
+- 分析CrackMe2.exe中的反调试手段
+- 分析CrackMe2.exe中混合的64位代码的功能
+
+
@@ -766,7 +779,7 @@
-
+
@@ -798,7 +811,7 @@
- 15.5k
+ 15.8k
diff --git a/about/index.html b/about/index.html
index 7fcb7e73..b983ec10 100644
--- a/about/index.html
+++ b/about/index.html
@@ -466,7 +466,7 @@
- 15.5k
+ 15.8k
diff --git a/archives/2000/01/index.html b/archives/2000/01/index.html
index 4aee90f5..222d26a3 100644
--- a/archives/2000/01/index.html
+++ b/archives/2000/01/index.html
@@ -496,7 +496,7 @@
- 15.5k
+ 15.8k
diff --git a/archives/2000/index.html b/archives/2000/index.html
index a283eacc..1247c23d 100644
--- a/archives/2000/index.html
+++ b/archives/2000/index.html
@@ -496,7 +496,7 @@
- 15.5k
+ 15.8k
diff --git a/archives/2018/11/index.html b/archives/2018/11/index.html
index 6d393b08..a132a81c 100644
--- a/archives/2018/11/index.html
+++ b/archives/2018/11/index.html
@@ -496,7 +496,7 @@
- 15.5k
+ 15.8k
diff --git a/archives/2018/12/index.html b/archives/2018/12/index.html
index 258a21d0..a6b0345d 100644
--- a/archives/2018/12/index.html
+++ b/archives/2018/12/index.html
@@ -566,7 +566,7 @@
- 15.5k
+ 15.8k
diff --git a/archives/2018/index.html b/archives/2018/index.html
index cb9bb2dc..895317fb 100644
--- a/archives/2018/index.html
+++ b/archives/2018/index.html
@@ -601,7 +601,7 @@
- 15.5k
+ 15.8k
diff --git a/archives/2019/01/index.html b/archives/2019/01/index.html
index ed2aaa8d..c92cf8de 100644
--- a/archives/2019/01/index.html
+++ b/archives/2019/01/index.html
@@ -496,7 +496,7 @@
- 15.5k
+ 15.8k
diff --git a/archives/2019/02/index.html b/archives/2019/02/index.html
index b45e6caf..107a6bb0 100644
--- a/archives/2019/02/index.html
+++ b/archives/2019/02/index.html
@@ -496,7 +496,7 @@
- 15.5k
+ 15.8k
diff --git a/archives/2019/03/index.html b/archives/2019/03/index.html
index e185a421..1c532d28 100644
--- a/archives/2019/03/index.html
+++ b/archives/2019/03/index.html
@@ -601,7 +601,7 @@
- 15.5k
+ 15.8k
diff --git a/archives/2019/index.html b/archives/2019/index.html
index 0d6f53fb..3aa33b9a 100644
--- a/archives/2019/index.html
+++ b/archives/2019/index.html
@@ -671,7 +671,7 @@
- 15.5k
+ 15.8k
diff --git a/archives/index.html b/archives/index.html
index 7140022d..405964e9 100644
--- a/archives/index.html
+++ b/archives/index.html
@@ -820,7 +820,7 @@
- 15.5k
+ 15.8k
diff --git a/archives/page/2/index.html b/archives/page/2/index.html
index 88b479f7..4eb939c9 100644
--- a/archives/page/2/index.html
+++ b/archives/page/2/index.html
@@ -500,7 +500,7 @@
- 15.5k
+ 15.8k
diff --git a/bookmarks/index.html b/bookmarks/index.html
index ab334b65..53aba9a3 100644
--- a/bookmarks/index.html
+++ b/bookmarks/index.html
@@ -518,7 +518,7 @@
- 15.5k
+ 15.8k
diff --git a/categories/IOT/index.html b/categories/IOT/index.html
index ae660c89..da315f6c 100644
--- a/categories/IOT/index.html
+++ b/categories/IOT/index.html
@@ -529,7 +529,7 @@
- 15.5k
+ 15.8k
diff --git a/categories/index.html b/categories/index.html
index 67b43a66..896e708a 100644
--- a/categories/index.html
+++ b/categories/index.html
@@ -468,7 +468,7 @@
- 15.5k
+ 15.8k
diff --git a/categories/二进制/index.html b/categories/二进制/index.html
index 233394a5..70d47811 100644
--- a/categories/二进制/index.html
+++ b/categories/二进制/index.html
@@ -477,7 +477,7 @@
- 15.5k
+ 15.8k
diff --git a/categories/加密解密/index.html b/categories/加密解密/index.html
index 25e392bb..40ac42b0 100644
--- a/categories/加密解密/index.html
+++ b/categories/加密解密/index.html
@@ -477,7 +477,7 @@
- 15.5k
+ 15.8k
diff --git a/categories/杂七杂八/index.html b/categories/杂七杂八/index.html
index 089a18aa..7de45547 100644
--- a/categories/杂七杂八/index.html
+++ b/categories/杂七杂八/index.html
@@ -477,7 +477,7 @@
- 15.5k
+ 15.8k
diff --git a/categories/理论学习/index.html b/categories/理论学习/index.html
index b2730da1..84619bcf 100644
--- a/categories/理论学习/index.html
+++ b/categories/理论学习/index.html
@@ -477,7 +477,7 @@
- 15.5k
+ 15.8k
diff --git a/categories/顶会论文/index.html b/categories/顶会论文/index.html
index eb07402a..d26ba015 100644
--- a/categories/顶会论文/index.html
+++ b/categories/顶会论文/index.html
@@ -503,7 +503,7 @@
- 15.5k
+ 15.8k
diff --git a/index.html b/index.html
index 95d2cb16..93c4135e 100644
--- a/index.html
+++ b/index.html
@@ -395,7 +395,7 @@
- 845 字
+ 1.1k 字
@@ -2354,7 +2354,7 @@ ettercap嗅探智能设备和网关之间的流量sudo ettercap -i ens33 -T -q
- 15.5k
+ 15.8k
diff --git a/page/2/index.html b/page/2/index.html
index 249cf8c6..d46936f9 100644
--- a/page/2/index.html
+++ b/page/2/index.html
@@ -604,7 +604,7 @@
- 15.5k
+ 15.8k
diff --git a/search.xml b/search.xml
index d98e37a3..8cfe0d96 100644
--- a/search.xml
+++ b/search.xml
@@ -3,7 +3,7 @@
%2F2019%2F03%2F28%2F%E9%80%86%E5%90%91%E5%B7%A5%E7%A8%8B%E5%AE%9E%E9%AA%8C%2F
-
+
-二进制
diff --git a/sitemap.xml b/sitemap.xml
index bb556c59..647be0a4 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -4,7 +4,7 @@
https://cool-y.github.io/2019/03/28/%E9%80%86%E5%90%91%E5%B7%A5%E7%A8%8B%E5%AE%9E%E9%AA%8C/
- 2019-03-28T13:05:56.799Z
+ 2019-03-28T13:28:37.246Z
diff --git a/tags/CVE/index.html b/tags/CVE/index.html
index e8f8ef25..1747135c 100644
--- a/tags/CVE/index.html
+++ b/tags/CVE/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/QQ/index.html b/tags/QQ/index.html
index d7e60480..c1995553 100644
--- a/tags/QQ/index.html
+++ b/tags/QQ/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/SSH/index.html b/tags/SSH/index.html
index 14374b9d..ee694514 100644
--- a/tags/SSH/index.html
+++ b/tags/SSH/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/Samba/index.html b/tags/Samba/index.html
index d35f980c..2e12ae3f 100644
--- a/tags/Samba/index.html
+++ b/tags/Samba/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/TCPDUMP/index.html b/tags/TCPDUMP/index.html
index 14a3af7a..a1d52ea1 100644
--- a/tags/TCPDUMP/index.html
+++ b/tags/TCPDUMP/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/USENIX/index.html b/tags/USENIX/index.html
index a8394aca..d83d36bd 100644
--- a/tags/USENIX/index.html
+++ b/tags/USENIX/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/index.html b/tags/index.html
index 3140c5be..88661235 100644
--- a/tags/index.html
+++ b/tags/index.html
@@ -468,7 +468,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/itchat/index.html b/tags/itchat/index.html
index 876361f4..925f2231 100644
--- a/tags/itchat/index.html
+++ b/tags/itchat/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/miio/index.html b/tags/miio/index.html
index a6e9f062..95e19e4c 100644
--- a/tags/miio/index.html
+++ b/tags/miio/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/python/index.html b/tags/python/index.html
index b4f7661e..8c95b624 100644
--- a/tags/python/index.html
+++ b/tags/python/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/wifi/index.html b/tags/wifi/index.html
index ea33f5a2..f1b94abd 100644
--- a/tags/wifi/index.html
+++ b/tags/wifi/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/中间人/index.html b/tags/中间人/index.html
index a572e028..4d509a1b 100644
--- a/tags/中间人/index.html
+++ b/tags/中间人/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/侧信道攻击/index.html b/tags/侧信道攻击/index.html
index 24466dd4..1984e584 100644
--- a/tags/侧信道攻击/index.html
+++ b/tags/侧信道攻击/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/密码/index.html b/tags/密码/index.html
index 07a3ece0..0af0f086 100644
--- a/tags/密码/index.html
+++ b/tags/密码/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/小米/index.html b/tags/小米/index.html
index 911956f4..9d950a55 100644
--- a/tags/小米/index.html
+++ b/tags/小米/index.html
@@ -502,7 +502,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/微信/index.html b/tags/微信/index.html
index 57227079..ea7ee812 100644
--- a/tags/微信/index.html
+++ b/tags/微信/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/拒绝服务攻击/index.html b/tags/拒绝服务攻击/index.html
index 5d9ebee5..a0f461d5 100644
--- a/tags/拒绝服务攻击/index.html
+++ b/tags/拒绝服务攻击/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/数据库/index.html b/tags/数据库/index.html
index 2c499113..ed86e37c 100644
--- a/tags/数据库/index.html
+++ b/tags/数据库/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/数据挖掘/index.html b/tags/数据挖掘/index.html
index 61bd917a..d056d52d 100644
--- a/tags/数据挖掘/index.html
+++ b/tags/数据挖掘/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/文件格式/index.html b/tags/文件格式/index.html
index 5d6b34dd..30170074 100644
--- a/tags/文件格式/index.html
+++ b/tags/文件格式/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/模型实现/index.html b/tags/模型实现/index.html
index 5cffe968..13d65098 100644
--- a/tags/模型实现/index.html
+++ b/tags/模型实现/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/自然语言处理/index.html b/tags/自然语言处理/index.html
index ca54a8e6..ac520825 100644
--- a/tags/自然语言处理/index.html
+++ b/tags/自然语言处理/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/访问控制/index.html b/tags/访问控制/index.html
index 1e2a10e3..246cba64 100644
--- a/tags/访问控制/index.html
+++ b/tags/访问控制/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/远程执行/index.html b/tags/远程执行/index.html
index 7607b65f..36c07d1d 100644
--- a/tags/远程执行/index.html
+++ b/tags/远程执行/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/逆向/index.html b/tags/逆向/index.html
index 1ee50386..8a99448c 100644
--- a/tags/逆向/index.html
+++ b/tags/逆向/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k
diff --git a/tags/重放攻击/index.html b/tags/重放攻击/index.html
index fc1294ef..bb13cf41 100644
--- a/tags/重放攻击/index.html
+++ b/tags/重放攻击/index.html
@@ -476,7 +476,7 @@
- 15.5k
+ 15.8k