<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[Mikasys的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/Mikasys</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; Mikasys]]></copyright><item><title><![CDATA[驱动开发 借壳通信]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/116604896</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/116604896</guid><author>Mikasys</author><pubDate>Wed, 20 Oct 2021 13:44:19 +0800</pubDate><description><![CDATA[Ring3
#include &lt;stdio.h&gt;
#include &lt;windows.h&gt;

#define LINK_NAME L"\\\\.\\ndis"

//控制码起始地址
#define  IRP_IOCTRL_BASE 0x8000
//控制码宏定义
#define IRP_IOCTRL_CODE(i) CTL_CODE(FILE_DEVICE_UNKNOWN,IRP_IOCTRL_BASE + i,METHOD_BUFFERED,FILE_ALL_ACCESS)
//控]]></description><category></category></item><item><title><![CDATA[驱动开发1]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/116563387</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/116563387</guid><author>Mikasys</author><pubDate>Wed, 20 Oct 2021 13:43:30 +0800</pubDate><description><![CDATA[64位新增

PG    如果修改SSDT GDT ntosk，直接蓝，而且检查是随机的。
DES   强制签名

内存操作
#include &lt;ntifs.h&gt;
//wdm.h
//ntifs.h

VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
	UNREFERENCED_PARAMETER(pDriver);
	DbgPrint("卸载成功!\n");
}



NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver,]]></description><category></category></item><item><title><![CDATA[用户句柄表的遍历]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/116950408</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/116950408</guid><author>Mikasys</author><pubDate>Wed, 20 Oct 2021 13:42:27 +0800</pubDate><description><![CDATA[私有句柄表
_HANDLE_TABLE_ENTRY的Object直接指向_OBJECT_HEADER不用减
#include &lt;ntifs.h&gt;

//一个页最大容纳的_HANDLE_TABLE_ENTRY
#define MAX_ENTRY_COUNT (0x1000/sizeof(HANDLE_TABLE_ENTRY))  

//未公开未文档化
typedef PVOID(NTAPI *OBGETOBJECTTYPE)(IN PVOID pObject);
EXTERN_C NTKERNE]]></description><category></category></item><item><title><![CDATA[EPROCESS 遍历进程 隐藏 保护]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/116723731</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/116723731</guid><author>Mikasys</author><pubDate>Wed, 20 Oct 2021 13:40:47 +0800</pubDate><description><![CDATA[0: kd&gt; dt _KPROCESS
nt!_KPROCESS
   +0x000 Header           : _DISPATCHER_HEADER		//dt _KEVENT
   +0x018 ProfileListHead  : _LIST_ENTRY			//任务管理器上的性能
   +0x028 DirectoryTableBase : Uint8B				//cr3
   +0x030 ThreadListHead   : _LIST_ENTRY			//当前进程所有线程
  ]]></description><category></category></item><item><title><![CDATA[驱动的遍历和隐藏]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/116766202</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/116766202</guid><author>Mikasys</author><pubDate>Wed, 20 Oct 2021 13:39:57 +0800</pubDate><description><![CDATA[DRIVER_OBJECT
0: kd&gt; dt _DRIVER_OBJECT
nt!_DRIVER_OBJECT
   +0x000 Type             : Int2B
   +0x002 Size             : Int2B
   +0x008 DeviceObject     : Ptr64 _DEVICE_OBJECT
   +0x010 Flags            : Uint4B
   +0x018 DriverStart      : Ptr64 Void
]]></description><category></category></item><item><title><![CDATA[Msf木马偷其他程序的Token 实现提权]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/117218052</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/117218052</guid><author>Mikasys</author><pubDate>Wed, 20 Oct 2021 13:38:50 +0800</pubDate><description><![CDATA[#include &lt;windows.h&gt;
#include &lt;TlHelp32.h&gt;
#include &lt;iostream&gt;

DWORD getParentProcessID() { //返回explorer.exe的pid
	HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	PROCESSENTRY32 process = { 0 };
	process.dwSize = sizeo]]></description><category></category></item><item><title><![CDATA[使用upx压缩生成的vs程序]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/118379398</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/118379398</guid><author>Mikasys</author><pubDate>Wed, 20 Oct 2021 13:36:28 +0800</pubDate><description><![CDATA[属性-生成事件-后期生成事件-命令行
$(SolutionDir)..\tools\upx-win64\upx.exe -7v "$(TargetPath)"


]]></description><category></category></item><item><title><![CDATA[x64 Global HANDLE 全局句柄表]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/116893893</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/116893893</guid><author>Mikasys</author><pubDate>Wed, 20 Oct 2021 13:34:50 +0800</pubDate><description><![CDATA[全局句柄表
0: kd&gt; dq PspCidTable
fffff800`04070408  fffff8a0`00004880 00000000`00000000
fffff800`04070418  ffffffff`80000020 00000000`00000101
fffff800`04070428  ffffffff`80000298 ffffffff`80000024
fffff800`04070438  00000000`00000000 00000000`00000113
fffff]]></description><category></category></item><item><title><![CDATA[Ring3下蓝屏的代码demo]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/120512961</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/120512961</guid><author>Mikasys</author><pubDate>Wed, 20 Oct 2021 13:30:48 +0800</pubDate><description><![CDATA[0x00 前言
蓝屏死机（英语：Blue Screen of Death，缩写：BSoD）指的是微软Windows操作系统在无法从一个系统错误中恢复过来时所显示的屏幕图像。
如下图所示经典的XP蓝屏

早在XP时代，大家应该经常能够看见蓝屏。处在Win10时代，Win11即将面世的今天，由于PG、各种验证机制的保护，以及MS各种漏洞补丁的修补，虽然不像之前那样漏洞百出，仍人宰割，但是还是存在着各种各样的问题，从我们今天讲的内容就可见一斑。
0x01 Ring3蓝屏的方式
简单的可以分成2类，实际上全是一类，]]></description><category></category></item><item><title><![CDATA[C++ 底层分析 7.malloc free new delete]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/115868095</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/115868095</guid><author>Mikasys</author><pubDate>Tue, 27 Apr 2021 21:46:01 +0800</pubDate><description><![CDATA[1.malloc和free底层调用
malloc-&gt;_nh_malloc_dbg-&gt;_heap_alloc_dbg-&gt;_heap_alloc_base-&gt;HeapAlloc
free-&gt;_free_dbg-&gt;_free_base-&gt;HeapFree

]]></description><category></category></item><item><title><![CDATA[C++ 底层分析 6.模板、引用、友元、运算符重载]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/115622210</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/115622210</guid><author>Mikasys</author><pubDate>Tue, 27 Apr 2021 21:45:27 +0800</pubDate><description><![CDATA[1.模板
#include &lt;iostream&gt;

using namespace std;

template&lt;class T&gt;
void Swap(T &amp;a,T &amp;b)
{
	a = a + b;
	b = a - b;
	a = a - b;
}
int main() 
{
	double a = 1.5456456456,b = 2.5456546546;
	printf("%lf %lf\n",a,b);
	Swap(a,b);
	printf("%lf %]]></description><category></category></item><item><title><![CDATA[C++ 底层分析 5.动态绑定、多态]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/115362976</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/115362976</guid><author>Mikasys</author><pubDate>Tue, 27 Apr 2021 21:44:45 +0800</pubDate><description><![CDATA[1.多继承无函数覆盖
struct Base1						
{						
public:						
    virtual void Fn_1()						
    {						
        printf("Base1:Fn_1...\n");						
    }						
    virtual void Fn_2()						
    {						
        printf("Base1:Fn_2...\n");						
    }						
};						
struc]]></description><category></category></item><item><title><![CDATA[C++ 底层分析 4.虚函数表]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/115347968</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/115347968</guid><author>Mikasys</author><pubDate>Tue, 27 Apr 2021 21:44:20 +0800</pubDate><description><![CDATA[kd&gt; u IopCreateFile l200
nt!IopCreateFile:
80576c2c 6a3c            push    3Ch
80576c2e 6898a14d80      push    offset nt!GUID_DOCK_INTERFACE+0x54 (804da198)
80576c33 e8485ffcff      call    nt!_SEH_prolog (8053cb80)
80576c38 64a124010000    mov     ea]]></description><category></category></item><item><title><![CDATA[C++ 堆栈小问题]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/115324327</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/115324327</guid><author>Mikasys</author><pubDate>Tue, 27 Apr 2021 21:43:44 +0800</pubDate><description><![CDATA[下面两个程序最终i的值不一样，但是反汇编居然一样，太诡异了
#include &lt;iostream&gt;
using namespace std;
int main() 
{
    int i = 10;
    &amp;i;
	if(i == 10) 
	{
		int i = 3;		//最终i=10
		//i = 3	        //最终i = 3
	}
    return 0;




vs2010使得上述代码的反汇编完全一样，让人琢磨不透，最终还是用vc6发现了端倪

结论：以这]]></description><category></category></item><item><title><![CDATA[C++ 底层分析 3.权限控制 Class]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/115152030</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/115152030</guid><author>Mikasys</author><pubDate>Tue, 27 Apr 2021 21:43:07 +0800</pubDate><description><![CDATA[1.将定义与实现分开
将定义与实现分离，代码会有更好的可读性，但不是必须的

xxx.h 只是一个文件，可以是任何的后缀名,如果你愿意，可以叫xxx.exe
#include 的作用只是把里面的内容复制过来 仅此而已.
如：#include "abc.exe
xxx.h 与 xxx.cpp并不要求一定同名

2.public private的使用
public：这个成员哪里都可以用，不用担心被修改，所以，一旦发布成public的成员，是不能够改名字的.
private：这个成员只用于内部使用，不要在其他的地]]></description><category></category></item><item><title><![CDATA[C++ 底层分析 2.构造-析构，继承]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/115124241</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/115124241</guid><author>Mikasys</author><pubDate>Tue, 27 Apr 2021 21:42:30 +0800</pubDate><description><![CDATA[析构函数（初始）
可以没有，有了必须按照规则用
作用：初始化对象用的，创造对象的时候调用
特点：3个


重载：函数名字一样  参数个数或者类型不一样
析构函数（清理）

]]></description><category></category></item><item><title><![CDATA[C++ 底层分析 1.this 指针]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/115046335</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/115046335</guid><author>Mikasys</author><pubDate>Tue, 27 Apr 2021 21:42:05 +0800</pubDate><description><![CDATA[1.结构体参数传递：相当于复制一份，浪费空间
struct Base
{
	int x;
	int y;
	int z;
};
void function(Base b){}
int main(int argc, char* argv[])
{
	Base base;
	function(base);
	return 0;
}


2.结构体指针参数传递：只传结构体首地址，节省空间
struct Base
{
	int x;
	int y;
};
int Max(Base* pb)
{
	if (pb-&g]]></description><category></category></item><item><title><![CDATA[4.Inline Hook模板]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/109688701</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/109688701</guid><author>Mikasys</author><pubDate>Sat, 14 Nov 2020 11:42:13 +0800</pubDate><description><![CDATA[#include "stdafx.h"
#include "DebugTool.h"


DWORD g_dwHookAddr; //Hook开始的地方
DWORD g_dwRetAddr; //Hook结束的地方
DWORD g_dwLength; //Hook字节数
PBYTE g_pCodePatch; //存储Hook原来的硬编码
DWORD g_dwHookFlag; //HOOK状态， 1 Hook成功， 0 HOOK 失败

typedef struct _REGISTER
{
	DWORD ]]></description><category></category></item><item><title><![CDATA[3.KPCR，等待链表，调度链表]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/109613170</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/109613170</guid><author>Mikasys</author><pubDate>Wed, 11 Nov 2020 10:44:37 +0800</pubDate><description><![CDATA[一、内容回顾
内容回顾
进程在内核中对应结构体：EPROCESS

线程在内核中对应结构体：ETHREAD

CPU在内核中也有一个对应的结构体：KPCR

二、KPCR结构
kd&gt; dt _KPCR
nt!_KPCR
   +0x000 NtTib            : _NT_TIB
   +0x01c SelfPcr          : Ptr32 _KPCR
   +0x020 Prcb             : Ptr32 _KPRCB
   +0x024 Irql         ]]></description><category></category></item><item><title><![CDATA[番外：win32k.sys什么情况下会挂上PTE]]></title><link>https://blog.youkuaiyun.com/Mikasys/article/details/109561293</link><guid>https://blog.youkuaiyun.com/Mikasys/article/details/109561293</guid><author>Mikasys</author><pubDate>Sun, 08 Nov 2020 17:53:52 +0800</pubDate><description><![CDATA[一、前因
在HOOK SSDT Shadow的时候老师说，必须要调用一个界面函数使自己成为GUI进程(线程)，才会给这个进程挂上PTE，我对此表示怀疑，于是有了以下探讨
二、探究
1、首先来看一下system进程
查询所有进程
kd&gt; !process 0 0
**** NT ACTIVE PROCESS DUMP ****
PROCESS 867b5830  SessionId: none  Cid: 0004    Peb: 00000000  ParentCid: 0000
    DirBas]]></description><category></category></item></channel></rss>