<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[cumirror的专栏]]></title><description><![CDATA[编程学习者]]></description><link>https://blog.youkuaiyun.com/cumirror</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; cumirror]]></copyright><item><title><![CDATA[关于naked (C++)]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/7848426</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/7848426</guid><author>cumirror</author><pubDate>Thu, 09 Aug 2012 23:48:25 +0800</pubDate><description><![CDATA[MSDN中关于naked关键字的介绍：
For functions declared with the naked attribute, 
the compiler generates code without prolog and epilog code. You can use this feature to write your own prolog/epilog code sequen]]></description><category></category></item><item><title><![CDATA[wireshark过滤语法总结]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/7054496</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/7054496</guid><author>cumirror</author><pubDate>Fri, 09 Dec 2011 22:38:50 +0800</pubDate><description><![CDATA[做应用识别这一块经常要对应用产生的数据流量进行分析。
抓包采用wireshark，提取特征时，要对session进行过滤，找到关键的stream，这里总结了wireshark过滤的基本语法，供自己以后参考。（脑子记不住东西）


wireshark进行过滤时，按照过滤的语法可分为协议过滤和内容过滤。
对标准协议，既支持粗粒度的过滤如HTTP，也支持细粒度的、依据协议属性值进行的过滤如tc]]></description><category></category></item><item><title><![CDATA[NDISLWF how to modify the packet]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/6688412</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/6688412</guid><author>cumirror</author><pubDate>Mon, 15 Aug 2011 15:25:34 +0800</pubDate><description><![CDATA[http://www.osronline.com/showThread.cfm?link=172579

You are not generally permitted to modify something that your driver doesnot 'own'. A]]></description><category></category></item><item><title><![CDATA[一道百度试题]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/6676770</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/6676770</guid><author>cumirror</author><pubDate>Wed, 10 Aug 2011 20:38:43 +0800</pubDate><description><![CDATA[有一串首尾相连的珠子，共有m个，每一个珠子有一种颜色，并且颜色的总数不超过n(n]]></description><category></category></item><item><title><![CDATA[NDISLWF how to block stream]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/6675411</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/6675411</guid><author>cumirror</author><pubDate>Wed, 10 Aug 2011 12:58:00 +0800</pubDate><description><![CDATA[下面的代码中部分是伪代码，但关键的流程整理出来了，过滤databuffer，将允许通过的NBL和不允许通过的NBL分别加入
NBL_QUEUE_HEADER NblSendQueue;或NBL_QUEUE_HEADER NblDropQueue;链表中。然后将两个NBLs分别进]]></description><category></category></item><item><title><![CDATA[ndis6.0 NetBufferSend相关函数与数据结构]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/6644815</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/6644815</guid><author>cumirror</author><pubDate>Mon, 01 Aug 2011 19:35:08 +0800</pubDate><description><![CDATA[FilterSendNetBufferListsComplete：
NDIS calls the FilterSendNetBufferListsComplete function to complete a send request that a filter driver]]></description><category></category></item><item><title><![CDATA[微博内容过滤]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/6632986</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/6632986</guid><author>cumirror</author><pubDate>Mon, 25 Jul 2011 21:00:57 +0800</pubDate><description><![CDATA[今天精神不太好，突然想到如何针对weibo的内容做流量过滤，以前做过应用识别方面的东西，对这方面比较熟悉，于是安装wireshark抓包，看看在微博上发消息数据包到底是什么样子的。我用的是新浪微博，发了三条内容如下：通过wireshark过滤找到了相应的session，对应包的内]]></description><category></category></item><item><title><![CDATA[全排列，递归实现]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/6584149</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/6584149</guid><author>cumirror</author><pubDate>Mon, 04 Jul 2011 18:56:49 +0800</pubDate><description><![CDATA[最近在看linux C一站式学习（http://learn.akae.cn/media/index.html），里面关于C的基础大部分都了解，对GDB、汇编和后面关于linux编程的内容比较感兴趣，不过还是重头把文档看了下，8.3后面的一个习题尝试自己写了下。]]></description><category></category></item><item><title><![CDATA[linux学习资料，更新ing]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/6572982</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/6572982</guid><author>cumirror</author><pubDate>Tue, 28 Jun 2011 16:21:00 +0800</pubDate><description><![CDATA[最近在看oldlinux的源码，可惜基础薄弱，囫囵吞枣了一遍，虽然没能学到很多，但对于操作系统中的一些基本概念，如copy on write, load on demand，页式管理等，有了比较好的理解。 下面链接中，对“逻辑地址、线性地址、物理地址和虚拟地址”的概念讲得挺透彻。http://bbs.chinaunix.net/thread-2083672-1-1.html 这个链接中，对于old]]></description><category></category></item><item><title><![CDATA[CHash、spinlock等知识点小结]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/6310298</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/6310298</guid><author>cumirror</author><pubDate>Fri, 08 Apr 2011 18:04:00 +0800</pubDate><description><![CDATA[CHash即cache hash，主要是考虑buket中有多个item时，考虑到cache的大小，如mips中是128字节，可以把buket指向的item设置为128字节，里面用一个bitmap和几个指针地址指向具体的item。spinlock：自旋锁，如果没有申请到锁，会一直占用到它的时间片结束。注意调用spinlock时往往要关闭中断，防止死锁。相关知识有：进程翻转。找到了一个参考网页：http://www.ibm.com/developerworks/cn/linux/l-cn-spinlock/]]></description><category></category></item><item><title><![CDATA[queue(3)--freebsd中的queue结构使用]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/6283655</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/6283655</guid><author>cumirror</author><pubDate>Mon, 28 Mar 2011 15:13:00 +0800</pubDate><description><![CDATA[<br />前几天看代码，发现有类似这样的结构：<br /> <br />	TAILQ_FOREACH(np, &head, entries){
		printf("%d  %d/n", np->a1, np->a2);
	} <br />我没太多代码编写经验，初读的时候能模糊知道和for_each()函数类似，但十分好奇是如何实现了,后来在发现引用了queue.h头文件，是freebsd里定义的一头文件，采用宏定义的形式实现了4种基本的数据结构，没做太多深入的理解，我简单把其中的Tail queue拿]]></description><category></category></item><item><title><![CDATA[DNS域名压缩]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/6276581</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/6276581</guid><author>cumirror</author><pubDate>Fri, 25 Mar 2011 09:49:00 +0800</pubDate><description><![CDATA[<br />前几天大家讨论DNS协议时，突然发现一些字段长度与实际编码不一致。<br /> <br /> <br />后来仔细看了DNS协议，发现，在返回结果中有许多域名可能是重复的，为了避免不必要的开销，DNS协议中使用了压缩方法。<br /> <br />当一个域名中的标识符是压缩的，它的单记数字节中的最高两位被置为11，剩下的14bit说明实际域名所在位置相对DNS起始表示字段的偏移。<br /> <br />插图片太麻烦了...就简单的写写记录下来，感兴趣的自己再去深入看看。<br /> ]]></description><category></category></item><item><title><![CDATA[c语言小的知识点int* a[5]   int (*b)[5]]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/6247561</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/6247561</guid><author>cumirror</author><pubDate>Mon, 14 Mar 2011 10:21:00 +0800</pubDate><description><![CDATA[<br /><br />int main()<br />{<br />int* a[5];<br />int (*b)[5];<br />int i = 2, j = 3, k = 4; <br />b = a;<br />a[0] = &i;<br />printf("%d  %d %d/n", *a, *a[0], i);<br />printf("%d  %d %d/n", a, a[0], &i);<br />printf("%d  ", b);<br />b++;<br />printf("%d/]]></description><category></category></item><item><title><![CDATA[int型在内存中的存储方式与高低字节（大小端）]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/6232282</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/6232282</guid><author>cumirror</author><pubDate>Tue, 08 Mar 2011 18:05:00 +0800</pubDate><description><![CDATA[首先明确一点：结构体中的成员是从低地址向高地址排列的，这一点和数组类似，即排在结构体前面的成员占用内存低地址，排在结构体后面的成员占用内存高地址。
union int_char {
int a;
char b[4];
}ton;
ton.a = 0x02ff03ff;]]></description><category></category></item><item><title><![CDATA[AC算法]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/6177835</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/6177835</guid><author>cumirror</author><pubDate>Thu, 10 Feb 2011 22:34:00 +0800</pubDate><description><![CDATA[可以参考：http://hi.baidu.com/lightxianjian/blog/item/d0f0b8de8041125095ee3710.htmlhttp://blogold.chinaunix.net/u/12592/showart_284591.html第一个链接中，里面对于trie树的构建讲解得比较清楚，也介绍了失效函数（文中是失效指针）的原理，不过对算法并未做仔细讲解。第二个链接中，对于转向函数、失效函数、输出函数都有详细介绍，而且可以下载相关文档资料和代码，势不可多得的参考资料。]]></description><category></category></item><item><title><![CDATA[KMP算法的实现]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/6173399</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/6173399</guid><author>cumirror</author><pubDate>Sun, 06 Feb 2011 18:21:00 +0800</pubDate><description><![CDATA[// kmp.cpp : 定义控制台应用程序的入口点。
//
#include "stdafx.h"
char pattern[] = "abaabaabbcdf";
char text[] = "abaabaabbcdfkashdfirabcabcedbyuvabcabddcdscgyuvwb,mbkabcabcedabaabaabbcdfdcdsjciuzxqwmd,sanfixcvjwqkfniozxyciuwqfksgiuytsw";
int next[sizeof(pattern)-1]]]></description><category></category></item><item><title><![CDATA[批处理-保留空行并去掉注释行]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/5888907</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/5888907</guid><author>cumirror</author><pubDate>Thu, 16 Sep 2010 17:10:00 +0800</pubDate><description><![CDATA[<br />下午写的，看abap代码时，有些注释行不想要，正好用批处理来解决。<br />其中扩展了下，使得代码中的空行也能输出。<br /> <br /> <br />@rem 注释在行首的才能判断出来...<br />@echo off<br />@rem .则输出空行<br />@echo.>editaaa.txt<br /> SetLocal EnableDelayedExpansion  <br />for /f " tokens=1,* delims=:" %%i in ('findstr /n]]></description><category></category></item><item><title><![CDATA[在文本中找出重复的数据记录的批处理怎么写]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/5886712</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/5886712</guid><author>cumirror</author><pubDate>Wed, 15 Sep 2010 19:11:00 +0800</pubDate><description><![CDATA[<br />最新想学习批处理，在网上搜索信息时看到百度上的一个问题就自己写了下。<br />问题地址：<br />http://zhidao.baidu.com/question/101833311<br /> <br />对很多东西不熟，费了一下午才完成要求，写的批处理程序如下：<br />@rem 这个程序实现了把文件中相同行的内容提取出来
@rem 注意SetLocal与EndLocal，用它使得上面for中的环境变量不会对下面for循环中的环境变量产生影响
@rem 现在程序执行不能得到正确结果]]></description><category></category></item><item><title><![CDATA[如何阅读passthru?]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/5607202</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/5607202</guid><author>cumirror</author><pubDate>Wed, 19 May 2010 12:35:00 +0800</pubDate><description><![CDATA[环境是：window 2003 server工具：Windows Server 2003 DDK(迅雷下载地址：ftp://www.driverdevelop.com/en_ws2003_sp1_ddk.iso)Driverstudio3.2 (迅雷下载地址：http://cracklab.ru/_dl/_/DriverStudio_3.2_CRACKLAB.rU.rar)Vi]]></description><category></category></item><item><title><![CDATA[C++ STL学习笔记十二 hash_map映照容器]]></title><link>https://blog.youkuaiyun.com/cumirror/article/details/5596916</link><guid>https://blog.youkuaiyun.com/cumirror/article/details/5596916</guid><author>cumirror</author><pubDate>Sun, 16 May 2010 11:06:00 +0800</pubDate><description><![CDATA[/* * ************************************************************************************ *       hash_map映照容器的基础说明： ***********************************************************************************]]></description><category></category></item></channel></rss>