https://blog.youkuaiyun.com/gaa_razh-cnhttps://blog.youkuaiyun.com/https://blog.youkuaiyun.com/gaa_ra/article/details/8125521https://blog.youkuaiyun.com/gaa_ra/article/details/8125521gaa_raMon, 29 Oct 2012 20:46:45 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/7882753https://blog.youkuaiyun.com/gaa_ra/article/details/7882753gaa_raSun, 19 Aug 2012 16:39:30 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/7841204https://blog.youkuaiyun.com/gaa_ra/article/details/7841204gaa_raWed, 08 Aug 2012 00:17:41 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/7462389https://blog.youkuaiyun.com/gaa_ra/article/details/7462389gaa_raSun, 15 Apr 2012 12:35:13 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/7436940https://blog.youkuaiyun.com/gaa_ra/article/details/7436940gaa_raSun, 08 Apr 2012 11:44:02 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/7350942https://blog.youkuaiyun.com/gaa_ra/article/details/7350942gaa_raTue, 13 Mar 2012 23:08:37 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/7167764https://blog.youkuaiyun.com/gaa_ra/article/details/7167764gaa_raSat, 31 Dec 2011 10:35:06 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/7037542https://blog.youkuaiyun.com/gaa_ra/article/details/7037542gaa_raSat, 03 Dec 2011 17:25:06 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/6989406https://blog.youkuaiyun.com/gaa_ra/article/details/6989406gaa_raFri, 18 Nov 2011 21:23:21 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/6594815https://blog.youkuaiyun.com/gaa_ra/article/details/6594815gaa_raSat, 09 Jul 2011 16:18:31 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/6593860https://blog.youkuaiyun.com/gaa_ra/article/details/6593860gaa_raFri, 08 Jul 2011 23:12:12 +0800_      吐槽能力下降,难道是因为两天没看银魂么...阿西啊~~~      入正题,注释写很多啦我就不多费口舌啦.鬼影3还是很亮的,神马加花指令啊,自解码的都用上了.哥喜欢..]]>https://blog.youkuaiyun.com/gaa_ra/article/details/6589324https://blog.youkuaiyun.com/gaa_ra/article/details/6589324gaa_raThu, 07 Jul 2011 03:16:05 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/6557106https://blog.youkuaiyun.com/gaa_ra/article/details/6557106gaa_raMon, 20 Jun 2011 20:53:00 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/6554009https://blog.youkuaiyun.com/gaa_ra/article/details/6554009gaa_raSat, 18 Jun 2011 21:30:00 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/6550254https://blog.youkuaiyun.com/gaa_ra/article/details/6550254gaa_raFri, 17 Jun 2011 09:32:00 +08002),果断下床继续干活.天不负我..泪流满面.终于停在该死的0x7c00上面了..阿西..上图     图片发到微薄上就删了..大家将就着看吧.     下面不是进入正题,今天没有正题,今天就是吐槽...     前几天看群里三哥发了鬼影3的无壳样本,决心分析一下,结果无奈不是exe,只]]>https://blog.youkuaiyun.com/gaa_ra/article/details/6535461https://blog.youkuaiyun.com/gaa_ra/article/details/6535461gaa_raFri, 10 Jun 2011 04:28:00 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/6529371https://blog.youkuaiyun.com/gaa_ra/article/details/6529371gaa_raTue, 07 Jun 2011 13:21:00 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/6528359https://blog.youkuaiyun.com/gaa_ra/article/details/6528359gaa_raMon, 06 Jun 2011 20:28:00 +0800https://blog.youkuaiyun.com/gaa_ra/article/details/6429217https://blog.youkuaiyun.com/gaa_ra/article/details/6429217gaa_raWed, 18 May 2011 12:57:00 +0800    昨天赶了个界面出来,比较水,将就一下,总结大会过了之后准备果断重构一遍.上图

 
    一个Ring0下的exe,跟驱动通信的,简单通信(DeviceIoControl)和一个文件系统过滤驱动,基本完成的功能是对指定进程的文件操作进行重定向.录了两个测试视频,不过优酷可能看不太清,有兴趣的同学请猛击(不过这个是无解说的...)
 
    正常程序测试:http://v.youku.com/v_show/id_XMjY3Nzg0Nzc]]>https://blog.youkuaiyun.com/gaa_ra/article/details/6419714https://blog.youkuaiyun.com/gaa_ra/article/details/6419714gaa_raSat, 14 May 2011 14:51:00 +0800图像分析->寻路做的.瞬间各种膜拜.分析图像这一点已经够亮了,但是据说以此为基础的寻路有点小问题,昨天干了一个命令行版的.晒下    如果让我说亮点,我觉得    1.直接开进程空间读Table,能够自动适应不同的操作系统寻找Table基址(就是棋盘基址),分析过程比较亮,后面有图有真相    2.做了自动Reload功能,单无解时候自动进行Reload,不过只做一次(一般Reload道具有两个)    学到神马,嗯,CE工具,无敌加强大,内存断]]>