<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[ip1234pi的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/ip1234pi</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; ip1234pi]]></copyright><item><title><![CDATA[WinOs4.0分析 一]]></title><link>https://blog.youkuaiyun.com/ip1234pi/article/details/138421764</link><guid>https://blog.youkuaiyun.com/ip1234pi/article/details/138421764</guid><author>ip1234pi</author><pubDate>Sat, 04 May 2024 11:44:11 +0800</pubDate><description><![CDATA[WinOs是基于开源的Gh0st源码改编而成的。它功能齐全，控制架构稳定可靠，能够轻松实现数千个受控端的稳定上线。此外，代码注释详尽清晰，便于修改以免疫杀软检测。主要模块分为上线模块和功能模块。上线模块负责维持后门，接收命令并执行功能模块的功能。]]></description><category></category></item><item><title><![CDATA[静态规则提取]]></title><link>https://blog.youkuaiyun.com/ip1234pi/article/details/138381036</link><guid>https://blog.youkuaiyun.com/ip1234pi/article/details/138381036</guid><author>ip1234pi</author><pubDate>Thu, 02 May 2024 16:30:23 +0800</pubDate><description><![CDATA[传统的静态病毒检测引擎（类clamav引擎）支持的泛化能力有限（内存引擎亦是如此），在基本的二进制字节串比较，正则匹配，子表达式逻辑运算的功能之上，并未有太多的泛化能力。出于安全的考虑，提取的特征也不能太弱了，否则容易误报，因此提取泛化性较强的静态规则是件麻烦的事。静态规则一般是一段变化可控的模式串（字节串），其变化范围能通过正则进行表示。如果要修改该段特征，就需要大改源代码的话，则该特征串的泛化性就较好。这模式串提取的位置不一定要与特定的恶意功能相关，只要与正常软件有所区分，能标识这类软件就行。]]></description><category></category></item><item><title><![CDATA[恶意文件分析总结]]></title><link>https://blog.youkuaiyun.com/ip1234pi/article/details/138353355</link><guid>https://blog.youkuaiyun.com/ip1234pi/article/details/138353355</guid><author>ip1234pi</author><pubDate>Tue, 30 Apr 2024 18:44:58 +0800</pubDate><description><![CDATA[恶意文件分析总结]]></description><category></category></item><item><title><![CDATA[内核对象管理器学习笔记]]></title><link>https://blog.youkuaiyun.com/ip1234pi/article/details/122256135</link><guid>https://blog.youkuaiyun.com/ip1234pi/article/details/122256135</guid><author>ip1234pi</author><pubDate>Mon, 09 Oct 2023 22:04:41 +0800</pubDate><description><![CDATA[Windows 内核对象学习笔记
对象组成
_HANDLE_HEADER
   +0x000 PointerCount     : Int8B
   +0x008 HandleCount      : Int8B
   +0x008 NextToFree       : Ptr64 Void
   +0x010 Lock             : _EX_PUSH_LOCK
   +0x018 TypeIndex        : Uchar   //global variable ObTypeIndex]]></description><category></category></item><item><title><![CDATA[进程学习笔记1]]></title><link>https://blog.youkuaiyun.com/ip1234pi/article/details/122292500</link><guid>https://blog.youkuaiyun.com/ip1234pi/article/details/122292500</guid><author>ip1234pi</author><pubDate>Mon, 09 Oct 2023 22:04:25 +0800</pubDate><description><![CDATA[进程学习笔记1]]></description><category></category></item><item><title><![CDATA[windows的安全模型学习笔记]]></title><link>https://blog.youkuaiyun.com/ip1234pi/article/details/122276128</link><guid>https://blog.youkuaiyun.com/ip1234pi/article/details/122276128</guid><author>ip1234pi</author><pubDate>Thu, 28 Sep 2023 09:33:39 +0800</pubDate><description><![CDATA[windows的安全模型学习笔记]]></description><category></category></item><item><title><![CDATA[QEMU创建arm64架构的centos7虚拟机]]></title><link>https://blog.youkuaiyun.com/ip1234pi/article/details/128613738</link><guid>https://blog.youkuaiyun.com/ip1234pi/article/details/128613738</guid><author>ip1234pi</author><pubDate>Mon, 09 Jan 2023 15:13:11 +0800</pubDate><description><![CDATA[QEMU创建arm64架构的centos7虚拟机]]></description><category></category></item><item><title><![CDATA[Linux 模块加载学习笔记]]></title><link>https://blog.youkuaiyun.com/ip1234pi/article/details/128227342</link><guid>https://blog.youkuaiyun.com/ip1234pi/article/details/128227342</guid><author>ip1234pi</author><pubDate>Wed, 07 Dec 2022 23:24:34 +0800</pubDate><description><![CDATA[Linux 模块加载学习笔记]]></description><category></category></item></channel></rss>