05/07/16

博主记录了朋友工作情况,分享了对加/脱壳技术的看法,认为加/脱壳非王道,高手应知识广泛。还提到分析病毒样本、研究od plugin帮助文档,有写插件的想法。此外,决定不再喝可乐,保持吃苦作风,明天打算去电影院娱乐。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

今天头的同学也正式来上班了。这斯以前搞vb,后来给海尔干。早就听说海尔此类公司很资本家,一问果不其然。说新去的人实习期一月200,正式了以后800,很汗。他跟头以前是同学,现在一个上面一个下面,看起来很感叹。不过人还不错,很老实的那种。不过具体要等过段时间看才知道。

下午看loveboom分析的jingulong的unpackme,自己也挑起来瞅瞅。我对壳几乎一窍不通,但看他写的感觉还能应付。进去一跟果不其然,开始是一大断变态解密,往后是利用一些native api进行处理,往后到了一个CreateProcess我的OD就挂了,也不知道为啥就懒得搞了。

我从来没脱过一个壳,碰上牛壳更是郁闷,不过个人感觉加/脱壳不是王道,只要水平高,谁都能把个一般的壳脱了,只是时间问题。但脱壳高手未必就见的对别的也懂。你懂这个是因为天天搞,经验多,人家牛人是知识广泛,啥都能应付,性质不一样。不过话虽这么说,碰到牛壳我也怕的要死,毕竟我不牛,估计也没那么多时间。

晚上下了个号称比较新的病毒样本,诺顿查不出来,稍微分析了一下,太累,就拉倒了。感觉是老外写的一个垃圾PE病毒,不过不知道是否用了变形引擎,如果用的话或许还有点技术含量。

早上看了od plugin的帮助,写得很详细,很好。对我来说研究一下写这个更有意义。回头要能写出来个,那就翻译+忽悠再去混个这方面的精华之类。

今天决定以后不喝可乐了。一罐可乐2块,一天就是4块。以前大一一天才花3块钱,多苦啊。3块钱啊,啥概念?!早上不吃饭,中午5毛钱米饭+1块钱白菜,晚上一碗面条。现在吃饭太奢侈了,动不动还想喝饮料,应该保持优良吃苦作风,对身体也有好处。

明天休息,去电影院瞅瞅,适当娱乐花钱还是值得的。

逐行解析一下这些打印XOS#2025/05/28 16:44:15 informational: WMAC_AC: Dis-assocation frame received from station with MAC address 92:aa:0e:84:c5:22 and reason code 3 2025/05/28 16:44:15 informational: WMAC_AC: Sending DEL-STA to AP 1 by CAPWAP with station MAC address 92:aa:0e:84:c5:22 BSSID 6c:ef:c6:65:ab:d1 2025/05/28 16:44:15 notifications: WMAC_AC: [IPC] Sending DELETE-STA to AP by CAPWAP with station MAC 92:aa:0e:84:c5:22. asso seq [0x1000] 2025/05/28 16:44:15 errors : WMAC_AC: Failed to notify L2F to delete sta with MAC address 92:aa:0e:84:c5:22 | vlan 1 | dynamic vlan -1. 2025/05/28 16:44:15 informational: WMAC_AC: STA 92:aa:0e:84:c5:22 - event 2 notification 2025/05/28 16:44:15 informational: WMAC_AC: Unauthorizing port for station 92:aa:0e:84:c5:22. 2025/05/28 16:44:15 informational: WMAC_AC: STA 92:aa:0e:84:c5:22 - MLME-DISASSOCIATE.indication(92:aa:0e:84:c5:22, 3) 2025/05/28 16:44:15 informational: WMAC_AC: Receiving authention frame from station 92:07:d3:da:91:62. 2025/05/28 16:44:15 informational: WMAC_AC: Receiving authention frame from station 92:07:d3:da:91:62 in bssid 6c:ef:c6:65:ab:d7. auth_alg 0, auth_transaction 1 2025/05/28 16:44:15 informational: WMAC_AC: Authentication OK (Open-System) with bssid 6c:ef:c6:65:ab:d7 . 2025/05/28 16:44:15 informational: WMAC_AC: Receiving association request from sta 92:07:d3:da:91:62 in bssid 6c:ef:c6:65:ab:d7 2025/05/28 16:44:15 warnings : WMAC_AC: IEEE 802.11 element parse ignored unknown element (id=191 elen=12) 2025/05/28 16:44:15 informational: WMAC_AC: Station association succeed with AID: 1, SSID: a-wangjian-portal, BSSID: 6c:ef:c6:65:ab:d7. 2025/05/28 16:44:15 informational: WMAC_AC: Vlan 1 station increasing, count 3. 2025/05/28 16:44:15 notifications: WMAC_AC: [IPC] Sending ADD-STATION to AP by CAPWAP with station MAC 92:07:d3:da:91:62, AID 1 and APID 1 RID 2. assoseq [0x1000] 2025/05/28 16:44:15 informational: APM: APM_Cloud_Server_Sendto(line:3313):send sta online 2025/05/28 16:44:15 informational: APM: APM_Cloud_Server_Sendto(line:3319):sta mac:92:07:d3:da:91:62 2025/05/28 16:44:15 informational: APM: APM_Cloud_Server_Sendto(line:3324):AP mac:6c:ef:c6:65:ab:c0 2025/05/28 16:44:15 errors : APM: APM_WmacSocket_Recv_Msg(line:975):!!! RECV MSG WMAC_GET_TRAFFIC_LIMIT, StaMac[92:07:d3:da:91:62] 2025/05/28 16:44:15 errors : APM: APM_SendStaTraffic(line:794):APM_SendStaTraffic uplimit 0, downlimit 0 2025/05/28 16:44:15 debugging : APM: APM_WMAC_SendStaTrafficLimit(line:1059):APM_WMAC_SendStaTrafficLimit success 2025/05/28 16:44:15 informational: APM: APM_DecMsgHead(line:71):MessageType 8 MessageLen 50 2025/05/28 16:44:15 informational: APM: APM_Recv_Pkt_Handle(line:3467):Recv MsgType: STA_AUTH_SUCCESS 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2970):store id :1 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2829):Sta mac:92:07:d3:da:91:62 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2708):AP mac:6c:ef:c6:65:ab:c0 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:3061):usProfileId 2 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2855):STA pass time:586 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:3206):APM Portal username:admin 2025/05/28 16:44:15 informational: APM: APM_RecvPktProcess(line:2509):[EasyPortal] user $MAC:92:7:d3:da:91:62 auth success, pass time is 600 s 2025/05/28 16:44:15 informational: APM: APM_AddUserNode(line:836):APM_AddUserNode:: User Node is exist (mac = 9207.d3da.9162) 2025/05/28 16:44:15 informational: APM: APM_AddUserNode(line:851):Create user Node timer 2025/05/28 16:44:15 errors : APM: APM_SendStaTraffic(line:794):APM_SendStaTraffic uplimit 0, downlimit 0 2025/05/28 16:44:15 debugging : APM: APM_WMAC_SendStaTrafficLimit(line:1059):APM_WMAC_SendStaTrafficLimit success 2025/05/28 16:44:15 informational: APM: APM_DecMsgHead(line:71):MessageType 25 MessageLen 54 2025/05/28 16:44:15 informational: APM: APM_Recv_Pkt_Handle(line:3467):Recv MsgType: User trafic limit 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2970):store id :1 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2829):Sta mac:92:07:d3:da:91:62 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2732):AP input limit:0 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2738):AP output limit:0 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2708):AP mac:6c:ef:c6:65:ab:c0 2025/05/28 16:44:15 debugging : APM: APM_SetStaTraffic(line:2399):STA[92:07:d3:da:91:62] inputlimit 0 outlimit 0 2025/05/28 16:44:15 informational: APM: APM_DecMsgHead(line:71):MessageType 7 MessageLen 53 2025/05/28 16:44:15 informational: APM: APM_Recv_Pkt_Handle(line:3467):Recv MsgType: STA_ONLINE_RESP 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2970):store id :1 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2829):Sta mac:92:07:d3:da:91:62 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2708):AP mac:6c:ef:c6:65:ab:c0 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2843):STA Privilege:0 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:3061):usProfileId 2 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2849):STA Auth Mode:1 2025/05/28 16:44:15 informational: APM: APM_DecPkt_Data(line:2855):STA pass time:600 2025/05/28 16:44:15 informational: APM: APM_RecvPktProcess(line:2500):sta online response 2025/05/28 16:44:15 informational: APM: APM_UpdateUserNode(line:702):APM_AddUserNode:: User Node is exist (mac = 9207.d3da.9162) 2025/05/28 16:44:15 informational: APM: APM_UpdateUserNode(line:752):APM_AddUserNode:: Create user Node timer 2025/05/28 16:44:16 informational: WMAC_AC: STA 92:aa:0e:84:c5:22 - deauthenticated due to inactivity 2025/05/28 16:44:16 informational: WMAC_AC: STA 92:aa:0e:84:c5:22 - MLME-DEAUTHENTICATE.indication(92:aa:0e:84:c5:22, 2) 2025/05/28 16:44:16 informational: WMAC_AC: Trying to free station with MAC address 92:aa:0e:84:c5:22 and BSSID 6c:ef:c6:65:ab:d1. 2025/05/28 16:44:16 informational: WMAC_AC: Vlan 1 station degression, count 2. 2025/05/28 16:44:16 informational: WMAC_AC: Sending DEL-STA to AP 1 by CAPWAP with station MAC address 92:aa:0e:84:c5:22 BSSID 6c:ef:c6:65:ab:d1 2025/05/28 16:44:16 notifications: WMAC_AC: [IPC] Sending DELETE-STA to AP by CAPWAP with station MAC 92:aa:0e:84:c5:22. asso seq [0x1000] 2025/05/28 16:44:16 errors : WMAC_AC: Failed to notify L2F to delete sta with MAC address 92:aa:0e:84:c5:22 | vlan 1 | dynamic vlan -1.
最新发布
05-29
评论 2
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值