<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[whispermemory的专栏]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/whispermemory</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; whispermemory]]></copyright><item><title><![CDATA[为可读性编程]]></title><link>https://blog.youkuaiyun.com/whispermemory/article/details/7086667</link><guid>https://blog.youkuaiyun.com/whispermemory/article/details/7086667</guid><author>whispermemory</author><pubDate>Tue, 20 Dec 2011 10:35:01 +0800</pubDate><description><![CDATA[最近参与公司项目，需要编写一个帮助引导用户使用的类。 在调用的时候会生成一个VIEW引导用户。
第一种设计
这个View 第一次被我设计成用GetInstance静态方法在使用的时候创生一个类，这样需要生成的方法内置于对象构造函数之中。
第二种设计
   而后又写了一个静态方法用来判断该类需不需要生成对象。这样就避免了对象不管如何都要构造的问题
       第三次改写]]></description><category></category></item><item><title><![CDATA[sysdebugger  win7故障]]></title><link>https://blog.youkuaiyun.com/whispermemory/article/details/6798905</link><guid>https://blog.youkuaiyun.com/whispermemory/article/details/6798905</guid><author>whispermemory</author><pubDate>Wed, 21 Sep 2011 23:02:52 +0800</pubDate><description><![CDATA[1   蓝屏 无限蓝屏

   只需要把控制面板--账户控制--控制等级  放到最小即可解决2  video buffer  install tool 问题
2  修改 tool option 中显示器mode 为usermode
 
3 sysdebugger的桌面快]]></description><category></category></item><item><title><![CDATA[System_mudule_information]]></title><link>https://blog.youkuaiyun.com/whispermemory/article/details/6790473</link><guid>https://blog.youkuaiyun.com/whispermemory/article/details/6790473</guid><author>whispermemory</author><pubDate>Mon, 19 Sep 2011 16:11:17 +0800</pubDate><description><![CDATA[typedef struct _SYSTEM_MODULE_INFORMATION {


  ULONG                ModulesCount;
  SYSTEM_MODULE        Modules[0];


} SYSTEM_MODU]]></description><category></category></item><item><title><![CDATA[MajorFunction ARRAY]]></title><link>https://blog.youkuaiyun.com/whispermemory/article/details/6774380</link><guid>https://blog.youkuaiyun.com/whispermemory/article/details/6774380</guid><author>whispermemory</author><pubDate>Wed, 14 Sep 2011 14:18:13 +0800</pubDate><description><![CDATA[create    0
create_named_pipe  1

close   2
read   3
write 4
query_information 5
set_information 6
query_ea 7
set_ea          8
fl]]></description><category></category></item><item><title><![CDATA[ZwQuerySystemInformation]]></title><link>https://blog.youkuaiyun.com/whispermemory/article/details/6754144</link><guid>https://blog.youkuaiyun.com/whispermemory/article/details/6754144</guid><author>whispermemory</author><pubDate>Tue, 06 Sep 2011 17:13:49 +0800</pubDate><description><![CDATA[ZwQuerySystemInformation 
2011-05-06 11:32


最近一直在纠结~~
代码是网上的~~
#include 
#include 
#include 
#include 

#pragma comment( linker,]]></description><category></category></item><item><title><![CDATA[求补操作前前后后]]></title><link>https://blog.youkuaiyun.com/whispermemory/article/details/6748906</link><guid>https://blog.youkuaiyun.com/whispermemory/article/details/6748906</guid><author>whispermemory</author><pubDate>Mon, 05 Sep 2011 10:47:54 +0800</pubDate><description><![CDATA[格式：NEG OPR ;B/W
　　执行的操作：(OPR)←(OPR)求补
　　这条指令的执行影响全部标志位。
　　下面就求补操作时对CF和OF两个标志位的影响做一个分析。求补操作即是把操作数按位求反后末位加1，即FFFFH-OPR+1=0-OPR。也就是说，对一个操作数求]]></description><category></category></item><item><title><![CDATA[neg sbb转换逻辑跳转为算术运算]]></title><link>https://blog.youkuaiyun.com/whispermemory/article/details/6748878</link><guid>https://blog.youkuaiyun.com/whispermemory/article/details/6748878</guid><author>whispermemory</author><pubDate>Mon, 05 Sep 2011 10:44:06 +0800</pubDate><description><![CDATA[call    ds:ZwReadFile
neg     eax
sbb     eax, eax
not     eax
and     eax, [ebp+IoStatusBlock.Information]
 
 

 

neg（求补指令）
NEG]]></description><category></category></item><item><title><![CDATA[内核态fs寄存器指向结构KPCR，方便反汇编]]></title><link>https://blog.youkuaiyun.com/whispermemory/article/details/6743074</link><guid>https://blog.youkuaiyun.com/whispermemory/article/details/6743074</guid><author>whispermemory</author><pubDate>Fri, 02 Sep 2011 15:37:36 +0800</pubDate><description><![CDATA[typedef struct _KPCR {
KPCR_TIB Tib; /* 00 */
struct _KPCR *Self; /* 1C */
struct _KPRCB *Prcb; /* 20 */
KIRQL Irql; /* 24 */
ULONG IRR]]></description><category></category></item><item><title><![CDATA[Device_object_extension 方便反汇编]]></title><link>https://blog.youkuaiyun.com/whispermemory/article/details/6740449</link><guid>https://blog.youkuaiyun.com/whispermemory/article/details/6740449</guid><author>whispermemory</author><pubDate>Thu, 01 Sep 2011 17:56:34 +0800</pubDate><description><![CDATA[struct _DEVOBJ_EXTENSION (sizeof=36)
+00 int16 Type = 000d
+02 uint16 Size = 0000
+04 struct _DEVICE_OBJECT *DeviceObject = FE4F5DF0
+08]]></description><category></category></item><item><title><![CDATA[DEV_OBJ和 DRI_OBJ 结构]]></title><link>https://blog.youkuaiyun.com/whispermemory/article/details/6735840</link><guid>https://blog.youkuaiyun.com/whispermemory/article/details/6735840</guid><author>whispermemory</author><pubDate>Wed, 31 Aug 2011 14:44:06 +0800</pubDate><description><![CDATA[struct _DRIVER_OBJECT (sizeof=168)
+00 int16 Type
+02 int16 Size
+04 struct _DEVICE_OBJECT *DeviceObject
+08 uint32 Flags
+0c void *Dri]]></description><category></category></item><item><title><![CDATA[SSDT 结构体 方便反汇编]]></title><link>https://blog.youkuaiyun.com/whispermemory/article/details/6735308</link><guid>https://blog.youkuaiyun.com/whispermemory/article/details/6735308</guid><author>whispermemory</author><pubDate>Wed, 31 Aug 2011 11:48:01 +0800</pubDate><description><![CDATA[typedef struct _SYSTEM_SERVICE_TABLE 
{ 
PVOID ServiceTableBase; //这个指向系统服务函数地址表 
PULONG ServiceCounterTableBase; 
ULONG NumberOfService]]></description><category></category></item><item><title><![CDATA[IRP 以及 STACKLOCATION 结构体成员，方便反汇编]]></title><link>https://blog.youkuaiyun.com/whispermemory/article/details/6734576</link><guid>https://blog.youkuaiyun.com/whispermemory/article/details/6734576</guid><author>whispermemory</author><pubDate>Wed, 31 Aug 2011 09:23:51 +0800</pubDate><description><![CDATA[这两个结构体是从DEBUGMAN 那里剽窃过来的。 读书人嘛。






struct _IRP (sizeof=112) 
{
00 int16 Type 
02 uint16 Size 
04 struct _MDL *MdlAddress 
08]]></description><category></category></item><item><title><![CDATA[SSDT HOOK]]></title><link>https://blog.youkuaiyun.com/whispermemory/article/details/6732214</link><guid>https://blog.youkuaiyun.com/whispermemory/article/details/6732214</guid><author>whispermemory</author><pubDate>Tue, 30 Aug 2011 13:31:03 +0800</pubDate><description><![CDATA[文章标题】: 必备绝技——hook大法( 中 )
【文章作者】: LvG
【作者邮箱】: LvG2008@gmail.com
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
--------------------------------------]]></description><category></category></item></channel></rss>