yjz1409276的专栏

1: // Dasm.cpp : Defines the entry point for the console application.2: //3:4: #include "stdafx.h"5: #include 6: using namespace std;7:8: int main(int argc, char* argv[])9:

1. 拷贝要调试的可执行文件和对应的PDB符号到虚拟机。 2. 在虚拟机中启动服务端，有2种方式。`windbg.exe -server tcp:port=8888 C:\Test.exe` 这种方式可以调试main函数和程序的启动过程。 `windbg.exe -server tcp:port=8888 -p 10086` 这种方式相当于附加到PID为10086的进程上去。 3. 在

使用!process 0 0 进程名或ID得到EPROCESS使用.process /p + EPROCESS切换到应用程序的地址空间重新加载user PDB文件：.reload /f /user使用非侵入式的切换进程空间：.process /i /p EPROCESS下应用层断点，执行

jad -o -r -8 -dDestDirectory -sjava C:/Users/SrcDirectory/**/*.class将 C:/Users/SrcDirectory目录下的所有class文件按目录结构反编译到DestDirectory下.-o 不提示,覆盖文件-r 生成原始目录结构-8 使用Uniocde编码

// 原理就是安装全局的WH_KEYBOARD_LL底层键盘钩子.主程序是360安装路径下的safemon文件夹下的searchdesktop.exe// 安装底层键盘钩子g_hHook =::SetWindowsHookEx( WH_KEYBOARD_LL, LowKeyboardProc, g_hDll, 0);// 底层钩子过程LRESULT CALLBACK LowKe

相关知识: Windows在调用进程，创建线程时，操作系统都会为每个线程创建TEB，而且FS段寄存器总是被设置成FS:0,指向线程的TEB数据，TEB结构的0x30偏移处是PEB。基本原理: 根据系统版本(Win7 Or Not)和架构(64\32位)加载不同的Dll,在explorer中开启一个远线程执行,远线程中根据PEB,动态获取LoadLibrary的地址,加载该DLL.在

45: ArrayParam(Arr,ArrSize);004019E8 push 5 // 函数参数2(数组长度)入栈004019EA lea ecx,[ebp-18h] // 取数组首地址放ecx004019ED push ecx // 数组首地址入栈004019EE call

15: void ArrayTest()16: {004010D0 push ebp004010D1 mov ebp,esp004010D3 sub esp,5Ch004010D6 push ebx004010D7 push esi004010D8 push edi

int x=CallFunc(2,3);0040185B push 3 // 第二个参数3入栈0040185D push 2 // 第一个参数2入栈0040185F call @ILT+105(CallFunc) (0040106e) // 调用CallFunc00401864 add e

00401213 |. 6A 03 push 3 // 第二个参数3入栈00401215 |. 6A 02 push 2 // 第一个参数2入栈00401217 |. E8 C4FFFFFF call 004011E0 // 调用CallFunc(2,3)0040121C |. 83C4 08

00401730 push ebp00401731 mov ebp,esp00401733 sub esp,44h00401736 push ebx00401737 push esi00401738 push edi00401739 lea edi,[eb

004016D0 push ebp004016D1 mov ebp,esp004016D3 sub esp,44h004016D6 push ebx004016D7 push esi004016D8 push edi004016D9 lea edi,[eb

00401780 push ebp00401781 mov ebp,esp00401783 sub esp,48h00401786 push ebx00401787 push esi00401788 push edi00401789 lea edi,[eb

00401020 push ebp00401021 mov ebp,esp00401023 sub esp,44h00401026 push ebx00401027 push esi00401028 push edi00401029 lea edi,[eb

004015D0 push ebp004015D1 mov ebp,esp004015D3 sub esp,48h004015D6 push ebx004015D7 push esi004015D8 push edi004015D9 lea edi,[eb

00401500 push ebp00401501 mov ebp,esp00401503 sub esp,44h00401506 push ebx00401507 push esi00401508 push edi00401509 lea edi,[eb

17: void Grammar_if_else()18: {00401450 push ebp00401451 mov ebp,esp00401453 sub esp,44h00401456 push ebx00401457 push esi00401458 push

kd> !process 0 0**** NT ACTIVE PROCESS DUMP ****PROCESS fffffa801a89e060 SessionId: 1 Cid: 026c Peb: 7fffffd3000 ParentCid: 0200 DirBase: 66362000 ObjectTable: fffff8a00111c4d0 Ha...