Gray Hat Python

按有用程度 按页码先后 最新笔记

• 

  第22页

  candy

  

  硬件断点： 不太明白断点长度是个什么意思？ (更多)

  硬件断点：

  
  

  不太明白断点长度是个什么意思？ (收起)

  2011-04-19 17:22:37   1回应

  收藏

  推荐
• 

  第20页

  candy

  

  调试器软件断点原理： 如何反调试？ Soft breakpoints have one caveat, however: when you change a byte of the executable in memory, you change the running software’s cyclic redundancy check (CRC) checksum. A CRC is a type of function that is used to determine if data has been altered in any way, and it can be applied to files, memory, text, network packets, or anything you would like to ... (更多)

  调试器软件断点原理：

  
  

  如何反调试？

  Soft breakpoints have one caveat, however: when you change a byte of the executable in memory, you change the running software’s cyclic redundancy check (CRC) checksum. A CRC is a type of function that is used to determine if data has been altered in any way, and it can be applied to files, memory, text, network packets, or anything you would like to monitor for data altera- tion. A CRC will take a range of values—in this case the running process’s memory—and hash the contents. It then compares the hashed value against a known CRC checksum to determine whether there have been changes to the data. If the checksum is different from the checksum that is stored for validation, the CRC check fails. This is important to note, as quite often malware will test its running code in memory for any CRC changes and will kill itself if a failure is detected. This is a very effective technique to slow reverse engineering and prevent the use of soft breakpoints, thus limiting dynamic analysis of its behavior. In order to work around these specific scenarios, you can use hardware breakpoints.

  (收起)

  2011-04-19 16:47:38   回应

  收藏

  推荐
• 

  第17页

  candy

  

  函数调用时栈的变化 Function Call in C /代码内容已省略/ Function Call in x86 Assembly /代码内容已省略/ To see what the stack frame would look like, refer to Figure 2-1. As you can see, this is a straightforward data structure and is the basis for all function calls inside a binary. When the my_socks() function returns... (更多)

  函数调用时栈的变化

  Function Call in C

  int my_socks(color_one, color_two, color_three);
  

  Function Call in x86 Assembly

  push color_three
  push color_two
  push color_one
  call my_socks
  

  To see what the stack frame would look like, refer to Figure 2-1.

  
  

  As you can see, this is a straightforward data structure and is the basis for all function calls inside a binary. When the my_socks() function returns, it pops off all the values on the stack and jumps to the return address to continue executing in the parent function that called it. The other consideration is the notion of local variables. Local variables are slices of memory that are valid only for the function that is executing. To expand our my_socks() function a bit, let’s assume that the first thing it does is set up a character array into which to copy the parameter color_one. The code would look like this:

  int my_socks(color_one, color_two, color_three)
  {
       char stinky_sock_color_one[10];
       ... 
  }
  

  The variable stinky_sock_color_one would be allocated on the stack so that it can be used within the current stack frame. Once this allocation has occurred, the stack frame will look like the image in Figure 2-2.

  
  

  Now you can see how local variables are allocated on the stack and how

  the stack pointer gets incremented to continue to point to the top of the

  stack. The ability to capture the stack frame inside a debugger is very useful

  for tracing functions, capturing the stack state on a crash, and tracking down

  stack-based overflows. (收起)

  2011-04-19 16:36:24   回应

  收藏

  推荐

• 

  第5页

  candy

  我见到的最全的eclipse+PyDev环境搭建解说 安装Eclips和PyDev 1. Download the Eclipse Classic package from http://www.eclipse.org/ downloads/. 2. Unzip it to C:\Eclipse. 3. Run C:\Eclipse\eclipse.exe. 4. The first time it starts, it will ask where to store your workspace; you can accept the default and check the box Use this as default and do not ask again. Click OK. 5. O... (更多)

  我见到的最全的eclipse+PyDev环境搭建解说

  安装Eclips和PyDev

  1. Download the Eclipse Classic package from http://www.eclipse.org/ downloads/. 2. Unzip it to C:\Eclipse. 3. Run C:\Eclipse\eclipse.exe. 4. The first time it starts, it will ask where to store your workspace; you can accept the default and check the box Use this as default and do not ask again. Click OK. 5. Once Eclipse has fired up, choose Help 6. Select the radio button labeled Search for new features to install and click Next. 7. On the next screen click New Remote Site. 8. In the Name field enter a descriptive string like PyDev Update. Make sure the URL field contains http://pydev.sourceforge.net/updates/ and click OK. Then click Finish, which will kick in the Eclipse updater. 9. The updates dialog will appear after a few moments. When it does, expand the top item, PyDev Update, and check the PyDev item. Click Next to continue. 10. Then read and accept the license agreement for PyDev. If you agree to its terms, then select the radio button I accept the terms in the license agreement. 11. Click Next and then Finish. You will see Eclipse begin pulling down the PyDev extension. When it’s finished, click Install All. 12. The final step is to click Yes on the dialog box that appears after PyDev is installed; this will restart Eclipse with your shiny new PyDev included.

  配置Eclipse和PyDev

  1. With Eclipse started, select Window 2. Expand the PyDev tree item, and select Interpreter – Python. 3. In the Python Interpreters section at the top of the dialog, click New. 4. Browse to C:\Python25\python.exe, and click Open. 5. The next dialog will show a list of included libraries for the interpreter; leave the selections alone and just click OK. 6. Then click OK again to finish the interpreter setup.

  (收起)

  2011-04-18 18:27:06   回应

  收藏

  推荐
• 

  第7页

  candy

  调用DLL函数的两种约定，区别主要在于由谁来平栈，调用者还是被调用者？ U N D E R S T A N D I N G C A L L I N G C O N V E N T I O N S A calling convention describes how to properly call a particular function. This includes the order of how function parameters are allocated, which parameters are pushed onto the stack or passed in registers, and how the stack is unwound when a function retur... (更多)

  调用DLL函数的两种约定，区别主要在于由谁来平栈，调用者还是被调用者？

  U N D E R S T A N D I N G C A L L I N G C O N V E N T I O N S A calling convention describes how to properly call a particular function. This includes the order of how function parameters are allocated, which parameters are pushed onto the stack or passed in registers, and how the stack is unwound when a function returns. You need to understand two calling conventions: cdecl and stdcall. In the cdecl convention, parameters are pushed from right to left, and the caller of the func- tion is responsible for clearing the arguments from the stack. It’s used by most C systems on the x86 architecture. Following is an example of a cdecl function call: In C

  int python_rocks(reason_one, reason_two, reason_three);
  

  In x86 Assembly

  push reason_three
  push reason_two
  push reason_one
  call python_rocks
  add esp, 12
  

  You can clearly see how the arguments are passed, and the last line increments

  the stack pointer 12 bytes (there are three parameters to the function, and each stack

  parameter is 4 bytes, and thus 12 bytes), which essentially clears those parameters.

  An example of the stdcall convention, which is used by the Win32 API, is shown

  here:

  In C

  int my_socks(color_one color_two, color_three);
  

  In x86 Assembly

  push color_three
  push color_two
  push color_one
  call my_socks
  

  In this case you can see that the order of the parameters is the same, but the stack clearing is not done by the caller; rather the my_socks function is responsible for cleaning up before it returns. For both conventions it’s important to note that return values are stored in the EAX register.

  (收起)

  2011-04-18 18:43:44   回应

  收藏

  推荐
• 

  第8页

  candy

  

  (更多)

  
  Python to C Datatype Mapping

  (收起)

  2011-04-18 18:54:17   回应

  收藏

  推荐

• 

  第22页

  candy

  

  硬件断点： 不太明白断点长度是个什么意思？ (更多)

  硬件断点：

  
  

  不太明白断点长度是个什么意思？ (收起)

  2011-04-19 17:22:37   1回应

  收藏

  推荐
• 

  第20页

  candy

  

  调试器软件断点原理： 如何反调试？ Soft breakpoints have one caveat, however: when you change a byte of the executable in memory, you change the running software’s cyclic redundancy check (CRC) checksum. A CRC is a type of function that is used to determine if data has been altered in any way, and it can be applied to files, memory, text, network packets, or anything you would like to ... (更多)

  调试器软件断点原理：

  
  

  如何反调试？

  Soft breakpoints have one caveat, however: when you change a byte of the executable in memory, you change the running software’s cyclic redundancy check (CRC) checksum. A CRC is a type of function that is used to determine if data has been altered in any way, and it can be applied to files, memory, text, network packets, or anything you would like to monitor for data altera- tion. A CRC will take a range of values—in this case the running process’s memory—and hash the contents. It then compares the hashed value against a known CRC checksum to determine whether there have been changes to the data. If the checksum is different from the checksum that is stored for validation, the CRC check fails. This is important to note, as quite often malware will test its running code in memory for any CRC changes and will kill itself if a failure is detected. This is a very effective technique to slow reverse engineering and prevent the use of soft breakpoints, thus limiting dynamic analysis of its behavior. In order to work around these specific scenarios, you can use hardware breakpoints.

  (收起)

  2011-04-19 16:47:38   回应

  收藏

  推荐
• 

  第17页

  candy

  

  函数调用时栈的变化 Function Call in C /代码内容已省略/ Function Call in x86 Assembly /代码内容已省略/ To see what the stack frame would look like, refer to Figure 2-1. As you can see, this is a straightforward data structure and is the basis for all function calls inside a binary. When the my_socks() function returns... (更多)

  函数调用时栈的变化

  Function Call in C

  int my_socks(color_one, color_two, color_three);
  

  Function Call in x86 Assembly

  push color_three
  push color_two
  push color_one
  call my_socks
  

  To see what the stack frame would look like, refer to Figure 2-1.

  
  

  As you can see, this is a straightforward data structure and is the basis for all function calls inside a binary. When the my_socks() function returns, it pops off all the values on the stack and jumps to the return address to continue executing in the parent function that called it. The other consideration is the notion of local variables. Local variables are slices of memory that are valid only for the function that is executing. To expand our my_socks() function a bit, let’s assume that the first thing it does is set up a character array into which to copy the parameter color_one. The code would look like this:

  int my_socks(color_one, color_two, color_three)
  {
       char stinky_sock_color_one[10];
       ... 
  }
  

  The variable stinky_sock_color_one would be allocated on the stack so that it can be used within the current stack frame. Once this allocation has occurred, the stack frame will look like the image in Figure 2-2.

  
  

  Now you can see how local variables are allocated on the stack and how

  the stack pointer gets incremented to continue to point to the top of the

  stack. The ability to capture the stack frame inside a debugger is very useful

  for tracing functions, capturing the stack state on a crash, and tracking down

  stack-based overflows. (收起)

  2011-04-19 16:36:24   回应

  收藏

  推荐