It crAcks

二进制面前,了无秘密
 
 

常用链接

  • 我的随笔
  • 我的评论
  • 我参与的随笔

留言簿

  • 给我留言
  • 查看公开留言
  • 查看私人留言

随笔档案

  • 2008年12月 (2)
  • 2008年10月 (1)
  • 2008年9月 (1)
  • 2008年8月 (1)
  • 2008年6月 (1)
  • 2008年5月 (1)
  • 2008年4月 (4)
  • 2008年1月 (1)
  • 2007年12月 (3)
  • 2007年11月 (2)
  • 2007年10月 (1)

搜索

  •  

最新评论

  • 1. re: 几个解释执行C/C++的软件[未登录]
  • 这么长时间才来一篇新的!
  • --jarod
  • 2. re: 隐写术
  • 很好,谢谢
  • --pengkuny
  • 3. re: Mingw GCC 4.3.0 安装与配置(解决CreateProcess问题)
  • @weierwuha
    你去TDM下一个大包就OK了,该有的基本上都有了。
  • --空明流转
  • 4. re: Mingw GCC 4.3.0 安装与配置(解决CreateProcess问题)
  • 额,越看越糊涂,
    能不能把过程说明+程序集打包放网盘呢?
  • --weierwuha
  • 5. re: python coins[未登录]
  • what are u doing!
  • --jarod

阅读排行榜

  • 1. Mingw GCC 4.3.0 安装与配置(解决CreateProcess问题)(6392)
  • 2. windows crypto API - Random Generator 的 Cpp 封装(1484)
  • 3. Mingw GCC 4.2.2 + Boost Lib 打包下载(769)
  • 4. 静态链接库生成小小备忘(269)
  • 5. 隐写术(242)

评论排行榜

  • 1. Mingw GCC 4.3.0 安装与配置(解决CreateProcess问题)(8)
  • 2. windows crypto API - Random Generator 的 Cpp 封装(3)
  • 3. 隐写术(2)
  • 4. The mathematical way of thinking(1)
  • 5. 静态链接库生成小小备忘(1)

Powered by: 博客园
模板提供:沪江博客
C++博客 | 首页 | 发新随笔 | 发新文章 | 联系 | 聚合 | 管理

2008年12月27日

Malware
Malware是Malicious Software的缩写,即恶意软件,该类软件的目的通常有3个:破坏,控制和窃取,下图展示了Malware中的一些常见类型:


Malware
|
|---- 破坏:
|  |---- adware
|  |---- virus
|  |---- worm
|
|
|---- 控制:
|  |---- shellcode
|  |---- rootkit
|
|
|---- 窃取:
|  |---- spyware
|    |---- crimeware
 
virus – 是一段恶意代码,必须依托正常文件作为宿主(这和生物学上的病毒特征是一致的,即病毒通常为RNA,离开了宿主就失去活性),不能独立运行,需要由它的宿主运行来激活它。能够自我复制和感染正常文件。
 
worm – 是一个恶意程序,能够独立存在,无须依赖其它用户程序即可运行的攻击程序或代码,其特征是通过网络传播,传染目标是网络上的其他计算机
 
adware:安装在用户主机上,自动下载、播放(可能是强制性)广告的程序
 
shellcode:一段代码,利用系统漏洞(通常是缓冲区溢出漏洞)来未经授权地进入用户主机
 
rootkit:一类未经授权、运行在用户主机上的程序,可以获得用户主机的超级管理员控制权限,并利用各种反检测技术隐藏自身进程的存在
 
spyware:安装在用户主机上,用以监视和窃取用户信息和行为(尤其是私密信息),并将其发送至信息收集者的恶意程序
 
crimeware:spyware的一种,专门窃取用户私密信息,例如银行账户和密码,信用卡卡号密码,用户邮箱或者其他网络服务程序的用户名和密码等的恶意程序
 
------------------------------------------------------
 有人会说,上述定义里面为什么没有 trojan horse,实际上,trojan horse 指的是看似具有正常功能,然而却隐藏恶意功能的程序(与希腊神话传说中的特洛伊木马的含义一致),trojan horse 可能是上面所述的各种类型的 malware 的载体( malware 好比当年藏在木马里面的士兵),因此,本文不把 trojan horse 归为 malware 里面特殊的一类
posted @ 2008-12-27 20:36 RomanGol 阅读(22) | 评论 (0) | 编辑 收藏
 

2008年12月9日

几个解释执行C/C++的软件
http://www.softintegration.com/
Ch is an embeddable C/C++ interpreter for cross-platform scripting, shell programming, 2D/3D plotting, numerical computing, and embedded scripting. It is an alternative free C/C++ compiler for learning C/C++.

http://root.cern.ch/twiki/bin/view/ROOT/CINT
CINT is a C/C++ interpreter aimed at processing C/C++ scripts. Scripts are programs performing specific tasks. Generally execution time is not critical, but rapid development is. Using an interpreter the compile and link cycle is dramatically reduced facilitating rapid development. CINT makes C/C++ programming enjoyable even for part-time programmers.

http://bellard.org/tcc/
Fabrice Bellard 发明的 GNU/Linux 环境下最小的 ANSI C 语言编译器: TCC
posted @ 2008-12-09 21:44 RomanGol 阅读(76) | 评论 (1) | 编辑 收藏
 

2008年10月14日

RFC1925 - The Twelve Networking Truths

Network Working Group                                  R. Callon, Editor
Request for Comments: 1925                                          IOOF
Category: Informational                                     1 April 1996

                      The Twelve Networking Truths

Status of this Memo

   This memo provides information for the Internet community.  This memo
   does not specify an Internet standard of any kind.  Distribution of
   this memo is unlimited.

Abstract

   This memo documents the fundamental truths of networking for the
   Internet community. This memo does not specify a standard, except in
   the sense that all standards must implicitly follow the fundamental
   truths.

Acknowledgements

   The truths described in this memo result from extensive study over an
   extended period of time by many people, some of whom did not intend
   to contribute to this work. The editor merely has collected these
   truths, and would like to thank the networking community for
   originally illuminating these truths.

1. Introduction

   This Request for Comments (RFC) provides information about the
   fundamental truths underlying all networking. These truths apply to
   networking in general, and are not limited to TCP/IP, the Internet,
   or any other subset of the networking community.

2. The Fundamental Truths

   (1)  It Has To Work.

   (2)  No matter how hard you push and no matter what the priority,
        you can't increase the speed of light.

        (2a) (corollary). No matter how hard you try, you can't make a
             baby in much less than 9 months. Trying to speed this up
             *might* make it slower, but it won't make it happen any
             quicker.

   (3)  With sufficient thrust, pigs fly just fine. However, this is
        not necessarily a good idea. It is hard to be sure where they
        are going to land, and it could be dangerous sitting under them
        as they fly overhead.

   (4)  Some things in life can never be fully appreciated nor
        understood unless experienced firsthand. Some things in
        networking can never be fully understood by someone who neither
        builds commercial networking equipment nor runs an operational
        network.

   (5)  It is always possible to aglutenate multiple separate problems
        into a single complex interdependent solution. In most cases
        this is a bad idea.

   (6)  It is easier to move a problem around (for example, by moving
        the problem to a different part of the overall network
        architecture) than it is to solve it.

        (6a) (corollary). It is always possible to add another level of
             indirection.

   (7)  It is always something

        (7a) (corollary). Good, Fast, Cheap: Pick any two (you can't
            have all three).

   (8)  It is more complicated than you think.

   (9)  For all resources, whatever it is, you need more.

       (9a) (corollary) Every networking problem always takes longer to
            solve than it seems like it should.

   (10) One size never fits all.

   (11) Every old idea will be proposed again with a different name and
        a different presentation, regardless of whether it works.

        (11a) (corollary). See rule 6a.

   (12) In protocol design, perfection has been reached not when there
        is nothing left to add, but when there is nothing left to take
        away.

Security Considerations

   This RFC raises no security issues. However, security protocols are
   subject to the fundamental networking truths.

References

   The references have been deleted in order to protect the guilty and
   avoid enriching the lawyers.

Author's Address

   Ross Callon
   Internet Order of Old Farts
   c/o Bay Networks
   3 Federal Street
   Billerica, MA  01821

   Phone: 508-436-3936
   EMail: rcallon@baynetworks.com

posted @ 2008-10-14 21:50 RomanGol 阅读(19) | 评论 (0) | 编辑 收藏
 

2008年9月18日

Microsoft network Monitor 3.2

Microsoft network Monitor 更新到3.2,要学习使用之

新特性包括:
Process Tracking: Now you can identify rogue applications sending network data! View all the processes on your machine generating network traffic (process name and PID). Use the conversation tree to view frames associated with each process.
也就是说,可以选择一组程序(这组程序可能是不相关的软件),监视它们的网络通讯

§ Capture engine re-architecture to improve capture rate in high-speed networks. Network Monitor 3.2 drops significantly fewer frames that Network Monitor 3.1.

§ Find conversations: You asked for this. Many of our users found conversation tracking to be difficult to use as the view grew hard to manage, and it was difficult to correlate the frames they were seeing with the conversation nodes in the tree. Now, you can quickly isolate frames in the same network conversation. Just right-click on a frame and select a conversation to track, and you will see all the frames in that conversation. View TCP streams, HTTP flows etc.

§ Extensive parser set: Parsers for over 300 protocols! As before, the parsers are fully customizable.

§ Better parser management: By default only a subset of parsers are loaded. You can load the full parser set by going to Tools>Options>Parser and choose Full vs. Stub implementations.

§ CodePlex Ready: In the upcoming months, we plan to place all our Windows parsers on the Microsoft open-source CodePlex site and allow the community to modify and contribute parsers. You can find out more information on this here. This version of Network Monitor seamlessly integrates new parser packages.
微软准备将源代码发布出来了!

§ Network Monitor API: Create your own applications that capture, parse and analyze network traffic!

§ More extensive documentation of the API and NPL. Access the documentation from Help > NPL and API Documentation.

§ IA64 builds.

§ PCAP capture file support*.

§ ContainsBin Plug-in: Search frames for arbitrary byte sequences or strings.

§ . and more. See our Release Notes in the Help directory of the installation folder for a complete list of new features and known issues.


Enjoy!

posted @ 2008-09-18 20:04 RomanGol 阅读(46) | 评论 (0) | 编辑 收藏
 

2008年8月29日

python coins

coins = [1, 5, 10, 25, 50]
pos = [0]
counter = 0
num = 100

for i in coins:
    while counter < num:
        if counter + i > len(pos) - 1:
            for j in range( counter + i ):
                pos.append(0)
        if counter != 0:
            pos[counter + i] = pos[counter + i] + pos[counter]
        else:
            pos[counter + i] = pos[counter + i] + 1
        counter = counter + 1
    counter = 0

print pos[num]

posted @ 2008-08-29 16:00 RomanGol 阅读(25) | 评论 (1) | 编辑 收藏
 

2008年6月24日

F03 a lifetime name
F03,记住这个代号,多少年以后,这不光是我们每个人的骄傲,也是散落在天涯的我们,零零落落个体孤单的我们,找到归属感的温存。
posted @ 2008-06-24 17:56 RomanGol 阅读(49) | 评论 (1) | 编辑 收藏
 

2008年5月20日

缅怀逝者,铭记国殇,提高代码质量

地震之后,出来这样一条新闻:最牛建筑商:所建五所希望小学均未倒

想起来《编程珠玑》上面说的,美国的一座大桥(忘记了是不是金门大桥),修建的时候造桥学科还没发展到能够精确计算出承受力等方面所需要的结构和用料。但是到了数十年以后,其他同时期建造的桥差不多都报废了,剩下来它一座桥还能用。有人去问那个建筑师你在那么早就能预料到后面的发展?他说,我按当时设计的标准,把所有强度加了10倍上去。


地震时候房子塌了这么多,有人在指责房地产商,可是我们写的代码又何尝不是如此,有时候明明知道这个代码在经典著作中无数次提到会有bug,可是手一懒就省略了提高健壮性的工作,而某一天,这代码很可能就流入了应用场合,而有那么一天,地震就来了。

铭记5.12地震,不仅仅是要缅怀和哀悼,也不是捐款和抱怨,更重要的是,从自己做起,好好工作,做有质量的事情,写有质量的代码

posted @ 2008-05-20 22:00 RomanGol 阅读(81) | 评论 (1) | 编辑 收藏
 

2008年4月19日

Mingw GCC 4.3.0 安装与配置(解决CreateProcess问题)

首先,下载Mingw TDM 4.3.0版本
http://www.tdragon.net/recentgcc/

有两种选择
GCC 4.3.0-tdm-2 (Default SJLJ exceptions) 和 GCC 4.3.0-tdm-2 With DW2 Exceptions
可以根据SJLJ or DW2 (Dwarf-2) 异常模型来选择需要下载的版本,通常情况下win32平台下选择SJLJ(set jump long jump)模型

然后还需要去Mingw官网下载
binutils
http://downloads.sourceforge.net/mingw/binutils-2.18.50-20080109-2.tar.gz
mingw-runtime (mingw-runtime-3.14.tar.gz, 494KB)
http://downloads.sourceforge.net/mingw/mingw-runtime-3.14.tar.gz
w32api (w32api-3.11.tar.gz, 1.55MB)
http://downloads.sourceforge.net/mingw/w32api-3.11.tar.gz

也可以选择安装以下组件
mingw-utils
http://downloads.sourceforge.net/mingw/mingw-utils-0.3.tar.gz
mingw32-make(可以选择最新的mingw32-make-3.81-20080326-2)
http://downloads.sourceforge.net/mingw/mingw32-make-3.81-2.tar.gz
gdb(可以选择最新的6.8试验版)
http://downloads.sourceforge.net/mingw/gdb-6.6.tar.bz2

把这些东西都下载下来,然后解压到不同的目录,每个目录里面大概都会有bin,include,lib,man这样的目录,要做的就是合并它们,也就是拷贝到同一个目录里面,注意可能有些文件会重复,一般来说GCC 4.3.0 TDM包里面的文件比较重要,不要用其他的包里面的文件覆盖了它

然后就可以得到一个完整包含gcc,g++,binutils,gdb,make等的目录了,此时,在windows环境变量中的path变量里面添加该目录的bin子目录,就可以在cmd窗口中调用gcc和g++进行编译了。如果你不想污染了环境变量,也可以写个bat:(假设你的mingw目录是C:\mingw\bin)
set path=C:\mingw\bin;%path%"

现在还没有结束,需要进行两个地方的设置
1 make
mingw官方提供的make工具,名称不是简单的make,而是mingw32-make.exe,把它改名成make.exe或者复制一份为make.exe都可以

2 gcc: CreateProcess: No such file or Directory 错误
这个问题在google里面很多人发问,但是没有一个完整的解答,下面给出一个完整的解答
产生这个错误有两个原因:
第一是gcc无法找到安装目录里面的libexec目录里面的工具,通常这些工具包括cc1.exe,cc1plus.exe,collect2.exe,它们通常存放在:
安装目录\libexec\gcc\mingw32\4.3.0
第二是gcc无法找到mingw目录里面binutils的工具,它们通常存放在
安装目录\mingw32\bin
这两个目录的名字并不完全固定,根据不同组织编译的gcc各有不同,比如mingw官方编译的gcc4.3.0 alpha,上述目录就是
安装目录\gcc\i386-pc-mingw32\4.3.0
而官方提供的binutils包里面是
安装目录\i686-pc-mingw32\bin

只要这两个地方没有设置好,就可能导致CreateProcess错误,那么,有没有什么好办法能够确定这里应该怎样命名呢?办法是用16进制编辑器打开gcc.exe,搜索GCC_EXEC_PREFIX,当搜索到该字符串(不止一个)时,观察后面是否出现版本号4.3.0,如果出现,后面紧接着的就是路径,如果是mingw32那么上面的命名就应该是
安装目录\libexec\gcc\mingw32\4.3.0
安装目录\mingw32\bin

如果是其他的例如i686-pc-mingw32,那么名称相应的变为
安装目录\libexec\gcc\i686-pc-mingw32\4.3.0
安装目录\i686-pc-mingw32\bin

好了,可以测试一下你的hallo world程序了^_^


 

posted @ 2008-04-19 15:17 RomanGol 阅读(6393) | 评论 (8) | 编辑 收藏
 

2008年4月16日

ARIA:a block cipher -- C++ implementation
     摘要: 韩国国家加密算法ARIA,Cpp实现constant.h #ifndef _CONSTANT_H_#define _CONSTANT_H_namespace triod{    const static unsigned short NUM_OF_ROUND_KEY  ...  阅读全文
posted @ 2008-04-16 13:34 RomanGol 阅读(94) | 评论 (1) | 编辑 收藏
 

2008年4月15日

c++ 中函数参数如何传入固定大小的数组
例如要传入一个16字节大小的数组,传统的做法是参数里面写unsigned char*
可以改用如下方法:

typedef const unsigned char  (&const_block) [16];
typedef unsigned char   (&block)  [16];

void test( const_block input, block output );

编译器检查会保证传入的只能是固定大小的数组,不能是指针或者大小与指定值不同的数组。
posted @ 2008-04-15 15:23 RomanGol 阅读(87) | 评论 (0) | 编辑 收藏
 
仅列出标题  下一页