-
-
[旧帖] [推荐]私家珍藏，兑现诺言，可以网盘下载啦 0.00雪花
-
发表于: 2010-10-23 02:01
-
兑现当初诺言，贴上网盘地址
上面的书籍都在网盘里：http://www.vdisk.cn/user/admin/tempuser1288288600?1288288586000 需要的速度下载哦，不然过期可别怪我
为了赚点Kx，赶紧转正，现吐血奉上个人珍藏的书籍。有需要的下～
一、反调试技术
发现OD的处理
1. 窗口类名、窗口名
2. 检测调试器进程
3. 父进程是否是Explorer
4. RDTSC/ GetTickCount时间敏感程序段
5. StartupInfo结构
6. BeingDebugged
7. PEB.NtGlobalFlag , Heap.HeapFlags, Heap.ForceFlags
8. DebugPort: CheckRemoteDebuggerPresent()/NtQueryInformationProcess()
9. SetUnhandledExceptionFilter/ Debugger Interrupts
10. Trap Flag单步标志异常
11. SeDebugPrivilege 进程权限
12. DebugObject: NtQueryObject()
13. OllyDbg：Guard Pages
14. Software Breakpoint Detection
15. Hardware Breakpoints
16. PatchingDetection CodeChecksumCalculation补丁检测，代码检验和
17. block input封锁键盘、鼠标输入
18. EnableWindow禁用窗口
19. ThreadHideFromDebugger
20. Disabling Breakpoints禁用硬件断点
21. OllyDbg:OutputDebugString() Format String Bug
22. TLS Callbacks
二、ODbgScript
-------------------------------------------------
1. 关于 OllyScript
2. 目前情况
2.1 v1.54最新更新
3. 文档
3.1 语言概述
3.1.1 保留变量
3.1.2 指令
3.2 标签
3.3 注释
3.4 菜单
4. 嵌入其他的插件
5. 疑难解析
6. 如何联系我
7. 特许与源代码
8. 鸣谢！
三、脱壳的艺术
四、Anti-Anti-Dump_and_Nonintrusive_tracers 外国原版的反调试书籍
1. Abstract............................................................................................................................... 2
2. Needed knowledge .............................................................................................................. 3
2.1. Offset independent code .................................................................................................. 3
2.2. Retrieving kernel32.dll base and APIs ............................................................................. 4
2.3. Loader injector ................................................................................................................ 7
2.4. Hybrid hooking approach ................................................................................................ 8
2.5. What next? .................................................................................................................... 10
3. MemoryManager .............................................................................................................. 11
3.1. Expanding program memory ......................................................................................... 11
3.2. Memory manager for VirtualAlloc and VirtualFree ....................................................... 12
3.3. Problems with Delphi code............................................................................................ 16
3.4. Memory manager conclusion......................................................................................... 18
4. Nonintrusive tracers for MemoryManager ........................................................................ 19
4.1. Writing nonintrusive tracer ............................................................................................ 20
4.2. Using PAGE_GUARD with nonintrusive tracer ............................................................ 22
4.3. PAGE_GUARD in weird conditions aka KiUserExceptionDispatcher improved ........... 24
4.4. Logging Access ............................................................................................................. 28
4.5. Invoking driver from tracer............................................................................................ 29
4.6. Making stealth nonintrusive tracers ............................................................................... 29
4.7. Nonintrusive tracer conclusion ...................................................................................... 33
5. Loader for Loader.............................................................................................................. 34
5.1. Loader for Loader with injected code............................................................................. 34
5.2. Loader for Loader without injected code........................................................................ 35
5.3. Nonintrusive tracers for Debugged process.................................................................... 36
6. Debugging injected code - tips .......................................................................................... 40
7. Conslusion ........................................................................................................................ 41
8. References......................................................................................................................... 42
9. Greetings........................................................................................................................... 43
上面的书籍都在网盘里：http://www.vdisk.cn/user/admin/tempuser1288288600?1288288586000 需要的速度下载哦，不然过期可别怪我
为了赚点Kx，赶紧转正，现吐血奉上个人珍藏的书籍。有需要的下～
一、反调试技术
发现OD的处理
1. 窗口类名、窗口名
2. 检测调试器进程
3. 父进程是否是Explorer
4. RDTSC/ GetTickCount时间敏感程序段
5. StartupInfo结构
6. BeingDebugged
7. PEB.NtGlobalFlag , Heap.HeapFlags, Heap.ForceFlags
8. DebugPort: CheckRemoteDebuggerPresent()/NtQueryInformationProcess()
9. SetUnhandledExceptionFilter/ Debugger Interrupts
10. Trap Flag单步标志异常
11. SeDebugPrivilege 进程权限
12. DebugObject: NtQueryObject()
13. OllyDbg：Guard Pages
14. Software Breakpoint Detection
15. Hardware Breakpoints
16. PatchingDetection CodeChecksumCalculation补丁检测，代码检验和
17. block input封锁键盘、鼠标输入
18. EnableWindow禁用窗口
19. ThreadHideFromDebugger
20. Disabling Breakpoints禁用硬件断点
21. OllyDbg:OutputDebugString() Format String Bug
22. TLS Callbacks
二、ODbgScript
-------------------------------------------------
1. 关于 OllyScript
2. 目前情况
2.1 v1.54最新更新
3. 文档
3.1 语言概述
3.1.1 保留变量
3.1.2 指令
3.2 标签
3.3 注释
3.4 菜单
4. 嵌入其他的插件
5. 疑难解析
6. 如何联系我
7. 特许与源代码
8. 鸣谢！
三、脱壳的艺术
四、Anti-Anti-Dump_and_Nonintrusive_tracers 外国原版的反调试书籍
1. Abstract............................................................................................................................... 2
2. Needed knowledge .............................................................................................................. 3
2.1. Offset independent code .................................................................................................. 3
2.2. Retrieving kernel32.dll base and APIs ............................................................................. 4
2.3. Loader injector ................................................................................................................ 7
2.4. Hybrid hooking approach ................................................................................................ 8
2.5. What next? .................................................................................................................... 10
3. MemoryManager .............................................................................................................. 11
3.1. Expanding program memory ......................................................................................... 11
3.2. Memory manager for VirtualAlloc and VirtualFree ....................................................... 12
3.3. Problems with Delphi code............................................................................................ 16
3.4. Memory manager conclusion......................................................................................... 18
4. Nonintrusive tracers for MemoryManager ........................................................................ 19
4.1. Writing nonintrusive tracer ............................................................................................ 20
4.2. Using PAGE_GUARD with nonintrusive tracer ............................................................ 22
4.3. PAGE_GUARD in weird conditions aka KiUserExceptionDispatcher improved ........... 24
4.4. Logging Access ............................................................................................................. 28
4.5. Invoking driver from tracer............................................................................................ 29
4.6. Making stealth nonintrusive tracers ............................................................................... 29
4.7. Nonintrusive tracer conclusion ...................................................................................... 33
5. Loader for Loader.............................................................................................................. 34
5.1. Loader for Loader with injected code............................................................................. 34
5.2. Loader for Loader without injected code........................................................................ 35
5.3. Nonintrusive tracers for Debugged process.................................................................... 36
6. Debugging injected code - tips .......................................................................................... 40
7. Conslusion ........................................................................................................................ 41
8. References......................................................................................................................... 42
9. Greetings........................................................................................................................... 43
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
潜力贴留名.Opera插图补丁.字数补丁..
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
旧资料了，，论坛以前就有的..
|
|
|
|
|
|
|
|
|
收藏一下！
|
|
|
|
|
|
|
|
|
等LZ转正了绝对多奉上更多，而且是免费的网盘地址～不想花Kx的可以稍微等一下···
|
|
|
我这有了 不过还是感谢分享
|
|
|
|
|
|
过来补考的
|
|
|
貌似不错的东西，不过现在还看不明白
|
|
|
|
|
|
|
|
|
3721,我先mark一下
|
|
|
转正后再来。
|
