Jump instructions are divided into three categories:First, unconditional jump: JMP;Second, according to the value of CX, ECX Register jump: JCXZ (CX is 0 jump), JECXZ (ECX for 0 jump);Three, according to the EFLAGS register flag bit jump, this too many.JMP Unconditional Transfer Instructions1, the direct short transfer within the paragraph 2, a direct near-transfer within the paragraph 3, within the paragraph near the transfer of 4, the direct transfe
In assembly, $ is used to obtain the address where $ is located. Therefore, JMP $ is an endless loop. Unless
Interrupted, and the interrupted service program will be executed again. However, it should be noted that the returned address is still JMP $, rather than its
The next statement.
In JMP $ execution, the address of the
① JMP is not responsible for scheduling. It does not save any information, and it does not consider turning back. Skip this step.② Call, save EIP, and so on, so that the program can jump back. RET is the inverse process of call and the process of turning back. This is an inherent CPU command, so we do not need to save the information. Run the command directly.③ Privilege-level transfer within the same task, which is similar to ②, but you need to prepa
Tag: instruction equals Win32 html WWW htm greater than lag strongJump instructions are divided into three categories:First, unconditional jump: JMP;Second, according to the value of CX, ECX Register jump: JCXZ (CX is 0 jump), JECXZ (ECX for 0 jump);Three, according to the EFLAGS register flag bit jump, this too many.Instructions to jump according to the flag bit:JE or equal to the jumpJNE ; not equal to the jumpJZ ; for 0 then Jumpjnz ; not 0 jumps
Jmp selector: offset. The selector may indicate a segment descriptor or a gate descriptor. The cpu executes this command as follows:
The above is my understanding of the jmp selector: offset execution process. In fact, the call selector: offset is similar, but the stack of cs and eip is added at the beginning and end, And the stack is output.
(The arrow shown in the figure is a bit eye-catching. I can
Virus name: Trojan-PSW.Win32.QQPass.ajo (Kaspersky)Virus alias: worm. win32.pabug. CF (rising star), win32.troj. qqpasst. ah.110771 (drug overlord)Virus size: 32,948 bytesShelling method: UPXSample MD5: 772f4dfc995f7c1ad6d1978691190cdeSample sha1: e9d2bcc5666a3433d5ef8cc836c4579f03f8b6ccAssociated Virus:Transmission Mode: Spread through malicious web pages, other trojan downloads, USB flash drives, and mobile hard drives
Technical Analysis============
After the trojan is run, copy itself:Cod
YourselfProgramTo share with you. It's dangerous to remember sprintf!
VC ++ 2008 in debug mode
# Include
This program gets stuck when it is executed to free, and F11 is used for debugging until it reaches the assembly language.
JMP _ vec_memzero; Use fast zero sse2 implementation
The system stops and displays "No information available for the current location ".Source code".
Cause:
Invalid Memory Access, subscript out of bounds.
Use of the Python3 learning APIGit:https://github.com/linyi0604/machinelearningCode:1 fromSklearn.datasetsImportLoad_boston2 fromSklearn.cross_validationImportTrain_test_split3 fromSklearn.preprocessingImportStandardscaler4 fromSklearn.treeImportDecisiontreeregressor5 fromSklearn.metricsImportR2_score, Mean_squared_error, Mean_absolute_error6 ImportNumPy as NP7 8 " "9 regression tree:Ten strictly speaking, the return tree is not a return . One The leaf node is a group of training data mean
Words don't say much, directly on the code
1 Code implementation and results screenshot,
#coding: Utf-8#使用skflow内置的LR, the integrated regression model in Dnn,scikit-learn predicts "US Boston house prices"From Sklearn import datasets,metrics,preprocessing,cross_validation#读取数据Boston=datasets.load_boston ()#获取房价数据特征及对应房价X,y=boston.data,boston.target#数据分割, 25% tests.X_train,x_test,y_train,y_test=cross_validati
' Deep ({0}, {1}, {2}) '. Format (one_str[1:], Tmp_str + C, res_list)
if __name__ = ' __main__ ':
one_str _list=[', ' 567 ', ', ', ', ', ' ', ' and '
one_str in one_str_list:
one_list=phone_num_map (One_str,phone_ dict)
print one_list
print len (one_list)
The results are as follows:
Deep (, AD, [' Ad ']) deep (, AE, [' ad ', ' AE ']] deep (, AF, [' Ad ', ' AE ', ' af ']) deep (3, A, [' Ad ', ' AE ', ' af ']) deep (, BD, [' Ad '] , ' AE ', ' af ', ' BD ']
db_recovery_file_dest= '/oracle/app/oracle/oradata/'#SET sga_max_size 200M#SET Sga_target 185MNofilenamecheck;}These storage directories: Flash back directory, ADR directory, audit log directory, oracle-managed data file directory and so on, must pay attention to AH------------here to explain the principle of initializing the repository with the above command, using the date output of the class above command execution:$rman target Sys/[email protected] auxiliary sys/[email protected]Connected t
I read an article on IAT encryption processing. I learned how to fix IAT after arriving at OEP. If there is any error, please advise.Copyright: evilangel
Test shell is The original program kryton The Krypter [v.0.2]
I. Shell check:
PEiD shell check:Kryton 0.2-> Yado/Lockless
2. Arrive at OEP
First, load the OD, ignore all exceptions, and stop
00434000> 8B0C24 mov ecx, [esp];
Kernel32.7C81702700434003 E9 0A7C0100 jmp 0044BC1200434008 AD lods dword ptr
! NtWriteVirtualMemory
01. GIF (48.97 KB)
The three functions show YES, indicating that the Address is written down by the HOOK. We can use WINDBG to check the Address.
Switch to the WINDBG menu and choose "open"> "kernel mode"> "local". Then, confirm whether to save or choose "yes ".
Menu-View-command browser we break into command uf 0xaa096314 (my Address here may be different from yours to see clearly !!)
02. GIF (116.31 KB)
Aa096314 PUSH EBPAa096315 mov ebp, ESPAa096317 add esp,-28Aa09631a
address for all 6F statements ). This CALL is called not only when the money and wood population changes, but even when the Organization is created or destroyed. All we need here is to HOOK the call to the change of money and wood. After all, other abnormal functions have already been written by our predecessors and there is no need to repeat the wheel. (If you are interested, you can analyze it yourself)
You only need to determine the value of edx before mov edx, dword ptr ss: [esp + 0x4] to
int 21h
Retry:cmp al, "1"
Je speed1
CMP al, "2"
Je speed2
CMP al, "3"
Je speed3
CMP al, "4"
Je speed4
CMP al, "5"
Je speed5
CMP al, "6"
Je speed6
CMP AL,1BH
Je to_over0
JMP input
TO_OVER0:JMP over
Speed1:mov ah,01h
int 21h
CMP AL,0DH
Jne OtherKey
MOV ax,speed+2
MOV Speed,ax
JMP begin
Speed2:mov ah,01h
int 21h
CMP AL,0DH
Jne OtherKey
MOV ax,speed+4
MOV Speed,ax
This anti-debugging method is different from the previous anti-debugging method.In the past, anti-debugging was based on the determination of the debugging personnel. Currently, powerful VMP and TMD methods are also used, the disadvantage of this method is that it is ineffective for a strong-willed, curious, or shake M (that is, if you give him a slap in the face, he also feels good from the heart. At present, we can all crack the VMP, TMD's norm, and prove the bottleneck of this anti-debugging.
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.