<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>cdut-boy&#039;s blog</title>
	<atom:link href="http://www.cdut-boy.com/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.cdut-boy.com</link>
	<description>又拿程序换酒钱</description>
	<lastBuildDate>Fri, 18 May 2012 07:30:55 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.2</generator>
		<item>
		<title>WinAll calc x86 shellcode 93 byte</title>
		<link>http://www.cdut-boy.com/2012/05/18/winall-calc-x86-shellcode/</link>
		<comments>http://www.cdut-boy.com/2012/05/18/winall-calc-x86-shellcode/#comments</comments>
		<pubDate>Fri, 18 May 2012 07:18:26 +0000</pubDate>
		<dc:creator>cdut-boy</dc:creator>
				<category><![CDATA[原创作品]]></category>
		<category><![CDATA[shellcode]]></category>

		<guid isPermaLink="false">http://www.cdut-boy.com/?p=757</guid>
		<description><![CDATA[for win2k~win8 x86通用 //by xSpy unsigned char ShellCodeCalc[93] = { 0&#215;55, 0x8B, 0xEC, 0&#215;33, 0xC9, 0x6A, 0&#215;18, 0&#215;58, 0&#215;64, 0x8B, 0&#215;30, 0x8B, 0&#215;76, 0&#215;30, 0x8B, 0&#215;76, 0x0C, 0x8B, 0&#215;76, 0x1C, 0x8B, 0x7E, 0&#215;08, 0x8B, 0x5E, 0&#215;20, 0x8B, 0&#215;36, 0&#215;38, 0x4B, 0&#215;18, 0&#215;75, 0xF3, 0x8B, 0x5F, 0x3C, 0x8B, 0x5C, 0x3B, 0&#215;78, 0x8B, 0&#215;74, 0x3B, 0&#215;20, 0&#215;03, [...]]]></description>
		<wfw:commentRss>http://www.cdut-boy.com/2012/05/18/winall-calc-x86-shellcode/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>搜索指定目录下会触发UAC的程序</title>
		<link>http://www.cdut-boy.com/2012/03/06/finduacfile/</link>
		<comments>http://www.cdut-boy.com/2012/03/06/finduacfile/#comments</comments>
		<pubDate>Tue, 06 Mar 2012 14:57:57 +0000</pubDate>
		<dc:creator>cdut-boy</dc:creator>
				<category><![CDATA[原创作品]]></category>
		<category><![CDATA[UAC]]></category>

		<guid isPermaLink="false">http://www.cdut-boy.com/?p=752</guid>
		<description><![CDATA[无壳无花,拖到IDA里就是源码. vista/7/8 FindUAC]]></description>
		<wfw:commentRss>http://www.cdut-boy.com/2012/03/06/finduacfile/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>windows 8 SSDT</title>
		<link>http://www.cdut-boy.com/2012/03/04/windows-8-ssdt/</link>
		<comments>http://www.cdut-boy.com/2012/03/04/windows-8-ssdt/#comments</comments>
		<pubDate>Sat, 03 Mar 2012 16:16:20 +0000</pubDate>
		<dc:creator>cdut-boy</dc:creator>
				<category><![CDATA[程序设计]]></category>
		<category><![CDATA[SSDT]]></category>
		<category><![CDATA[win8]]></category>
		<category><![CDATA[windbg]]></category>

		<guid isPermaLink="false">http://www.cdut-boy.com/?p=743</guid>
		<description><![CDATA[去年出开发者预览版的时候,我的vmware 7 装不上,蓝屏.据说可以用virtual pc,懒得换. 这次出消费者预览版了,赶紧下回来试试.把vmware也换成8.0了.还好一起顺利. 感觉开启内核调试 &#160; windbg 显示的版本号是 windows 7 8250 x86 不知道是不是预览版的原因,居然还是windows 7 SSDT &#160; 完整的SSDT 列表 kd&#62; $$&#62;&#60; d:\ssdt.txt Ord   Address   fnAddr   Symbols &#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8211; [  0] 812EF6E8: 812DAD15 (nt!NtWorkerFactoryWorkerReady (812dad15)) [  1] 812EF6EC: 8126FCC2 (nt!NtYieldExecution (8126fcc2)) [  2] 812EF6F0: 814E5717 (nt!NtWriteVirtualMemory (814e5717)) [  3] 812EF6F4: 815C07B3 (nt!NtWriteRequestData (815c07b3)) [  4] 812EF6F8: 815739A9 [...]]]></description>
		<wfw:commentRss>http://www.cdut-boy.com/2012/03/04/windows-8-ssdt/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>任务管理UAC管理员权限</title>
		<link>http://www.cdut-boy.com/2012/02/23/%e4%bb%bb%e5%8a%a1%e7%ae%a1%e7%90%86uac%e7%ae%a1%e7%90%86%e5%91%98%e6%9d%83%e9%99%90/</link>
		<comments>http://www.cdut-boy.com/2012/02/23/%e4%bb%bb%e5%8a%a1%e7%ae%a1%e7%90%86uac%e7%ae%a1%e7%90%86%e5%91%98%e6%9d%83%e9%99%90/#comments</comments>
		<pubDate>Thu, 23 Feb 2012 01:57:09 +0000</pubDate>
		<dc:creator>cdut-boy</dc:creator>
				<category><![CDATA[程序设计]]></category>
		<category><![CDATA[UAC]]></category>

		<guid isPermaLink="false">http://www.cdut-boy.com/?p=741</guid>
		<description><![CDATA[vista以后任务管理显示所有进程的按钮是带盾牌的,说明可以提权至管理员. windbg调试简要记录. bp SHELL32!ShellExecuteExW bp taskmgr!ElevateOrRelaunch taskmgr!g_hMainWnd = 00000000000c04b2 rsp+0C0h = 模块路径 00000000`ff5a784f 是call Shellexecute的地方 0:000> dt _SHELLEXECUTEINFOW 10ea60 ole32!_SHELLEXECUTEINFOW +0&#215;000 cbSize : 0&#215;70 +0&#215;004 fMask : 0&#215;400 +0&#215;008 hwnd : 0&#215;00000000`000c04b2 HWND__ +0&#215;010 lpVerb : 0&#215;00000000`ff5968b8 “runas” +0&#215;018 lpFile : 0&#215;00000000`0010ead0 “C:\Windows\system32\taskmgr.exe” +0&#215;020 lpParameters : 0&#215;00000000`ff596b48 ” /1&#8243; +0&#215;028 lpDirectory : (null) +0&#215;030 nShow [...]]]></description>
		<wfw:commentRss>http://www.cdut-boy.com/2012/02/23/%e4%bb%bb%e5%8a%a1%e7%ae%a1%e7%90%86uac%e7%ae%a1%e7%90%86%e5%91%98%e6%9d%83%e9%99%90/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>x64 findkernel32 shellcode 45byte</title>
		<link>http://www.cdut-boy.com/2012/02/19/x64-findkernel32-shellcode/</link>
		<comments>http://www.cdut-boy.com/2012/02/19/x64-findkernel32-shellcode/#comments</comments>
		<pubDate>Sun, 19 Feb 2012 06:39:10 +0000</pubDate>
		<dc:creator>cdut-boy</dc:creator>
				<category><![CDATA[程序设计]]></category>
		<category><![CDATA[shellcode]]></category>

		<guid isPermaLink="false">http://www.cdut-boy.com/?p=733</guid>
		<description><![CDATA[unsigned char x64_GetKernel32[45] = { 0&#215;56, 0&#215;57, 0&#215;53, 0&#215;48, 0&#215;33, 0xDB, 0x6A, 0&#215;30, 0&#215;58, 0&#215;65, 0&#215;48, 0x8B, 0&#215;30, 0&#215;48, 0x8B, 0&#215;46, 0&#215;60, 0&#215;48, 0x8B, 0&#215;40, 0&#215;18, 0&#215;48, 0x8B, 0&#215;70, 0&#215;10, 0&#215;48, 0x8B, 0x7E, 0&#215;60, 0&#215;48, 0x8B, 0&#215;46, 0&#215;30, 0&#215;48, 0x8B, 0&#215;36, 0&#215;38, 0x5F, 0&#215;18, 0&#215;75, 0xF0, 0x5B, 0x5F, 0x5E, 0xC3 }; 纯字符,无截断,执行后,rax就是kernel32基址. winxp ~7 x64通用]]></description>
		<wfw:commentRss>http://www.cdut-boy.com/2012/02/19/x64-findkernel32-shellcode/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>x64 gs搜索kernel32</title>
		<link>http://www.cdut-boy.com/2012/01/15/x64-gs/</link>
		<comments>http://www.cdut-boy.com/2012/01/15/x64-gs/#comments</comments>
		<pubDate>Sun, 15 Jan 2012 09:17:29 +0000</pubDate>
		<dc:creator>cdut-boy</dc:creator>
				<category><![CDATA[程序设计]]></category>
		<category><![CDATA[shellcode]]></category>
		<category><![CDATA[x64]]></category>

		<guid isPermaLink="false">http://www.cdut-boy.com/?p=707</guid>
		<description><![CDATA[编写shellcode很重要的一步就是搜索kernel32的基址,毕竟我们要获取API的地址 x86下总所周知的fs寄存器搜索kernel32基址的办法,在x64下已经失效了. 鉴于网上的资料太少,也许是我没搜索到.暂且写一段分享. x64下fs的角色已经换成了gs. 暂时发现存储的一些感兴趣的东西,如果有其他的,希望能告知我. gs:[0x30]                 TEB gs:[0x40]                 Pid gs:[0x48]                 Tid gs:[0x60]                PEB gs:[0x68]                 LastError 值得一提的是,虽然gs:[0x60] 直接存放的PEB,但是由于vista/7后的地址随机化机制,还是从TEB获取比较靠谱. 0:009&#62; dt 000007fffff98000 _TEB ntdll!_TEB +0&#215;000 NtTib            : _NT_TIB +0&#215;038 EnvironmentPointer : (null) +0&#215;040 ClientId         : _CLIENT_ID +0&#215;050 ActiveRpcHandle  : (null) +0&#215;058 ThreadLocalStoragePointer : (null) +0&#215;060 ProcessEnvironmentBlock : 0x000007ff`fffd5000 _PEB    //这里即是PEB //用c语言描述就是 #define x64_GetPeb()               [...]]]></description>
		<wfw:commentRss>http://www.cdut-boy.com/2012/01/15/x64-gs/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>买个火车票跟买彩票一样</title>
		<link>http://www.cdut-boy.com/2012/01/07/%e4%b9%b0%e4%b8%aa%e7%81%ab%e8%bd%a6%e7%a5%a8%e8%b7%9f%e4%b9%b0%e5%bd%a9%e7%a5%a8%e4%b8%80%e6%a0%b7/</link>
		<comments>http://www.cdut-boy.com/2012/01/07/%e4%b9%b0%e4%b8%aa%e7%81%ab%e8%bd%a6%e7%a5%a8%e8%b7%9f%e4%b9%b0%e5%bd%a9%e7%a5%a8%e4%b8%80%e6%a0%b7/#comments</comments>
		<pubDate>Sat, 07 Jan 2012 00:30:19 +0000</pubDate>
		<dc:creator>cdut-boy</dc:creator>
				<category><![CDATA[琐碎]]></category>

		<guid isPermaLink="false">http://www.cdut-boy.com/?p=701</guid>
		<description><![CDATA[先谢国家,感谢finback,我买到票了.,我还不能抑制住鸡冻的心情. 买个火车票跟买彩票一样. SB的铁道部网站,还是电话订票靠谱,手机根本打不进去,还是得座机]]></description>
		<wfw:commentRss>http://www.cdut-boy.com/2012/01/07/%e4%b9%b0%e4%b8%aa%e7%81%ab%e8%bd%a6%e7%a5%a8%e8%b7%9f%e4%b9%b0%e5%bd%a9%e7%a5%a8%e4%b8%80%e6%a0%b7/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>写在2011最后一天</title>
		<link>http://www.cdut-boy.com/2011/12/31/%e5%86%99%e5%9c%a82011%e6%9c%80%e5%90%8e%e4%b8%80%e5%a4%a9/</link>
		<comments>http://www.cdut-boy.com/2011/12/31/%e5%86%99%e5%9c%a82011%e6%9c%80%e5%90%8e%e4%b8%80%e5%a4%a9/#comments</comments>
		<pubDate>Sat, 31 Dec 2011 15:45:08 +0000</pubDate>
		<dc:creator>cdut-boy</dc:creator>
				<category><![CDATA[琐碎]]></category>

		<guid isPermaLink="false">http://www.cdut-boy.com/?p=689</guid>
		<description><![CDATA[和朋友吃饭回来,还有几分钟就2012年了. 这一年感觉过的好快,仿佛昨天还在成都,今天就到了北京. 一些同事来了又走了,悲欢离合. 年初第二次跳槽到现在的公司,到现在也快一年了,希望是一个好的转折点. 感谢一年的工作中,给予大量指点的AD-lab的同事,科技,村长等. 希望新的一年,自己的水平能有更多的提升. 希望薪水能涨点,哈哈哈.]]></description>
		<wfw:commentRss>http://www.cdut-boy.com/2011/12/31/%e5%86%99%e5%9c%a82011%e6%9c%80%e5%90%8e%e4%b8%80%e5%a4%a9/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Ferris</title>
		<link>http://www.cdut-boy.com/2011/12/25/ferris/</link>
		<comments>http://www.cdut-boy.com/2011/12/25/ferris/#comments</comments>
		<pubDate>Sun, 25 Dec 2011 15:42:46 +0000</pubDate>
		<dc:creator>cdut-boy</dc:creator>
				<category><![CDATA[原创作品]]></category>
		<category><![CDATA[joke]]></category>

		<guid isPermaLink="false">http://www.cdut-boy.com/?p=669</guid>
		<description><![CDATA[Ferris是什么? Ferris是一个小恶作剧,把屏幕模拟摩天轮旋转. 大约在大一~大二时(07年)看到这个创意,可惜当时没法去实现, 今天把它实现了. Ferris在运行时,你是没法关闭它的,所以我提供了一个快捷键F12 Ferris CRC32: 3061646D MD5: 7E9A561D78B7F70BD9FA3D6C622EE629 SHA-1: A0F88A433991F633E4C73B321A86FE095506EC88]]></description>
		<wfw:commentRss>http://www.cdut-boy.com/2011/12/25/ferris/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>全shellcode化完成了</title>
		<link>http://www.cdut-boy.com/2011/11/29/%e5%85%a8shellcode%e5%8c%96%e5%ae%8c%e6%88%90%e4%ba%86/</link>
		<comments>http://www.cdut-boy.com/2011/11/29/%e5%85%a8shellcode%e5%8c%96%e5%ae%8c%e6%88%90%e4%ba%86/#comments</comments>
		<pubDate>Tue, 29 Nov 2011 13:14:59 +0000</pubDate>
		<dc:creator>cdut-boy</dc:creator>
				<category><![CDATA[琐碎]]></category>

		<guid isPermaLink="false">http://www.cdut-boy.com/?p=667</guid>
		<description><![CDATA[重大时刻,全shellcode化完成了,特发此文以记之.]]></description>
		<wfw:commentRss>http://www.cdut-boy.com/2011/11/29/%e5%85%a8shellcode%e5%8c%96%e5%ae%8c%e6%88%90%e4%ba%86/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
	</channel>
</rss>

