ITPub博客

I needed to know what kind of information was stored into the RAM of my server when users were logged in. Accessing the content of the entire memory at a specific time is possible for example when Windows crashes.So, how to make Windows XP crash ?I first thought about coding some weird and ugly stuff which would make the system hang out and crash but...it's harder than I thought : )Eventually, I came upon a Microsoft KB article for activating a feature called 'Crash on Control Scroll'. This feat

我的首个IDC, 呵呵,是在搞GameGuard用解释字符串用的.#include <idc.idc>static main(){ auto ea; auto i; auto uEcx; auto uDx; auto cLowLen; auto cDl,cBl; auto str; str=""; ea=ScreenEA(); uEcx=Byte(ea)+Byte(ea)*2; cLowLen=(0xff & (0xff & uEcx+0x65)) ^ Byte(ea+1);// Message("cLowLen: %8xrn",cLowLen);// PatchByte(ea+1,cLowLen); uEcx=uEcx+uEcx*2+3; cDl=0xff &uEcx; Message("cDl: %8xrn",cDl); cBl=Byte(ea+2);

0x38 [00] IRP_MJ_CREATE ba98bb1a +0xba98bb1a0x3c [01] IRP_MJ_CREATE_NAMED_PIPE 804f420e nt!IopInvalidDeviceRequest0x40 [02] IRP_MJ_CLOSE ba98ee86 +0xba98ee860x44 [03] IRP_MJ_READ 804f420e nt!IopInvalidDeviceRequest0x48 [04] IRP_MJ_WRITE 804f420e nt!IopInvalidDeviceRequest0x4c [05] IRP_MJ_QUERY_INFORMATION 804f420e nt!IopInvalidDeviceRequest0x50 [06] IRP_MJ_SET_INFORMATION 804f4

http://www-igm.univ-mlv.fr/~lecroq/string/node1.html[@more@]

+0x000 MajorFunction : UChar+0x001 MinorFunction : UChar+0x002 Flags : UChar+0x003 Control : UChar+0x004 Parameters : __unnamed+0x000 Create : __unnamed+0x000 SecurityContext : Ptr32 _IO_SECURITY_CONTEXT+0x004 Options : Uint4B+0x008 FileAttributes : Uint2B+0x00a ShareAccess : Uint2B+0x00c EaLength : Uint4B+0x000 CreatePipe : __unnamed+0x000 SecurityContext : Ptr32 _IO_SECURITY_CONTEXT+0x004 Options : Uint4B+0x008 Reserved : Uint2B+0x00a ShareAccess : Uint2B+0x00c Parameters : Ptr32 _NAMED_PIPE_C

lkd> dt _IRP -r +0x000 Type : Int2B +0x002 Size : Uint2B +0x004 MdlAddress : Ptr32 _MDL +0x000 Next : Ptr32 _MDL +0x000 Next : Ptr32 _MDL +0x004 Size : Int2B +0x006 MdlFlags : Int2B +0x008 Process : Ptr32 _EPROCESS +0x00c MappedSystemVa : Ptr32 Void +0x010 StartVa : Ptr32 Void +0x014 ByteCount : Uint4B +0x018 ByteOffset