-
编辑 删除
我的首个IDC脚本.
我的首个IDC, 呵呵,是在搞GameGuard用解释字符串用的.#include <idc.idc>static main(){ auto ea; auto i; auto uEcx; auto uDx; auto cLowLen; auto cDl,cBl; auto str; str=""; ea=ScreenEA(); uEcx=Byte(ea)+Byte(ea)*2; cLowLen=(0xff & (0xff & uEcx+0x65)) ^ Byte(ea+1);// Message("cLowLen: %8xrn",cLowLen);// PatchByte(ea+1,cLowLen); uEcx=uEcx+uEcx*2+3; cDl=0xff &uEcx; Message("cDl: %8xrn",cDl); cBl=Byte(ea+2);
-
编辑 删除
口诀1
0x38 [00] IRP_MJ_CREATE ba98bb1a +0xba98bb1a0x3c [01] IRP_MJ_CREATE_NAMED_PIPE 804f420e nt!IopInvalidDeviceRequest0x40 [02] IRP_MJ_CLOSE ba98ee86 +0xba98ee860x44 [03] IRP_MJ_READ 804f420e nt!IopInvalidDeviceRequest0x48 [04] IRP_MJ_WRITE 804f420e nt!IopInvalidDeviceRequest0x4c [05] IRP_MJ_QUERY_INFORMATION 804f420e nt!IopInvalidDeviceRequest0x50 [06] IRP_MJ_SET_INFORMATION 804f4
-
编辑 删除
字符串处理算法
http://www-igm.univ-mlv.fr/~lecroq/string/node1.html[@more@]
-
编辑 删除
备忘 -- _IO_STACK_LOCATION
+0x000 MajorFunction : UChar+0x001 MinorFunction : UChar+0x002 Flags : UChar+0x003 Control : UChar+0x004 Parameters : __unnamed+0x000 Create : __unnamed+0x000 SecurityContext : Ptr32 _IO_SECURITY_CONTEXT+0x004 Options : Uint4B+0x008 FileAttributes : Uint2B+0x00a ShareAccess : Uint2B+0x00c EaLength : Uint4B+0x000 CreatePipe : __unnamed+0x000 SecurityContext : Ptr32 _IO_SECURITY_CONTEXT+0x004 Options : Uint4B+0x008 Reserved : Uint2B+0x00a ShareAccess : Uint2B+0x00c Parameters : Ptr32 _NAMED_PIPE_C
-
编辑 删除
备忘 ---IRP
lkd> dt _IRP -r +0x000 Type : Int2B +0x002 Size : Uint2B +0x004 MdlAddress : Ptr32 _MDL +0x000 Next : Ptr32 _MDL +0x000 Next : Ptr32 _MDL +0x004 Size : Int2B +0x006 MdlFlags : Int2B +0x008 Process : Ptr32 _EPROCESS +0x00c MappedSystemVa : Ptr32 Void +0x010 StartVa : Ptr32 Void +0x014 ByteCount : Uint4B +0x018 ByteOffset
