摘要：I use the code snippet below to test some points of SEH: #define WIN32_LEAN_AND_MEAN#include#includevoid main(){ char *str="this is a local string"; printf("Entering main function\n"); ... 阅读全文

摘要：static void Main(){ System.ServiceProcess.ServiceBase[] ServicesToRun; // More than one user Service may run within the same process. To add // another service to this process, change the fo... 阅读全文

摘要：Kernel32!LoadLibraryW(LPCWSTR lpFileName){ LoadLibraryExW(lpFileName, 0, 0);} Kernel32!LoadLibraryA(LPCSTR lpFileName){ if(lpFileName==NULL) { LoadLibraryExA(lpFileName, 0, 0); } else { int ret1=str... 阅读全文

摘要：kernel32!SetLastError(dwErrorCode){ if(g_dwLastErrorToBreakOn!=null) { if(g_dwLastErrorToBreakOn==dwErrorCode) { DbgBreakPoint(); } } if(teb.LastErrorValue... 阅读全文

摘要：1. After installing the service, the SCP only writes the service exe information in the SCM database, so any modification to the exe will be valid, since the exe path does not change. The exe file wil... 阅读全文

摘要：1. CreateNamedPipe CreateFile Access/Open Mode--The open handle's read/write pe... 阅读全文

摘要：#include#include#include #pragma comment(lib, "libdasm.lib") int inst_len = 0;FARPROC hAPI=NULL;char *szInstruction=NULL;PDWORD pHookFuncAddr; void MB(LPTSTR pszInfo){ MessageBox(NULL, pszInfo, TEXT("... 阅读全文

摘要：1. Why .h file is neededIf we are developing several cpp files in a project, the compiler will compile one cpp file at a time. If A.cpp refers B.cpp symbols(variable/function), there must be a way to ... 阅读全文

摘要：1. TipsAt runtime, the IAT(RVA obtained by IMAGE_THUNK_DATA->FirstThunk) is modified by OS loader and points to the real API addresses, so we should use IMAGE_THUNK_DATA->OriginalFirstThunk to refer t... 阅读全文

摘要：P1. When will link take place?It can take action in 3 different places: 1. compile-time2. load-time3. run-time.P2. To create executable file, the compiler must complete 2 tasks:1. Symbol Resolution: a... 阅读全文

摘要：1. "x" command in windbg requires the module name. For example, if we only type "x createprocessa" in windbg, we will get nothing. "x kernel32!createprocessa" is the correct way.If you really do not k... 阅读全文