SECURITY RESEARCH / ENGINEERING
文章与研究
在证据与实验中理解复杂系统。
2011-09-07
form：
Private Sub Form_Load()
' 安装钩子
lHook = SetWindowsHookEx(WH_KEYBOARD_LL, AddressOf CallKeyHookProc, App.hInstance, 0)
End Sub
Private Sub Form_Unload(Cancel As Integer)
' 卸载钩子
UnhookWindowsHookEx lHook
End Sub
Module:
Option Explicit
Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long)
Public Declare Function GetKeyState Lib "user32" (ByVal nVirtKey As Long) As Integer
Public Declare Function SetWindowsHookEx Lib "user32" Alias "SetWindowsHookExA" (ByVal idHook As Long, ByVal lpfn As Long, ByVal hmod As Long, ByVal dwThreadId As Long) As Long
Public Declare Function CallNextHookEx Lib "user32......
阅读全文 →
2011-09-07
form：
Private Sub Form_Load()
' 安装钩子
lHook = SetWindowsHookEx(WH_KEYBOARD_LL, AddressOf CallKeyHookProc, App.hInstance, 0)
End Sub
Private Sub Form_Unload(Cancel As Integer)
' 卸载钩子
UnhookWindowsHookEx lHook
End Sub
Module:
Option Explicit
Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long)
Public Declare Function GetKeyState Lib "user32" (ByVal nVirtKey As Long) As Integer
Public Declare Function SetWindowsHookEx Lib "user32" Alias "SetWindowsHookExA" (ByVal idHook As Long, ByVal lpfn As Long, ByVal hmod As Long, ByVal dwThreadId As Long) As Long
Public Declare Function CallNextHookEx Lib "user32......
阅读全文 →
2011-09-07
作者：Sebastien Renaud
译者：riusksk（泉哥：http://riusksk.blogbus.com）
本文将向各位揭示一些关于Stuxnet蠕虫病毒的技术细节，主要旨在讲述作者是如何利用0day漏洞实现代码的通用性。文中讨论的是作者所用到的两个Windows提权漏洞之一。这一漏洞在微软发布的MS10-073升级补丁中已经修复了，但还有另一个windows......
阅读全文 →