-
Notifications
You must be signed in to change notification settings - Fork 27
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
update site at 20240716-194208, machine LiaoSirui-MacMini.local
- Loading branch information
Showing
10 changed files
with
91 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,10 @@ | ||
Go 语言的编译工具链会全静态链接构建二进制文件,把标准库函数和第三方 package 全部做了静态编译,再加上 Go 二进制文件中还打包进去了 runtime 和 GC(Garbage Collection,垃圾回收) 模块代码,所以即使做了 strip 处理( `go build -ldflags "-s -w"` ),生成的二进制文件体积仍然很大。在反汇编工具中打开 Go 语言二进制文件,可以看到里面包含动辄几千个函数。再加上 Go 语言的独特的函数调用约定、栈结构和多返回值机制,使得对 Go 二进制文件的分析,无论是静态逆向还是动态调式分析,都比分析普通的二进制程序要困难很多 | ||
|
||
参考文档: | ||
|
||
- <https://www.anquanke.com/post/id/214940> | ||
- <https://jiayu0x.com/2020/08/28/go-binary-reverse-engineering-metainfo-symbols-and-srcfile-path/> | ||
|
||
- <https://jiayu0x.com/2020/09/02/go-binary-reverse-engineering-types/> | ||
- <https://jiayu0x.com/2020/09/25/go-binary-reverse-engineering-itab-and-strings/> | ||
- <https://jiayu0x.com/2020/09/28/go-binary-reverse-engineering-tips-and-example/> |
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,5 @@ | ||
Ghidra 工具 | ||
|
||
- <https://github.com/NationalSecurityAgency/ghidra> | ||
|
||
Ghidra 是一个开源的逆向工程工具,支持多种平台和二进制文件格式。 它提供了强大的反编译、调试和静态分析功能,帮助研究人员快速理解二进制程序的逻辑。 安装与配置:下载Ghidra 安装包,按照官方文档进行安装。 安装完成后,启动Ghidra 并创建一个新项目,设置工作空间和分析的二进制文件 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,32 @@ | ||
`IDA` 是运行于 `32/64` 位下,可用作反编译和调试的一个完整的逆向工具。使用 `IDA` 尽管是个更加复杂的学习过程,但它提供了 `Ollydbg` 无法实现的静态逆向分析 手段,并且使用户能够在 `Windows`、`Linux` 或 `Macosx` 本地环境以及以下环境中远程操作 | ||
|
||
- <https://www.hex-rays.com/products/ida/> | ||
|
||
参考文档: | ||
|
||
- <https://blog.csdn.net/m0_55854679/article/details/127746844> | ||
|
||
## IDA 使用 | ||
|
||
### IDA 文件加载 | ||
|
||
IDA 会生成一个可能的文件类型列表,在顶部显示,它将显示最适合处理文件的加载器。 | ||
|
||
Binary File (二进制文件) 是列表最后一个选项,会一直显示,是 IDA 加载无法识别文件的默认选项,提供最低级的加载方法。需要使用二进制加载器的情形包括:分析从网络数据包或日志文件中提取出来的 rom 镜像和破解程序负载。 | ||
|
||
在 processor type【处理器类型】下拉菜单中,可以指定在反汇编过程中使用的处理器模块【在 ida 的 procs 目录中】。多数情况下,ida 将根据可执行文件头中读取信息,选择合适的处理器。 | ||
|
||
### 界面介绍 | ||
|
||
导航栏:显示程序的不同类型数据【普通函数、未定义函数的代码、数据、未定义等】。 | ||
|
||
反汇编的主窗口:显示反汇编的结果、控制流图等,可以进行拖动、选择等操作 | ||
|
||
函数窗口:显示所有的函数名称和地址【拖动下方滚动条即可查看】,通过 Ctrl+F 组合进行筛选。 | ||
|
||
输出窗口:显示运行过程中 IDA 的日志,也可以在下方的输入框中输入命令并执行。 | ||
|
||
状态指示器:显示为 “AU:idle” 即代表 IDA 已经完成了对程序的自动化分析。 | ||
|
||
![img](./.assets/IDA/06549cb2e0644976bbe2e3721698a95a.png) | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file added
BIN
+68.5 KB
运维研发/项目管理与团队协作/Mattermost/.assets/Mattermost简介/image-20240715155703006.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added
BIN
+328 KB
运维研发/项目管理与团队协作/Mattermost/.assets/Mattermost简介/image-20240715155713178.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters