안랩

[win32api] data type

TCHAR resolves to either a "char" or a "wchar_t" depending on if UNICODE is defined or not (in VS project properties, "Use Unicode Character Set" will enable UNICODE).

LPCTSTR - the "T" in the middle stands for TCHAR, so this is a "const TCHAR*" - which in turn is either "const char*" or "const wchar_t*".

LPSTR = char*
LPCSTR = const char*

LPWSTR = wchar_t*
LPCWSTR = const wchar_t*

LPTSTR = LPSTR or LPWSTR
LPCTSTR = LPCSTR or LPCWSTR

[면접]회사가 부당한 지시를 하면 어떻게 할 건가

면접관이 자주 물어보는 질문이다. 물론 안 물어보는 회사도 많지만 많은 회사가 이런 질문을 한다. 이 때 부당한 지시니까 따르지 않겠다고 하면 면접에서 떨어진다. 회사 입장에서는 직원이 혹시 회사의 기밀이나 비리를 누설하거나 고발을 할까봐 우려하기 때문에 비록 부당한 지시를 따르는 것이 옳지 않다고 생각하더라도 일단 면접에서 합격하려면 회사의 방침에 따르겠다고 말하는 것이 옳다. 그리고 면접에서 합격하고 나서 실제로 회사가 그런 지시를 한다면 그 때 정말 부당하다고 생각되면 안 따르면 그만이다.

면접은 윤리시험이 아니라 회사에 필요한 직원을 뽑는 시험이기 때문에 자기 입장에서 생각하지 말고 회사 입장에서 생각해야 한다.

3.20 해킹사건 재구성

메인서버 관리자계정 탈취

피씨 악성코드 감염

windbg

WDK에 있음. WDK 다운받고 kisetup 실행 windows debugging tools 선택

#pragma

14.6. The #pragma Directive The #pragma directive is a standard way to provide additional information to the compiler. This directive has the following form: #pragma [tokens] If the first token after #pragma is STDC, then the directive is a standard pragma. If not, then the effect of the #pragma directive is implementation-dependent. For the sake of portability, you should use #pragma directives sparingly. If the preprocessor recognizes the specified tokens, it performs whatever action they stand for, or passes information on to the compiler. If the preprocessor doesn't recognize the tokens, it must ignore the #pragma directive. Recent versions of the GNU C compiler and Microsoft's Visual C compiler both recognize the pragma pack(n), for example, which instructs the compiler to align structure members on certain byte boundaries. The following example uses pack(1) to specify that each structure member be aligned on a byte boundary: #if defined( _ _GNUC_ _ ) || defined( _MSC_VER ) #pragma pack(1) // Byte-aligned: no padding. #endif Single-byte alignment ensures that there are no gaps between the members of a structure. The argument n in a pack pragma is usually a small power of two. For example, pack(2) aligns structure members on even-numbered byte addresses, and pack(4) on four-byte boundaries. pack( ) with no arguments resets the alignment to the implementation's default value. C99 introduced the following three standard pragmas: #pragma STDC FP_CONTRACT on_off_switch #pragma STDC FENV_ACCESS on_off_switch #pragma STDC CX_LIMITED_RANGE on_off_switch The value of the on_off_switch must be ON, OFF, or DEFAULT. The effects of these pragmas are discussed in "Mathematical Functions" in Chapter 16.

[win32api] icon

change NULL into hInstance

 char szAppName[] ="해구장"; 
 WndClass.style = NULL; 
 WndClass.lpfnWndProc = WndProc; 
 WndClass.cbClsExtra = 0; 
 WndClass.cbWndExtra = 0; 
 WndClass.hInstance = hInstance; 
 WndClass.hIcon = LoadIcon(hInstance, MAKEINTRESOURCE(IDI_ICON2)); 
 WndClass.hCursor = LoadCursor(NULL, IDC_ARROW); 
 WndClass.hbrBackground = (HBRUSH) GetStockObject(WHITE_BRUSH); 
 WndClass.lpszMenuName = NULL; 
 WndClass.lpszClassName = szAppName;

[win32api] read file

 HANDLE hFile = CreateFile(szFileName, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
 if (hFile != INVALID_HANDLE_VALUE)
 {
  // Get text length of data in editbox
  DWORD dwTextLength = GetWindowTextLength(GetDlgItem(hWnd, editID));
  if (dwTextLength > 0)
  {
   char* pszRead;
   DWORD dwBufferSize = dwTextLength + 1; // + 1 because NULL character needed (\0)

   pszRead = (char*)malloc(dwBufferSize);
   // Read text from editbox
   if (GetWindowText(GetDlgItem(hWnd, editID), pszRead, dwBufferSize))
   {
    DWORD dwWritten;

    WriteFile(hFile, pszRead, dwTextLength, &dwWritten, NULL);
    bSaved = TRUE;
   }
   free(pszRead);
  }

  CloseHandle(hFile);

[r]install package

>install.packages("MCMCpack")

[asm] int 21h

http://mongmio.tistory.com/12

[asm]FCB

A File Control Block (FCB) is a file system structure in which the state of an open file is maintained. An FCB is managed by the operating sytem, but it resides in the memory of the program that uses the file, not in operating system memory. This allows a program to have as many files open at one time as it wants to, provided it can spare enough memory for an FCB per file.

The FCB originates from CP/M and is also present in most variants of DOS, though only as a backwards compatibility measure in MS-DOS versions 2.0 and later. A full FCB is 36 bytes long; in early versions of CP/M, it was 33 bytes. This fixed size, which could not be increased without breaking application compatibility, lead to the FCB's eventual demise as the standard method of accessing files.

The meanings of several of the fields in the FCB differ between CP/M and MS-DOS, and also depending on what operation is being performed. The following fields have consistent meanings:

Offset	Byte size	Contents
00	1	Drive number — 0 for default, 1 for A:, 2 for B:,...
01	8	File name and file type — together these form a 8.3 file name
09	3
0C	20	Implementation dependent — should be initialised to zero before the FCB is opened.
20	1	Record number in the current section of the file — used when performingsequential access.
21	3	Record number to use when performing random access.

[edit]Usage

In CP/M and MS-DOS 1 (which did not include support for subdirectories), the FCB was the only method of accessing files. When subdirectories were introduced in MS-DOS 2, FCBs proved too small to handle the extra data required for that, and thus were superseded by file handles, as used on UNIX and its derivatives. File handles are simply consecutive integer numbers associated with specific open files.

If a program uses the newer file handle API to open a file, the operating system will manage its internal data structure associated with that file in its own memory area. This has the great advantage that these structures can grow in size in later operating system versions without breaking compatibility with application programs; its disadvantage is that, given the rather simplistic memory management of MS-DOS and its compatibles, space for as many of these structures as the most "file-hungry" program is likely to use has to be reserved at boot time and cannot be used for any other purpose while the computer is running. Such memory reservation is done using the FILES= command in the CONFIG.SYS file. This problem does not occur with FCBs in DOS 1 or in CP/M, since the operating system stores all that it needs to know about an open file inside the FCB and thus does not need to use any per-file memory in operating system memory space. When using FCBs in MS-DOS 2 or later, the FCBs are dummies that store references to the actual file management data in operating system memory. Because of this, the number of FCBs which can be kept open at once in DOS 2 or higher is limited as well, usually to 4; using the FCBS= command in the CONFIG.SYS file, it may be increased beyond that number if necessary.

FCBs were supported in all versions of MS-DOS and Windows until the introduction of theFAT32 filesystem. Windows 95, Windows 98 and Windows Me do not support the use of FCBs on FAT32 drives, except to read the volume label. This caused some old DOS applications, including Wordstar, to fail under these versions of Windows.

The FCB interface does not work properly on Windows NT, 2000, etc. either - WordStar does not function properly on these operating systems. DOS emulators DOSEMU and DOSBoximplement the FCB interface properly, thus they are a way to run older DOS programs that need FCBs on modern operating systems.

[edit]External links

[asm]DTA

DTA - Disk Transfer Area (partially undocumented)

 DTA contains data, of which the first 21 bytes (00-15h) are known
 as being "reserved for DOS use on subsequent find next calls"

     Offset Size    Description

 00   byte attribute of search (undocumented)
 01   byte drive used in search  (undocumented)
 02  11bytes search name used (undocumented)
 0D   word directory entry number (0 based, DOS 3.x+, undoc.)
 0F   word starting cluster number of current directory
   zero for root directory (DOS 3.x+, undocumented)
 11   word reserved (undocumented)
 13   word starting cluster number of current directory
   zero for root directory (DOS 2.x+, undocumented)
 15   byte attribute of matching file
 16   word file time  (see FILE ATTRIBUTES)
 18   word file date  (see FILE ATTRIBUTES)
 1A   word file size
 1E 13bytes ASCIIZ filename and extension in the form NAME.EXT
   with blanks stripped


 - fields of DTA change dependent upon function call in progress
 - the DTA cannot span a 64K segment boundary
 - for compatibility with CP/M the default DTA is at offset 80h
   in the PSP;  this area is also used for the command tail. To
   avoid collision, set another DTA (INT 21,1A) or preserve the
   command tail before using FCB function calls

 - see  INT 21,4E  INT 21,1A  INT 21,2F

[asm]win32 helloworld

.386
.MODEL flat, stdcall
.STACK 4096


;include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\user32.inc

includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\user32.lib


STD_OUTPUT_HANDLE EQU -11

GetStdHandle PROTO,
  nStdHandle:DWORD

WriteConsole EQU 

ExitProcess PROTO,
 dwExitCode:DWORD

.data
consoleOutHandle dd ?
bytesWritten   dd ?
message db "Hello World", 13, 10, 0

.code
ProcStrLength PROC USES edi,
    ptrString:PTR BYTE
 mov edi, ptrString
 mov eax, 0
L1:
 cmp byte ptr [edi], 0
 je  L2
 inc edi
 inc eax
 jmp L1
L2: ret
procStrLength ENDP

ProcWriteString proc
 pushad

 INVOKE procStrLength, edx
 cld

 INVOKE WriteConsole,
     consoleOutHandle,
     edx,
     eax,
     offset bytesWritten,
     0
 
 popad
 ret
procWriteString endp

main PROC
 INVOKE GetStdHandle, STD_OUTPUT_HANDLE

 mov [consoleOutHandle], eax

 mov edx, offset message

 INVOKE procWriteString

 INVOKE ExitProcess, 0

main ENDP

END main

compile ml /c /coff link link /subsytem:console

[win32api] 문자열

LPCTSTR <- char*

vc++

insert breakpoint
go debugging
[alt]+8

[asm]문자열처리

DS:SI
ES:DI

[asm]DWORD

WORD -> 4 byte
DWORD -> 8 byte

0x0000FFFF <- DWORD dwOffSet

[asm]win32api

masm32 다운로드

.386
.model flat, stdcall
option casemap :none

include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\user32.inc

includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\user32.lib

.data
 HelloWorld db "Hello World!", 0
.code
start:
 invoke MessageBox, NULL, addr HelloWorld, addr HelloWorld, MB_OK
 invoke ExitProcess, 0
end start

ml /c /coff hellowin.asm link /subsystem:windows hellowin.obj

李 전 대통령의 파안대소

뉴시스 | 입력 2013.03.04 11:53

eip register

int foo (int a, int b)
{
    return a+b;
}

int main()
{
    int a1 = 100;
    int b1 = a1 + 100;

    a1 = foo (a1, b1);

    return 0;
}

[c++] type casting

#include 
using namespace std;
int main()
{
int i = 20;
int *pi;
pi = &i;
cout<< "value of i = " << i <BlogThis!X에 공유Facebook에서 공유Pinterest에 공유