2013년 2월 28일 목요일

pe format


코드섹션
.text
데이터섹션
.data <- 데이터코드
.rdata <- 일기전용 데이터 코드
.idata <- 임포트데이터

[ctrl]+[esc]

시작메뉴 팝업

2013년 2월 27일 수요일

seh


16:   {
00401070   push        ebp
00401071   mov         ebp,esp
00401073   push        0FFh
00401075   push        offset string "1: Raise an Exception\n"+20h (0042f080)
0040107A   push        offset __except_handler3 (004083e4)
0040107F   mov         eax,fs:[00000000]
00401085   push        eax
00401086   mov         dword ptr fs:[0],esp
0040108D   add         esp,0B8h
00401090   push        ebx
00401091   push        esi
00401092   push        edi
00401093   mov         dword ptr [ebp-18h],esp
00401096   lea         edi,[ebp-58h]
00401099   mov         ecx,10h
0040109E   mov         eax,0CCCCCCCCh
004010A3   rep stos    dword ptr [edi]
17:       __try
004010A5   mov         dword ptr [ebp-4],0
18:       {
19:           __try{
004010AC   mov         dword ptr [ebp-4],1
20:               printf("1: Raise an Exception\n");
004010B3   push        offset string "1: Raise an Exception\n" (0042f060)
004010B8   call        printf (00408270)
004010BD   add         esp,4
21:               RAISE_AN_EXCEPTION();
004010C0   call        @ILT+0(RAISE_AN_EXCEPTION) (00401005)
22:           }
004010C5   mov         dword ptr [ebp-4],0
004010CC   call        $L8443 (004010d3)
004010D1   jmp         $L8446 (004010e1)
23:           __finally
24:           {
25:               printf("2: In Finally\n");
004010D3   push        offset string "2: In Finally\n" (0042f04c)
004010D8   call        printf (00408270)
004010DD   add         esp,4
$L8444:
004010E0   ret
26:           }
27:       }
004010E1   mov         dword ptr [ebp-4],0FFFFFFFFh
004010E8   jmp         $L8440+17h (0040110f)
28:       __except( printf("3: In Filter\n"))
004010EA   push        offset string "3: In Filter\n" (0042f03c)
004010EF   call        printf (00408270)
004010F4   add         esp,4
$L8441:
004010F7   ret
$L8440:
004010F8   mov         esp,dword ptr [ebp-18h]
29:       {
30:           printf("4: In Exception Handler\n");
004010FB   push        offset string "4: In Exception Handler\n" (0042f01c)
00401100   call        printf (00408270)
00401105   add         esp,4
31:       }
00401108   mov         dword ptr [ebp-4],0FFFFFFFFh
32:       return 0;
0040110F   xor         eax,eax
33:   }
00401111   mov         ecx,dword ptr [ebp-10h]
00401114   mov         dword ptr fs:[0],ecx
0040111B   pop         edi
0040111C   pop         esi
0040111D   pop         ebx
0040111E   add         esp,58h
00401121   cmp         ebp,esp
00401123   call        __chkesp (00408230)
00401128   mov         esp,ebp
0040112A   pop         ebp
0040112B   ret

2013년 2월 23일 토요일

[win32api] CreateWindow()


HWND CreateWindow(
  LPCTSTR lpClassName,    // 등록된 윈도우 클래스 이름
  LPCTSTR lpWindowName, // 윈도우 캡션 이름
  DWORD dwStyle,              // 윈도우 스타일
  int x,                               // 윈도우 좌측 상단의 x 좌표
  int y,                               // 윈도우 좌측 상단의 y 좌표
  int nWidth,                       // 윈도우 폭
  int nHeight,                      // 윈도우 높이  HWND hWndParent,          // 부모 윈도우의 핸들
  HMENU hMenu,               // 메뉴 또는 자식 윈도우 식별자
  HINSTANCE hInstance,     // 윈도우를 생성한 인스턴스 핸들
  LPVOID lpParam               // CREATESTRUCT 구조체를 통해 전달되는 값
);

2013년 2월 20일 수요일

execve()


#include 
#include 
#include 


int main( int ac, char* av[] )
{
   char *name[2];
   name[0] = "pass.exe";
   name[1] = 0;
 execve(name[0], name, NULL);
}

2013년 2월 18일 월요일

[c++/win32api]메모장

// MM4.cpp : Defines the entry point for the application.
//

#include "stdafx.h"
#include "resource.h"

#define MAX_LOADSTRING 100

// Global Variables:
HINSTANCE hInst;        // current instance
TCHAR szTitle[MAX_LOADSTRING];        // The title bar text
TCHAR szWindowClass[MAX_LOADSTRING];        // The title bar text

// Foward declarations of functions included in this code module:
ATOM    MyRegisterClass(HINSTANCE hInstance);
BOOL    InitInstance(HINSTANCE, int);
LRESULT CALLBACK WndProc(HWND, UINT, WPARAM, LPARAM);
LRESULT CALLBACK About(HWND, UINT, WPARAM, LPARAM);

int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
  // TODO: Place code here.
 MSG msg;
 HACCEL hAccelTable;

 // Initialize global strings
 LoadString(hInstance, IDS_APP_TITLE, szTitle, MAX_LOADSTRING);
 LoadString(hInstance, IDC_MM4, szWindowClass, MAX_LOADSTRING);
 MyRegisterClass(hInstance);

 // Perform application initialization:
 if (!InitInstance (hInstance, nCmdShow)) 
 {
  return FALSE;
 }

 hAccelTable = LoadAccelerators(hInstance, (LPCTSTR)IDC_MM4);

 // Main message loop:
 while (GetMessage(&msg, NULL, 0, 0)) 
 {
  if (!TranslateAccelerator(msg.hwnd, hAccelTable, &msg)) 
  {
   TranslateMessage(&msg);
   DispatchMessage(&msg);
  }
 }

 return msg.wParam;

 
// 메시지 루프
 while (GetMessage(&msg, NULL, 0, 0))
 {
  TranslateMessage(&msg); // 키보드 메시지를 번역
  DispatchMessage(&msg);  // 메시지를 해당 윈도우 프로시저로 보냅니다.
 }
 return msg.wParam;
}



//
//  FUNCTION: MyRegisterClass()
//
//  PURPOSE: Registers the window class.
//
//  COMMENTS:
//
//    This function and its usage is only necessary if you want this code
//    to be compatible with Win32 systems prior to the 'RegisterClassEx'
//    function that was added to Windows 95. It is important to call this function
//    so that the application will get 'well formed' small icons associated
//    with it.
//
ATOM MyRegisterClass(HINSTANCE hInstance)
{
 WNDCLASSEX wcex;

 wcex.cbSize = sizeof(WNDCLASSEX); 

 wcex.style   = CS_HREDRAW | CS_VREDRAW;
 wcex.lpfnWndProc = (WNDPROC)WndProc;
 wcex.cbClsExtra  = 0;
 wcex.cbWndExtra  = 0;
 wcex.hInstance  = hInstance;
 wcex.hIcon   = LoadIcon(hInstance, (LPCTSTR)IDI_MM4);
 wcex.hCursor  = LoadCursor(NULL, IDC_ARROW);
 wcex.hbrBackground = (HBRUSH)(COLOR_WINDOW+1);
 wcex.lpszMenuName = (LPCSTR)IDC_MM4;
 wcex.lpszClassName = szWindowClass;
 wcex.hIconSm  = LoadIcon(wcex.hInstance, (LPCTSTR)IDI_SMALL);

 return RegisterClassEx(&wcex);
}

//
//   FUNCTION: InitInstance(HANDLE, int)
//
//   PURPOSE: Saves instance handle and creates main window
//
//   COMMENTS:
//
//        In this function, we save the instance handle in a global variable and
//        create and display the main program window.
//
BOOL InitInstance(HINSTANCE hInstance, int nCmdShow)
{
   HWND hWnd;

   hInst = hInstance; // Store instance handle in our global variable

   hWnd = CreateWindow(szWindowClass, szTitle, WS_OVERLAPPEDWINDOW,
      CW_USEDEFAULT, 0, CW_USEDEFAULT, 0, NULL, NULL, hInstance, NULL);

   if (!hWnd)
   {
      return FALSE;
   }
SLWA pSetLayeredWindowAttributes = NULL;  // 함수포인터 선언, 초기화.
 HINSTANCE hmodUSER32 = LoadLibrary("USER32.DLL"); // 인스턴스 얻음.
 pSetLayeredWindowAttributes=(SLWA)GetProcAddress(hmodUSER32,"SetLayeredWindowAttributes");    
 //함수포인터 얻음.
  SetWindowLong(hWnd, GWL_EXSTYLE,GetWindowLong(hWnd, GWL_EXSTYLE) | WS_EX_LAYERED);
 pSetLayeredWindowAttributes(hWnd, 0, (255 * 50) / 100, LWA_ALPHA);

   ShowWindow(hWnd, nCmdShow);
   UpdateWindow(hWnd);

   return TRUE;
}

//
//  FUNCTION: WndProc(HWND, unsigned, WORD, LONG)
//
//  PURPOSE:  Processes messages for the main window.
//
//  WM_COMMAND - process the application menu
//  WM_PAINT - Paint the main window
//  WM_DESTROY - post a quit message and return
//
//
 
LRESULT CALLBACK WndProc(HWND hWnd,UINT iMessage,WPARAM wParam,LPARAM lParam)
{
 static char str[100];
 
 static int count, yPos;
 static SIZE size;
 HDC hdc;
 PAINTSTRUCT ps;
 switch(iMessage) {
 
 case WM_CREATE:
  count = 0;
  yPos = 0;
  CreateCaret(hWnd, NULL, 5, 15);
  ShowCaret(hWnd);
  break;
 case WM_PAINT: 
  /*
  hdc = BeginPaint(hWnd, &ps);
  TextOut(hdc,0,0,"helloWorld",10);
  EndPaint(hWnd, &ps);
  */
  hdc = BeginPaint(hWnd, &ps);
  GetTextExtentPoint(hdc,str, strlen(str), &size);
  TextOut(hdc,0,yPos,str,strlen(str));
  SetCaretPos(size.cx, 0);
  EndPaint(hWnd, &ps);
  break;
 /*
 case WM_KEYDOWN:
  hdc = GetDC(hWnd);
  TextOut(hdc,100,0,"KeyDown",7);
  ReleaseDC(hWnd, hdc);
  break;
 */
 /* 
 case WM_KEYUP:
  hdc = GetDC(hWnd);
  TextOut(hdc,200,0,"KeyUP",5);
  ReleaseDC(hWnd, hdc);
  break;
 */
 case WM_CHAR:
  
  if(wParam == VK_BACK) //backspace key
   count--;
  else if(wParam == VK_RETURN) //enter key
  {
   count = 0;
   yPos +=20;
  }
  else 
   str[count++] = wParam;
  
  str[count] = '\0';
  /*
  hdc = GetDC(hWnd);
  TextOut(hdc,300,0,str,strlen(str));
  ReleaseDC(hWnd, hdc);
  */
  InvalidateRgn(hWnd, NULL, TRUE);
  break;
 case WM_DESTROY:
  HideCaret(hWnd);
  DestroyCaret();
  PostQuitMessage(0);
  return 0;
 }
 return(DefWindowProc(hWnd,iMessage,wParam,lParam));
}

 

2013년 2월 17일 일요일

파일 각 라인 왼쪽 문자 제거

#!/usr/bin/perl

#Specify the file
$file = "key.txt";
#Open the file and read data
#Die with grace if it fails
open (FILE, "<$file") or die "Can't open $file: $!\n";
@lines = ;
open (DATA, '>>data.txt');
foreach ( @lines ) {
print $_;
#$_ =~ s/^d{3}//;
$_=substr($_,4);
print DATA $_;
}
#Finish up
close FILE;
close DATA;