[B! 2012å¹´][Win32API] Itisangoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

Itisango id:Itisango

2012å¹´ã¨Win32APIã«é–¢ã™ã‚‹Itisangoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (2)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

PEãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã‚’è§£é‡ˆã›ã‚ˆï¼
ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã‚¦ã‚¤ãƒ«ã‚¹ã®è§£æžãªã©ã«æ¬ ã‹ã›ãªã„ãƒªãƒãƒ¼ã‚¹ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãƒªãƒ³ã‚°æŠ€è¡“ã§ã™ãŒã€ä½•ã ã‹é›£ã—ãã†ã ãªã€ã¨ã„ã†å°è±¡ã‚’æŠ±ã„ã¦ã„ã‚‹äººã‚‚å¤šã„ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚ã“ã®é€£è¼‰ã§ã¯ã€ã€Œã‚·ã‚§ãƒ«ã‚³ãƒ¼ãƒ‰ã€ã‚’ä¾‹ã«ã€å®Ÿè·µå½¢å¼ã§ãã®åŸºç¤Žã‚’ç´¹ä»‹ã—ã¦ã„ãã¾ã™ã€‚ï¼ˆç·¨é›†éƒ¨ï¼‰ Windows APIã®å‘¼ã³å‡ºã—æ–¹æ³•ã«è¿«ã‚Œï¼ ç¬¬4å›žã€ŒUndocumentedãªãƒ‡ãƒ¼ã‚¿æ§‹é€ ä½“ã‚’çŸ¥ã‚‹ã€ã«å¼•ãç¶šãã€ä»Šå›žã‚‚ã‚·ã‚§ãƒ«ã‚³ãƒ¼ãƒ‰ãŒWindowsã®APIã‚’å‘¼ã³å‡ºã™æ–¹æ³•ã«ã¤ã„ã¦è¿«ã£ã¦ã„ããŸã„ã¨æ€ã„ã¾ã™ã€‚ ã‚·ã‚§ãƒ«ã‚³ãƒ¼ãƒ‰ã§ã¯ã€è‡ªç”±ã«APIã‚’å‘¼ã³å‡ºã™ãŸã‚ã«ä»¥ä¸‹ã®3ã‚¹ãƒ†ãƒƒãƒ—ã®å‡¦ç†ã‚’å®Ÿè¡Œã—ã¾ã™ã€‚ kernel32.dllã®ãƒ™ãƒ¼ã‚¹ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’å–å¾—ã™ã‚‹ ï¼ˆkernel32.dllãŒã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã—ã¦ã„ã‚‹ï¼‰LoadLibraryé–¢æ•°ã¨GetProcAddressé–¢æ•°ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’å–å¾—ã™ã‚‹ LoadLibraryé–¢æ•°ã¨GetProcAddressé–¢æ•°ã‚’åˆ©ç”¨ã—ã¦ä»»æ„ã®APIã‚’å‘¼ã³å‡º
Itisango 2012/07/05
"kernel32.dllã¯ã€PEï¼ˆPortable Executableï¼‰ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã¨å‘¼ã°ã‚Œã‚‹å½¢å¼ã®ãƒ•ã‚¡ã‚¤ãƒ«ã§ã™ã€‚kernel32.dllãŒæŒã¤LoadLibraryé–¢æ•°ã‚„GetProcAddressé–¢æ•°ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’æŽ¢ã™ã«ã¯ã€ã“ã®PEãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã‚’è§£é‡ˆã—ã¦ã„ãã“ã¨ã«ãªã‚Šã¾ã™ã€‚"

PE

Win32API

API

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

shellcode

é–‹ç™º

ã‚½ãƒ¼ã‚¹ã‚³ãƒ¼ãƒ‰

Windows

api

2012å¹´
ãƒªãƒ³ã‚¯
[VC++] ãƒ—ãƒã‚»ã‚¹ ID ã‹ã‚‰å®Ÿè¡Œã•ã‚Œã¦ã„ã‚‹çµ¶å¯¾ãƒ‘ã‚¹ã‚’å–å¾—
ç›®æ¬¡ ãƒ›ãƒ¼ãƒ é€£çµ¡ã‚’ã™ã‚‹ RSS Login Blog åˆ©ç”¨çŠ¶æ³ æŠ•ç¨¿æ•° - 59 è¨˜äº‹ - 0 ã‚³ãƒ¡ãƒ³ãƒˆ - 8018 ãƒˆãƒ©ãƒƒã‚¯ãƒãƒƒã‚¯ - 20 ãƒ‹ãƒ¥ãƒ¼ã‚¹ Donut RAPT é…å¸ƒæ‰€ æ›¸åº« 2015å¹´1æœˆ (1) 2012å¹´5æœˆ (2) 2010å¹´4æœˆ (2) 2009å¹´1æœˆ (2) 2008å¹´8æœˆ (3) 2008å¹´3æœˆ (2) 2008å¹´2æœˆ (3) 2008å¹´1æœˆ (2) 2007å¹´12æœˆ (6) 2007å¹´11æœˆ (2) 2007å¹´8æœˆ (4) 2007å¹´7æœˆ (3) 2007å¹´6æœˆ (8) 2007å¹´5æœˆ (6) 2007å¹´4æœˆ (1) 2007å¹´3æœˆ (1) 2007å¹´2æœˆ (2) 2007å¹´1æœˆ (4) 2006å¹´12æœˆ (2) 2006å¹´11æœˆ (3) æ—¥è¨˜ã‚«ãƒ†ã‚´ãƒª C/C++ (rss) Donut (rss) HTML (rss) Internet Explorer
Itisango 2012/05/06
GetProcessImageFileName

QueryDosDevice

Microsoft

Windows

VC++

MSDN

2012å¹´

Win32api
ãƒªãƒ³ã‚¯
1

ãŠçŸ¥ã‚‰ã›

ã‚‚ã£ã¨èªã‚€

å…¬å¼Twitter

@hatebu
æœ€æ–°ã®äººæ°—ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã®é…ä¿¡

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

jæ¬¡ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kå‰ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

lã‚ã¨ã§èªã‚€

eã‚³ãƒ¡ãƒ³ãƒˆä¸€è¦§ã‚’é–‹ã

oãƒšãƒ¼ã‚¸ã‚’é–‹ã

è¨å®šã‚’å¤‰æ›´ã—ã¾ã—ãŸx

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (14)

2012å¹´ã¨Win32APIã«é–¢ã™ã‚‹Itisangoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (2)

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬5é€±ï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬4é€±ï¼‰

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ä¸€éƒ¨æ©Ÿèƒ½ã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã«é–¢ã™ã‚‹ãŠçŸ¥ã‚‰ã›

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (14)

2012å¹´ã¨Win32APIã«é–¢ã™ã‚‹Itisangoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (2)

PEãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã‚’è§£é‡ˆã›ã‚ˆï¼

[VC++] ãƒ—ãƒ­ã‚»ã‚¹ ID ã‹ã‚‰å®Ÿè¡Œã•ã‚Œã¦ã„ã‚‹çµ¶å¯¾ãƒ‘ã‚¹ã‚’å–å¾—

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬5é€±ï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬4é€±ï¼‰

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ä¸€éƒ¨æ©Ÿèƒ½ã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã«é–¢ã™ã‚‹ãŠçŸ¥ã‚‰ã›

å…¬å¼Twitter

ã‚­ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (14)

2012å¹´ã¨Win32APIã«é–¢ã™ã‚‹Itisangoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (2)

PEãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆã‚’è§£é‡ˆã›ã‚ˆï¼

[VC++] ãƒ—ãƒã‚»ã‚¹ ID ã‹ã‚‰å®Ÿè¡Œã•ã‚Œã¦ã„ã‚‹çµ¶å¯¾ãƒ‘ã‚¹ã‚’å–å¾—

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬5é€±ï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬4é€±ï¼‰

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ä¸€éƒ¨æ©Ÿèƒ½ã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã«é–¢ã™ã‚‹ãŠçŸ¥ã‚‰ã›

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹