USB over Network (Server) & VMWare WorkStation 7.1 BSOD

这几天一直在折腾USB over Network (Server)驱动的卸载问题,发现不管是手工卸载还是使用自身的安装程序进行卸载。重新安装的时候都会导致蓝屏。最后在对CrashDump文件进行分析之后发现是vm的一个usb驱动的问题,卸载之后问题就解决了。天哪,竟然会犯这种错误~

出错误的驱动是这个文件:

Continue Reading

Fast IDB2Sig and LoadMap plugins(IDA)

Click Here to Download these plugins!

It took me two weeks to write two IDA plugins, a renew, fast IDB2Sig plugin and a new, very fast LoadMap plugin.
The IDB2SIG plugin I rewrote base on the orginal source code and idea of:
– Quine (quine@blacksun.res.cmu.edu)
– Darko
– IDB2PAT of J.C. Roberts <mercury@abac.com>
Thanks all of you very much. I think all of you will allow me to public the new source code.
The LoadMap plugin I wrote base on the idea of Toshiyuki Tega. It will supports loading and parsing VC++, Borland (Delphi/BC++/CBuilder) and DeDe map files.
And with two plugins, I need only two days to create two signature file for Delphi 6/7. Very fast and convenience. Hereafter, we can use two above plugins to create signature files, load map symbols…

Source is included, and plugins are precompiled for IDA 4.5 and 5.2.

iTunes 无限授权

其实这个东西网上貌似也有不少的文章,其实我知道的方法应该是有4种(包括我自己的“另类”方法):

1.使用虚拟机

这是最直接的方法,将授权之后的系统制作一个虚拟机镜像,然后随身携带就可以了。当然了,那个体积貌似有点大哦~。 😎

2.取消授权

这也是网上比较流行的另外的一种方法,当然这个授权是不能直接取消了,如果直接取消了那授权就没了。还授权个p啊,具体的方法就是提前备份授权文件,让后取消授权之后再把文件拷贝回去。授权文件路径:

Windows vista/7/2008: C:\ProgramData\Apple Computer\iTunes\SC Info(隐藏文件)

Windows 2000/xp/2003 : C:\Documents and Settings\All Users\Application Data\Apple Computer\iTunes\SC Info(隐藏文件)

具体的文章可以参考这里,两种方法都介绍了。 smile

3.经销商的方法(方法保密不说)

4.另类方法

使用那么一个小东东实现无限授权,嘎嘎。就是下面的这个东东。

至于文件嘛,不能外放目前,嘎嘎。 laugh

QQ international v1.1 today Remover

QQ international v1.1 has been released for several days,till now i release my first patch .In now days i am too busy to do my personal jobs,so it takes  so a long time.

What worse is that i just catch a cold when i visit Gulangyu.so bad luky.

lol, just click here to download the patch ,and then place the file in “QQIntl\Bin” directory.Finally u can run the program and click the patch button to patch the selfcheck function.

Also u can delete any plugins u dislike. After i Remove the Com.Tencent.CityWeekend, it looks much better!lol

Continue Reading

IDA 6.1调试驱动

今天在测试的时候发现IDA 5.5可以启动windbg调试器,而IDA 6.0却无法启动windbg调试器。大体看了一下可能是由于搜索路径造成的,重新将windbg安装到program files下之后问题就结局了。

网上也有关于用IDA调试驱动的文章,这里只是再整理一下,用IDA载入驱动分析完成之后选择调试器为Windbg debugger,如图1所示:

图1

然后执行菜单中的Debugger->Debugger options打开如图2所示的设置窗口。

图2

Continue Reading

IDA调试Windows 内核

以前总想知道IDA是否能够实现内核调试,后来找了一段时间没什么结果就暂时放弃了。今天在国外的一个博客上偶然看到了用IDA实现内核调试的方法。

其实现在国内也有很多文章介绍了IDA通过串口进行调试的文章,如果大家想看的话可以搜索下。

这里只是参考远远吧实现的方法大体的用中文表述了一下。在调试之前需要安装如下的软件:

  1. IDA PRO这个我想大家都应该有了;
  2. Windbg如果调试过驱动或者系统内核的话这个东西也应该有了;
  3. VirtualKd 这个东西我想大家如果没有做过使用IDA调试内核的话这个东西应该是还没有。
Continue Reading

FullDisasm : plugin OllyDbg & Immunity Debugger

This is a plugin for OllyDbg 1.10 and Immunity Debugger 1.xx to replace the old disasm engine by a more recent one : BeaEngine 4.0.

You just have to press Ctrl+W to change the disasm engine.

If you want to use BeaEngine only on selected lines, then just press Ctrl+X.

With this plugin, you can decode recent instructions for the following technologies : MMX, FPU, SSE, SSE2, SSE3, SSSE3, SSE4.1, SSE4.2 , VMX, CLMUL and AES.

You can even decode undocumented instructions usually used in malicious codes.

If you want to use a specific syntax, BeaEngine allows you to disassemble code in masm32 syntax, nasm syntax, GoAsm syntax or GNU Assembler syntax.

Current version : 3.0