病毒原理-复习总结

其他 2018-09-26 13:07:27 阅读次数: 0

结构

Screen Shot 2018-06-26 at 16.30.25

病毒基本

病毒基本能力
Screen Shot 2018-06-27 at 10.25.28
Screen Shot 2018-06-27 at 10.25.44
Screen Shot 2018-06-27 at 10.35.33
Screen Shot 2018-06-27 at 10.36.59

Screen Shot 2018-06-27 at 10.44.25

文件系统

磁盘原理

Screen Shot 2018-06-27 at 11.07.37

Screen Shot 2018-06-27 at 11.07.51
Screen Shot 2018-06-27 at 11.08.07



FAT12

DOS时代,主要用于软盘
Screen Shot 2018-06-27 at 11.09.13
Screen Shot 2018-06-27 at 14.04.14
Screen Shot 2018-06-27 at 14.04.22

55aa结束标志
Screen Shot 2018-06-27 at 14.06.36
Screen Shot 2018-06-27 at 14.06.57

文件定位

Screen Shot 2018-06-27 at 14.09.57
Screen Shot 2018-06-27 at 14.10.09
Screen Shot 2018-06-27 at 14.11.18
Screen Shot 2018-06-27 at 14.18.28

Screen Shot 2018-06-27 at 14.19.47
Screen Shot 2018-06-27 at 14.20.36
Screen Shot 2018-06-27 at 14.21.06
Screen Shot 2018-06-27 at 14.21.54
Screen Shot 2018-06-27 at 14.22.55Screen Shot 2018-06-27 at 14.41.30

Screen Shot 2018-06-27 at 14.40.47
Screen Shot 2018-06-27 at 14.41.59
Screen Shot 2018-06-27 at 14.42.40
Screen Shot 2018-06-27 at 14.42.58

文件删除与恢复


Screen Shot 2018-06-27 at 14.44.39
Screen Shot 2018-06-27 at 14.46.13
Screen Shot 2018-06-27 at 14.46.45

文件创建与分配

Screen Shot 2018-06-27 at 14.47.08

FAT16

Screen Shot 2018-06-27 at 14.47.54

FAT32

Screen Shot 2018-06-27 at 14.48.19
Screen Shot 2018-06-27 at 14.49.07

FAT32引导记录



Screen Shot 2018-06-27 at 14.50.08
Screen Shot 2018-06-27 at 14.51.13

Screen Shot 2018-06-27 at 14.52.59

Screen Shot 2018-06-27 at 14.54.39
Screen Shot 2018-06-27 at 14.55.32

硬盘数据结构

分区



Screen Shot 2018-06-27 at 14.56.21
Screen Shot 2018-06-27 at 14.56.38
Screen Shot 2018-06-27 at 14.58.03
Screen Shot 2018-06-27 at 14.58.47
Screen Shot 2018-06-27 at 15.02.28

硬盘启动

Screen Shot 2018-06-27 at 15.03.17
Screen Shot 2018-06-27 at 15.03.43

Screen Shot 2018-06-27 at 15.04.18
同时要验证55AA结束标志

DOS病毒

Screen Shot 2018-06-28 at 10.14.31

Screen Shot 2018-06-28 at 10.14.36

病毒程序在正常程序中头插入或尾插入

Screen Shot 2018-06-28 at 15.36.13
Screen Shot 2018-06-28 at 18.36.41
Screen Shot 2018-07-03 at 21.07.42

简答题:

病毒定义

Screen Shot 2018-07-01 at 16.29.19
Screen Shot 2018-07-01 at 16.29.25
Screen Shot 2018-07-04 at 08.48.22

PE格式
Screen Shot 2018-07-03 at 21.37.11

Screen Shot 2018-07-03 at 21.37.23

FAT32/12

Screen Shot 2018-06-27 at 14.49.07

Screen Shot 2018-06-27 at 14.51.13

Screen Shot 2018-06-27 at 14.55.32

文件名长度 根目录区 32的引导区有保留区

病毒防范

Screen Shot 2018-07-03 at 21.53.36
Screen Shot 2018-07-03 at 21.53.43

Screen Shot 2018-07-03 at 21.53.54
Screen Shot 2018-07-03 at 21.54.36

虚拟机

Screen Shot 2018-07-03 at 21.54.51

蠕虫

Screen Shot 2018-07-03 at 21.57.43
Screen Shot 2018-07-03 at 21.57.32

木马

Screen Shot 2018-07-03 at 21.57.36

RVA地址转换

入口点RVA - 节表 - 查找文件起始位置

可造头 - 入口点RVA - 从节表中找到代码节的文件偏移

计算节头到入口点的差值+文件偏移 -》 入口点偏移量

病毒扫描 - 特征码技术
病毒监控 - 程序行为定义 int13h
病毒防范 - 查杀

保护模式-实模式

Screen Shot 2018-07-03 at 22.04.38

猜你喜欢

转载自www.cnblogs.com/tinoryj/p/bing-du-yuan-lifu-xi-zong-jie.html
今日推荐
周排行
AIZU 2224 Save your cats(并查集)
HTTP响应头状态码详解
Python socket编程（2）
MaxCompute Studio使用心得系列7—作业对比
Supervisor安装使用
LeetCode 164. Maximum Gap
mysql面试题: 一张表里面有ID自增主键，当insert了17条记录之后，删除了第15,16,17条记录，再把mysql重启，再insert一条记录，这条记录的ID是18还是15
nutch1.2 DeleteDuplicates IndexMerger 详解
OC - @property与setter,getter方法
SpringBoot @Transactional的rollbackFor属性
每日归档
更多
2024-09-19(0)
2024-09-18(0)
2024-09-17(0)
2024-09-16(0)
2024-09-15(0)
2024-09-14(0)
2024-09-13(0)
2024-09-12(0)
2024-09-11(0)
2024-09-10(0)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022