电子芥末
tempbk.py 临时备份文件到 Cloudflare R2
本软件通过终端输入命令上传文件到 Cloudflare R2 进行临时(短期)备份.
Cloudflare R2 的优点: 10GB 免费容量, 流量免费.
本软件专门针对小文件的临时(短期)备份, 因此 10GB 免费容量够用了.
不加密版 与 加密版
本软件有两个版本, 一个加密, 一个不加密, 各有各的好处.
(我比较喜欢加密版)
加密版
可以防止云端分析文件
一旦丢失密钥就无法解密
加密后文件体积会增加33%
不加密版
不能防止云端分析文件, 有一定法律风险…
计算机天才
Windows ExCreateCallback多驱动间通信
//sender
#include <ntifs.h>
#define CALLBACKNAME L"\\Callback\\driverStart"
VOID UnloadDriver(PDRIVER_OBJECT driver);
VOID MyThread(PVOID context);
BOOLEAN gbSuccess = 0;
//线程句柄
HANDLE ghThread = NULL;
//回调指针
PCALLBACK_OBJECT gpObjCallback = NULL;
KEVENT gEvent;
extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING registry)
{
UNREFERENCED_PARAMETER(registry);
NTSTATUS status;
OBJECT_ATTRIBUTES objAttri;
driver->DriverUnload = UnloadDriver;
//初始化通知事件
KeInitializeEvent(&gEvent, SynchronizationEvent, FALSE);
UNICODE_STRING uniCallbackName = RTL_CONSTANT_STRING(CALLBACKNAME);
//这里必须指定OBJ_PERMANENT属性,否则会失败
InitializeObjectAttributes(&objAttri, &uniCallbackName, OBJ_CASE_INSENSITIVE | OBJ_PERMANENT, NULL, NULL…
计算机天才
C++ 读取文件到vector
inline bool open_binary_file(const std::string& file,
std::vector<uint8_t>& data) {
std::ifstream fstr(file, std::ios::binary);
if (!fstr.is_open()) return false;
fstr.unsetf(std::ios::skipws);
fstr.seekg(0, std::ios::end);
const auto file_size = fstr.tellg();
fstr.seekg(NULL, std::ios::beg);
data.reserve(static_cast<uint32_t>(file_size));
data.insert(data.begin(), std::istream_iterator<uint8_t>(fstr),
std::istream_iterator<uint8_t>());
return true;
}
计算机天才
minifilter InstanceSetup函数测试
#include"minifilter.h"
namespace minifilter {
// minifilter加载的时候会给每个卷都挂载上
NTSTATUS InstanceSetup(_In_ PCFLT_RELATED_OBJECTS FltObjects,
_In_ FLT_INSTANCE_SETUP_FLAGS Flags,
_In_ DEVICE_TYPE VolumeDeviceType,
_In_ FLT_FILESYSTEM_TYPE VolumeFilesystemType) {
PAGED_CODE();
NTSTATUS Status;
ULONG SizeOfBuffer;
// https://github.com/189569400/adversary_emulation_library/blob/997419bb0b8cd61ba69086a35a91a3d073d41d05/wizard_spider/Resources/Mimikatz/mimikatz/mimidrv/kkll_m_filters.c
PFILTER_FULL_INFORMATION myFilterFullInformation;
PINSTANCE_BASIC_INFORMATION myInstanceBasicInformation;
dbg::print("------------------Start-----------------\n");
if (FltObjects->FileObject)
dbg::print("[FltObjects->FileObject]%wZ\n",
FltObjects->FileObject->FileName);
else
dbg::print("[FltObjects->FileObject] NULL\n");
UNICODE…
计算机天才
WUDFPlatform.dll中检测内核调试器函数实现
__int64 __fastcall _WudfIsKernelDebuggerPresent()
{
unsigned int v0; // ebx
char SystemInformation; // [rsp+30h] [rbp+8h] BYREF
char v3; // [rsp+31h] [rbp+9h]
v0 = 0;
if ( NtQuerySystemInformation(SystemKernelDebuggerInformation, &SystemInformation, 2u, 0i64) >= 0
&& SystemInformation == 1
&& !v3 )
{
return 1;
}
return v0;
}
计算机天才
Zydis反汇编引擎v4版本测试代码
这版本直接以.h .c文件提供,可以直接加入工程,方便了不少
ZydisDisassembledInstruction insn;
ZydisDisassembleIntel(ZYDIS_MACHINE_MODE_LONG_COMPAT_32, (ZyanU64)ip, ip,
15, &insn);
ZyanU64 ResultAddress;
if (insn.info.mnemonic == ZYDIS_MNEMONIC_CALL) {
ZydisCalcAbsoluteAddress(&insn.info, insn.operands, (ZyanU64)ip,
&ResultAddress);
TraceFile << hex << "ip : ResultAddress " << ip << "\t" << ResultAddress
<< endl;
if (ResultAddress > NtdllModule->start_ && ResultAddress < NtdllModule->end_) {
auto it = kSymbolInfo[NtdllModuleIndex].begin();
it = kSymbolInfo[NtdllModuleIndex].find(ResultAddress);
if (it != kSymbolInfo[NtdllModuleIndex…
计算机天才
测量 win api和c++标准库的字符集转换性能 (win的API性能好一倍多)
#include <benchmark/benchmark.h>
#include <iostream>
#include <codecvt>
#include <windows.h>
#pragma comment(lib,"Shlwapi.lib")
wchar_t *Curl_convert_UTF8_to_wchar(const char *str_utf8) {
wchar_t *str_w = NULL;
if (str_utf8) {
int str_w_len = MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, str_utf8,
-1, NULL, 0);
if (str_w_len > 0) {
str_w = (wchar_t*)malloc(str_w_len * sizeof(wchar_t));
if (str_w) {
if (MultiByteToWideChar(CP_UTF8, 0, str_utf8, -1, str_w, str_w_len) ==
0) {
free(str_w…
计算机天才
Rust 函数模板使用例子
最基本的模板语法
fn template_fn<F>(mut num: F) -> F{
num
}
fn main() {
println!("{}",template_fn(2));
println!("{}",template_fn(2.0));
println!("{}",template_fn("123"));
println!("{}",template_fn(std::string::String::from("456")));
}
稍微加点操作
fn template_fn<F:std::ops::Add<Output=F> + std::convert::From<i32> >(mut num: F) -> F{
num = num + 2.into();
num
}
fn main() {
println!("{}",template_fn(2));
println!("{}",template_fn(2.0));
}