[url=]
[/url]逆向工程實(shí)戰(zhàn)圖書(shū)簡(jiǎn)介
本書(shū)由淺入深地講解了包括Windows內(nèi)核模式代碼的惡意軟件和驅(qū)動(dòng)程序、虛擬機(jī)保護(hù)技術(shù)等內(nèi)容。作者通過(guò)大量真實(shí)案例和示例，提供了系統(tǒng)化的解決方案。
目錄
第 1 章 x86 與x64...........................................1
1.1 寄存器組與數(shù)據(jù)類(lèi)型.................................1
1.2 指令集........................................................3
1.2.1 語(yǔ)法................................................3
1.2.2 數(shù)據(jù)移動(dòng)........................................4
1.3 練習(xí)...........................................................9
1.3.1 算術(shù)運(yùn)算........................................9
1.3.2 棧操作與函數(shù)調(diào)用.......................11
1.4 練習(xí).........................................................14
1.5 系統(tǒng)機(jī)制..................................................21
1.5.1 地址轉(zhuǎn)換......................................21
1.5.2 中斷與異常..................................23
1.6 綜合練習(xí)..................................................23
1.7 練習(xí).........................................................29
1.8 x64 ...........................................................30
1.8.1 寄存器組與數(shù)據(jù)類(lèi)型...................30
1.8.2 數(shù)據(jù)移動(dòng)......................................31
1.8.3 規(guī)范地址......................................31
1.8.4 函數(shù)調(diào)用......................................31
1.9 練習(xí).........................................................32
第 2 章 ARM ...................................................33
2.1 基本特性..................................................34
2.2 數(shù)據(jù)類(lèi)型與寄存器..................................35
2.3 系統(tǒng)級(jí)控制與設(shè)置..................................37
2.4 指令集介紹..............................................38
2.5 數(shù)據(jù)加載與存儲(chǔ)......................................39
2.5.1 LDR 與STR...................................39
2.5.2 LDR 的其他用途...........................42
2.5.3 LDM 與STM...................................43
2.5.4 PUSH 與POP.................................46
2.6 函數(shù)與函數(shù)調(diào)用......................................48
2.7 算術(shù)運(yùn)算..................................................50
2.8 分支跳轉(zhuǎn)與條件執(zhí)行..............................51
2.8.1 Thumb 狀態(tài)..................................54
2.8.2 switch-case..............................55
2.9 雜項(xiàng).........................................................56
2.9.1 JIT 與SMC ..................................56
2.9.2 同步原語(yǔ)......................................57
2.9.3 系統(tǒng)服務(wù)與機(jī)制...........................57
2.9.4 指令..............................................59
2.10 綜合練習(xí)................................................59
2.11 下一步...................................................65
2.12 練習(xí).......................................................65 [2]
第3 章 Windows 內(nèi)核..................................73
3.1 Windows 基礎(chǔ)..........................................73
3.1.1 內(nèi)存布局......................................73
3.1.2 處理器初始化..............................74
3.1.3 系統(tǒng)調(diào)用......................................77
3.1.4 中斷請(qǐng)求級(jí)..................................88
3.1.5 內(nèi)存池..........................................89
3.1.6 MDL.............................................90
3.1.7 進(jìn)程與線程..................................90
3.1.8 執(zhí)行上下文..................................92
3.1.9 內(nèi)核同步原語(yǔ)..............................93
3.2 列表.........................................................94
3.2.1 實(shí)現(xiàn)細(xì)節(jié)......................................94
3.2.2 綜合練習(xí)....................................100
3.2.3 練習(xí)............................................104
3.3 異步與亂序執(zhí)行....................................108
3.3.1 系統(tǒng)線程....................................108
3.3.2 work item ...................................109
3.3.3 APC............................................111
3.3.4 DPC............................................114
3.3.5 定時(shí)器........................................118
3.3.6 進(jìn)程與線程回調(diào)........................120
3.3.7 完成例程....................................120
3.4 I/O 請(qǐng)求包.............................................122
3.5 驅(qū)動(dòng)程序結(jié)構(gòu)........................................123
3.5.1 入口點(diǎn)........................................124
3.5.2 驅(qū)動(dòng)程序與設(shè)備對(duì)象.................125
3.5.3 IRP 處理.....................................126
3.5.4 用戶(hù) 內(nèi)核通信常用機(jī)制...........127
3.5.5 系統(tǒng)機(jī)制雜項(xiàng)............................128
3.6 綜合練習(xí)......................... 游客，如果您要查看本帖隱藏內(nèi)容請(qǐng) 回復(fù)
| 
發(fā)表于 2019-4-11 18:16:48
收藏