close

Вход

Забыли?

вход по аккаунту

?

Отчёт по ЛР 2

код для вставкиСкачать
 ??????? 1.
?????????? ?????? ??????? ? ??????? x86 ? x86-64.
???????? ????? WordPad.exe Readme.txt. ???????? ?????????? ProcessInfo. ??????? ??? WordPad.exe ? ?????????????? ??????, ???????? ??? PID ? ParentPID (PID ????????????? ????????). ???????? ????????? VMMap (????? ???? VMMap!), ??????? ?????? ?????????? ??????? ??????????? ???????????? ?????????? WordPad.exe. ?????????? ?????? (???, ??????, ???????? ???????), ??????????? ??? ????????? 0-? ??????????. ???????? ?????????? ? ???????? ? ?????.
??? ?86-64 ?????? ????? WordPad.exe ???? Readme.txt. ?????? ?????????? ProcessInfo. ????? ??? WordPad.exe ? ?????????????? ??????. ??? ?? ?????, PID ? ParentPID ???????????. ?????? ????????? VMMap ????? ???? VMMap. ? ???????? ???????????? ????????????, ?????????? ???? ??????????? "??????" ? "?????" ???????? 7 ?????? ?? 60 ????? ??????, ??????? ??? Free (????????? ???????? 0-? ?????????). ?? ???????? ???????????? 2 ??????? ?? 7, ??????????? ????????????? ???????? ???????, ??? ? ??????, ??????????? ??? ?? ?????????.
?????? ????? ?????????? ? ?????? 0000009DB8131000h, ??? ?????? 60 ?????, ????? ??? Free (15 ???????).
?????? ????? ?????????? ? ?????? 0000009DB8241000h, ??? ?????? 60 ?????, ????? ??? Free (15 ???????).
?????? ????? ?????????? ? ?????? 0000009DB8741000h, ??? ?????? 60 ?????, ????? ??? Free (15 ???????).
????????? ????? ?????????? ? ?????? 0000009DB91?1000h, ??? ?????? 60 ?????, ????? ??? Free (15 ???????).
????? ????? ?????????? ? ?????? 0000009DB9211000h, ??? ?????? 60 ?????, ????? ??? Free (15 ???????).
?????? ????? ?????????? ? ?????? 0000009DB9751000h, ??? ?????? 60 ?????, ????? ??? Free (15 ???????).
??????? ????? ?????????? ? ?????? 0000009DB?9?1000h, ??? ?????? 60 ?????, ????? ??? Free (15 ???????).
??? ?86 ?????? ????? WordPad.exe ???? Readme.txt. ?????? ?????????? ProcessInfo, ???????? ??? PID = 00000C2C ? ParentPID = 0000084?. ?????? ????????? VMMap ????? ???? VMMap. ? ???????? ???????????? ????????????, ?????????? ???? ??????????? "??????" ? "?????" ???????? 6 ?????? ?? 60 ????? ??????, ??????? ??? Free (????????? ???????? 0-? ?????????). ?? ???????? ???????????? 2 ??????? ?? 6, ??????????? ????????????? ???????? ???????, ??? ? ??????, ??????????? ??? ?? ?????????.
?????? ????? ?????????? ? ?????? 02561000h, ??? ?????? 60 ?????, ????? ??? Free (15 ???????). ?????? ????? ?????????? ? ?????? 025?1000h, ??? ?????? 60 ?????, ????? ??? Free (15 ???????).
?????? ????? ?????????? ? ?????? 027B1000h, ??? ?????? 60 ?????, ????? ??? Free (15 ???????).
????????? ????? ?????????? ? ?????? 03721000h, ??? ?????? 60 ?????, ????? ??? Free (15 ???????).
????? ????? ?????????? ? ?????? 04D41000h, ??? ?????? 60 ?????, ????? ??? Free (15 ???????).
?????? ????? ?????????? ? ?????? 04?01000h, ??? ?????? 60 ?????, ????? ??? Free (15 ???????).
??????? 2.
?????????? ?????? ??????? ? ?????? x86 ? x86-64.
????????? ????????? VMMap, ?????????? ???????? ????????????, ??????? ? ?? ?????????????? (??????? ?????, ???, ??????, ????????), ??????????? ? ?????? ???????????? ???????? WordPad.exe, ?????????? ?????????? ??? ???? ????? ??????, ????? ??? ????????? ????????????? ????? (National Language Support - NLS) - ??? ? ??????????????, ????? ??? DLL ???????? (??? ? ??????????????). ???????? ?????????? ? ????? ? ???????? ??.
??? ?86-64. ????????? ????????? VMMap, ????????? ???????? ???????????? ?????????? WordPad.exe. ????? ?????? ???????? 4476 ?????, ??????? ????? ??????? - 000007F6F53D0000h. ?????? ????? ??? Image, ??? ????????, ??? ?????? ???????? ?????????? ?????? ?? ????????????? ? ?????? ??? ??? DLL-?????. ?????? ???????? 8 ??????: - ?????? ???? ????? ?????? 4 ?????, ?????? 1 ???????? ? ????? ??????? ??????: ?????? ?????? (R);
- ?????? ???? ????? ?????? 604 ?????, ?????? 151 ???????? ? ????? ??????? ??????: ?????? ?????? ? ?????????? (ER);
- ?????? ???? ????? ?????? 388 ?????, ?????? 97 ????????? ? ????? ??????? ??????: ?????? ?????? (R);
- ????????? ???? ????? ?????? 8 ?????, ?????? 2 ????????? ? ????? ??????? ??????: ?????? ?????? ? ?????? (RW);
- ????? ???? ????? ?????? 12 ?????, ?????? 3 ????????? ? ????? ??????? ??????: ??????????? ? ?????? (CW);
- ?????? ???? ????? ?????? 8 ?????, ?????? 2 ????????? ? ????? ??????? ??????: ?????? ? ?????? (RW);
- ??????? ???? ????? ?????? 4 ?????, ?????? 1 ???????? ? ????? ??????? ??????: ??????????? ? ?????? (CW);
- ??????? ???? ????? ?????? 3448 ?????, ?????? 862 ????????? ? ????? ??????? ??????: ?????? ?????? (R).
? ???? ???????? ???????????? ???????????? ????????? ?????????? ? ????????:
????? ? ???????? ???????????? ????????? ???????, ?????????? ????? ??? ????????? ????????????? ?????:
???? ? ??????? ??????? 0007101BB0000h ????? ??? Mapped File, ??? ????????, ??? ???? ???????? ?????????? ?????? ?? ????????????? ? ?????? ????? ??????. ?????? ????? 68 ????? (17 ???????), ??????? Read ????????, ??? ???? ???? ????? ?????? ??????. ??? ????????? ??????????. ????? ? ???????? ???????????? ????????? ???????, ?????????? ????? ??? DLL-???????? (??? ? ??????????????):
???? ? ??????? ??????? 000000717?630000h ????? ??? Mapped File, ??? ????????, ??? ???? ???????? ?????????? ?????? ?? ????????????? ? ?????? ????? ??????. ?????? ????? 4 ????? (1 ????????), ??????? Read ????????, ??? ???? ???? ????? ?????? ??????. ??? ????????? ??????????.
??? ?86. ????????? ????????? VMMap, ?????????? ???????? ???????????? ?????????? WordPad.exe. ????? ?????? ???????? 4196 ?????, ??????? ????? ??????? - 01070000h. ?????? ????? ??? Image, ??? ????????, ??? ?????? ???????? ?????????? ?????? ?? ????????????? ? ?????? ??? ??? DLL-?????. ?????? ???????? 5 ??????: - ?????? ???? ????? ?????? 4 ?????, ?????? 1 ???????? ? ????? ??????? ??????: ?????? ?????? (R);
- ?????? ???? ????? ?????? 732 ?????, ?????? 183 ????????? ? ????? ??????? ??????: ?????? ?????? ? ?????????? (ER);
- ?????? ???? ????? ?????? 8 ?????, ?????? 2 ????????? ? ????? ??????? ??????: ?????? ? ?????? (RW);
- ????????? ???? ????? ?????? 16 ?????, ?????? 4 ????????? ? ????? ??????? ??????: ??????????? ? ?????? (?W);
- ????? ???? ????? ?????? 3436 ?????, ?????? 859 ????????? ? ????? ??????? ??????: ?????? ?????? (R).
? ???? ???????? ???????????? ???????????? ????????? ?????????? ? ????????:
????? ? ???????? ???????????? ????????? ???????, ?????????? ????? ??? ????????? ????????????? ?????:
???? ? ??????? ??????? 00700000h ????? ??? Mapped File, ??? ????????, ??? ???? ???????? ?????????? ?????? ?? ????????????? ? ?????? ????? ??????. ?????? ????? 464 ????? (116 ???????), ??????? Read ????????, ??? ???? ???? ????? ?????? ??????. ??? ????????? ??????????. ????? ? ???????? ???????????? ????????? ???????, ?????????? ????? ??? DLL-???????? (??? ? ??????????????):
???? ? ??????? ??????? 00CF0000h ????? ??? Mapped File, ??? ????????, ??? ???? ???????? ?????????? ?????? ?? ????????????? ? ?????? ????? ??????. ?????? ????? 4 ????? (1 ????????), ??????? Read ????????, ??? ???? ???? ????? ?????? ??????. ??? ????????? ??????????.
??????? 3.
?????????? ?????? ??????? ? ?????? x86 ? x86-64.
????????????? ? ??????? WordPad, ???????? ????? ?? ??????, ?????????? 20 ?????? ???????? ????? ? ????? ??????. ???????? ????????? WinHex. ????? ???? Tools ???????? RAM Editor. ? ?????????????? ?????? "Edit Virtual Memory" ???????? ??????? WordPad, ????????? ?????? ???????? ??????, ???????? ??? ?????? Primary Memory. ????? ???? Position=>Go To Offset ????????? ?? ??????, ?????????? ? 1-? ???????. ????? ???? Search=>Find Text ???????? ????? ?? ?????? (?????? Unicode!), ??????? ??? ????? ??????? ?? ???????? ??????. ???????? 1 ???????????? ??????. ?????????? ?????????? ???? ??? ??????? ? WinWord (??? ??????). ??? ??????????? ????????? ??????????? ???? ????????? ?????? ?????? ? ????? (1 ??? PageDown, 1 ??? PageUp). ????????????? ? ??????? WordPad, ???????? ????? ?? ??????, ?????????? ?? ???? ????????? ??? ????????? ????????? ? ???????? 1-3, ????? ProcessInfo. ???????? ?????????? ? ????? ? ???????? ??.
??? ?????? ????????? x86-64 ?????????????? HexEditorNeo.
??? ?86.
???????????? ? ??????? WordPad, ????????= ????? ?? ?????? (This is just a Test file for SellExecute), ?????????? 20 ?????? ???????? ????? ? ????? ?????? (This is just a Test). ?????? ????????? WinHex. ????? ???? Tools ?????? RamEditor. ? ?????????????? ?????? "Edit Virtual Memory" ?????? ??????? WordPad, ??????? ?????? ???????? ??????, ?????? ??? ?????? Primary Memory. ????? ???? Position => Go To Offset ??????? ?? ?????? 00000?2?h. ????? ???? Search => Find Text ??????? ????? ?? ?????? (?????? Unicode), ????? ??? ????? ??????? ?? ???????? ??????.
??????? ???? ??????.
??? ??????????? ????????? ????????? ???? ????????? ?????? ?????? ? ????? (???? ??? Page Down, ???? ??? Page Up). ???????????? ? ??????? WordPad, ?????????, ??? ????? ??????????.
??? ??? WordPad.exe ???????????? ? ?????? (Image), ??, ??????? ? ??????? ?????????? WinHex ??????, ?????????? ? ??????? ???????? ????????????, ?????? ??? ????????? ? ???? ?????????? WordPad.exe.
??? ?86-64.
???????????? ? ??????? WordPad, ??????? ????? ?? ?????? (This is just a Test file for SellExecute), ?????????? 20 ?????? ???????? ????? ? ????? ?????? (This is just a Test). ?????? ????????? HexEditorNeo. ????? ???? File => Open => Open Processes. ? ?????????????? ?????? ?????? ??????? WordPad, ??????? ?????? ???????? ??????, ?????? ??? ?????? Primary Memory. ????? ???? Edit => Go To Offset ??????? ?? ?????? 0000081?h. ????? ???? Search => Find Text ??????? ????? ?? ?????? (?????? Unicode), ????? ??? ????? ??????? ?? ???????? ??????.
??????? ???? ??????.
??? ??????????? ????????? ????????? ???? ????????? ?????? ?????? ? ????? (???? ??? Page Down, ???? ??? Page Up). ???????????? ? ??????? WordPad, ?????????, ??? ????? ??????????.
??? ??? WordPad.exe ???????????? ? ?????? (Image), ??, ??????? ? ??????? ?????????? HexEditorNeo ??????, ?????????? ? ??????? ???????? ????????????, ?????? ??? ????????? ? ???? ?????????? WordPad.exe.
??????? 5.
???????? ????????? VMAlloc, ?????????????? ?????? ??? 50 ???????? ?? 2 ?? ??????. ????????????? ? ???? ProcessInfo, ???????? ?????? ????????? (???? Processes!). ??????? ??? VMAlloc.exe ? ?????????????? ??????, ???????? ??? PID ? ParentPID (PID ????????????? ????????). ???????? ????????? VMMap (????? ???? VMMap!), ??????? ?????? ?????????? ??????? ??????????? ???????????? ?????????? VMAlloc.exe. ????????? ?????????? ???????? (???? Expand Regions), ??????? ?????? (???, ??????, ???????? ???????), ?????? ??? ????????????????? ???? ??? 50 ???????? ?? 2 ?? ?????? (??? ?????? = 2??*50=102400 ????). ????????? ????????? VMAlloc, ????????? ?????????? ?????? ?? ?????? ???????? ???????, ??????????? ???????? 2. ????????????? ? VMMap, ???????? ?????????? ???? (???? Refresh!), ???????? ????????? ? ?????????? ????? ?????????????????? ??????? ? ???????? ??. ??????????, ????????? ?????????? ?????? ?? ??????? ????????? ???????, ?????????? ????????? 9, 25, 37 (?????? ??? ???????????? ? VMMap, ???????? ?????????? ????, ????????? ????????? ? ??????? ? ??????? ??). ???????? ??? ???????????? ????????, ?????????? ????????? 2, 9. ??????? ?????????? ??????, ?????????? ????????? 2, 9. ??????? ?????????? ??????, ?????????? ????????? 25, 37 (??????????, ?????? ??? ???????????? ? VMMap, ???????? ?????????? ????, ????????? ????????? ? ??????? ? ??????? ??). ????????? ??? ????????? ????????? ? ???????? 1-6. ???????? ?????????? ? ????? ? ???????? ??.
?????? ????????? VMAlloc. ?????????????? ?????? ??? 50 ???????? ?? 2 ????? ??????.
???????????? ? ?????????? ProcessInfo, ??????? ?????? ?????????, ????? ??? VMAlloc.exe ? ?????????????? ??????. PID = 00000028, ParentPID = 00000864.
????????? ??????? ??????????? ???????????? ??? ???????? VMAlloc, ????? ???? VMMap. ????? ????????????????? ?????? ????????102400 ????. ???, ??????, ???????? ??????? ??? ?????????????????? ???????:
????????? ????????? VMAlloc, ??????? ?????????? ?????? ?? ?????? ???????? ???????, ??????????? ? ???????? 2.
???????????? ? VMMap, ??????? ?????????? ???? (???? Refresh!), ????????? ? ?????????? ????? ?????????????????? ???????:
???? ???????? ?????????? ?????? ????? ???????? ???????? ? 4 ????? ?? ?????? 00831000h. ?????????? ??????? ?????????? ?????? ?? ??????? ????????? ???????, ?????????? ????????? 9, 25, 37 (?????? ??? ???????????? ? VMMap, ???????? ?????????? ????).
???? ???????? ?????????? ?????? ??? ????? ???????? ? ???????? 9 ???????? 4 ????? ?? ?????? 00834000h. ???? ???????? ?????????? ?????? ??? ????? ???????? ? ???????? 25 ???????? 4 ????? ?? ?????? 0083C000h.
???? ???????? ?????????? ?????? ??? ????? ???????? ? ???????? 37 ???????? 4 ????? ?? ?????? 00842000h.
????? ??????? ??? ???????????? ????????, ?????????? ????????? 2, 9. ?????? ?????????? ??????, ?????????? ????????? 2, 9. ???????????? ? VMMap, ??????? ?????????? ????, ????????? ????????? ????.
?????????? ?????? ?? ??????? ? ????????? 2, 9 ???? ?????????? ???????, ??????? ?????? 00831000h ? 00834000h, ??????????????? ???? ?????????, ????????? ? ???????? ???????????? ? ????? Reserve. ?????? ?????????? ??????, ?????????? ????????? 25, 37. ???????????? ? VMMap, ??????? ?????????? ????, ????????? ????????? ????.
?????????? ?????? ?? ??????? ? ????????? 25, 37 ???? ?????????? ???????, ??????? ?????? 0083C000h ? 00842000h, ??????????????? ???? ?????????, ????????? ? ???????? ???????????? ? ????? Reserve. ????? ???? ??????????? ???????? ???? ?????? ????? ??? Reserve ? ??? ?????????? ??????, ?????????? ????? ????? ???????, ?????????? ???????.
Документ
Категория
Без категории
Просмотров
16
Размер файла
436 Кб
Теги
отчет
1/--страниц
Пожаловаться на содержимое документа