前几天收到一个蓝屏DUMP文件，运行我们的XX，然后运行IceSword必蓝，由此发现了一个IceSword的BUG。由于此ＢＵＧ的存在，在安装有卡巴2010的机器上运行IceSword有很大的可能蓝屏。
IceSword在启动时会检查SSDT中的NtDeviceIoControlFile有没有被Hook，如果被Hook过就首先将它恢复，但是在恢复此SSDT项时没有关写保护中断，引起ATTEMPTED_WRITE_TO_READONLY_MEMORY蓝屏。
存在问题的代码如下：
......
文章归档
- 2010 August (4)
- 2010 July (1)
- 2010 May (4)
- 2010 March (9)
- 2010 February (1)
- 2010 January (1)
- 2009 December (1)
- 2009 November (3)
- 2009 October (1)
- 2009 August (3)
- 2009 July (5)
- 2009 June (1)
- 2009 May (1)
- 2009 March (2)
- 2009 February (2)
- 2009 January (1)
- 2008 December (2)
- 2008 November (2)
- 2008 October (3)
- 2008 September (5)
- 2008 August (2)
- 2008 June (1)
- 2008 April (1)
- 2008 March (2)
- 2008 February (1)
- 2008 January (1)
- 2007 December (1)
- 2007 November (2)
- 2007 October (4)
- 2007 September (4)
- 2007 August (3)
- 2007 July (3)
- 2007 June (2)
- 2007 April (3)
- 2007 March (3)
- 2007 February (11)
Tags
- 编程 (20)
- 日记 (15)
- 驱动 (15)
- 杀毒软件、防火墙 (12)
- 溢出 (7)
- IE卫士 (7)
- 0day (7)
- 脚本注入 (6)
- 算法 (6)
- 漏洞 (6)
- BUG (6)
- 后门、远程控制 (5)
- 木马 (5)
- 电脑技术 (4)
- rootkit (3)
- 跨站 (3)
- x64 (3)
- widbg (3)
- Shellcode (3)
- 数据库 (2)
- ISAPI (2)
- IIS (2)
- 傲游 (2)
- XSS (2)
- 自启动 (2)
- windows7 (2)
- 隐藏 (2)
- ida (2)
- OD (2)
- 盗号器 (1)
- 密码相关 (1)
- MFC (1)
- CSS (1)
- 心理测试 (1)
- 北京 (1)
- 南京大屠杀 (1)
- 长城 (1)
- 经典 (1)
- 捆绑 (1)
- WEP (1)
- 生活成本 上海 (1)
- 数字电视 (1)
- IceSword (1)
- 江大 (1)
- 内存 (1)
- 冲突 (1)
- DLL (1)
- 异常; (1)
- 文件格式分析 (0)
- 解答 (0)