
任意代码保护 - 防止非图像支持的执行代码和代码页修改(例如VirtualAlloc / VirtualProtect创建/修改的代码) 阻止低完整性图像 阻止远程图像 阻止不受信任的字体 代码完整性守护者 禁用Win32k系统调用 不允许子进程 导出地址过滤 - 将功能修补到另一个功能的一个常见方法中的一个步骤 导入地址过滤 - 将功能修补到另一个功能的一个常见方法中的一个步骤 模拟执行 验证API调用(CallerCheck) 验证图像依赖完整性 验证堆栈完整性
xperf - “PROC_THREAD + LOADER”-f“wdeg_klogger.etl” xperf -start“WDEG” - “Microsoft-Windows-Security-Mitigations:0xFFFFFFFFFFFFFF:0xFF:'stack'”-f“wdeg_unmerged.etl”
xperf -stop -stop“WDEG”-d“wdeg_merged.etl”

#include #include using namespace std;void* CreateCodeInVirtualMemory(BOOL writable)
{ BYTE code[3] = { 0x33, 0xc0, 0xc3 }; LPVOID result = VirtualAlloc(NULL, sizeof(code), MEM_COMMIT | MEM_RESERVE, writable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE); if (result)
{
memcpy(result, code, sizeof(code));
} else cout << "VirtualAllocEx failed with error " << GetLastError() << endl; return result;
}void CreateCodeInVirtualMemoryAndExecute(BOOL useWritableMemory)
{ LPTHREAD_START_ROUTINE addr = (LPTHREAD_START_ROUTINE)CreateCodeInVirtualMemory(useWritableMemory); if (addr)
{ DWORD result = addr(NULL);
cout << "Code at 0x" << hex << (void*)addr << " returned " << result << endl;
} else cout << "NULL address was not executed" << endl;
}void ExecuteIllegalMemory()
{
CreateCodeInVirtualMemoryAndExecute(FALSE);
}
void PrintOptions()
{
cout << "Enter one of the following options:" << endl;
cout << "1 - Execute Memory Not Marked As Executable" << endl;
cout << "2 - Create Code in Virtual Memory" << endl;
cout << "3 - Create Code in Virtual Memory and Execute" << endl;
cout << "0 - Exit" << endl;
}void DecisionLoop()
{ while (true)
{ int selection;
PrintOptions();
cin >> selection; switch (selection)
{ case 0: return; case 1:
ExecuteIllegalMemory(); break; case 2:
CreateCodeInVirtualMemory(TRUE); break; case 3:
CreateCodeInVirtualMemoryAndExecute(TRUE); break; default:
cout << "Invalid input" << endl;
}
}
}int main()
{
DecisionLoop(); return 0;
}【慧都十四周年庆预热开启!全场满额送七级豪礼,AppleMac笔记本电脑、iwatch、iPad等您来拿!】
活动时间:10月1日-10月30日

DWObject.OpenSource(); DWObject.IfShowUI = false; DWObject.IfDisableSourceAfterAcquire = true; DWObject.PixelType = EnumDWT_PixelType.TWPT_BW; //Black - White image : EnumDWT_PixelType.TWPT_BW, GRAY image: EnumDWT_PixelType.TWPT_GRAY, RGB image: EnumDWT_PixelType.TWPT_RGB DWObject.AcquireImage();
function BeginScan(){
DWObject.OpenSource();
DWObject.IfShowUI = false; //set without user interface
DWObject.IfDisableSourceAfterAcquire = true;
DWObject.AcquireImage();
}
function DWObject_OnPostTransfer(){
DWObject.SaveAsBMP("C:\\temp.bmp",0);
}DWObject.SelectSource(); DWObject.OpenSource(); DWObject.IfShowUI = false; //Set Image Layout DWObject.Unit = EnumDWT_UnitType.TWUN_INCHES; DWObject.SetImageLayout(0, 0, 5, 5); DWObject.AcquireImage();
DWObject.OpenSourceManager();
for(i = 0, i<=DWObject.SourceCount - 1,i++){
if (DWObject.GetSourceNameItems(i) == "Specified device name")
DWObject.SelectSourceByIndex (i);
}
//if can't find the specified source, it'll select default source
DWObject.AcquireImage(); DWObject.IfShowUI = false; DWObject.IfDisableSourceAfterAcquire = true; DWObject.OpenSource(); DWObject.IfShowIndicator = false; DWObject.AcquireImage();
DWObject.SelectSource();
DWObject.OpenSource();
//Set XRESOLUTION current value.
DWObject.Capability = 0x1118; //ICAP_XRESOLUTION
DWObject.CapType = 5; //TWON_ONEVALUE
DWObject.CapValue = 300;
if (DWObject.CapSet == false){
alert( "Failed to set the x-resolution. " + DWObject.ErrorString);
}
//Set YRESOLUTION current value.
DWObject.Capability = 0x1119; //ICAP_YRESOLUTION
DWObject.CapType = 5; //TWON_ONEVALUE
DWObject.CapValue = 200;
if (DWObject.CapSet == false){
alert( "Failed to set the y-resolution." + DWObject.ErrorString);
}
DWObject.AcquireImage();DWObject = document.getElementById("dwtcontrolContainer");
//dwtcontrolContainer is the id of the Dynamic Web TWAIN on the page (An object or an embed).
function btnScan_onclick()
{
DWObject.SelectSource();
DWObject.OpenSource();
DWObject.AcquireImage();
}
function btnUpload_onclick()
{
var strActionPage;
var strHostIP;
var CurrentPathName = unescape(location.pathname); // get current PathName in
plain ASCII
var CurrentPath = CurrentPathName.substring(0, CurrentPathName.lastIndexOf("/")
+ 1);
strActionPage = CurrentPath + "SaveToFile.aspx"; //the ActionPage's file path
strHostIP = "localhost"; //The host's IP or name
DWObject.HTTPPort = 80;
DWObject.HTTPUploadThroughPost(strHostIP,0,strActionPage,"imageData.tif");
if (DWObject.ErrorCode != 0)
alert(DWObject.ErrorString);
else //succeed
alert("Image Uploaded successfully");
}var iDocumentCounter =0;
function BeginScan(){
DWObject.OpenSource();
DWObject.IfShowUI = false;
DWObject.IfDisableSourceAfterAcquire = true;
if(DWObject.Duplex != TWDX_NONE)
DWObject.IfDuplexEnabled = true; //enable duplex
DWObject.IfFeederEnabled = true;
if (DWObject.IfFeederEnabled == true){
DWObject.XferCount = -1;
if(DWObject.IfFeederLoaded == True)
DWObject.AcquireImage();
}
}
function DWObject_OnPosttransfer(){
iDocumentCounter = iDocumentCounter + 1;
if(DWObject.SaveAsBMP("C:\\Image\\" + iDocumentCounter + ".bmp", 0) == false)
alert( DWObject.ErrorString);
}function btnUpload_onclick()
{
DWObject.HTTPPort = 80;
DWObject.IfSSL = false; // if 80 is the port number of
non-secure port
/*
DWObject.HTTPPort = 443;
DWObject.IfSSL = true; // if 443 is the port number of secure
port
*/
DWObject.HTTPUploadThroughPost("127.0.0.1", 0,
"/SaveToFile.php", "imageData.jpg");
if (DWObject.ErrorCode != 0)
alert(DWObject.ErrorString);
else //succeed
alert("Successful");
}function Scan_Click(){
DWObject.AcquireImage();
}
function DWObject_OnPostTransfer(){
DWObject.CloseSource();
DWObject.IfTiffMultiPage = true;
DWObject.SaveAsTIFF("SaveAsTIFF.tif", 0);
if (DWObject.ErrorCode != 0)
alert (DWObject.ErrorString);
else //succeed
alert ("Successful");
}function NextImage_Click(){
if (DWObject.HowManyImagesInBuffer == 0)
alert ("There is no image in buffer");
DWObject.CurrentImageIndexInBuffer += 1;
}
13.如何进行双面扫描?
function DuplexScan_Click(){
DWObject.SelectSource();
DWObject.OpenSource();
DWObject.IfShowUI = false;
DWObject.IfDuplexEnabled = true; //enable duplex
DWObject.AcquireImage();
} 【慧都十四周年庆预热开启!全场满额送七级豪礼,AppleMac笔记本电脑、iwatch、iPad等您来拿!】
活动时间:10月1日-10月30日
