Contents
4.1.2. ¶
- wiki , 하 해 .
- gcc 환 하 .
1) https://www.virtualbox.org VirtualBux
2) http://ftp.daum.net -> Ubuntu-releases -> 11.10 -> ubuntu-11.10-deskto-amd64.iso
3) Virtualbox행 -> -> : Linux : Ubuntu -> 1024MB 하 폴트
4) ubuntu 행 -> ISO파 트 ->
( 해 : 판 한(101/104키 호환) 해!)
- gcc hello world 파 해.
1) 투 트 gcc &
2) 하 (확 .c 해)
3) 해
4) terminal 행 -> .c 파 (ls cd 합.)
5) gcc 파 합. (gcc 파.c -o 하파 -std=c99) 해 .
6) 파 파 행합. (./파)
- w3schools 했. (www.w3schools.com)
- 협 해 했.
- , , 합.
- , , 합.
4.1.3. ¶
- wiki 히
1) 페 - 하 페 하 . 하 .
2) - 회 편 . feedback 항 하.
- gcc 환 하
1) virtual box linux hello world 하 파하 크 .
4.2.2. ¶
- 해 .
1) gcc 파 . - gcc 파 파 크티한 하 .
- 트크 하 히 .
1) 하 패킷 포 하 트크 .
2) 토 해 .
- app : 하 하 . http, smtp, ftp .3) 하 통 할 .
- transport : 하 . , 할 해 합. TCP/UDP .
- ip : 호트 호트, (패킷) 하 할 합. .
- link : 할 합. , 포함.
- physical : 트 키 할 합. 한 , .
- , 하 할 하 해.4) ?
- , 해 함 하 함 하 통 할 .
- (Internet socket, socket' network socket 한) 트크 퓨 통 한 통 .5) 한 항 http://forum.falinux.com/zbxe/?document_srl=441104 하.
트크 통 한 하, 통해 환한. - wikipedia- 크 :P 히 하 클트 byte stream 파 하 해 .
파 파 fopen() connect() read()/write() read()/write() close() close()
4.2.5. ¶
.png ":)")
- 4.3.2. ¶
- 한 해 했.
1) 포트 해하?
- 할 하 클트2) 하 클트 하 ?
포트 통 합.- 하 하 클트 하 황 히 할 .
- . 험해3) 클트 편합. ?
- thread 하 클트 한 플 하4) 클트 항 큽.
concurrent 하.
- 향 통 한 off-line태 하
push형 . C2DM 합.
- Thread 해 .
- thread 하 하 히 하.
할 .
4.3.5. ¶
4.4.2. ¶
- 해 했.
1) 학 클트 한
-> 한 close해 .2) 하 클트 하
-> 해 히 하 해 .3) 키 트 한
-> 키 트 하
했 thread 희 학 thread 팅 .
- concurrent 해 .
1) thread
- thread thread 하, 키 해 .
- 한 크 . http://www.joinc.co.kr/modules/moniwiki/wiki.php/Site/Thread/Beginning/WhatThread
4.6.2. ¶
- NTFS 하 하 하.
-
// 헤 : ntfs.h #pragma once #define _WIN32_WINNT 0x0500 #include <windows.h> #include <winioctl.h> #include <stdio.h> typedef BOOLEAN TF; typedef UCHAR U8; typedef USHORT U16; typedef ULONG U32; typedef ULONGLONG U64; typedef struct { U32 Type; U16 UsaOffset; U16 UsaCount; U64 Usn; } NTFS_RECORD_HEADER, *PNTFS_RECORD_HEADER; typedef struct { NTFS_RECORD_HEADER Ntfs; U16 SequenceNumber; U16 LinkCount; U16 AttributeOffset; U16 Flags; // inUse 0x0001 Directory 0x0002 U32 BytesInUse; U32 BytesAllocated; U64 BaseFileRecord; U16 NextAttributeNumber; } FILE_RECORD_HEADR, *PFILE_RECORD_HEADER; // Standard Attribute typedef enum { AttributeStandardInformation = 0x10, AttributeAttributeList = 0x20, AttributeFileName = 0x30, AttributeObjectId = 0x40, AttributeSecurityDesciptor = 0x50, AttributeVolumeName = 0x60, AttributeVolumeInformation = 0x70, AttributeData = 0x80, AttributeIndexRoot = 0x90, AttributeIndexAllocation = 0xA0, AttributeBitmap = 0xB0, AttributeReparsePoint = 0xC0, AttributeEAInformation = 0xD0, AttributeEA = 0xE0, AttributePropertySet = 0xF0, AttributeLoggedUtilityStream = 0x100 } ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE; typedef struct { ATTRIBUTE_TYPE AttributeType; U32 Length; TF Nonresident; U8 NameLength; U16 NameOffset; U16 Flags; U16 AttributeNumber; } ATTRIBUTE, *PATTRIBUTE; typedef struct { ATTRIBUTE Attribute; U32 ValueLength; U16 ValueOffset; U16 Flags; } RESIDENT_ATTRIBUTE,*PRESIDENT_ATTRIBUTE; #pragma pack(push, 1) typedef struct { U8 Jump[3]; U8 Format[8]; U16 BytesPerSector; // 트 U8 SectorsPerCluster; // 클 U16 BootSectors; U8 Mbz1; U16 Mbz2; U16 Reserved1; U8 MediaType; U16 Mbz3; U16 SectorsPerTrack; U16 NumberOfHeads; U32 PartitionOffset; U32 Reserved2[2]; U64 TotalSectors; //크 . U64 MftStartLcn; //MFT . U64 Mft2StartLcn; // MFT Mirror U32 ClustersPerFileRecord; // 파 클 U32 ClustersPerIndexBlock; // 클 U64 VolumeSerialNumber; U8 Code[0x1AE]; U16 BootSignature; } BOOT_BLOCK, *PBOOT_BLOCK; #pragma pack(pop)- main.cpp
#include "ntfs.h"
U32 BytesPerFileRecord;
BOOT_BLOCK boot_block;
HANDLE hVolume;
U32 cnt;
CHAR drive[] = "\\\\.\\C:";
PFILE_RECORD_HEADER MFT;
void ReadSector(U64 sector, U32 count, void* buffer);
void LoadMFT();
void main()
{
hVolume = CreateFile(drive, GENERIC_READ,FILE_SHARE_READ | FILE_SHARE_WRITE, 0,OPEN_EXISTING, 0, 0);
ReadFile(hVolume, &boot_block, sizeof(boot_block), &cnt, 0);
printf("======My FILE SYSTEM INFO==========\n");
printf("File System : %s \n",boot_block.Format);
printf("Total Sectors : %u \n",boot_block.TotalSectors);
printf("Sector per Bytes : %u \n",boot_block.BytesPerSector);
printf("Cluster per Sectors : %u\n",boot_block.SectorsPerCluster);
printf("Clusters Per FileRecord : %u\n",boot_block.ClustersPerFileRecord);
printf("Clusters Per IndexBlock : %u\n",boot_block.ClustersPerIndexBlock);
}
void LoadMFT()
{
BytesPerFileRecord = boot_block.ClustersPerFileRecord < 0x80? boot_block.ClustersPerFileRecord* boot_block.SectorsPerCluster* boot_block.BytesPerSector : 1 << (0x100 - boot_block.ClustersPerFileRecord);
MFT = PFILE_RECORD_HEADER(new U8[BytesPerFileRecord]);
ReadSector(boot_block.MftStartLcn * boot_block.SectorsPerCluster, BytesPerFileRecord / boot_block.BytesPerSector, MFT);
printf("buffer : %s\n", MFT+0x27);
}
void ReadSector(U64 sector, U32 count, void* buffer)
{
ULARGE_INTEGER offset;
OVERLAPPED overlap = {0};
U32 n;
offset.QuadPart = sector * boot_block.BytesPerSector;
overlap.Offset = offset.LowPart;
overlap.OffsetHigh = offset.HighPart;
ReadFile(hVolume, buffer, count * boot_block.BytesPerSector, &n, &overlap);
}
4.6.3. ¶
- http://forensic-proof.com/ mft 해 .
4.8.5. ¶
- CreateFile함 하. - 희
트
- fopen 하 fopen , fread . - 희
- fopen Standard함 input , 할 합. - 희
- 형 16 헤. ;ㅅ; - 희
- 확하 한 해 MFT Little Endian형 . - 희
- ReadFile overlap 힘 ;ㅅ;
ReadFile 파포 ReadSector ? ? - 희
- 함 해 행해 , 파 . - 희
- 함 해 행해 , 파 . - 희
- 파 하.(2012/04/13/01:44)- 희
- 트
- CreateFile함 LPCWSTR 환 CreateFileA 해.
한 http://stackoverflow.com/questions/3783842/converting-a-string-to-lpcwstr-for-createfile-to-address-a-serial-port
4.9.2. ¶
#include "ntfs.h"
U32 BytesPerFileRecord;
BOOT_BLOCK boot_block;
HANDLE hVolume;
U32 cnt;
CHAR drive[] = "\\\\.\\C:";
//WCHAR drive[] = TEXT("\\\\.\\C:");
PFILE_RECORD_HEADER MFT;
void ReadSector(U64 sector, U32 count, void* buffer);
void LoadMFT();
void main()
{
hVolume = CreateFile(drive, GENERIC_READ,FILE_SHARE_READ | FILE_SHARE_WRITE, 0,OPEN_EXISTING, 0, 0);
ReadFile(hVolume, &boot_block, sizeof(boot_block), &cnt, 0);
// FILE *fp=fopen(drive,"rb");
// fread((void*)&boot_block,sizeof(boot_block),1,fp);
printf("======My FILE SYSTEM INFO==========\n");
printf("File System : %s \n",boot_block.Format);
printf("Total Sectors : %u \n",boot_block.TotalSectors);
printf("Sector per Bytes : %u \n",boot_block.BytesPerSector);
printf("Cluster per Sectors : %u\n",boot_block.SectorsPerCluster);
printf("Clusters Per FileRecord : %u\n",boot_block.ClustersPerFileRecord);
printf("Clusters Per IndexBlock : %u\n",boot_block.ClustersPerIndexBlock);
printf("\n\n");
LoadMFT();
}
void LoadMFT()
{
int i;
BytesPerFileRecord = boot_block.ClustersPerFileRecord < 0x80? boot_block.ClustersPerFileRecord* boot_block.SectorsPerCluster* boot_block.BytesPerSector : 1 << (0x100 - boot_block.ClustersPerFileRecord);
MFT = PFILE_RECORD_HEADER(new U8[BytesPerFileRecord]);
ReadSector(boot_block.MftStartLcn * boot_block.SectorsPerCluster, BytesPerFileRecord / boot_block.BytesPerSector, MFT);
printf("$MFT's Signaturer : %s\n", MFT);//+0x27);
printf("Offset to fixup array : 0x%02x%02x\n", *((unsigned char*)MFT+5),*((unsigned char*)MFT+4));
printf("Number of this MFT Entry : 0x%02x%02x%02x%02x\n"
, *((unsigned char*)MFT+47),*((unsigned char*)MFT+46),*((unsigned char*)MFT+45),*((unsigned char*)MFT+44));
printf("Offset to first attribute : 0x%02x%02x \n"
, *((unsigned char*)MFT+21),*((unsigned char*)MFT+20));
i=((int)(*((unsigned char*)MFT+21))<<8)+*((unsigned char*)MFT+20);//Offset 포
printf("First Attribute : 0x%02x%02x%02x%02x\n",*((unsigned char*)MFT+i+3),*((unsigned char*)MFT+i+2),*((unsigned char*)MFT+i+1),*((unsigned char*)MFT+i));
i+=4;// 4트
printf("First Attribute Size : 0x%02x%02x%02x%02x\n",*((unsigned char*)MFT+i+3),*((unsigned char*)MFT+i+2),*((unsigned char*)MFT+i+1),*((unsigned char*)MFT+i));
printf("\n");
i= i+
((int)(*((unsigned char*)MFT+i+3))<<24)+
((int)(*((unsigned char*)MFT+i+2))<<16)+
((int)(*((unsigned char*)MFT+i+1))<<8)+
*((unsigned char*)MFT+i)
-4;// 해 한 4트 한.
printf("Second Attribute : 0x%02x%02x%02x%02x\n",*((unsigned char*)MFT+i+3),*((unsigned char*)MFT+i+2),*((unsigned char*)MFT+i+1),*((unsigned char*)MFT+i));
i+=4;// 4트
printf("Second Attribute Size : 0x%02x%02x%02x%02x\n",*((unsigned char*)MFT+i+3),*((unsigned char*)MFT+i+2),*((unsigned char*)MFT+i+1),*((unsigned char*)MFT+i));
printf("\n");
i= i+
((int)(*((unsigned char*)MFT+i+3))<<24)+
((int)(*((unsigned char*)MFT+i+2))<<16)+
((int)(*((unsigned char*)MFT+i+1))<<8)+
*((unsigned char*)MFT+i)
-4;// 해 한 4트 한.
printf("Third Attribute : 0x%02x%02x%02x%02x\n",*((unsigned char*)MFT+i+3),*((unsigned char*)MFT+i+2),*((unsigned char*)MFT+i+1),*((unsigned char*)MFT+i));
i+=4;// 4트
printf("Third Attribute Size : 0x%02x%02x%02x%02x\n",*((unsigned char*)MFT+i+3),*((unsigned char*)MFT+i+2),*((unsigned char*)MFT+i+1),*((unsigned char*)MFT+i));
printf("\n");
/*
ReadSector(boot_block.Mft2StartLcn * boot_block.SectorsPerCluster, BytesPerFileRecord / boot_block.BytesPerSector, MFT);
printf("$MFT Mirr's Signaturer : %s\n", MFT);//+0x27);
printf("Offset to fixup array : 0x%02x%02x\n", *((unsigned char*)MFT+5),*((unsigned char*)MFT+4));
printf("Number of this MFT Entry : 0x%02x%02x%02x%02x\n"
, *((unsigned char*)MFT+47),*((unsigned char*)MFT+46),*((unsigned char*)MFT+45),*((unsigned char*)MFT+44));
printf("\n");
//*/
printf("MftStartLcn : %d\n",boot_block.MftStartLcn);
printf("Mft2StartLcn : %d\n",boot_block.Mft2StartLcn);
}
void ReadSector(U64 sector, U32 count, void* buffer)
{
ULARGE_INTEGER offset;
OVERLAPPED overlap = {0};
U32 n;
offset.QuadPart = sector * boot_block.BytesPerSector;
overlap.Offset = offset.LowPart;
overlap.OffsetHigh = offset.HighPart;
ReadFile(hVolume, buffer, count * boot_block.BytesPerSector, &n, &overlap);
}
4.9.5. ¶
- 함 , 환하 함 .
합.
htons, htonl
- HxD 헥 . 4 트 파 8 트 합. 한 .
http://mh-nexus.de/en/hxd/ -
- Code jam 태 ... - 희
- 해하 형 하. 4bit unsigned 형 3byte,7byte unsigned 형 하.ㅠㅜ - 희
4.10.2. ¶
#include "ntfs.h"
U32 BytesPerFileRecord;
BOOT_BLOCK boot_block;
HANDLE hVolume;
U32 cnt;
CHAR drive[] = "\\\\.\\C:";
//WCHAR drive[] = TEXT("\\\\.\\C:");
PFILE_RECORD_HEADER MFT;
void ReadSector(U64 sector, U32 count, void* buffer);
void LoadMFT();
unsigned int LoadAttribute(int i);
unsigned __int64 htonll(unsigned __int64);
unsigned int htonl(unsigned int);
//unsigned short htons(unsigned short);
void main()
{
hVolume = CreateFile(drive, GENERIC_READ,FILE_SHARE_READ | FILE_SHARE_WRITE, 0,OPEN_EXISTING, 0, 0);
ReadFile(hVolume, &boot_block, sizeof(boot_block), &cnt, 0);
// FILE *fp=fopen(drive,"rb");
// fread((void*)&boot_block,sizeof(boot_block),1,fp);
printf("======My FILE SYSTEM INFO==========\n");
printf("File System : %s \n",boot_block.Format);
printf("Total Sectors : %u \n",boot_block.TotalSectors);
printf("Sector per Bytes : %u \n",boot_block.BytesPerSector);
printf("Cluster per Sectors : %u\n",boot_block.SectorsPerCluster);
printf("Clusters Per FileRecord : %u\n",boot_block.ClustersPerFileRecord);
printf("Clusters Per IndexBlock : %u\n",boot_block.ClustersPerIndexBlock);
printf("\n\n");
LoadMFT();
system("pause");
}
void LoadMFT()
{
int point;
unsigned __int64 num;
BytesPerFileRecord = boot_block.ClustersPerFileRecord < 0x80? boot_block.ClustersPerFileRecord* boot_block.SectorsPerCluster* boot_block.BytesPerSector : 1 << (0x100 - boot_block.ClustersPerFileRecord);
MFT = PFILE_RECORD_HEADER(new U8[BytesPerFileRecord]);
printf("MftStartLcn : %016x\n",boot_block.MftStartLcn);
printf("Mft2StartLcn : %016x\n",boot_block.Mft2StartLcn);
printf("\n");
//0 하 MFT entry .
ReadSector((boot_block.MftStartLcn+0) * boot_block.SectorsPerCluster, BytesPerFileRecord / boot_block.BytesPerSector, MFT);
printf("MFT's Signaturer : %s\n", MFT);//+0x27);
printf("Offset to fixup array : 0x%02x%02x\n", *((unsigned char*)MFT+5),*((unsigned char*)MFT+4));
printf("Number of this MFT Entry : 0x%02x%02x%02x%02x\n"
, *((unsigned char*)MFT+47),*((unsigned char*)MFT+46),*((unsigned char*)MFT+45),*((unsigned char*)MFT+44));
printf("Offset to first attribute : 0x%02x%02x \n"
, *((unsigned char*)MFT+21),*((unsigned char*)MFT+20));
printf("\n");
point=((int)(*((unsigned char*)MFT+21))<<8)+*((unsigned char*)MFT+20);//Offset 포
printf("Attribute List Start\n\n");
while(htonl(*((unsigned int*)((unsigned char*)MFT+point)))!=0xFFFFFFFF)
point+=LoadAttribute(point);
printf("Attribute List End\n");
printf("\n");
}
unsigned int LoadAttribute(int point)
{
int i=0,j=0,k=0;
int HeaderSize;
/*
*((unsigned char*)MFT+i+9) = Attribute Name Size
Resident=24 / Non-resident=64
*/
if(*((unsigned char*)MFT+point+8))
HeaderSize=64+*((unsigned char*)MFT+point+9);
else
HeaderSize=24+*((unsigned char*)MFT+point+9);
switch(htonl(*((unsigned int*)((unsigned char*)MFT+point))))
{
case 0x10://$STANDARD_INFORMATION
printf("Attribute type : Standard Information\n");
break;
case 0x20://$ATTRIBUTE_LIST
printf("Attribute type : Attribute List\n");
break;
case 0x30://$FILE_NAME
printf("Attribute type : File Name\n");
printf("File Name Size : %d\n",*((unsigned char*)MFT+point+HeaderSize+64));
printf("File NameSpace : ");
switch(*((unsigned char*)MFT+point+HeaderSize+65))
{
case 0:
printf("POSIX\n");
break;
case 1:
printf("Win32\n");
break;
case 2:
printf("DOS\n");
break;
case 3:
printf("Win32 & DOS\n");
break;
}
printf("File Name : ");
for(j=0;j<2**((unsigned char*)MFT+point+HeaderSize+64);j++)
printf("%c",*((unsigned char*)MFT+point+HeaderSize+66+j));
printf("\n");
break;
case 0x40://$
printf("Attribute type : \n");
break;
case 0x50://$SECURITY_DESCRIPTOR
printf("Attribute type : Security Descriptor\n");
break;
case 0x60://$
printf("Attribute type : \n");
break;
case 0x70://$
printf("Attribute type : \n");
break;
case 0x80://$DATA
printf("Attribute type : Data\n");
//__int64 little endian . 해 ...
printf("Run List Start VCN : %I64d\n",*((unsigned __int64*)((unsigned char*)MFT+point+16)));
printf("Run List End VCN : %I64d\n",*((unsigned __int64*)((unsigned char*)MFT+point+24)));
printf("Run List Start Offset : 0x%02x%02x\n",*((unsigned char*)MFT+point+33),*((unsigned char*)MFT+point+32));
// printf("Cluster Size : %I64d\n",*((unsigned __int64*)((unsigned char*)MFT+point+40)));
// printf("Attribute Size : %I64d\n",*((unsigned __int64*)((unsigned char*)MFT+point+48)));
// printf("real Size : %I64d\n",*((unsigned __int64*)((unsigned char*)MFT+point+56)));
i=(int)*((unsigned char*)MFT+point+33)+*((unsigned char*)MFT+point+32);
for(j=0;j<(*((unsigned char*)MFT+point+i)&0x0F);j++)//*((unsigned __int64*)((unsigned char*)MFT+point+24));j++)
{
printf("Cluster %d lenth : 0x",j);
for(k=0;k<(*((unsigned char*)MFT+point+i)&0x0F);k++)
printf("%02x",*((unsigned char*)MFT+point+i+(*((unsigned char*)MFT+point+i)&0x0F)-k));
printf("\n");
printf("Cluster %d offset : 0x",j);
for(;k<(*((unsigned char*)MFT+point+i)&0x0F)+((*((unsigned char*)MFT+point+i)&0xF0)>>4);k++)
printf("%02x",*((unsigned char*)MFT+point+i
+(*((unsigned char*)MFT+point+i)&0x0F)+((*((unsigned char*)MFT+point+i)&0xF0)>>4)
-k+(*((unsigned char*)MFT+point+i)&0x0F)));
printf("\n");
i+=(*((unsigned char*)MFT+point+i)&0x0F)+((*((unsigned char*)MFT+point+i)&0xF0)>>4)+1;
}
break;
case 0xB0:
printf("Attribute type : Bitmap\n");
break;
}
printf("\n");
return htonl(*((unsigned int*)((unsigned char*)MFT+point+4)));
}
void ReadSector(U64 sector, U32 count, void* buffer)
{
ULARGE_INTEGER offset;
OVERLAPPED overlap = {0};
U32 n;
offset.QuadPart = sector * boot_block.BytesPerSector;
overlap.Offset = offset.LowPart;
overlap.OffsetHigh = offset.HighPart;
ReadFile(hVolume, buffer, count * boot_block.BytesPerSector, &n, &overlap);
}
unsigned __int64 htonll(unsigned __int64 LittleEndian)
{
unsigned __int64 BigEndian;
int i;
LittleEndian>>=16;
BigEndian=0;
BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+7))<<54;
BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+6))<<48;
BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+5))<<40;
BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+4))<<32;
BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+3))<<24;
BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+2))<<16;
BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+1))<<8;
BigEndian+=(unsigned __int64)(*((unsigned char*)&LittleEndian+0));
return BigEndian;
}
unsigned int htonl(unsigned int LittleEndian)
{
unsigned int BigEndian;
BigEndian=
((unsigned int)(*((unsigned char*)&LittleEndian+3))<<24)+
((unsigned int)(*((unsigned char*)&LittleEndian+2))<<16)+
((unsigned int)(*((unsigned char*)&LittleEndian+1))<<8)+
*((unsigned char*)&LittleEndian)
;
return BigEndian;
}
/*
unsigned short htons(unsigned short LittleEndian)
{
unsigned short BigEndian;
BigEndian=
((unsigned short)(*((unsigned char*)&LittleEndian+1))<<8)+
*((unsigned char*)&LittleEndian)
;
return BigEndian;
}
/*/
4.10.5. ¶
- 탬 , 파트 한테 ...- 희
- ( MS , micro second )
- ( MS , micro second )
- http://ezbeat.tistory.com/124
탬 포 환 API - 희
- http://lioler.blog.me/20051109234
NFTS - 희
- 황
클화 , . ( , 파 , data )
희/MTFREADER - 희
