安全研究笔记：Web、二进制、移动端与 CTFhttps://omiilgo.com/zh-CNhttps://omiilgo.com/posts/cve-2024-2961-iconv-php-bucket-lifetimes/https://omiilgo.com/posts/cve-2024-2961-iconv-php-bucket-lifetimes/核对状态编码的固定字节越界，沿 PHP 流过滤器区分有效长度、分配请求与所有权，再分析 Zend 空闲链和错误清理如何影响内存解释。Thu, 13 Jun 2024 04:00:00 GMTmemory-safetyreverse-engineeringhttps://omiilgo.com/posts/android-dex-dgc-runtime-bytecode-restoration/https://omiilgo.com/posts/android-dex-dgc-runtime-bytecode-restoration/从八份隐藏 DEX 追踪外部方法代码池，区分两套 RC4 密钥派生、DGC 索引与 Dalvik 指令边界，再核对 ART 方法入口提供的修复时机。Tue, 06 Feb 2024 04:00:00 GMTandroidartreverse-engineeringhttps://omiilgo.com/posts/hyperv-ium-guest-context-debugging/https://omiilgo.com/posts/hyperv-ium-guest-context-debugging/沿 VTL 返回事件回溯 VP、VTL 与 VMCS，区分内部偏移和架构字段编码，再通过两次地址转换、栈返回值与调用指令核对 Secure Kernel 的上下文和调试边界。Thu, 07 Sep 2023 04:00:00 GMTreverse-engineeringwindowshttps://omiilgo.com/posts/windows-token-creation-effective-impersonation/https://omiilgo.com/posts/windows-token-creation-effective-impersonation/从已有的 SeCreateTokenPrivilege 出发，区分新令牌属性、线程有效身份与文件访问结果。解析错误 1346、会话标识对照和 StorSvc 加载路径，并验证 SID 比较与变长数组容量。Thu, 17 Aug 2023 04:00:00 GMTreverse-engineeringwindowshttps://omiilgo.com/posts/xnu-arm64-pac-context-state-authentication/https://omiilgo.com/posts/xnu-arm64-pac-context-state-authentication/追踪启动常量、共享区域、调度和异常往返中的 PAC 状态，区分硬件键、软件值与 discriminator，核对 jophash 字段、carry 掩码及辅助接口真正接受的键类型。Mon, 06 Dec 2021 04:00:00 GMTiosmemory-safetyreverse-engineeringhttps://omiilgo.com/posts/arm64-kpti-roots-ranges-exception-entry/https://omiilgo.com/posts/arm64-kpti-roots-ranges-exception-entry/对照 Linux trampoline 与 XNU TCR 切换，跟踪 VBAR、TTBR、ASID 和 X30 的保存顺序，解释 T1SZ 增大为何缩小高端范围，以及固定向量如何在两种视图中连续执行。Mon, 29 Nov 2021 04:00:00 GMTiosmemory-safetyreverse-engineeringhttps://omiilgo.com/posts/dns-beacon-fragment-reassembly-authentication/https://omiilgo.com/posts/dns-beacon-fragment-reassembly-authentication/从配置和 XOR 控制值拆解 DNS Beacon，分别重组 TXT 下载与查询名上传，检查乱序、重复和缺片，再以 HMAC 与 AES 验证三段密文，明确完整数据和部分记录的边界。Mon, 29 Nov 2021 04:00:00 GMTmalware-analysisreverse-engineeringhttps://omiilgo.com/posts/ios-ktrr-ctrr-ranges-lockdown-order/https://omiilgo.com/posts/ios-ktrr-ctrr-ranges-lockdown-order/从启动映射收缩追踪到 CTRR 锁定，核对物理端点、KTRR 与 CTRR 的范围差异、分代 TLB 时序、调试位限制和多核 reset 条件，避免把单次寄存器写入当成完整保护证据。Mon, 29 Nov 2021 04:00:00 GMTiosmemory-safetyreverse-engineeringhttps://omiilgo.com/posts/ios-ppl-entry-state-page-ownership/https://omiilgo.com/posts/ios-ppl-entry-state-page-ownership/沿 ARM64 内核的启动、服务派发与页交接路径，区分每 CPU 状态、物理页所有权和权限编码，核对 16 KiB 步长、原子置位以及异常恢复边界。Fri, 26 Nov 2021 04:00:00 GMTiosmemory-safetyreverse-engineeringhttps://omiilgo.com/posts/dcsync-dcshadow-rpc-context-detection/https://omiilgo.com/posts/dcsync-dcshadow-rpc-context-detection/从接口协商、context ID 和 opnum 还原目录复制请求，解释 flowbit 的状态缺口、DCShadow 反向拉取及字节序边界，并给出协议规则与部署回归矩阵。Mon, 15 Nov 2021 04:00:00 GMTreverse-engineeringwindowshttps://omiilgo.com/posts/x86-shellcode-ror13-resolver-assumptions/https://omiilgo.com/posts/x86-shellcode-ror13-resolver-assumptions/从 call/pop、PEB 节点基准与 PE 导出表恢复九个 API 常量，核对有符号大小写分支、容量字节和哈希碰撞，再沿标准句柄与退出条件界定样本行为。Thu, 02 Sep 2021 04:00:00 GMTmalware-analysisreverse-engineeringwindowshttps://omiilgo.com/posts/wdnisdrv-flow-context-device-boundaries/https://omiilgo.com/posts/wdnisdrv-flow-context-device-boundaries/沿 WFP 过滤器、流上下文和异步通知还原网络检查链路，核对服务 SID、注入语义及三类长度错误，区分修改访问条件后的调试观察与默认配置下的实际可达性。Tue, 13 Jul 2021 04:00:00 GMTmemory-safetyreverse-engineeringwindowshttps://omiilgo.com/posts/cve-2021-24086-nested-ipv6-reassembly/https://omiilgo.com/posts/cve-2021-24086-nested-ipv6-reassembly/从两处补丁追到嵌套 IPv6 重组对象，核对 65,528 字节头部请求如何遇到非连续存储。区分 NDIS 与后续调用的返回值，解释内核崩溃证据、协议约束和拒绝服务边界。Wed, 07 Apr 2021 04:00:00 GMTmemory-safetyreverse-engineeringwindowshttps://omiilgo.com/posts/android-emulator-kernel-structure-location/https://omiilgo.com/posts/android-emulator-kernel-structure-location/以 Android 11 x86_64 AVD 为例，从 comm 搜索验证任务链表，用状态差分筛选 SELinux 字段，再用跨冷启动关系评价重定位锚点。区分构建配置、结构证据、算术模型与运行结果。Thu, 04 Mar 2021 04:00:00 GMTandroidreverse-engineeringhttps://omiilgo.com/posts/msvc-xfg-type-hash-encoding/https://omiilgo.com/posts/msvc-xfg-type-hash-encoding/限定 MSVC 19.28 预览版的 x64 C 实现，拆解类型归一化、递归摘要与后端掩码。用 memcpy 和浮点函数原型验证序列化结果，区分调用点常量、入口标记和未覆盖的类型语义。Thu, 12 Nov 2020 04:00:00 GMTmemory-safetyreverse-engineeringwindowshttps://omiilgo.com/posts/cve-2020-16898-rdnss-parser-boundaries/https://omiilgo.com/posts/cve-2020-16898-rdnss-parser-boundaries/从 RDNSS 长度奇偶性追到两阶段解析分歧，再区分 NdisGetDataBuffer 的直接访问与栈复制路径。用边界模型验证八字节错位，结合分片 RA 约束和 GS 崩溃证据限定影响。Fri, 16 Oct 2020 04:00:00 GMTmemory-safetyreverse-engineeringwindowshttps://omiilgo.com/posts/flutter-ios-routing-tls-analysis/https://omiilgo.com/posts/flutter-ios-routing-tls-analysis/以 2020 年 ARM64 Flutter 样本为例，把 VPN 路由、透明代理、Mach-O 地址换算和证书校验语义分层验证；通过候选常量、32 字节函数前缀及双端请求记录说明每一步的证据边界。Fri, 12 Jun 2020 04:00:00 GMTflutteriosreverse-engineeringhttps://omiilgo.com/posts/vba-signature-source-cache-divergence/https://omiilgo.com/posts/vba-signature-source-cache-divergence/同一份 Word 文档的源码显示 Hello，P-Code 却出现 calc 与 Shell。沿模块流和 contents hash 分清签名覆盖、缓存采纳与宏执行策略，并设计单字节对照实验及 V3 签名检查。Thu, 04 Jun 2020 04:00:00 GMTmalware-analysisofficevbahttps://omiilgo.com/posts/evidence-of-vba-purging-found-in-malicious-documents/https://omiilgo.com/posts/evidence-of-vba-purging-found-in-malicious-documents/一份恶意 PPAM 加载项的模块流只剩压缩源码，缓存长度为零。用 zipdump.py 和 oledump.py 逐层确认 VBA Purging 的结构痕迹，说明它为何让依赖缓存字符串的检测失效，以及如何用结构与行为交叉验证。Sat, 15 Feb 2020 20:00:00 GMTmaldocmalware-analysisofficevbahttps://omiilgo.com/posts/checkm8-dfu-object-lifetime/https://omiilgo.com/posts/checkm8-dfu-object-lifetime/沿 t8015 SecureROM 的 DFU 缓冲区、USB 请求状态和 reset 清理路径，解释长度合法时仍会出现的生命周期错误，并以对象代际模型和请求字段布局区分悬空引用、内存重用与回调控制。Tue, 29 Oct 2019 04:00:00 GMTiosmemory-safetyreverse-engineeringhttps://omiilgo.com/posts/excel-embedded-png-dll-analysis/https://omiilgo.com/posts/excel-embedded-png-dll-analysis/从 OLE 流、PNG 文件头和两个相邻 PE 区间追踪 Excel 样本的载荷，核对 overlay 与文件摘要的关系，再用 VBA 位数分支区分进程内加载意图和实际执行证据。Wed, 18 Sep 2019 04:00:00 GMTmaldocmalware-analysisofficevbahttps://omiilgo.com/posts/flutter-armv7-proxy-tls-analysis/https://omiilgo.com/posts/flutter-armv7-proxy-tls-analysis/以 2019 年 Android ARMv7 Flutter 构建为例，分开验证代理路由与 TLS 信任，通过握手错误、字符串交叉引用和 Thumb 入口定位证书链判断点，并说明返回值、副作用与插件层检查的边界。Tue, 13 Aug 2019 04:00:00 GMTandroidflutterreverse-engineeringhttps://omiilgo.com/posts/obfuscated-okhttp-certificate-pinning/https://omiilgo.com/posts/obfuscated-okhttp-certificate-pinning/在 Android 7.1.2 的普通与混淆构建之间比较三条请求路径，区分平台策略和 OkHttp 固定，通过 Smali 参数描述符、实参语义与 Builder 构造时机定位混淆方法。Tue, 02 Apr 2019 04:00:00 GMTandroidokhttpreverse-engineeringhttps://omiilgo.com/posts/android-runtime-restrictions-bypass/https://omiilgo.com/posts/android-runtime-restrictions-bypass/沿 soinfo 与 Runtime 两条数据链，区分 Android 7–9 的原生库装载限制和 Hidden API 策略，解释内联访问的依赖差异，并给出固定输入、前后对照的验证方法。Wed, 27 Mar 2019 04:00:00 GMTandroidartreverse-engineering