▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 AndroBugs Framework is an efficient Android vulnerability scanner that helps developers or hackers find potential security vulnerabilities in Android applications. No need to install on Windows.
fb.com/UndercodeTesting


🦑Features:

> Find security vulnerabilities in an Android app

> Check if the code is missing best practices

> Check dangerous shell commands (e.g. “su”)

> Collect Information from millions of apps

> Check the app’s security protection (marked as <Hacker>, designed for app repackaging hacking)

🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ :

1) git clone https://github.com/AndroBugs/AndroBugs_Framework

2) cd AndroBugs_Framework

3) python androbugs.py -f [APK file]
####To check the usage:####

python androbugs.py -h

🦑Easy to use for Android developers or hackers on Microsoft Windows: (a) No need to install Python 2.7 (b) No need to install any 3rd-party library (c) No need to install AndroBugs Framework

>mkdir C:\AndroBugs_Framework

> cd C:\AndroBugs_Framework

> Unzip the latest Windows version of AndroBugs Framework from Windows releases

>Go to Computer->System Properties->Advanced->Environment Variables. Add "C:\AndroBugs_Framework" to the "Path" variable
androbugs.exe -h
androbugs.exe -f [APK file]

🦑 Massive Analysis Tool Steup Steps and Usage for Windows

> Complete the Steup Steps and Usage for Windows first
Install the Windows version of MongoDB (https://www.mongodb.org/downloads)

> Install PyMongo library
Config your own MongoDB settings: C:\AndroBugs_Framework\androbugs-db.cfg

> Choose your preferred MongoDB management tool (http://mongodb-tools.com/)

> AndroBugs_MassiveAnalysis.exe -h
Example: AndroBugs_MassiveAnalysis.exe -b 20151112 -t BlackHat -d .\All_Your_Apps\ -o .\Massive_Analysis_Reports
AndroBugs_ReportByVectorKey.exe -h
Example: AndroBugs_ReportByVectorKey.exe -v WEBVIEW_RCE -l Critical -b 20151112 -t BlackHat

» USE FOR LEARN ONLY !!

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Core Technology-Reading Nuclear DiaryReading nuclear diary
full by undercode
t.me/undercodeTesting

> face of nearly 50 m of source code, confusion is inevitable, so I decided to grasp the big picture first, and then cut in some specific points. In this way, the Linux startup process is very important, so I use The dmesg command

looks at the message that is printed when Linux starts. (I think the source file should be in /usr/src/linux/init/main.c) The kernel startup finally reaches start_kernel (in /init/main.c), which is Said that the startup process is running from head.S (arch / i386 / boot /) to main.c (start_kernel). Its role is to complete the settings after the boot and the initialization of the kernel. Wait for the user's input, and call fork to spawn a child process. In order to meet the design requirements of the interactive operating system.

Part 1: Inside Core initialization and startup.

Start the system. When the PC is powered on and starts, the 80X86 processor (CPU) self-tests in real mode and starts executing the code at the physical address 0xFFFF0, which is the starting address of the ROM-BIOS. The BIOS of the PC performs a system self-test and initializes the interrupt vector table to the physical address 0x0. Then load the first sector of the boot device to address 0x7C00 and execute the instructions here. It has nothing to do with linux here, the hardware settings of x86 series are like this.

The Linux kernel itself cannot be bootstrapped, so the role of lilo and loadlin is to load the system kernel. For the principle of lilo, please refer to the readme of lilo. The process from power on to kernel load is: power on-> execute BIOS-> load The first sector-> lilo-> loading the kernel

The initial part of the Linux kernel code is written in assembly language (the file is boot / bootsect.s). (My assembly level is limited, I will not look at it for now), it first moves its own part of the code to the absolute address 0x90000, loads the following 2K code from the boot device to the address 0x90200, and the rest of the kernel is loaded to the address 0x10000. "Loading ..." is displayed when the system is loaded. Then, program control is transferred to another real-mode assembler (boot / Setup.S). Next, this program moves the entire system from address 0x10000 to address 0x1000 and enters protection mode. Program control is transferred to the rest of the system, which is address 0x1000.

The next step is the decompression process of the system kernel. This part of the code is at address 0x1000 (file /Boot/head.S). The program initializes the register and then executes decompress_kernel (). This function is derived from zBoot / inflate.c, zBoot / unzip.c and zBoot / misc.c three files

Loading .... [bootsect.S]

uncompress ..... [decompress_kernel ()]

main.c ---> start_kernel () Start.

Start printk (banner) ;

Linux version 2.2.6 (root @ lance) (gcc version 2.7.2.3) (check the version number of GCC, if the version number of gcc is not enough in /init/main.c, it is not allowed to compile the kernel)



calls init_time () to print out the following:

Detected 199908264 Hz processor.

Then run console_init ()-> drivers / char / tty_io.c * /

Console: colour VGA + 80x25 to

run one Loop, measure MIPS – it is said to use a certain machine instruction cycle to achieve real-time delay.

Calibrating delay loop ... 199.48 BogoMIPS

initial memory / * init_mem * /

Memory: 63396k / 65536k available (848k kernel code, 408k reserved , 856k data

, 28k

/ dquote_init () /

VFS: Diskquotas version dquot_6.4.0 initialized to check

the type of CPU (after 2.2.14 I heard that support for multiple CPUs has been added, I may have to look at it in the future , if I can find a bug of intel then ……)

CPU: Intel Pentium Pro stepping 09

initial or processor and coprocessor, for older processors, Linux will use software to simulate the coprocessor?

Checking 386/387 coupling ... OK, FPU using exception 16 error reporting.

Check the legitimacy of governance

Checking 'HLT' Instruction ... the OK.

The POSIX the Conformance Testing by UNIFIX

After calling linux_thread (init, .., .., ) (arch / i386 / kernel / process.c )

to create a run init process.

entered the second phase of user-mode (user_mode) End of start_kerne finally into cpu_idle (arch / i386 / kernel / process.c)

the second part of the device Initialization

Initialize the call to the device. Init () ---> do_basic_init ()-+

pci_init () Initialize the pci device (there is such a ifdef PCI in the main.c file ... need to take a look) Printed below Result:

PCI: PCI BIOS revision 2.10 entry at 0xfd8d1

PCI: Using configuration type 1

PCI: Probing PCI hardware

initialization of Socket, socket_init () (here may be the linux network secret, I will pay attention to it later) -Linux NET4. 0 for Linux 2.2

Based upon Swansea University Computer Society NET3.039

NET4: Unix domain sockets 1.0 for Linux NET4.0.

NET4: Linux TCP / IP 1.0 for NET4.0

IP Protocols: ICMP, UDP, TCP

Starting kswapd v 1.5 kswapd_setup ()

calls device_setup ( )

Detected PS / 2 Mouse Port.

Initialization of sound card

Sound initialization started

Sound initialization complete

initialization floppy drive

Floppy drive (s): fd0 is 1.44M

FDC 0 is a National Semiconductor PC87306

SCSI device initialization

(scsi0) <Adaptec AIC-7880 Ultra SCSI host adapter> found at PCI 13/0

(scsi0) Wide Channel, SCSI ID = 7, 16/255 SCBs

(scsi0) Downloading sequencer code ... 419 instructions downloaded

scsi0: Adaptec AHA274x / 284x / 294x (EISA / VLB / PCI-Fast SCSI) 5.1.10 / 3.2.4

<Adaptec AIC-7880 Ultra SCSI host adapter>

scsi: 1 host.

Vendor: SEAGATE Model: ST32155W Rev: 0596

ype : Direct-Access ANSI SCSI revision: 02

Detected scsi disk sda at scsi0, channel 0, id 0, lun 0

Vendor: SEAGATE Model: ST32155W Rev: 0596

Type: Direct-Access ANSI SCSI revision: 02

Detected scsi disk sdb at scsi0, channel 0, id 1, lun 0

scsi: detected 2 SCSI disks total.

(scsi0: 0: 0: 0) Synchronous at 40.0 Mbyte / sec, offset 8.

SCSI device sda: hdwr sector = 512 bytes. Sectors = 4197405 [2049 MB] [2.0 GB] (scsi0: 0: 1: 0) Synchronous at 40.0 Mbyte / sec, offset 8.

SCSI device sdb: hdwr sector = 512 bytes. Sectors = 4197405 [2049 MB] [2.0 GB] Partition check: sda: sda1 |

sdb: sdb1 sdb2 <sdb5 sdb6> |

install file system filesystem_setup ()

install device driver mount_root ()

VFS: Mounted root (ext2 filesystem) readonly.

Freeing unused kernel memory: 28k freed

Adding Swap: 66540k swap-space (priority -1)

Soundblaster audio driver Copyright (C) by Hannu Savolainen 1993-1996

SB 3.01 detected OK (220)

< ESS ES1688 AudioDrive (rev 11) (3.01)> at 0x220 irq 5 dma 1

YM3812 and OPL-3 driver Copyright (C) by Hannu Savolainen, Rob Hooft 1993-1

996 <Yamaha OPL3> at 0x388

NET4: AppleTalk 0.18 for Linux NET4 .0

eth0: Intel EtherExpress Pro 10/100 at 0xf800, 00: A0: C9: 49: 2F: FF, IRQ 9.

Board assembly 645520-034, Physical connectors present: RJ45

Primary interface chip DP83840 PHY # 1.

DP83840 specific setup, setting register 23 to 8462.

General self-test: passed.

Serial sub-system self-test: passed.

Internal registers self-test: passed.

ROM checksum self-test: passed (0x49caa8d6).

Receiver lock-up workaround activated.

NET4: AppleTalk 0.18 for Linux NET4.0

end do_basic_setup ()

Open ( "/ dev / Console", O_RDWR, 0)

begin / sbin / init (execv (... ))

kernel this boot is completed ...

in this way the system The files needed at startup are clear at a glance. To read the source code in this area, you can probably do this:

Boot / head.S

decompress_kernel (), and then read the corresponding function according to a function block.

In fact, for the entire kernel, you should also interpret the makefile. To be honest, I am very fond of writing makefiles in programming. However, reading the kernel, she is working very hard. Difficult to carry out. Fortunately, with souce insight, we can easily find the definition of functions and constants, which is much more convenient.

Open main.c (in fact, I solved 2.2.14 under windows). I found that there are n functions and There are only a few init functions in the definition of 2n constants. Many other external functions are also defined. There is no main function here-I now doubt whether the linux program is the same as vc and I do n’t know where to start: __). Immediately understood, the whole kernel incident is in one. It also includes many modules such as storage management, processor management, memory management, etc. She will not start after she has no time to do it.

Okay, I ca n’t eat fat in one bite. I still first I read it from the start. But I started to wonder if I want to add Chinese wishes. The code itself is a master, and they should know what the best comment is. Do you read the code? ? E even this can not see the text

read nuclear diary (b)
This article comes from: http: //os.silversand.net Author: sunmoon (2001-08-31 12:00:00)
these days to see what the older generation There is a book guide, without my tongue, and a brief introduction to

understand the startup process of Linux. For the analysis of the entire system. Not even a beginning. What I did is to know that the system startup is a sequence of functions. As suggested by a friend's letter, if you read hard in this order, it is really self-mutilation. Fortunately, sunmoon has a certain self-knowledge. If you go on like this, you can't understand much. Then I can't stick to it, so my principle Yes ?: Never prepare yourself without sufficient preparation.

Interested experts around you suggest that you should start with the application, write some level programs related to the system, and track the program with all your heart. Understand the architecture and calling system of the entire system. Then analyze the source.

At the same time, sunmoon also knows, An operating system is a collection of all relevant software theories. Sunmoon is not a graduate of the computer department, and is very unfamiliar with many basic courses. So I have to find <<< assembly language >> << operating system principles >> << computer architecture> > << Principle of Compilation? >> << Design and Implementation of Operating System >> and other classic books are put on the desk. Of course, the newly published << Linux Operating System Kernel Analysis >> is very good.

Yesterday After these late, I started to analyze the architecture of

linux : the kernel of linux does not use the now popular (theoretically more advanced) as the kernel structure. It uses an integrated body composed of many processes. Each process Can call each other. It seems to be messy. This has something to do with its development process. But I personally feel that linux as a whole is a structured program. (Never opp). Different modules complete different functions And then through the whole scheduling, and integrated into a whole.

Separation of the five sub-systems << linux operating system kernel analysis >> in: process scheduling, memory management, virtual file system, interprocess communication, and network interfaces.

Specific The function, interface, subsystem structure, and data structure of each subsystem can be read in detail from this book. Strive to have a certainty of the overall.

Is it clearly in the nearly 50 trillion source of Linux. That In part, what functions are implemented so that it will not be confusing to read in the future.

If I have another two years, I will use pseudocode to simulate the linux functions. Then analyze it from the perspective of writing, which is what the scholars use for me. It ’s a great way. Unfortunately, due to some unspeakable secrets, I have arranged for the past two years,



This article comes from: http: //os.silversand.net Author: sunmoon (2001-08-31 15:00:01)
in linux each process task_struct data structure is defined by task_struct is what we usually refer to the PCB..

She is the only and most effective means of controlling the process.

When we call fork (), the system will generate a task_struct structure for us. Then inherit some data from the parent process

and insert the new process into the process tree In the process to be managed. So understanding the structure of task_struct is the key to understanding task

scheduling (task and process are the same concept in Linux). Before analyzing the definition of task_struct,

let ’s push it in accordance with our theory Structure.

1, Process status, will record the process is waiting, running, or deadlock

2, scheduling information, which scheduling function scheduling, how to schedule, etc.

3, the communication status of the process

4, because to insert the process tree, there must be a contact between the father and son The pointer of the brother, of course, is task_struct type

5, time information, such as calculating the execution time, so that the CPU allocates

6, the label, and decides to improve the process attribution

7, and can read and write some open documents. File information

8, process context and kernel context

9, processor context

10, memory information

Because every PCB is like this, only these structures can meet all the requirements of a process.

Open /include/linux/sched.h and find task_struct Definition

struct task_struct {

/ * these are hardcoded-don't touch * /

Here are some hardware settings that were originally transparent to the program. The state states whether the process can be executed,

or can be interrupted, etc. Flage is the process number, in It is given when calling fork (), addr_limit is to distinguish the location of the kernel process

and the ordinary process in the memory

volatile long state; / * -1 unrunnable, 0 runnable,> 0 stopped * /

unsigned long flags; / * per process flags, defined below * /

int sigpending;

mm_segment_t addr_limit; / * thread address space:

0-0xBFFFFFFF for user-thead

0-0xFFFFFFFF for kernel-thread

* /

struct exec_domain * exec_domain;

long need_resched;

　

/ * various fields * /

count is the counter priority Is the priority

long counter;

long priority;

cycles_t avg_slice;

/ * SMP and runqueue state * /

Variables defined for multiprocessor.

Int has_cpu;

int processor;

int last_processor;

int lock_depth;

/ * Lock depth. We can context switch in and out of holding a syscall kernel lock ... * /

In order to sort in the process tree, the defined father and son, sibling pointer

struct task_struct * next_task, * prev_task;

struct tas74k_struct * next_run, * prev_run;

　

/ * task state * /

defines the state in which the task can run, and the signal

struct linux_binfmt * binfmt;

int exit_code, exit_signal;

int pdeath_signal; / * The signal sent when the parent dies * /

/ * Define the processable user number, user group and process group * /

unsigned long personality;

int dumpable: 1;

int did_exec: 1;

pid_t pid;

pid_t pgrp;

pid_t tty_old_pgrp;

pid_t session;

/ * boolean value for session group leader * /

is the header file of the process group

int leader;

/ *

* pointers to (original) parent process, youngest child, younger sibling,

* older sibling, respectively. ( p-> father can be replaced with

* p-> p_pptr-> pid)

* /

Some pointers of the parent and child processes

struct task_struct * p_opptr, * p_pptr, * p_cptr, * p_ysptr, * p_osptr;

　

/ * PID hash table linkage. * /

Some hash tables used in scheduling

struct task_struct * pidhash_next;

struct task_struct pidhash_pprev;

　

/ * Pointer to task [] array linkage. * /

Struct task_struct tarray_ptr;

　

struct wait_queue * wait_chldexit; / * for wait4 () wait queue * /

struct semaphore * vfork_sem; / * for vfork () * /

unsigned long policy, rt_priority;

unsigned long it_real_value, it_prof_value, it_virt_value;

the nature of the processBecause the scheduling algorithm of the real-time process and the ordinary process are different, there should be variables to distinguish the

following is the process Some time information

unsigned long it_real_incr, it_prof_incr, it_virt_incr;

struct timer_list real_timer;

struct tms times;

unsigned long start_time;

long per_cpu_utime [NR_CPUS], per_cpu_stime [NR_CPUS]; defines the size of the time slice

/ * mm fault and swap info: this can arguably be seen as either mm-specific or thread-specific * /

memory information

unsigned long min_flt, maj_flt, nswap, cmin_flt, cmaj_flt, cnswap;

int swappable: 1;

/ * process credentials * /

uid_t uid, euid, suid, fsuid;

gid_t gid, egid, sgid, fsgid;

int

ngroups ; gid_t groups [NGROUPS];

kernel_cap_t cap_effective, cap_inheritable, cap_permitted;

struct user_struct * user; the

following English comments are clear

/ * limits * /

struct rlimit rlim [RLIM_NLIMITS];

unsigned short used_math ;

char comm [16];

/ * file system info * /

int link_count;

struct tty_struct * tty; / * NULL if no tty * /

/ * ipc stuff * /

　

struct sem_undo * semundo;

struct sem_queue * semsleeping;

/ * tss for this task * /

struct thread_struct tss;

/ * filesystem information * /

struct fs_struct * fs;

/ * open file information * /

struct files_struct * files;

/ * memory management info * /

struct mm_struct * mm;

　

/ * signal handlers * /

spinlock_t sigmask_lock; / * Protects signal and blocked * /

struct signal_struct * sig;

sigset_t signal, blocked;

struct signal_queue * sigqueue, sigqueue_tail;

unsigned long sas_ss_sp;

size_t sas_ss_size;

};

After analyzing this structure, there are still many problems to think about, maybe it ca n’t be read but the framework needs to be done well. The questions that need to be addressed are the following

1 , Such as the maximum number of processes, the maximum number of CPUs supported, etc.

2. When calling fork (), will the system allocate a piece of memory?

Malloc (1, sizeof (struct task_struck))

copy some variables, or kimono The process shares a part of the memory. How to implement the malloc function (in the part of memory management, but I do n’t think I ca n’t think of it here)

3. For threads, how to implement it?

4,

There are several situations in the scheduling strategy function schedule () , Time slice rotation, preemption, priority preemption, multi-level feedback system. In addition to time slice rotation, the process tree must be traversed, (for real-time processes

(The fifo mechanism is not used.) How does Linux ensure high efficiency? If you modify the maximum number of lines, will the efficiency be reduced by

5, the pipeline used for process communication, and the signal structure to

be continued ...

Read the nuclear diary (4)
This article comes from : http: //os.silversand.net author: sunmoon (2001-09-01 07:05:00)
these days not feeling well, slow progress sometimes suddenly found a gap in the code's hard to read, stop. Think about it for a while, the gain will be even greater. Especially for this very large system. Grasping the whole meaning is particularly important. With the dismantling of the overall Linux, I do n’t want to start to be so vague about the whole system. . It seems that I have passed the extreme point. But I should be prepared, because once I interpret the whole details, I will definitely have the same experience.

The reason why the entire Linux kernel is so difficult is that it is difficult to understand Sex. For people like us who rarely write more than 10,000 lines of programs, it is like a huge meat ball. Let you not know how to mouth. But once bite. It is very fragrant. After all, reading is so good the code is a pleasure.

I personally think that the linux kernel in difficult Several points: 1. The system is huge, too many variables, structures, and typedefs are not easy to find. 2. As an operating system, its function is dynamic when it is called, and you ca n’t read a lot of makefiles. You do n’t know this at all. How is the 50 M thing organized? Moreover, you can never use debug like a tracking program. 3. The huge data structure may be that relatively simple operations become difficult to read.

Therefore, in the initial stage of reading the core .We should be good at imagination and good at walking through the parts that are not easy to understand in the way of pseudocode. When we have a good grasp of the overall situation and disassemble the entire structure clearly, it is n

ot late to read. Moreover, although the core itself The calculations and structures involved in it are essentially the same as those in the textbooks. (Unfortunately I am not a graduate of the computer department). It is just a little more content.

For example, the process scheduling part, to put it bluntly, is that when fork () is called, a pointer of type task_strut is generated, which contains all the information used for process scheduling. Then insert this pointer into the queue, and then cpu takes pointers from the general team class and assigns them to time slices.

And how to insert this pointer? To put it plainly is to see its weight, weight calculation method, there are different algorithms (real-time process, kernel process , Ordinary process). Okay, so we think about << in the data structure >> about the operation of the queue, insert, delete, insert to the head of the queue, put it at the end of the queue. Think again, how these operations apply to the operating system Combined together. For example; a good team process is running, suddenly, due to a hardware interrupt. A process is generated, it must be processed immediately. The system should insert it into the head of the team.

Ok. You can read /usr./src/ linux / kenrel / sched.c, don't go through so many global variables, and now go over the data structure, as in the following code:

　

static inline void move_last_runqueue (struct task_struct * p)

{

struct task_struct * next = p-> next_run;

struct task_struct * prev = p-> prev_run;

　

/ * remove from list * /

next-> prev_run = prev;

prev-> next_run = next;

/ * add back to list * /

p-> next_run = & init_task;

prev = init_task. prev_run;

init_task.prev_run = p;

p-> prev_run = prev;

prev-> next_run = p;

}

　

static inline void move_first_runqueue (struct task_struct * p)

{

struct task_struct * next = p-> next_run;

struct task_struct * prev = p-> prev_run;

　

/ * remove from list * /

next-> prev_run = prev;

prev-> next_run = next;

/ * add back to list * /

p-> prev_run = & init_task;

next = init_task.next_run;

init_task.next_run = p;

p-> next_run = next;

next-> prev_run = p;

}

If you do n’t understand it yet, you may have to work harder on the C language and data structure. Other modules, I think, are similar, but also fix It's so simple. For example, a lot of balanced binary tree sorting, traversal, etc. are used in memory management. But the overall structure is unchanged. As long as you can pass the global, you can understand the meaning of global variables without opening the definition (in fact , Guess it is not a problem), it is not a problem to understand. At least I am confident.

I should be familiar with the basic computer software course !!

Nuclear read the diary (E)
This article comes from: http: //os.silversand.net Author: sunmoon (2001-09-01 08:05:00)
came incredibly busy, then just appreciate the work and at school really Different. Sometimes it ’s hard to do what I want to do. However, I have n’t been too lazy this time. I did a preliminary study of the 386 protection mode and memory management of Linux. When I first learned the operating system class, I always thought that the theory was useless. Nowadays, it ’s really time to know how lack of theoretical knowledge. Perhaps it ’s the book that hates it when it ’s used.

Gossip and less talk.

At present, Linux has been ported to various machines. Such as apple. But I personally think that Linux is really The charm is still on the i386 machine. Because the original intention of the predecessor llinus when writing linux is to realize the unix-like os

linux on the 386 platform using the "protected mode" of the intel 80386 series processor. The management and allocation of operating system resources . 80386 hardware realization of storage management and protection mechanisms for

virtual memory, a memory expansion design schemes. he had come from the main memory's very expensive. the program uses the principle of locality, that program is not necessary to run at full Loaded into memory. That part of the current branch to be run into memory can

in fact, the entire storage system is composed of a cache memory --- --- hard drives and other storage media consisting of multi-level, but this is transparent to the original program, For example, if we execute such a day instruction
mov bx, 1997
mov ax, [bx] in the program, the

　

address is back copied to the content of 1997, so the address generated by the program is a virtual address. This address is different from the actual physical address . To have this address translated to an actual physical address, you need to have a translation mechanism. A hardware unit usually called an MMU accomplishes this task

The so-called protection mechanism is carried out on this basis. Its purpose is to make different program segments do not interfere with each other. The system process and the user process are strictly separated to meet the requirements of system security and multi-user multi-process. In Linux, by giving Different tasks assign different mappings of virtual addresses to physical addresses. To achieve the switching and protection of different tasks. At the same time. Linux "may" is to separate the system process from the user process Controlled within 100,000? Of course, shared memory in iipv traffic may have unpredictable consequences due to improper operation.

In addition, Linux also protects unified tasks to varying degrees. It uses priority to determine. For example, the kernel The priority is 0, the system calls: 1 library: 2 user process 3. When the program reads and writes a certain data segment, the county should check the priority, before deciding the priority or access permission for its operation.

I think some association represents the scheduling priority and will struct_task priority parameters.

for memory management, there is usually a stage, p-type and p-type segment in three ways. in this Virtual messenger discussion in two ways -.. Different physical conversion mechanism is implemented because linux segment paged memory management so these two mapping mechanism, it must be present

stage management, using a series can change the size address collection management. its advantage is that you can take advantage of physical memory. the disadvantage is difficult to manage,

generally we can define a segment in c in (this definition just to explain the concept stage, linux in not so)

typedef stucrt Duan

{

struct duan * next, * pre; / * Required pointer * /

int tag;

iint begin, end / * Start and end point * /

int size;

data data; / * Content * /

......

} The

above is really the data structure of the segments that may be used in actual memory. In our protection mode, the so-called segments are protection management. In general, it is somewhat similar to the base addressing in assembly language: it is to implement virtual-physical addresses The basis of the conversion (to put it bluntly, I personally think that all segments are defined as the same size as pages, but in fact I have not seen how linux is done, so don't be misled by me)

segments have a base address (base address) of a predetermined line start address of the physical memory

has a restriction site, (limit) within a segment represented by the maximum offset (i.e. size)

segment attribute (attribute) indicates whether the segment is read

three The attribute, which is included in the segment descriptor. The

so-called descriptor. It is a storage unit of 8 subsections, and its structure is roughly as follows:

byte 0 ----- 0-7 bit description Fu

byte 1 ----- -8-15 bit descriptor

Byte 2 ----- 0-7 bit base address

Byte 3 ----- 8-15 bit base address

Byte 4 ----- 16-24 base address

word byte 5 knots ----- store permissions

byte 6 ----- G | D | 0 | 0 | 16-19 bit segment limit

byte 7 ----- 31--24 segment base

wherein The fifth byte is the access right byte, It contains several flag bits to mark whether the segment is in memory or not. The latter segment is a user segment or a system segment. The level of people is limited. I will not explain them one by one. I hope there are Interested friends can check the information, which will be listened to us all

In the system segment. There is a byte. You can define the type of the system segment. It seems that there are 16 types like 386.TSS, 386 interrupt gate, 386 trap gate, etc., which are marked as valid, which are not introduced one by one here. This is to understand the two rankings of TSS (System Status Indicator) and LDT (Local Description Indicator). In the relevant information, we often encounter

a series of description tables in the Linux kernel. Like the Global Description Table (GDT) , Interrupt Description Fu Table (IDT) and the above-mentioned LDT, etc., among them. Define the description of the system available Fu Fu, interrupt gate, etc. Its role is to make the compatibility of the machine is guaranteed

in LDT. Then define some code segments, data segments, etc. that are related to specific tasks. The internal data structure of the description of the

fu table is roughly as follows: typedef struct desc_struct

{

unsigned long a, b;

} The

description of the fu table is completed with the following two lines and an external definition defines described Fu:

desc_table [256]; // can define the maximum amount described in the local description Fu Fu table

extern dessc_table idt, gdt // external variables described

so far, the segmentation mechanism substantially about linux The last section is finished, the rest is in the deposit The mapping between the selector and the selector, as well as some addressing methods.

This part of the content is probably the same as that described in << Assembly Language >>. It is not much to say here.

Read the nuclear diary (6)
This article comes from: http: / /os.silversand.net author: sunmoon (2001-09-01 09:05:00)
we finished the segmentation mechanism. Next we need to analyze the second storage management mechanism of protection mode: paging mode.

We mentioned the turntable and control register set earlier. They include EFLAGS and ELP. And four 32-bit control registers CRO CR1CR2 CER3. One of the PEs in the CRO is used to mark whether the protection mode or the real mode is used. One PG defines whether to use paging mode (1 or 0).

When PG = 1, the system uses the paging mechanism. 80386 uses 4K pages, and the boundary of each page is surprising. That is, the starting position of each page can be divided by 4K. In this way, 4G bytes are divided into 1M pages. The paging mechanism maps linear pages to physical pages. Really played a role in conversion.

Let us look at the structure of LINUXE score page:

1. Multi-level page table structure

contains 1M pages in LINUX. Each page table occupies 4 bytes. You need to occupy 4M of continuous memory, so LINUX introduced a 2-level page table structure. The last 10 bits (22-32) in the linear address define the secondary page table.

The secondary page table has 1K bytes, and the page just exists] in a 4K page. And through the first 20 bits for indexing, so as to achieve the actual physical address.

I am not very clear about this place. This can be roughly understood.

For example: there are N linked lists. Each one is a page. But the content of the last page is a pointer to another second-level refining table (or index item)

2. Page items and page directory items

For each page. There will be a page item. Used to indicate whether the page is in use or not. Whether it is in memory, etc. And these phases will be stored as a continuous mark. To reduce the query time when using the table, etc.

And each page table, there will be 1024 page items, this is the real "page".

3. Switching from linear address to physical address
1. CR contains the starting address of the page directory, using the content of 31-22 bits in the 32-bit address as the index of the page directory entry of the page directory The starting addresses are added. Get the address of the corresponding page table
2. Remove the 32-bit page directory entry from the specified address. It mentions that the 12 bits are 0 and uses 21-12 bits in the 32-bit address as the index of the page in the page table. Multiply it by 4 and add the start address of the page table to get the 32-bit address
3. The 11-0 bit of the prize is used as the offset from the page address and added to the 32-bit page address. Form a 32-bit physical address.
　

4. Page CACHE

Of course, the system frequently accesses the secondary page table, which will cause a lot of waste of time. Therefore, the page table CACHE is introduced to save the most recently used pages or frequently used pages. Then explain in detail. Interested friends can check some basic computer teaching materials. So

far, the 836 protection mode used by Linux has basically been explained. As for control transfer and task switching. It is almost the same as general assembly programming, and my assembly level is too low. In

general, the switching of multitasking and the application of protection mode. The realization of the virtual storage system is based on the technical support of the hardware.

Personally think that Linux storage management. It is completely different on different machines. As for whether Linux provides them with a unified interface. I don't know yet. Other models can be found in the source code

reading nuclear diary (seven) --linux memory management (1)
This article comes from: http: //os.silversand.net Author: sunmoon (2001-09-01 13:05:00)
Memory management is an indispensable part of an operating system. And. A very important part. The success of Linux. It is very closely related to its excellent memory management. Because the efficiency and stability of a system ’s sexual desire is often determined by its memory management mechanism. I Many people have suffered 640k under DOS.

Earlier we introduced the 386 protection mode. From today onwards, we will analyze the virtual storage management of Linux for every programmer. They all want to have infinite and fast memory, however, at this stage it is impossible In addition, infinity and fast may contradict themselves in

order to solve infinity.Linux introduces a virtual storage system.In order to solve fast, linux introduces cache, exchange mechanism, etc., so that the storage system is close to the hard disk in terms of capacity and speed. Close to cache. (Of course, I think this is the actual purpose of the storage system).

Linux's memory management adopts a paging mechanism. It is designed for time-sharing and multitasking . Linux can process 256 tasks at the same time (this should be related to a certain Variables can't be remembered for a while). At the same time, it uses a two-level saturation mechanism to separate the kernel process and the user process.

In the 386 protected mode 0-4G linear virtual address, 3-4G is reserved for the kernel process. The 0-3G is assigned to the user process. The addressing of the kernel in the kernel space is different from the addressing of the user process in the user space. Because the kernel is loaded into memory at startup. It can be directly mapped by the address. 3G to above. For a user not allowed to get access to the kernel page table pointer by swapper_pg_div in.

Instead, the user process, in the address space of the user by the user to obtain the page directory pointer tables user page. Page by The pointer of the table directly points to the corresponding physical memory.

The implementation of Linux virtual memory requires several different mechanisms to implement:

address mapping mechanism

memory allocation and recycling

page mechanism

exchange mechanism

memory sharing

Before reading the source code in detail, let's consider how these several mechanisms are implemented based on the operating system knowledge we have learned before and the C language and other knowledge. Now design it yourself. Look at how others have implemented it. Find I ca n’t think of it. Or something that is detrimental to the efficiency space. Only in this way can I make progress. I have said more than once. A certain part of the operating system is very simple in terms of implementation. Its difficulty is how to integrate a large number of functions into one. Kernerl. The

address mapping mechanism, to put it bluntly , is a bridge between virtual memory and physical memory. What it needs to do is to pass several different tables. Convert the virtual address into a physical address, and convert the physical address into a virtual address.

We have said before. Because there are systems and users, it must also have different data structures. In order to solve problems such as speed. It will have a hardware buffer

for its data structure. We can think about it first. information virtual address, the virtual address in that area, and so

as to make page mechanism, better understanding, because linux is a page of storage, so there has to be a blank page and use the page. It is a page. There is bound to be a page overflow. The page is invalid (is it a similar error that often occurs under win98, of course, the memory management of linux cannot be the same as that of windows, but the basic reason is the same). Therefore, an error occurs on each page. Or When the page cannot store extra data, it is necessary to ask the kernel to allocate a new page

at the same time. When fork () is used to generate a new process, a new leaf needs to be allocated. This part roughly talks about how the process is inward and Describe how much you need and how many pages

we learned from << Data Structure >>. We learned a lot of memory allocation methods, such as first fit, best fit, worst fit, etc. But we can imagine. Linux probably wo n’t use them. That must be the partner system. So we can think about the basic algorithm for the allocation and recycling of the partner system. Recall. This way, when the readers part of the source code, there will be unexpected gains.

As for the exchange mechanism, we can also think about it now. There are always many pages in the memory. If these pages have all been used up. Some of the pages must be released when reallocating. Release those pages, Need to consider. Such as recently used pages. Recently used pages, etc. can be considered.

This algorithm is probably to calculate the pages used in memory, when can be replaced. To put it bluntly is to calculate one for all used pages "Right", and this "Right" determines when he is released to replace its content. What needs to be considered is for frequently used pages. You can put it in cahe. (Although this part is transparent to programmers

Yes , but we should understand his principle). The last part of shared memory, I want to learn from my beginner linux programming, the shared memory in the process communication is no different. Probably that is added to its data structure to allow different processes tag access on the line.

above, but we guess linux memory management mechanism, we need to do is read a specific source. correct incorrect guess. At the same time learning the actual ideas of others.

. We start next diary will explain each part of the realization of these

reading nuclear diary (eight) --linux memory management (2)
This article comes from: http: //os.silversand.net Author: sunmoon (2001-09- 02 07:05:00)
Address mapping mechanism The

address mapping mechanism mainly completes the association between main memory, auxiliary memory, and virtual memory, including the mapping of disk files to virtual memory and the mapping between virtual memory and memory. Virtual storage and process scheduling are consistent. Linux uses a series of data structures and a hardware cache (TLB) to implement the address mapping mechanism.

Mm_strut is used to describe the process cache.

Struct mm_struct

{

struct vm_area_struct * mmap; / * list of VMAs * /

struct vm_area_struct * mmap_avl; / * tree of VMAs * /

struct vm_area_struct * mmap_cache; / * last find_vma result * /

pgd_t * pgd;

atomic_t count;

int map_count; / * number of VMAs * /

struct semaphore mmap_sem;

spinlock_t page_table_lock;

unsigned long context;

unsigned long start_code, end_code, start_data, end_data;

unsigned long start_brk, brk, start_stack;

unsigned long arg_start, arg_end, env_start, env_end;

unsigned long rss, total_;

unsigned long def_flags;

unsigned long cpu_vm_mask;

unsigned long swap_cnt; / * number of pages to swap on next pass * /

unsigned long swap_address;

/ *

* This is an architecture-specific pointer: the portable

* part of Linux does not know about any segments.

* /

void * segments;

};

he describes the page directory of a process, context information about the process . And data. Code. The end address of the revelation of the stack. There are also the number of virtual storage acquisition. And the linked list pointer for scheduling storage. His

argument is higher. The higher level vm_area-struct is the virtual address area describing the process. Mathematical linked list. Arranged in descending order of virtual addresses. So when the kernel needs to perform a given operation on a given process page, the guest finds the item from the two-way list. In the world, it wants to deal with the page. For example. Page fault. Page change the like

his specific structure is as follows:

struct the vm_area_struct {

struct * mm_struct vm_mm; / * Parameters Area the VM * /

unsigned Long vm_start;

unsigned Long vm_end;

　

/ * linked per Task List Areas of the VM, the sorted by address * /

struct the vm_area_struct * vm_next;

　

pgprot_t vm_page_prot;

unsigned short vm_flags;

　

/ * AVL tree of VM areas per task, sorted by address * /

short vm_avl_height;

struct vm_area_struct * vm_avl_left;

struct vm_area_struct * vm_avl_right;

　

/ * For areas with inode, the list inode-> i_mmap, for shm areas,

* the list of attaches, otherwise unused.

* /

struct vm_area_struct * vm_next_share;

struct vm_area_struct vm_pprev_share;

　

struct vm_operations_struct * vm_ops;

unsigned long vm_offset;

struct file * vm_file;

unsigned long vm_pte; / * shared mem * /

);

yes A data structure described by a physical page. He is not a real physical page. It only describes the content and frame of a physical page. It makes a mark for a logical page; his logo field defines this page in progress. The operation. The chain domain defines a double necklace table. The page frame can be easily found. For the actual physical memory until convenient.

Its specific structure is as follows

typedef struct page {

/ * these must be first (free area handling) * /

struct page * next;

struct page * prev;

struct inode * inode;

unsigned long offset;

struct page * next_hash;

atomic_t count;

unsigned long flags; / * atomic flags, some possibly updated asynchronously * /

wait_queue_head_t wait;

struct page ** pprev_hash;

struct buffer_head * buffers;

int owner; / * temporary debugging check * /

} mem_map_t;

all page structures will be transferred into an array called mem_map.

When a process is running, both its code segment and data segment will be transferred into memory. If it uses a shared library. The content of the shared guest will also be carved into memory. When the process is running, the system first allocates a vm_area_struct to the process. Link these processes to the virtual memory link. This is based on the information in the executable image of the process. The data segment and the guest execution code are not allocated memory. The newly allocated memory must be linked to the existing memory of the process. It can only be applied. In this way, the page fault occurs at the party. The system uses the page request mechanism to avoid excessive use of physical memory. However, when the virtual memory accessed by the process is not in the current physical memory, the system will transfer the required pages into memory. At the same time Modify the page table of the process. Used to mark whether the virtual page is in physical memory.

Therefore, the system uses a more complex data structure to track the virtual address of the process. In the task_struct contains a pointer to the mm_struct structure. The mm_struct of the process is Contains the page directory pointer pgd of the process executable image. It also contains several pointers to vm_area_struct, each vm_area_struct contains a process Virtual address area.

A process has more than vm_area_stuct structure .linux should regularly allocation process or adjust vm_area_struct ... So look for the efficiency of vm_area_stuct For useful imaging systems. So here all the vm_area_struct formed a search efficiency than High balanced binary tree structure.

I personally think that this place is in the entire Linux kernel. The data structure is the most complicated. If this part is confirmed, the entire kernel will become clear.

written by undercoders
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 AndroBugs Framework is an efficient Android vulnerability scanner that helps developers or hackers find potential security vulnerabilities in Android applications. No need to install on Windows.
t.me/undercodeTesting


🦑Features:

> Find security vulnerabilities in an Android app

> Check if the code is missing best practices

> Check dangerous shell commands (e.g. “su”)

> Collect Information from millions of apps

> Check the app’s security protection (marked as <Hacker>, designed for app repackaging hacking)

🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ :

1) git clone https://github.com/AndroBugs/AndroBugs_Framework

2) cd AndroBugs_Framework

3) python androbugs.py -f [APK file]
####To check the usage:####

python androbugs.py -h

🦑Easy to use for Android developers or hackers on Microsoft Windows: (a) No need to install Python 2.7 (b) No need to install any 3rd-party library (c) No need to install AndroBugs Framework

>mkdir C:\AndroBugs_Framework

> cd C:\AndroBugs_Framework

> Unzip the latest Windows version of AndroBugs Framework from Windows releases

>Go to Computer->System Properties->Advanced->Environment Variables. Add "C:\AndroBugs_Framework" to the "Path" variable
androbugs.exe -h
androbugs.exe -f [APK file]

🦑 Massive Analysis Tool Steup Steps and Usage for Windows

> Complete the Steup Steps and Usage for Windows first
Install the Windows version of MongoDB (https://www.mongodb.org/downloads)

> Install PyMongo library
Config your own MongoDB settings: C:\AndroBugs_Framework\androbugs-db.cfg

> Choose your preferred MongoDB management tool (http://mongodb-tools.com/)

> AndroBugs_MassiveAnalysis.exe -h
Example: AndroBugs_MassiveAnalysis.exe -b 20151112 -t BlackHat -d .\All_Your_Apps\ -o .\Massive_Analysis_Reports
AndroBugs_ReportByVectorKey.exe -h
Example: AndroBugs_ReportByVectorKey.exe -v WEBVIEW_RCE -l Critical -b 20151112 -t BlackHat

» USE FOR LEARN ONLY !!

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁