<![CDATA[Slow.More¡ÌBLOG]]> http://520yl.blog.163.com zh-CN Thu, 3 Jul 2008 18:48:15 +0800 Thu, 3 Jul 2008 18:48:15 +0800 http://blogs.law.harvard.edu/tech/rss 120 <![CDATA[Slow.More¡ÌBLOG]]> http://520yl.blog.163.com/style/common/user_default.gif http://520yl.blog.163.com <![CDATA[ASCIIÂë¶ÔÕÕ±í]]> http://520yl.blog.163.com/blog/static/46914420085249033908

¡¡
ASCII, American Standard Code for Information Interchange ÄîÆðÀ´ÏñÊÇ "°¢Ë¹key"£¬¶¨Òå´Ó 0 µ½ 127 µÄÒ»°Ù¶þÊ®°Ë¸öÊý×ÖËù´ú±íµÄÓ¢ÎÄ×Öĸ»òÒ»ÑùµÄ½á¹ûÓëÒâÒå¡£ÓÉÓÚֻʹÓÃ7¸öλԪ(bit)¾Í¿ÉÒÔ±íʾ´Ó0µ½127µÄÊý×Ö£¬´ó²¿·ÖµÄµçÄÔ¶¼Ê¹ÓÃ8¸öλԪÀ´´æÈ¡×ÖÔª¼¯(character set)£¬ËùÒÔ´Ó128µ½255Ö®¼äµÄÊý×Ö¿ÉÒÔÓÃÀ´´ú±íÁíÒ»×éÒ»°Ù¶þÊ®°Ë¸ö·ûºÅ£¬³ÆΪ extended ASCII¡£
ASCIIÂë ¼üÅÌ ASCII Âë ¼üÅÌ ASCIIÂë ¼üÅÌ ASCII Âë ¼üÅÌ
27 ESC 32 SPACE 33 ! 34 "
35 # 36 $ 37 % 38 &
39 ' 40 ( 41 ) 42 *
43 + 44 ' 45 - 46 .
47 / 48 0 49 1 50 2
51 3 52 4 53 5 54 6
55 7 56 8 57 9 58 :
59 ; 60 < 61 = 62 >
63 ? 64 @ 65 A 66 B
67 C 68 D 69 E 70 F
71 G 72 H 73 I 74 J
75 K 76 L 77 M 78 N
79 O 80 P 81 Q 82 R
83 S 84 T 85 U 86 V
87 W 88 X 89 Y 90 Z
91 [ 92 \ 93 ] 94 ^
95 _ 96 ` 97 a 98 b
99 c 100 d 101 e 102 f
103 g 104 h 105 i 106 j
107 k 108 l 109 m 110 n
111 o 112 p 113 q 114 r
115 s 116 t 117 u 118 v
119 w 120 x 121 y 122 z
123 { 124 | 125 } 126 ~
  

¡¡¡¡Ä¿Ç°¼ÆËã»úÖÐÓõÃ×î¹ã·ºµÄ×Ö·û¼¯¼°Æä±àÂ룬ÊÇÓÉÃÀ¹ú¹ú¼Ò±ê×¼¾Ö(ANSI)Öƶ¨µÄASCIIÂ루American Standard Code for Information Interchange£¬ÃÀ¹ú±ê×¼ÐÅÏ¢½»»»Â룩£¬ËüÒѱ»¹ú¼Ê±ê×¼»¯×éÖ¯£¨ISO£©¶¨Îª¹ú¼Ê±ê×¼£¬³ÆΪISO 646±ê×¼¡£ÊÊÓÃÓÚËùÓÐÀ­¶¡ÎÄ×Ö×Öĸ£¬ASCIIÂëÓÐ7λÂëºÍ8λÂëÁ½ÖÖÐÎʽ¡£  

¡¡¡¡ÒòΪ1λ¶þ½øÖÆÊý¿ÉÒÔ±íʾ£¨21=£©2ÖÖ״̬£º0¡¢1£»¶ø2λ¶þ½øÖÆÊý¿ÉÒÔ±íʾ£¨22£©=4ÖÖ״̬£º00¡¢01¡¢10¡¢11£»ÒÀ´ÎÀàÍÆ£¬7λ¶þ½øÖÆÊý¿ÉÒÔ±íʾ£¨27=£©128ÖÖ״̬£¬Ã¿ÖÖ״̬¶¼Î¨Ò»µØ±àΪһ¸ö7λµÄ¶þ½øÖÆÂ룬¶ÔÓ¦Ò»¸ö×Ö·û£¨»ò¿ØÖÆÂ룩£¬ÕâЩÂë¿ÉÒÔÅÅÁгÉÒ»¸öÊ®½øÖÆÐòºÅ0¡«127¡£ËùÒÔ£¬7λASCIIÂëÊÇÓÃÆßλ¶þ½øÖÆÊý½øÐбàÂëµÄ£¬¿ÉÒÔ±íʾ128¸ö×Ö·û¡£  

¡¡¡¡µÚ0¡«32ºÅ¼°µÚ127ºÅ(¹²34¸ö)ÊÇ¿ØÖÆ×Ö·û»òͨѶרÓÃ×Ö·û£¬Èç¿ØÖÆ·û£ºLF£¨»»ÐУ©¡¢CR£¨»Ø³µ£©¡¢FF£¨»»Ò³£©¡¢DEL£¨É¾³ý£©¡¢BEL£¨ÕñÁ壩µÈ£»Í¨Ñ¶×¨ÓÃ×Ö·û£ºSOH£¨ÎÄÍ·£©¡¢EOT£¨ÎÄ⣩¡¢ACK£¨È·ÈÏ£©µÈ£» 

¡¡¡¡µÚ33¡«126ºÅ(¹²94¸ö)ÊÇ×Ö·û£¬ÆäÖеÚ48¡«57ºÅΪ0¡«9Ê®¸ö°¢À­²®Êý×Ö£»65¡«90ºÅΪ26¸ö´óдӢÎÄ×Öĸ£¬97¡«122ºÅΪ26¸öСдӢÎÄ×Öĸ£¬ÆäÓàΪһЩ±êµã·ûºÅ¡¢ÔËËã·ûºÅµÈ¡£  

¡¡¡¡×¢Ò⣺ÔÚ¼ÆËã»úµÄ´æ´¢µ¥ÔªÖУ¬Ò»¸öASCIIÂëÖµÕ¼Ò»¸ö×Ö½Ú(8¸ö¶þ½øÖÆλ)£¬Æä×î¸ßλ(b7)ÓÃ×÷ÆæżУÑéλ¡£ËùνÆæżУÑ飬ÊÇÖ¸ÔÚ´úÂë´«Ë͹ý³ÌÖÐÓÃÀ´¼ìÑéÊÇ·ñ³öÏÖ´íÎóµÄÒ»ÖÖ·½·¨£¬Ò»°ã·ÖÆæУÑéºÍżУÑéÁ½ÖÖ¡£ÆæУÑé¹æ¶¨£ºÕýÈ·µÄ´úÂëÒ»¸ö×Ö½ÚÖÐ1µÄ¸öÊý±ØÐëÊÇÆæÊý£¬Èô·ÇÆæÊý£¬ÔòÔÚ×î¸ßλb7Ìí1£»Å¼Ð£Ñé¹æ¶¨£ºÕýÈ·µÄ´úÂëÒ»¸ö×Ö½ÚÖÐ1µÄ¸öÊý±ØÐëÊÇżÊý£¬Èô·ÇżÊý£¬ÔòÔÚ×î¸ßλb7Ìí1¡£

¸½£º

ASCII±í

ASCIIÖµ ¿ØÖÆ×Ö·û ASCIIÖµ ¿ØÖÆ×Ö·û ASCIIÖµ ¿ØÖÆ×Ö·û ASCIIÖµ ¿ØÖÆ×Ö·û
0 NUT 32 (space) 64 @ 96 ¡¢
1 SOH 33 £¡ 65 A 97 a
2 STX 34 ¡± 66 B 98 b
3 ETX 35 # 67 C 99 c
4 EOT 36 $ 68 D 100 d
5 ENQ 37 % 69 E 101 e
6 ACK 38 & 70 F 102 f
7 BEL 39 , 71 G 103 g
8 BS 40 ( 72 H 104 h
9 HT 41 ) 73 I 105 i
10 LF 42 * 74 J 106 j
11 VT 43 + 75 K 107 k
12 FF 44 , 76 L 108 l
13 CR 45 - 77 M 109 m
14 SO 46 . 78 N 110 n
15 SI 47 / 79 O 111 o
16 DLE 48 0 80 P 112 p
17 DCI 49 1 81 Q 113 q
18 DC2 50 2 82 R 114 r
19 DC3 51 3 83 X 115 s
20 DC4 52 4 84 T 116 t
21 NAK 53 5 85 U 117 u
22 SYN 54 6 86 V 118 v
23 TB 55 7 87 W 119 w
24 CAN 56 8 88 X 120 x
25 EM 57 9 89 Y 121 y
26 SUB 58 : 90 Z 122 z
27 ESC 59 ; 91 [ 123 {
28 FS 60 < 92 \ 124 |
29 GS 61 = 93 ] 125 }
30 RS 62 > 94 ^ 126 ~
31 US 63 ? 95 ¡ª 127 DEL

 

NUL VT ´¹Ö±ÖƱí SYN ¿Õתͬ²½
SOH  ±êÌ⿪ʼ FF   ×ßÖ½¿ØÖÆ ETB  ÐÅÏ¢×é´«ËͽáÊø
STX  ÕýÎÄ¿ªÊ¼ CR   »Ø³µ CAN  ×÷·Ï
ETX  ÕýÎĽáÊø SO   ÒÆλÊä³ö EM   Ö½¾¡
EOY  ´«Êä½áÊø SI    ÒÆλÊäÈë SUB  »»ÖÃ
ENQ  ѯÎÊ×Ö·û DLE  ¿Õ¸ñ ESC  »»Âë
ACK  ³ÐÈÏ DC1  É豸¿ØÖÆ1 FS   ÎÄ×Ö·Ö¸ô·û
BEL  ±¨¾¯ DC2  É豸¿ØÖÆ2 GS   ×é·Ö¸ô·û
BS   ÍËÒ»¸ñ DC3  É豸¿ØÖÆ3 RS   ¼Ç¼·Ö¸ô·û
HT   ºáÏòÁбí DC4  É豸¿ØÖÆ4 US   µ¥Ôª·Ö¸ô·û
LF   »»ÐÐ NAK  ·ñ¶¨ DEL  ɾ³ý

 

¼üÅ̳£ÓÃASCIIÂë
ESC¼ü VK_ESCAPE (27)

»Ø³µ¼ü£º VK_RETURN (13)

TAB¼ü£º VK_TAB (9)

Caps Lock¼ü£º VK_CAPITAL (20)

Shift¼ü£º VK_SHIFT ($10)

Ctrl¼ü£º VK_CONTROL (17)

Alt¼ü£º VK_MENU (18)

¿Õ¸ñ¼ü£º VK_SPACE ($20/32)

Í˸ñ¼ü£º VK_BACK (8)

×ó»Õ±ê¼ü£º VK_LWIN (91)

ÓÒ»Õ±ê¼ü£º VK_LWIN (92)

Êó±êÓÒ¼ü¿ì½Ý¼ü£ºVK_APPS (93)

Insert¼ü£º VK_INSERT (45)

Home¼ü£º VK_HOME (36)

Page Up£º VK_PRIOR (33)

PageDown£º VK_NEXT (34)

End¼ü£º VK_END (35)

Delete¼ü£º VK_DELETE (46)

·½Ïò¼ü(¡û)£º VK_LEFT (37)

·½Ïò¼ü(¡ü)£º VK_UP (38)

·½Ïò¼ü(¡ú)£º VK_RIGHT (39)

·½Ïò¼ü(¡ý)£º VK_DOWN (40)

F1¼ü£º VK_F1 (112)

F2¼ü£º VK_F2 (113)

F3¼ü£º VK_F3 (114)

F4¼ü£º VK_F4 (115)

F5¼ü£º VK_F5 (116)

F6¼ü£º VK_F6 (117)

F7¼ü£º VK_F7 (118)

F8¼ü£º VK_F8 (119)

F9¼ü£º VK_F9 (120)

F10¼ü£º VK_F10 (121)

F11¼ü£º VK_F11 (122)

F12¼ü£º VK_F12 (123)

Num Lock¼ü£º VK_NUMLOCK (144)

С¼üÅÌ0£º VK_NUMPAD0 (96)

С¼üÅÌ1£º VK_NUMPAD0 (97)

С¼üÅÌ2£º VK_NUMPAD0 (98)

С¼üÅÌ3£º VK_NUMPAD0 (99)

С¼üÅÌ4£º VK_NUMPAD0 (100)

С¼üÅÌ5£º VK_NUMPAD0 (101)

С¼üÅÌ6£º VK_NUMPAD0 (102)

С¼üÅÌ7£º VK_NUMPAD0 (103)

С¼üÅÌ8£º VK_NUMPAD0 (104)

С¼üÅÌ9£º VK_NUMPAD0 (105)

С¼üÅÌ.£º VK_DECIMAL (110)

С¼üÅÌ*£º VK_MULTIPLY (106)

С¼üÅÌ+£º VK_MULTIPLY (107)

С¼üÅÌ-£º VK_SUBTRACT (109)

С¼üÅÌ/£º VK_DIVIDE (111)

Pause Break¼ü£º VK_PAUSE (19)

Scroll Lock¼ü£º VK_SCROLL (145)

]]> http://520yl.blog.163.com/blog/static/46914420085249033908 1 http://520yl.blog.163.com/blog/static/46914420085249033908 Tue, 24 Jun 2008 21:00:33 +0800 2008-06-24T21:00:33+08:00 <![CDATA[windowsÊý¾ÝÀàÐÍ]]> http://520yl.blog.163.com/blog/static/46914420085241617789

À´Ô´msdn

Windows Data Types

The data types supported by Microsoft® Windows® are used to define function return values, function and message parameters, and structure members. They define the size and meaning of these elements. For more information about the underlying C/C++ data types, see Data Type Ranges.

The following table contains the following types: character, integer, Boolean, pointer, and handle. The character, integer, and Boolean types are common to most C compilers. Most of the pointer-type names begin with a prefix of P or LP. Handles refer to a resource that has been loaded into memory.

For more information about handling 64-bit integers, see Large Integers.

Type Description
ATOM Atom. For more information, see Atoms.

This type is declared in WinDef.h as follows:

typedef WORD ATOM;
BOOL Boolean variable (should be TRUE or FALSE).

This type is declared in WinDef.h as follows:

typedef int BOOL;
BOOLEAN Boolean variable (should be TRUE or FALSE).

This type is declared in WinNT.h as follows:

typedef BYTE BOOLEAN;
BYTE Byte (8 bits).

This type is declared in WinDef.h as follows:

typedef unsigned char BYTE;
CALLBACK Calling convention for callback functions.

This type is declared in WinDef.h as follows:

#define CALLBACK __stdcall
CHAR 8-bit Windows (ANSI) character. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef char CHAR;
COLORREF Red, green, blue (RGB) color value (32 bits). See COLORREF for information on this type.

This type is declared in WinDef.h as follows:

typedef DWORD COLORREF;
CONST Variable whose value is to remain constant during execution.

This type is declared in WinDef.h as follows:

#define CONST const
DWORD 32-bit unsigned integer.

This type is declared in WinDef.h as follows:

typedef unsigned long DWORD;
DWORDLONG 64-bit unsigned integer.

This type is declared in WinNT.h as follows:

typedef ULONGLONG DWORDLONG;
DWORD_PTR Unsigned long type for pointer precision. Use when casting a pointer to a long type to perform pointer arithmetic. (Also commonly used for general 32-bit parameters that have been extended to 64 bits in 64-bit Windows. )

This type is declared in BaseTsd.h as follows:

typedef ULONG_PTR DWORD_PTR;
DWORD32 32-bit unsigned integer.

This type is declared in BaseTsd.h as follows:

typedef unsigned int DWORD32;
DWORD64 64-bit unsigned integer.

This type is declared in BaseTsd.h as follows:

typedef unsigned __int64 DWORD64;
FLOAT Floating-point variable.

This type is declared in WinDef.h as follows:

typedef float FLOAT;
HACCEL Handle to an accelerator table.

This type is declared in WinDef.h as follows:

typedef HANDLE HACCEL;
HALF_PTR Half the size of a pointer. Use within a structure that contains a pointer and two small fields.

This type is declared in Basetsd.h as follows:

#ifdef _WIN64
 typedef int HALF_PTR;
#else
 typedef short HALF_PTR;
#endif
HANDLE Handle to an object.

This type is declared in WinNT.h as follows:

typedef PVOID HANDLE;
HBITMAP Handle to a bitmap.

This type is declared in WinDef.h as follows:

typedef HANDLE HBITMAP;
HBRUSH Handle to a brush.

This type is declared in WinDef.h as follows:

typedef HANDLE HBRUSH;
HCOLORSPACE Handle to a color space.

This type is declared in WinDef.h as follows:

#if(WINVER >= 0x0400)
 typedef HANDLE HCOLORSPACE;
#endif
HCONV Handle to a dynamic data exchange (DDE) conversation.

This type is declared in Ddeml.h as follows:

typedef HANDLE HCONV;
HCONVLIST Handle to a DDE conversation list.

This type is declared in Ddeml.h as follows:

typedef HANDLE HCONVLIST;
HCURSOR Handle to a cursor.

This type is declared in WinDef.h as follows:

typedef HICON HCURSOR;
HDC Handle to a device context (DC).

This type is declared in WinDef.h as follows:

typedef HANDLE HDC;
HDDEDATA Handle to DDE data.

This type is declared in Ddeml.h as follows:

typedef HANDLE HDDEDATA;
HDESK Handle to a desktop.

This type is declared in WinDef.h as follows:

typedef HANDLE HDESK;
HDROP Handle to an internal drop structure.

This type is declared in ShellApi.h as follows:

typedef HANDLE HDROP;
HDWP Handle to a deferred window position structure.

This type is declared in WinUser.h as follows:

typedef HANDLE HDWP;
HENHMETAFILE Handle to an enhanced metafile.

This type is declared in WinDef.h as follows:

typedef HANDLE HENHMETAFILE;
HFILE Handle to a file opened by OpenFile, not CreateFile.

This type is declared in WinDef.h as follows:

typedef int HFILE;
HFONT Handle to a font.

This type is declared in WinDef.h as follows:

typedef HANDLE HFONT;
HGDIOBJ Handle to a GDI object.

This type is declared in WinDef.h as follows:

typedef HANDLE HGDIOBJ;
HGLOBAL Handle to a global memory block.

This type is declared in WinDef.h as follows:

typedef HANDLE HGLOBAL;
HHOOK Handle to a hook.

This type is declared in WinDef.h as follows:

typedef HANDLE HHOOK;
HICON Handle to an icon.

This type is declared in WinDef.h as follows:

typedef HANDLE HICON;
HINSTANCE Handle to an instance.

This type is declared in WinDef.h as follows:

typedef HANDLE HINSTANCE;
HKEY Handle to a registry key.

This type is declared in WinDef.h as follows:

typedef HANDLE HKEY;
HKL Input locale identifier.

This type is declared in WinDef.h as follows:

typedef HANDLE HKL;
HLOCAL Handle to a local memory block.

This type is declared in WinDef.h as follows:

typedef HANDLE HLOCAL;
HMENU Handle to a menu.

This type is declared in WinDef.h as follows:

typedef HANDLE HMENU;
HMETAFILE Handle to a metafile.

This type is declared in WinDef.h as follows:

typedef HANDLE HMETAFILE;
HMODULE Handle to a module. The value is the base address of the module.

This type is declared in WinDef.h as follows:

typedef HINSTANCE HMODULE;
HMONITOR Handle to a display monitor.

This type is declared in WinDef.h as follows:

if(WINVER >= 0x0500) typedef HANDLE HMONITOR;
HPALETTE Handle to a palette.

This type is declared in WinDef.h as follows:

typedef HANDLE HPALETTE;
HPEN Handle to a pen.

This type is declared in WinDef.h as follows:

typedef HANDLE HPEN;
HRESULT Return code used by interfaces. It is zero upon success and nonzero to represent an error code or status information.

This type is declared in WinNT.h as follows:

typedef LONG HRESULT;
HRGN Handle to a region.

This type is declared in WinDef.h as follows:

typedef HANDLE HRGN;
HRSRC Handle to a resource.

This type is declared in WinDef.h as follows:

typedef HANDLE HRSRC;
HSZ Handle to a DDE string.

This type is declared in Ddeml.h as follows:

typedef HANDLE HSZ;
HWINSTA Handle to a window station.

This type is declared in WinDef.h as follows:

typedef HANDLE WINSTA;
HWND Handle to a window.

This type is declared in WinDef.h as follows:

typedef HANDLE HWND;
INT 32-bit signed integer.

This type is declared in WinDef.h as follows:

typedef int INT;
INT_PTR Signed integer type for pointer precision. Use when casting a pointer to an integer to perform pointer arithmetic.

This type is declared in BaseTsd.h as follows:

#if defined(_WIN64) 
 typedef __int64 INT_PTR; 
#else 
 typedef int INT_PTR;
#endif
INT32 32-bit signed integer.

This type is declared in BaseTsd.h as follows:

typedef signed int INT32;
INT64 64-bit signed integer.

This type is declared in BaseTsd.h as follows:

typedef signed __int64 INT64;
LANGID Language identifier. For more information, see Locales.

This type is declared in WinNT.h as follows:

typedef WORD LANGID;
LCID Locale identifier. For more information, see Locales.

This type is declared in WinNT.h as follows:

typedef DWORD LCID;
LCTYPE Locale information type. For a list, see Locale and Language Information.

This type is declared in WinNls.h as follows:

typedef DWORD LCTYPE;
LGRPID Language group identifier. For a list, see EnumLanguageGroupLocales.

This type is declared in WinNls.h as follows:

typedef DWORD LGRPID;
LONG 32-bit signed integer.

This type is declared in WinNT.h as follows:

typedef long LONG;
LONGLONG 64-bit signed integer.

This type is declared in WinNT.h as follows:

#if !defined(_M_IX86)
 typedef __int64 LONGLONG; 
#else
 typedef double LONGLONG;
#endif
LONG_PTR Signed long type for pointer precision. Use when casting a pointer to a long to perform pointer arithmetic.

This type is declared in BaseTsd.h as follows:

#if defined(_WIN64)
 typedef __int64 LONG_PTR; 
#else
 typedef long LONG_PTR;
#endif
LONG32 32-bit signed integer.

This type is declared in BaseTsd.h as follows:

typedef signed int LONG32;
LONG64 64-bit signed integer.

This type is declared in BaseTsd.h as follows:

typedef __int64 LONG64;
LPARAM Message parameter.

This type is declared in WinDef.h as follows:

typedef LONG_PTR LPARAM;
LPBOOL Pointer to a BOOL.

This type is declared in WinDef.h as follows:

typedef BOOL far *LPBOOL;
LPBYTE Pointer to a BYTE.

This type is declared in WinDef.h as follows:

typedef BYTE far *LPBYTE;
LPCOLORREF Pointer to a COLORREF value.

This type is declared in WinDef.h as follows:

typedef DWORD *LPCOLORREF;
LPCSTR Pointer to a constant null-terminated string of 8-bit Windows (ANSI) characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef __nullterminated CONST CHAR *LPCSTR;
LPCTSTR An LPCWSTR if UNICODE is defined, an LPCSTR otherwise.

This type is declared in WinNT.h as follows:

#ifdef UNICODE
 typedef LPCWSTR LPCTSTR; 
#else
 typedef LPCSTR LPCTSTR;
#endif
LPCVOID Pointer to a constant of any type.

This type is declared in WinDef.h as follows:

typedef CONST void *LPCVOID;
LPCWSTR Pointer to a constant null-terminated string of 16-bit Unicode characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef CONST WCHAR *LPCWSTR;
LPDWORD Pointer to a DWORD.

This type is declared in WinDef.h as follows:

typedef DWORD *LPDWORD;
LPHANDLE Pointer to a HANDLE.

This type is declared in WinDef.h as follows:

typedef HANDLE *LPHANDLE;
LPINT Pointer to an INT.

This type is declared in WinDef.h as follows:

typedef int *LPINT;
LPLONG Pointer to a LONG.

This type is declared in WinDef.h as follows:

typedef long *LPLONG;
LPSTR Pointer to a null-terminated string of 8-bit Windows (ANSI) characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef CHAR *LPSTR;
LPTSTR An LPWSTR if UNICODE is defined, an LPSTR otherwise.

This type is declared in WinNT.h as follows:

#ifdef UNICODE
 typedef LPWSTR LPTSTR;
#else
 typedef LPSTR LPTSTR;
#endif
LPVOID Pointer to any type.

This type is declared in WinDef.h as follows:

typedef void *LPVOID;
LPWORD Pointer to a WORD.

This type is declared in WinDef.h as follows:

typedef WORD *LPWORD;
LPWSTR Pointer to a null-terminated string of 16-bit Unicode characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef WCHAR *LPWSTR;
LRESULT Signed result of message processing.

This type is declared in WinDef.h as follows:

typedef LONG_PTR LRESULT;
PBOOL Pointer to a BOOL.

This type is declared in WinDef.h as follows:

typedef BOOL *PBOOL;
PBOOLEAN Pointer to a BOOL.

This type is declared in WinNT.h as follows:

typedef BOOLEAN *PBOOLEAN;
PBYTE Pointer to a BYTE.

This type is declared in WinDef.h as follows:

typedef BYTE *PBYTE;
PCHAR Pointer to a CHAR.

This type is declared in WinNT.h as follows:

typedef CHAR *PCHAR;
PCSTR Pointer to a constant null-terminated string of 8-bit Windows (ANSI) characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef CONST CHAR *PCSTR;
PCTSTR A PCWSTR if UNICODE is defined, a PCSTR otherwise.

This type is declared in WinNT.h as follows:

#ifdef UNICODE
 typedef LPCWSTR PCTSTR;
#else
 typedef LPCSTR PCTSTR;
#endif
PCWSTR Pointer to a constant null-terminated string of 16-bit Unicode characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef CONST WCHAR *PCWSTR;
PDWORD Pointer to a DWORD.

This type is declared in WinDef.h as follows:

typedef DWORD *PDWORD;
PDWORDLONG Pointer to a DWORDLONG.

This type is declared in WinNT.h as follows:

typedef DWORDLONG *PDWORDLONG;
PDWORD_PTR Pointer to a DWORD_PTR.

This type is declared in BaseTsd.h as follows:

typedef DWORD_PTR *PDWORD_PTR;
PDWORD32 Pointer to a DWORD32.

This type is declared in BaseTsd.h as follows:

typedef DWORD32 *PDWORD32;
PDWORD64 Pointer to a DWORD64.

This type is declared in BaseTsd.h as follows:

typedef DWORD64 *PDWORD64;
PFLOAT Pointer to a FLOAT.

This type is declared in WinDef.h as follows:

typedef FLOAT *PFLOAT;
PHALF_PTR Pointer to a HALF_PTR.

This type is declared in Basetsd.h as follows:

#ifdef _WIN64
 typedef HALF_PTR *PHALF_PTR;
#else
 typedef HALF_PTR *PHALF_PTR;
#endif
PHANDLE Pointer to a HANDLE.

This type is declared in WinNT.h as follows:

typedef HANDLE *PHANDLE;
PHKEY Pointer to an HKEY.

This type is declared in WinDef.h as follows:

typedef HKEY *PHKEY;
PINT Pointer to an INT.

This type is declared in WinDef.h as follows:

typedef int *PINT;
PINT_PTR Pointer to an INT_PTR.

This type is declared in BaseTsd.h as follows:

typedef INT_PTR *PINT_PTR;
PINT32 Pointer to an INT32.

This type is declared in BaseTsd.h as follows:

typedef INT32 *PINT32;
PINT64 Pointer to an INT64.

This type is declared in BaseTsd.h as follows:

typedef INT64 *PINT64;
PLCID Pointer to an LCID.

This type is declared in WinNT.h as follows:

typedef PDWORD PLCID;
PLONG Pointer to a LONG.

This type is declared in WinNT.h as follows:

typedef LONG *PLONG;
PLONGLONG Pointer to a LONGLONG.

This type is declared in WinNT.h as follows:

typedef LONGLONG *PLONGLONG;
PLONG_PTR Pointer to a LONG_PTR.

This type is declared in BaseTsd.h as follows:

typedef LONG_PTR *PLONG_PTR;
PLONG32 Pointer to a LONG32.

This type is declared in BaseTsd.h as follows:

typedef LONG32 *PLONG32;
PLONG64 Pointer to a LONG64.

This type is declared in BaseTsd.h as follows:

typedef LONG64 *PLONG64;
POINTER_32 32-bit pointer. On a 32-bit system, this is a native pointer. On a 64-bit system, this is a truncated 64-bit pointer.

This type is declared in BaseTsd.h as follows:

#if defined(_WIN64)
#define POINTER_32 __ptr32
#else
#define POINTER32
#endif
POINTER_64 64-bit pointer. On a 64-bit system, this is a native pointer. On a 32-bit system, this is a sign-extended 32-bit pointer.

Note that it is not safe to assume the state of the high pointer bit.

This type is declared in BaseTsd.h as follows:

#define POINTER_64 __ptr64
POINTER_SIGNED A signed pointer.

This type is declared in BaseTsd.h as follows:

#define POINTER_SIGNED __sptr
POINTER_UNSIGNED An unsigned pointer.

This type is declared in BaseTsd.h as follows:

#define POINTER_UNSIGNED __uptr
PSHORT Pointer to a SHORT.

This type is declared in WinNT.h as follows:

typedef SHORT *PSHORT;
PSIZE_T Pointer to a SIZE_T.

This type is declared in BaseTsd.h as follows:

typedef SIZE_T *PSIZE_T;
PSSIZE_T Pointer to a SSIZE_T.

This type is declared in BaseTsd.h as follows:

typedef SSIZE_T *PSSIZE_T;
PSTR Pointer to a null-terminated string of 8-bit Windows (ANSI) characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef CHAR *PSTR;
PTBYTE Pointer to a TBYTE.

This type is declared in WinNT.h as follows:

typedef TBYTE *PTBYTE;
PTCHAR Pointer to a TCHAR.

This type is declared in WinNT.h as follows:

typedef TCHAR *PTCHAR;
PTSTR A PWSTR if UNICODE is defined, a PSTR otherwise.

This type is declared in WinNT.h as follows:

#ifdef UNICODE
 typedef LPWSTR PTSTR;
#else typedef LPSTR PTSTR;
#endif
PUCHAR Pointer to a UCHAR.

This type is declared in WinDef.h as follows:

typedef UCHAR *PUCHAR;
PUHALF_PTR Pointer to a UHALF_PTR.

This type is declared in Basetsd.h as follows:

#ifdef _WIN64
 typedef UHALF_PTR *PUHALF_PTR;
#else
 typedef UHALF_PTR *PUHALF_PTR;
#endif
PUINT Pointer to a UINT.

This type is declared in WinDef.h as follows:

typedef UINT *PUINT;
PUINT_PTR Pointer to a UINT_PTR.

This type is declared in BaseTsd.h as follows:

typedef UINT_PTR *PUINT_PTR;
PUINT32 Pointer to a UINT32.

This type is declared in BaseTsd.h as follows:

typedef UINT32 *PUINT32;
PUINT64 Pointer to a UINT64.

This type is declared in BaseTsd.h as follows:

typedef UINT64 *PUINT64;
PULONG Pointer to a ULONG.

This type is declared in WinDef.h as follows:

typedef ULONG *PULONG;
PULONGLONG Pointer to a ULONGLONG.

This type is declared in WinDef.h as follows:

typedef ULONGLONG *PULONGLONG;
PULONG_PTR Pointer to a ULONG_PTR.

This type is declared in BaseTsd.h as follows:

typedef ULONG_PTR *PULONG_PTR;
PULONG32 Pointer to a ULONG32.

This type is declared in BaseTsd.h as follows:

typedef ULONG32 *PULONG32;
PULONG64 Pointer to a ULONG64.

This type is declared in BaseTsd.h as follows:

typedef ULONG64 *PULONG64;
PUSHORT Pointer to a USHORT.

This type is declared in WinDef.h as follows:

typedef USHORT *PUSHORT;
PVOID Pointer to any type.

This type is declared in WinNT.h as follows:

typedef void *PVOID;
PWCHAR Pointer to a WCHAR.

This type is declared in WinNT.h as follows:

typedef WCHAR *PWCHAR;
PWORD Pointer to a WORD.

This type is declared in WinDef.h as follows:

typedef WORD *PWORD;
PWSTR Pointer to a null- terminated string of 16-bit Unicode characters. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef WCHAR *PWSTR;
SC_HANDLE Handle to a service control manager database. For more information, see SCM Handles.

This type is declared in WinSvc.h as follows:

typedef HANDLE SC_HANDLE;
SC_LOCK Lock to a service control manager database. For more information, see SCM Handles.

This type is declared in WinSvc.h as follows:

typedef LPVOID SC_LOCK;
SERVICE_STATUS_HANDLE Handle to a service status value. For more information, see SCM Handles.

This type is declared in WinSvc.h as follows:

typedef HANDLE SERVICE_STATUS_HANDLE;
SHORT Short integer (16 bits).

This type is declared in WinNT.h as follows:

typedef short SHORT;
SIZE_T The maximum number of bytes to which a pointer can point. Use for a count that must span the full range of a pointer.

This type is declared in BaseTsd.h as follows:

typedef ULONG_PTR SIZE_T;
SSIZE_T Signed SIZE_T.

This type is declared in BaseTsd.h as follows:

typedef LONG_PTR SSIZE_T;
TBYTE A WCHAR if UNICODE is defined, a CHAR otherwise.

This type is declared in WinNT.h as follows:

#ifdef UNICODE
 typedef WCHAR TBYTE;
#else
 typedef unsigned char TBYTE;
#endif
TCHAR A WCHAR if UNICODE is defined, a CHAR otherwise.

This type is declared in WinNT.h as follows:

#ifdef UNICODE
 typedef WCHAR TCHAR;
#else
 typedef char TCHAR;
#endif
UCHAR Unsigned CHAR.

This type is declared in WinDef.h as follows:

typedef unsigned char UCHAR;
UHALF_PTR Unsigned HALF_PTR. Use within a structure that contains a pointer and two small fields.

This type is declared in Basetsd.h as follows:

#ifdef _WIN64
 typedef unsigned int UHALF_PTR;
#else
 typedef unsigned short UHALF_PTR;
#endif
UINT Unsigned INT.

This type is declared in WinDef.h as follows:

typedef unsigned int UINT;
UINT_PTR Unsigned INT_PTR.

This type is declared in BaseTsd.h as follows:

#if defined(_WIN64)
 typedef unsigned __int64 UINT_PTR;
#else
 typedef unsigned int UINT_PTR;
#endif
UINT32 Unsigned INT32.

This type is declared in BaseTsd.h as follows:

typedef unsigned int UINT32;
UINT64 Unsigned INT64.

This type is declared in BaseTsd.h as follows:

typedef usigned __int 64 UINT64;
ULONG Unsigned LONG.

This type is declared in WinDef.h as follows:

typedef unsigned long ULONG;
ULONGLONG 64-bit unsigned integer.

This type is declared in WinNT.h as follows:

#if !defined(_M_IX86)
 typedef unsigned __int64 ULONGLONG;
#else
 typedef double ULONGLONG
#endif
ULONG_PTR Unsigned LONG_PTR.

This type is declared in BaseTsd.h as follows:

#if defined(_WIN64)
 typedef unsigned __int64 ULONG_PTR;
#else
 typedef unsigned long ULONG_PTR;
#endif
ULONG32 Unsigned LONG32.

This type is declared in BaseTsd.h as follows:

typedef unsigned int ULONG32;
ULONG64 Unsigned LONG64.

This type is declared in BaseTsd.h as follows:

typedef unsigned __int64 ULONG64;
USHORT Unsigned SHORT.

This type is declared in WinDef.h as follows:

typedef unsigned short USHORT;
USN Update sequence number (USN).

This type is declared in WinNT.h as follows:

typedef LONGLONG USN;
VOID Any type.

This type is declared in WinNT.h as follows:

#define VOID void
WCHAR 16-bit Unicode character. For more information, see Character Sets Used By Fonts.

This type is declared in WinNT.h as follows:

typedef wchar_t WCHAR;
WINAPI Calling convention for system functions.

This type is declared in WinDef.h as follows:

#define WINAPI __stdcall
WORD 16-bit unsigned integer.

This type is declared in WinDef.h as follows:

typedef unsigned short WORD;
WPARAM Message parameter.

This type is declared in WinDef.h as follows:

typedef UINT_PTR WPARAM;

 

]]> http://520yl.blog.163.com/blog/static/46914420085241617789 0 http://520yl.blog.163.com/blog/static/46914420085241617789 Tue, 24 Jun 2008 13:06:17 +0800 2008-06-24T13:06:53+08:00 <![CDATA[windowsÏûÏ¢]]> http://520yl.blog.163.com/blog/static/46914420085241213872

À´Ô´msdn

System-Defined Messages

The system sends or posts a system-defined message when it communicates with an application. It uses these messages to control the operations of applications and to provide input and other information for applications to process. An application can also send or post system-defined messages. Applications generally use these messages to control the operation of control windows created by using preregistered window classes.

Each system-defined message has a unique message identifier and a corresponding symbolic constant (defined in the software development kit (SDK) header files) that states the purpose of the message. For example, the WM_PAINT constant requests that a window paint its contents.

Symbolic constants specify the category to which system-defined messages belong. The prefix of the constant identifies the type of window that can interpret and process the message. Following are the prefixes and their related message categories.
Prefix Message category
ABM Application desktop toolbar
BM Button control
CB Combo box control
CBEM Extended combo box control
CDM Common dialog box
DBT Device
DL Drag list box
DM Default push button control
DTM Date and time picker control
EM Edit control
HDM Header control
HKM Hot key control
IPM IP address control
LB List box control
LVM List view control
MCM Month calendar control
PBM Progress bar
PGM Pager control
PSM Property sheet
RB Rebar control
SB Status bar window
SBM Scroll bar control
STM Static control
TB Toolbar
TBM Trackbar
TCM Tab control
TTM Tooltip control
TVM Tree-view control
UDM Up-down control
WM General window

General window messages cover a wide range of information and requests, including messages for mouse and keyboard input, menu and dialog box input, window creation and management, and Dynamic Data Exchange (DDE).

Application-Defined Messages

An application can create messages to be used by its own windows or to communicate with windows in other processes. If an application creates its own messages, the window procedure that receives them must interpret the messages and provide appropriate processing.

Message-identifier values are used as follows:

  • The system reserves message-identifier values in the range 0x0000 through 0x03FF (the value of WM_USER ¨C 1) for system-defined messages. Applications cannot use these values for private messages.
  • Values in the range 0x0400 (the value of WM_USER) through 0x7FFF are available for message identifiers for private window classes.
  • If your application is marked version 4.0, you can use message-identifier values in the range 0x8000 (WM_APP) through 0xBFFF for private messages.
  • The system returns a message identifier in the range 0xC000 through 0xFFFF when an application calls the RegisterWindowMessage function to register a message. The message identifier returned by this function is guaranteed to be unique throughout the system. Use of this function prevents conflicts that can arise if other applications use the same message identifier for different purposes.
]]> http://520yl.blog.163.com/blog/static/46914420085241213872 0 http://520yl.blog.163.com/blog/static/46914420085241213872 Tue, 24 Jun 2008 13:02:13 +0800 2008-06-24T13:07:23+08:00 <![CDATA[ÀûÓÃFS¼Ä´æÆ÷»ñÈ¡KERNEL32.DLL»ùÖ·Ëã·¨µÄÖ¤Ã÷]]> http://520yl.blog.163.com/blog/static/46914420085209258829

FS¼Ä´æÆ÷Ö¸Ïòµ±Ç°»î¶¯Ï̵߳ÄTEB½á¹¹£¨Ï߳̽ṹ£©

Æ«ÒÆ  ˵Ã÷

000  Ö¸ÏòSEHÁ´Ö¸Õë

004  Ï̶߳ÑÕ»¶¥²¿

008  Ï̶߳ÑÕ»µ×²¿

00C  SubSystemTib

010  FiberData

014  ArbitraryUserPointer

018  FS¶Î¼Ä´æÆ÷ÔÚÄÚ´æÖеľµÏñµØÖ·

020  ½ø³ÌPID

024  Ïß³ÌID

02C  Ö¸ÏòÏֲ߳̾¿´æ´¢Ö¸Õë

030  PEB½á¹¹µØÖ·£¨½ø³Ì½á¹¹£©

034  Éϸö´íÎóºÅ

 

ÔÚshellcodeÖÐÓÃËüÀ´ÕÒKERNEL32.DLL»ùµØÖ·Êdz£¼ûµÄËã·¨ÁË£¬¾­µäµÄÈýÖÖËã·¨¶¼Óõ½ÁËFS¼Ä´æÆ÷£¡ËýÃÇÊÇ£º

1.       ͨ¹ýPEB(FS:[30])»ñÈ¡KERNEL32.DLL»ùµØÖ·

2.       ͨ¹ýTEB(FS:[18])»ñÈ¡KERNEL32.DLL»ùµØÖ·

3.       ͨ¹ýSEH(FS:[00])»ñÈ¡KERNEL32.DLL»ùµØÖ·

ÏÂÃæ·Ö±ðÖ¤Ã÷Ö®¡£

 

ÃüÌâÒ»£ºÍ¨¹ýPEB(FS:[30])»ñÈ¡KERNEL32.DLL»ùµØÖ·

Ëã·¨ÃèÊö£º

mov eax,fs:[30h]     ;µÃµ½PEB½á¹¹µØÖ·

mov eax,[eax + 0ch]  ;µÃµ½PEB_LDR_DATA½á¹¹µØÖ·

mov esi,[eax + 1ch]  

lodsd  ; µÃµ½KERNEL32.DLLËùÔÚLDR_MODULE½á¹¹µÄ

; InInitializationOrderModuleListµØÖ·

mov edx,[eax + 8h]   ;µÃµ½BaseAddress£¬¼ÈKernel32.dll»ùÖ·

 

Ö¤Ã÷£º

1.       Ëæ±ãopenÒ»¸öexe£¬ÄÚ´æÖеÄKERNEL32.DLL»ùµØÖ·ÊDz»±äµÄ£»

 

2.       »ñÈ¡PEB»ùµØÖ·£¬

0:000> dd fs:30 L1

003b:00000030  7ffd6000

¿´µ½ÁË£¬7ffd6000

3.       »ñÈ¡PEB_LDR_DATA½á¹¹µØÖ·7ffd6000+0c

pebµÄ½á¹¹¶¨Ò壺

ntdll!_PEB

   +0x000 InheritedAddressSpace : UChar

   +0x001 ReadImageFileExecOptions : UChar

   +0x002 BeingDebugged    : UChar

   +0x003 SpareBool        : UChar

   +0x004 Mutant           : Ptr32 Void

   +0x008 ImageBaseAddress : Ptr32 Void

   +0x00c Ldr              : Ptr32 _PEB_LDR_DATA

   +0x010 ProcessParameters : Ptr32 _RTL_USER_PROCESS_PARAMETERS

   +0x014 SubSystemData    : Ptr32 Void

   +0x018 ProcessHeap      : Ptr32 Void

   +0x01c FastPebLock      : Ptr32 _RTL_CRITICAL_SECTION

......

0:000>  dd 7ffd6000+0c L1

7ffd600c  00181ea0

PEB_LDR_DATA-> 00181ea0

4.       »ñÈ¡InInitializationOrderModuleListµÄµØÖ·

˵һÏÂÕâ¸öPEB_LDR_DATA£¬ËýÊÇntdll.dllÖеÄu

 

ndocumented

µÄÒ»¸ö½á¹¹£¬PEB_LDR_DATAµÄ½á¹¹¶¨Ò壺

0:000> dt _PEB_LDR_DATA

   +0x000 Length           : Uint4B

   +0x004 Initialized      : UChar

   +0x008 SsHandle         : Ptr32 Void

   +0x00c InLoadOrderModuleList : _LIST_ENTRY

   +0x014 InMemoryOrderModuleList : _LIST_ENTRY

   +0x01c InInitializationOrderModuleList : _LIST_ENTRY

   +0x024 EntryInProgress  : Ptr32 Void

0:000> dd 00181ea0+1c L1

00181ebc  00181f58

InInitializationOrderModuleList->00181f58

5.       »ñÈ¡kernel32µÄ»ùµØÖ·

0:000> dd 00181f58+8 L1

00181f60  7c920000

7c920000¾ÍÊÇÁË£¿

checkһϣº

0:000> dd kernel32 L1

7c800000  00905a4d

°¡£¡¾¹È»²»ÊÇ°¡£¬7c920000ÊÇntdll.dllµÄ£¬¹þ¹þ¡£

 

²»¹ý£¬Ëã·¨ÃüÌâÈÔÈ»ÊÇÕýÈ·µÄ¡£ÒòΪÔÚshellcodeÖÐÄ£¿éÁбíµÄµÚÒ»¸ö¾ÍÊÇkernel32ÁË£¬µ±È»¿ÉÒÔͨ¹ý¾µÏñÃû³ÆÀ´checkµÄ£¬²»¹ýshellcodeµÄ¿Õ¼ä²»ÔÊÐíµÄ£¬Õâ¾ÍÊÇshellcodeµÄÒÕÊõÁË¡£ÎÒÓÃÀ´²âÊÔµÄexeÇ¡ºÃÏȼÓÔØÁËntdll.dll¡£

 

ÃüÌâ¶þ£ºÍ¨¹ýTEB(FS:[18])»ñÈ¡KERNEL32.DLL»ùµØÖ·

Ëã·¨ÃèÊö£º

±¾µØÏ̵߳ÄÕ»ÀïÆ«ÒÆ18HµÄÖ¸ÕëÖ¸Ïòkernel32.dllÄÚ²¿£¬¶øfs :[ 0x18 ] Ö¸Ïòµ±Ç°Ï̶߳øÇÒÍùÀïËĸö×Ö½ÚÖ¸ÏòÏß³ÌÕ»£¬½áºÏÕ»¶¥Ö¸Õë½øÐжÔÆë±éÀú£¬ÕÒµ½PEÎļþÍ·£¨DLLµÄÎļþ¸ñʽ£©µÄ¡°MZ¡±MSDOS±êÖ¾£¬¾ÍÄõ½ÁËkernel32.dll»ùÖ·¡£

xor esi , esi

mov esi , fs :[ esi + 0x18 ] // TEB

mov eax , [ esi + 4 ] // Õâ¸öÊÇÐèÒªµÄÕ»¶¥

mov eax , [ eax - 0x1c ] // Ö¸ÏòKernel32.dllÄÚ²¿

find_kernel32_base :

dec eax // ¿ªÊ¼µØ̺ʽËÑË÷Kernel32¿Õ¼ä

xor ax , ax

cmp word ptr [ eax ], 0x5a4d // "MZ"

jne find_kernel32_base // Ñ­ »·±é Àú £¬ÕÒµ½ Ôò ·µ»Ø eax

 

Ö¤Ã÷£º

1.       ÕÒµ½TEB£¬Õâ¸öºÃ°ì£º

0:000>  dd fs:18 L1

003b:00000018  7ffdd000

TEB->7ffdd000

2.       ÕÒµ½Õ»¶¥Ö¸Õ룺

0:000> dd 7ffdd000+4 L1

7ffdd004  00070000

3.       ½øÈëKernel32¿Õ¼ä£º

0:000> dd 00070000-1c L1

0006ffe4  7c839aa8

 

4.       Kernel32¿Õ¼äµÄ´óËÑË÷£º

0:000> db 7c839aa7 L4

7c839aa7  30 55 8b ec                                      0U..

......Ò»Ö±¸ãÏÂÈ¥

0:000> db 7c800000 L4

7c800000  4d 5a 90 00                                      MZ..

ÕÒµ½ÁË°É£¬¹þ¹þ¡£ÓеãЧÂÊÎÊÌ⣬shellcodeÓÐʱºòÊÇÒªÎþÉüЧÂʵģ¬Ã»°ì·¨£¬»¹ÊÇÒÕÊõÎÊÌâ¡£

 

ÃüÌâÈý£ºÍ¨¹ýSEH(FS:[00])»ñÈ¡KERNEL32.DLL»ùµØÖ·

Ëã·¨ÃèÊö£º

×¢Ò⣺FS:[ 0 ] Ö¸ÏòµÄÊÇSHE£¬ËüÖ¸Ïòkernel32.dllÄÚ²¿Á´£¬ÕâÑù¾Í¿ÉÒÔ˳ÌÙÃþ¹ÏÁË¡£FS:[ 0 ] Ö¸ÏòµÄÊÇSHEµÄÄÚ²ãÁ´£¬ÎªÁËÕÒµ½¶¥²ãÒì³£´¦Àí£¬ÎÒÃÇÏòÍâ±éÀúÕÒµ½prev³ÉÔ±µÈÓÚ 0xffffffff µÄEXCEPTION_REGISTER½á¹¹£¬¸Ã½á¹¹µÄhandlerÖµ¾ÍÊÇϵͳ Ĭ ÈϵĴ¦ÀíÀý³Ì£»ÕâÀïÓиöϸ½Ú£¬DLLµÄ×°ÔØÊÇ64K±ß½ç¶ÔÆëµÄ£¬ËùÒÔÐèÒªÀûÓñéÀúµ½µÄÖ¸Ïò×îºóµÄÒì³£´¦ÀíµÄÖ¸Õë½øÐÐÒ³²éÕÒ£¬ÔÙ½áºÏPEÎļþMSDOS±êÖ¾²¿·Ö£¬Ö»ÒªÔÚÿ¸ö 64K ±ß½ç²éÕÒ ¡°MZ ¡±×Ö·û¾ÍÄÜÕÒµ½kernel32.dll»ùÖ·¡£

xor ecx , ecx

mov esi , fs :[ ecx ]

find_seh :

mov eax ,[ esi ]

mov esi , eax

cmp [ eax ], ecx

jns find_seh // 0xffffffff

mov eax , [ eax + 0x04 ] // handler

find_kernel32_base :

dec eax

xor ax , ax

cmp word ptr [ eax ], 0x5a4d

jne find_kernel32_base

 

Ö¤Ã÷£º

1.    &n

 

bsp; 

ÕÒµ½µ±Ç°SEH£º

0:000> dd fs:0 L1

003b:00000000  0006fedc

2.       ÕÒµ½×îÍâ²ãSEH£º

round 1:

0:000> dd 0006fedc L1

0006fedc  0006ffb0 ; esi

0:000> dd 0006ffb0 L1

0006ffb0  0006ffe0 ; [eax]

round 2:

0:000> dd 0006ffb0 L1

0006ffb0  0006ffe0 ; esi

0:000> dd 0006ffe0 L1

0006ffe0  ffffffff ; [eax]

²»´í£¬µÚ¶þÌ˾ÍÕÒµ½ÁË£¡´Ëʱ£¬eax=0006ffe0

3.       ÕÒµ½MZ£º

0:000> dd 0006ffe0+4 L1

0006ffe4  7c839aa8

 

0:000> db 7c839aa7 L4

7c839aa7  30 55 8b ec                                      0U..

......ÓÖÊÇÒ»Ö±¸ãÏÂÈ¥

0:000> db 7c800000 L4

7c

 

800000  4d 5a 90 00                                      MZ..

ÕÒµ½£¡

 

ÖªÆäÈ»£¬¸üÒªÖªÆäËùÒÔÈ»£¡

]]> http://520yl.blog.163.com/blog/static/46914420085209258829 0 http://520yl.blog.163.com/blog/static/46914420085209258829 Fri, 20 Jun 2008 21:25:08 +0800 2008-06-20T21:25:08+08:00 <![CDATA[ÈçºÎдwindowsϵͳÒѱ£»¤µÄÄÚ´æÇøÓò]]> http://520yl.blog.163.com/blog/static/469144200852092247294

windowsϵͳÔÚijЩ°æ±¾Ï¶ÔijЩÄÚ´æÇøÓòÆôÓÃÁËд±£»¤µÄ¹¦ÄÜ£¬ÒòΪÕâЩÇøÓòÒ»°ãºÏ·¨³ÌÐòÊDz»ÄÜÐÞ¸ÄÆäÄÚÈݵģ¬ÄÇôÎÒÃÇÈçºÎÀ´Ð´ÕâЩÄÚ´æÄØ£¿

PS:1) ÕâЩϵͳ°üÀ¨:windows xpÓëwindows 2003
2) CPUÌṩд±£»¤µÄ¹¦ÄÜÊÇ´Ó486¿ªÊ¼µÄ
3) Ò»°ãºÏ·¨³ÌÐò²»°üÀ¨É±¶¾Èí¼þ£¬ÒòΪËûÃÇÔÚHook SSDTÖÐÊÇÖ±½Ó¸ÄServiceTableBase£¬¶øûÓÐÓÃinlineµÄ·½·¨

ÎÒÃǾÍÓÃSSDT×öÀý×Ó°É£¬ÔÚHook SSDTʱ²»ÓÃinnline hook·½·¨£¬ÎÒÃǾÍÒªÐÞ¸ÄSSDTÕâ¸öϵͳ·þÎñÃèÊö±í£»¶øÕâ¸ö±íÊDZ»Ð´±£»¤ÁË£¬ÔÚring0ÏÂÒ²ÊÇûÓÐдµÄȨÏÞ¡£

·½·¨Ò»£º
Ê×ÏÈÎÒÃÇÀ´¿´Ò»ÏÂCR0¼Ä´æÆ÷µÄ¸ñʽ
|31|30|      |18|17|16|          5|4|3|2|0|1|
|P |C |      |A | |W |          N|E|T|E|M|P|
|G |D |      |M | |P |          E|T|S|M|P|E|

ÎÒÃÇÖ÷ҪעÒâÕâ¸öWPÕâλ,ÆäËûµÄÇë²Î¿¼IA-32 Volume 3A£»
WP¡ª¡ªWrite Protect£¬µ±ÉèÖÃΪ1ʱֻÌṩ¶ÁҳȨÏÞ
PE¡ª¡ªPaging£¬µ±ÉèÖÃΪ1ʱÌṩ·ÖÒ³
MP¡ª¡ªProtection Enable£¬µ±ÉèÖÃΪ1ʱ½øÈë±£»¤Ä£Ê½
ËùÒÔÎÒÃÇÖ»Òª°ÑWPÕâһλÉèÖÃΪ0ʱ£¬¾Í¿ÉÒÔÐÞ¸ÄSSDTÁË

//1 ¹Ø±Õд±£»¤
__asm
{
push eax
mov eax, CR0
and eax, 0FFFEFFFFh
mov CR0, eax
pop eax
}

//2 ´ò¿ªÐ´±£»¤
__asm
{
push eax
mov eax, CR0
or eax, NOT 0FFFEFFFFh
mov CR0, eax
pop eax
}
ͨ¹ýÉÏÃæµÄµÚÒ»×éÖ¸ÁîÎÒÃǾͿÉÒÔÕý³£ÐÞ¸ÄSSDT£¬¼ÇµÃÐ޸ĺóÒª»¹Ô­¡£


·½·¨¶þ£º
´Ë·½·¨ÊǸǴÄÌṩµÄ£¬ÔÚÄÚ´æÃèÊö±í(MDL)ÖÐÃèÊöÒ»¿éÄÚ´æÇøÓò£¬MDL°üº¬´ËÄÚ´æÇøÓòµÄÆðʼµØÖ·£¬ÓµÓÐÕß½ø³Ì£¬×Ö½ÚÊýÁ¿ÒÔ¼°±êÖ¾¡£
//ÔÚddkÖеÄÃèÊö
typedef struct _MDL {
    struct _MDL *Next;
    CSHORT Size;
    CSHORT MdlFlags;
    struct _EPROCESS *Process;
    PVOID MappedSystemVa;
    PVOID StartVa;
    ULONG ByteCount;
    ULONG ByteOffset;
} MDL, *PMDL;

#define MDL_MAPPED_TO_SYSTEM_VA    0x0001
#define MDL_PAGES_LOCKED            0x0002
#define MDL_SOURCE_IS_NONPAGED_POOL 0x0004
#define MDL_ALLOCATED_FIXED_SIZE    0x0008
#define MDL_PARTIAL                0x0010
#define MDL_PARTIAL_HAS_BEEN_MAPPED 0x0020
#define MDL_IO_PAGE_READ            0x0040
#define MDL_WRITE_OPERATION        0x0080
#define MDL_PARENT_MAPPED_SYSTEM_VA 0x0100
#define MDL_LOCK_HELD              0x0200
#define MDL_PHYSICAL_VIEW          0x0400
#define MDL_IO_SPACE                0x0800
#define MDL_NETWORK_HEADER          0x1000
#define MDL_MAPPING_CAN_FAIL        0x2000
#define MDL_ALLOCATED_MUST_SUCCEED 0x4000


// Declarations

#pragma pack(1)

typedef struct ServiceDescriptorEntry {

        unsigned int *ServiceTableBase;

        unsigned int *ServiceCounterTableBase;

        unsigned int NumberOfServices;

        unsigned char *ParamTableBase;

} SSDT;

#pragma pack()

__declspec(dllimport) SSDTKeServiceDescriptorTable;

PMDL g_pmdlSystemCall;
PVOID *MappedSystemCallTable;

// save old system call locations
// Map the memory into our domain to change the permissions on
// the MDL
g_pmdlSystemCall = MmCreateMdl(NULL,
                  KeServiceDescriptorTable.ServiceTableBase,
                  KeServiceDescriptorTable.NumberOfServices*4);

if(!g_pmdlSystemCall)
return STATUS_UNSUCCESSFUL;

MmBuildMdlForNonPagedPool(g_pmdlSystemCall);

// Change the flags of the MDL
g_pmdlSystemCall->MdlFlags = g_pmdlSystemCall->MdlFlags |
                            MDL_MAPPED_TO_SYSTEM_VA;

MappedSystemCallTable = MmMapLockedPages(g_pmdlSystemCall, KernelMode);

MappedSystemCallTable¾ÍÊÇSSDTµÄµØÖ·£¬ÏÖÔÚ¿ÉÒÔ·ÅÐĵIJÙ×÷Ëü°É£¡ÓÃÍêÁË×îºÃMmFreePagesFromMdl¡£



sinister


      

ÒÔÏÂÊÇ Mark Russinovich ºÜÔçдµÄÒ»¶Î´úÂ룬ĿµÄÒ²ÊÇдֻ¶ÁÄÚ´æ¡£


NTSTATUS WriteReadOnlyMemory (char *dest, char *source, int length)
{
KSPIN_LOCK tempSpinLock;
KIRQL oldirql;
PMDL mdl;
PVOID writableAddress;

mdl = IoAllocateMdl((PVOID) dest, length, FALSE, FALSE, NULL);
if (mdl == NULL)
return STATUS_UNSUCCESSFUL;
MmBuildMdlForNonPagedPool(mdl);
MmProbeAndLockPages(mdl, KernelMode, IoWriteAccess);
writableAddress = MmMapLockedPages(mdl, KernelMode);
if (writableAddress == NULL) {
MmUnlockPages(mdl);
IoFreeMdl(mdl);
return STATUS_UNSUCCESSFUL;
}

KeInitializeSpinLock(&tempSpinLock);
KeAcquireSpinLock(&tempSpinLock, &oldirql);
RtlCopyMemory(writableAddress, source, length);
KeReleaseSpinLock(&tempSpinLock, oldirql);

MmUnmapLockedPages(writableAddress, mdl);
MmUnlockPages(mdl);
IoFreeMdl(mdl);
return STATUS_SUCCESS;
}]]> http://520yl.blog.163.com/blog/static/469144200852092247294 0 http://520yl.blog.163.com/blog/static/469144200852092247294 Fri, 20 Jun 2008 21:22:47 +0800 2008-06-20T21:22:47+08:00 <![CDATA[WindowsÖÐFS¶Î¼Ä´æÆ÷]]> http://520yl.blog.163.com/blog/static/469144200852092146899

Ïß³ÌÔËÐÐÔÚRING0£¨ÏµÍ³µØÖ·¿Õ¼ä£©ºÍRING3£¨Óû§µØÖ·¿Õ¼ä£©Ê±£¬FS¶Î¼Ä´æÆ÷·Ö±ðÖ¸Ïò²»Í¬ÄÚ´æ¶ÎµÄ¡£Ïß³ÌÔËÐÐÔÚRING0Ï£¬FS¶ÎÖµÊÇ0x3B£¨WindowsXPÏÂÖµ£¬ÔÚWindows2000ÏÂֵΪ0x38£©£»ÔËÐÐÔÚRING3ÏÂʱ£¬FS¶Î¼Ä´æÆ÷ÖµÊÇ0x30¡£FS¼Ä´æÆ÷ÖµµÄ¸Ä±äÊÇÔÚ³ÌÐò´ÓRing3½øÈëRing0ºóºÍ´ÓRing0Í˻ص½Ring3Ç°Íê³ÉµÄ£¬Ò²¾ÍÊÇ˵£º¶¼ÊÇÔÚRing0ϸøFS¸³²»Í¬ÖµµÄ¡£

Ò»£®           ÔÚRING3ÏÂÔËÐÐʱµÄFS

µ±Ïß³ÌÔËÐÐÔÚRing3ÏÂʱ£¬FSÖ¸ÏòµÄ¶ÎÊÇGDTÖеÄ0x30¶Î¡£¸Ã¶ÎµÄ³¤¶ÈΪ4K£¬»ùµØַΪµ±Ç°Ï̵߳ÄÏ̻߳·¾³¿é£¨TEB£©£¬ËùÒԸöÎÒ²±»³ÆΪ¡°TEB¶Î¡±¡£ÒòΪWindowsÖÐÏß³ÌÊDz»Í£Çл»µÄ£¬ËùÒԸöεĻùµØÖ·Öµ½«ËæÏß³ÌÇ뻶ø¸Ä±äµÄ¡£

Windows2000Öнø³Ì»·¾³¿é£¨PEB£©µÄµØַΪ0X7FFDF000£¬¸Ã½ø³ÌµÄµÚÒ»¸öÏ̵߳ÄTEBµØַΪ0X7FFDE000£¬µÚ¶þ¸öTEBµÄµØַΪ0X7FFDD000¡­..µ«ÊÇÔÚWindowsXP SP2 ÏÂÕâЩ½á¹¹µÄµØÖ·¶¼ÊÇËæ»úÓ³ÉäµÄ¡£ËùÒÔ½ø³ÌµÄPEBµÄµØÖ·Ö»ÄÜͨ¹ýFS:[0x30]À´»ñÈ¡ÁË¡£

WindowsÖÐÿ¸öÏ̶߳¼ÓÐÒ»¸öETHREAD½á¹¹£¬¸Ã½á¹¹µÄTEB³ÉÔ±£¨ÆäʵÊÇKTHREADÖеijÉÔ±£¬¶øKTHREADÓÖÊÇETHREADµÄ³ÉÔ±£©ÊÇÓÃÀ´±£´æÏ̵߳ÄTEBµØÖ·µÄ£¬µ±Ïß³ÌÇл»Ê±£¬Windows¾Í»áÓøÃÖµÀ´¸ü¸ÄGDTµÄ0x30¶ÎÃèÊö·ûµÄ»ùµØÖ·Öµ¡£

ÏÂÃæ¾ÍÊÇWindowsXP SP2ÔÚRING3ÏÂFS¶Î¼Ä´æÆ÷ËùÖ¸ÏòµÄÊý¾Ý½á¹¹ºÍµØÖ·¡£

_TIB

   +0x000 NtTib            : _NT_TIB

_NT_TIB

+0x000 ExceptionList: Ptr32 _EXCEPTION_REGISTRATION_RECORD

+0x004 StackBase        : Ptr32 Void

+0x008 StackLimit       : Ptr32 Void

+0x00c SubSystemTib     : Ptr32 Void

+0x010 FiberData        : Ptr32 Void

+0x010 Version          : Uint4B

+0x014 ArbitraryUserPointer : Ptr32 Void

   +0x018 Self            : Ptr32 _NT_TIB


¶þ£®           ÔÚRING0ÏÂÔËÐÐʱµÄFS

µ±Ïß³ÌÔËÐÐÔÚRing0ÏÂʱ£¬ FSÖ¸ÏòµÄ¶ÎÊÇGDTÖеÄ0x3B¶Î¡£¸Ã¶ÎµÄ³¤¶ÈҲΪ4K£¬»ùµØַΪ0xFFDFF000¡£¸ÃµØÖ·Ö¸ÏòϵͳµÄ´¦ÀíÆ÷¿ØÖÆÇøÓò£¨KPCR£©¡£Õâ¸öÇøÓòÖб£´æÕâ´¦ÀíÆ÷Ïà¹ØµÄһЩÖØÒªÊý¾ÝÖµ£¬ÈçGDT¡¢IDT±íµÄÖµµÈµÈ¡£ÏÂÃæ¾ÍÊÇWindowsXP sp2ÖеÄKPCRÊý¾Ý½á¹¹£º

_KPCR

   +0x000 NtTib            : _NT_TIB

_NT_TIB

+0x000 ExceptionList: Ptr32 _EXCEPTION_REGISTRATION_RECORD

+0x004 StackBase        : Ptr32 Void

+0x008 StackLimit       : Ptr32 Void

+0x00c SubSystemTib     : Ptr32 Void

+0x010 FiberData        : Ptr32 Void

+0x010 Version          : Uint4B

+0x014 ArbitraryUserPointer : Ptr32 Void

   +0x018 Self             : Ptr32 _NT_TIB


ÔÚWindowsXPÖУ¬Ðí¶à²Ù×÷ϵͳµÄϵͳ±äÁ¿µØÖ·Öµ±£´æÔÚÒÔKPCR¿ªÊ¼µÄÊý¾Ý½á¹¹ÖУ¨¿ÉÒԲο´ÏÂͼ£©¡£×¢Ò⣬ÕâÊÇÔÚWindowsXPÏ£¬¶øÔÚWIN2000ÏÂÊÇûÓÐÕâÖÐÇé¿ö¡£ÓÐÐËȤµÄ¶ÁÕß¿ÉÒÔ¿´Ò»ÏÂwww.rootkit.comϵÄÏà¹ØÎÄÕ¡£

]]> http://520yl.blog.163.com/blog/static/469144200852092146899 0 http://520yl.blog.163.com/blog/static/469144200852092146899 Fri, 20 Jun 2008 21:21:46 +0800 2008-06-20T21:21:46+08:00 <![CDATA[¹ØÓÚʹÓÃFS¼Ä´æÆ÷µÄÒÉ»ó Ï׸øÏñÎÒÃÇÕâÑùµÄ²ËÄñ]]> http://520yl.blog.163.com/blog/static/469144200852092048736

¹ØÓÚʹÓÃFS¼Ä´æÆ÷µÄÒÉ»ó Ï׸øÏñÎÒÃÇÕâÑùµÄ²ËÄñ

ÊÇÎÒûÓÐ˵Ã÷°×£¬ÊÇÕâÑùµÄ£¬ÒòΪWin32ÖеĵØַΪƽ̹ģʽ£¬ds,ss,csµÈ¸÷¶ÎµÄ¶Î»ùµØÖ·¶¼Ö¸Ïòͬһ¸öµØ·½£¬ËùÒÔƽ³£ÓõÄÂß¼­µØÖ·¶¼ÊÇĬÈÏÒÔÕâЩ¶ÎΪ»ùÖ·µÄ£¬²»¹ÜÊÇÊý¾Ý¶Î»¹ÊÇ´úÂë¶Î£¬Ö»ÒªËûÃǵÄÆ«ÒÆÏàµÈ£¬ÄÇôËûÃǾÍÊÇÑ°Ö·Ò»ÑùµÄÎïÀíÄڴ棬ËùÒÔÎÒÃǾÍÖ»ÐèÖ¸Ã÷Æ«ÒƾÍÄܵõ½Í³Ò»µÄÑ°Ö·Ä¿±ê£¬²»¹ÜÕâ¸öÄ¿±êÊÇÔÚ´úÂë¶Î»¹ÊÇÊý¾Ý¶Î»òÕ߶ÑÕ»¶ÎÖ®ÖС£WriteProcessMemoryÓõľÍÊÇÕâÑùµÄ¡°Âß¼­µØÖ·¡±£¬Ïñ"0xXXXXXXXX"£¬Æäʵ£¬ÕâÑùµÄÂß¼­µØַʵ¼ÊÉÏÊÇÕâÑùµÄÐÎʽ£ºds:XXXXXXXXX£¬Ö»ÒòΪds=ss=cs£¬ËùÒÔ¿ÉÒÔÓÃds:XXXXXXXXXÀ´Ñ°Ö·cs:XXXXXXXX»òÕßss:XXXXXXXX£¬Ò²¾ÍÊÇÖ»ÐèÒªÖ¸¶¨Æ«ÒƾÍ×㹻Ѱַ´úÂë¶Î»òÕßÊý¾Ý¶ÎÁË¡£µ«ÊÇÔÚwin32ÖУ¬fsÈ´ºÍ¸÷¸ö¶Î¼Ä´æÆ÷µÄÖµ²»Ò»Ñù£¬ËùÒÔÒªÏëÓÃdsÀ´Ñ°Ö·fsÖ¸ÏòµÄÄڴ棬ÄǾ͵Ãת»»Æ«ÒÆÁË£¬ÒòΪfs:XXXXXXXXºÍds:XXXXXXXXÖ¸µÄ²¢²»ÊÇͬÑùµÄÄڴ棻¶øÈç¹ûÓÃWriteProcessMemoryѰַij¸öµØÖ·Èç0xXXXXXXXXµÄ»°£¬ËüĬÈϵÄÑ°Ö·È´ÊÇds:XXXXXXXX¡£   

  Æ«ÒÆת»»µÄ·½·¨¾ÍÈçÎÒÉÏÃæ¸ø³öµÄ£¬ÏÂÃæÕâ¾ä»°   

  ¡°   

  È磺   

  mov   eax,dword   ptr   [12345678h+12345678h]   

  Ï൱ÓÚ   

  mov   eax,dword   ptr   fs:[12345678h]   

  ¡±   

  ÖеĠ  

  mov   eax,dword   ptr   [12345678h+12345678h]   

  ÊÇĬÈϵÄds¶ÎÑ°Ö·£¬Æäʵ¾ÍÊÇ   

  mov   eax,dword   ptr   ds:[12345678h+12345678h]   

  ¶øÕâ¾ä»°   

  mov   eax,dword   ptr   fs:[12345678h]   

  ÊÇÇ¿ÖÆfs¶ÎÑ°Ö·£¬ÉÏÃæÏ൱ÓÚ˵£¬fs¶ÎÑ°Ö·ÓõÄÆ«ÒÆ"12345678"ת»»µ½ds¶ÎÑ°Ö·µÄ»°£¬¾ÍµÃÓà  

  ×ª»»¹ýÀ´µÄ"12345678+12345678"Æ«ÒÆ

]]> http://520yl.blog.163.com/blog/static/469144200852092048736 0 http://520yl.blog.163.com/blog/static/469144200852092048736 Fri, 20 Jun 2008 21:20:48 +0800 2008-06-20T21:20:48+08:00 <![CDATA[timeGetTime]]> http://520yl.blog.163.com/blog/static/4691442008518105620988

timeGetTime

2007-12-28 10:35

ÀûÓà timeGetTime ¸ü¾«×¼µØ¼ÆËãʱ¼ä²î

ÎÒÏëÿ 0.005 Ãë×öijһ¼þ¹¤×÷£¬ ËùÒÔ׫дÁËÒÔϳÌÐò£º

Dim tm1 As Single

Do

tm1 = Timer

While Timer - tm1 < 0.005 ' µÈÓÚ 0.005 Ãë

DoEvents

Wend

...×öijһ¼þ¹¤×÷

Loop

µ«Êµ¼ÊÉÏ£¬ ÔÚ While Ñ­»·ÀïÃ棬 Timer º¯Êý¼¸ºõÿ´Î¶¼µÃµ½ÏàͬµÄʱ¼ä£¬Ö»ÓÐ

´óÔ¼¸ôÁË 0.05Ãë²Å»áµÃµ½²»Í¬µÄʱ¼ä£¬ Ò²¾ÍÊÇ˵ Timer µÄ׼ȷÐÔÖ»ÓÐ 0.05 Ã룬

µ«ÎÒÏ£Íû½øÐеŤ×÷È´ÊÇÿ 0.005 ÃëÒ»´Î£¬ ¸ÃÔõô°ìÄØ£¿

¿ÉÒÔ¸ÄÓà Windows API µÄ timeGetTime º¯Êý£¬ ´ËÒ»º¯Êý»á´«»Ø Windows ¿ª»úÒÔ

À´Ëù¾­¹ýµÄʱ¼ä£¬Ê±¼äµ¥Î»ÊÇ 1/1000 Ã룬 ¾ÙÀýÀ´Ëµ£¬ ¿ª»ú¾­¹ý 2 ·ÖÖÓ£¬ Ôò´«

»ØÖµµÈÓÚ 2*60*1000£¬ timeGetTime µÄÓŵãÊÇʱ¼ä¿ÉÒÔ¾«È·µ½ 1/1000 Ã룬 ËùÒÔ

¿ÉÒÔÓÃÀ´½â¾öÉÏÊöµÄÎÊÌ⣬ϸ½ÚÈçÏ£º

1. API 掐