NotionNext BLOG

python环境迁移到离线环境

Tue, 01 Mar 2022 00:00:00 GMT

使用绿色版python

比较方便打包用于直接运行的程序，以及在新环境中使用

下载

官网下载embed版本（Windows embeddable package (64-bit)）

不使用pip，只用原来用到的库

最好的做法是每个项目在开发的时候都有个单独的venv，与原有的环境隔离开来

部署的时候直接用原来venv里面的Lib文件夹替换新环境的python embed中的Lib文件夹即可

安装pip

有网的情况下

下载get-pip.py

执行python get-pip.py

离线情况下

下载get-pip.py

从pypi下载pip,wheel,setuptools三个whl文件放到whl文件夹下,例如

wheel-0.37.1-py2.py3-none-any.whl
pip-22.0.4-py3-none-any.whl
setuptools-62.1.0-py3-none-any.whl

执行python get-pip.py --no-index --find-links=whl

修改python37._pth

根据注释，去掉import site前面的# (uncomment)

已有python环境，新增库及依赖

安装pipdeptree

pip install pipdeptree

导出依赖

导出所有依赖pipdeptree -f > requirement.txt

导出某个包的依赖（比如selenium）pipdeptree -p selenium > requirement.txt

下载依赖中的whl文件

pip download -d whl -r requirement.txt

whl为目标文件夹名

通过requirement.txt和whl文件夹安装依赖

pip install --no-index --find-links=d:\whl -r requirement.txt

hyperv 显卡虚拟化配置

Fri, 23 Sep 2022 00:00:00 GMT

hyperv 显卡虚拟化配置

参考

[全网独家]最强显卡虚拟化，多项功能第一次解锁，其它教程都是残废_哔哩哔哩_bilibili

显卡虚拟化保姆级教程，爆肝3天，需要的小伙伴可以领走了, 视频播放量 71332、弹幕量 108、点赞数 2969、投硬币枚数 3143、收藏人数 4663、转发人数 316, 视频作者技术狂想曲, 作者简介没有做不到，只有想不到，相关视频：3分钟 VM虚拟机去虚拟化 VMware 一键去虚拟化最简单教程最新教程感谢高美男，VMware虚拟机去虚拟化过游戏检测过VMPSE鲁大师各种盾检测过环境检测去虚拟化教程，一键修改过检测。，Vmware虚拟机VM17 游戏防封 WIN10 一键去虚拟化永久驱动过VMP、SE、TMD、GK盾、TP等强壳过鲁大师，<全网首发>家用显卡虚拟化vGPU，微软Hyper-V独有免费功能，虚拟机去虚拟化\过检测\正常玩游戏\多开，最强虚拟机！ Hyper-V 显卡直通教程，vGPU虚拟化，用途广，速度贼快！支持秒开！| 零度解说，【AI翻唱/SoVITS 4.1】手把手教你老婆唱歌给你听~无需配置环境的本地训练/推理教程[懒人整合包]，原神虚拟机流畅运行用虚拟机玩原神虚拟机多开原神虚拟机过检测虚拟机去虚拟化，GPU 虚拟化技术分享 - 王老师，过检测 VM工作室虚拟机安装系统去虚拟化一键修改硬件主板 cup 大话梦幻 DNF吊打某购物平台几十几百元的虚拟机

https://www.bilibili.com/video/BV1JY4y1C7Bn/

设置 hyperv 显卡虚拟化的命令

上述命令后，进入 hyperv 可以在设备管理器看到显卡了，不过还没有驱动，有个感叹号

添加驱动

通过共享的 E 盘从主机 C:\Windows\System32\DriverStore\FileRepository目录下复制以 nv(英伟达)或 igd 开头(intels 显卡)的文件夹，AMD 没用过，复制到虚拟机 C:\Windows\System32\HostDriverStore\FileRepository文件夹下，HostDriverStore要自己创建

（也许在虚拟机重新下个 nvidia 驱动安装程序也能解决？补：测试了下无法安装上去）

其他问题

检查点是能用的，但是自动检查点必须关掉

关闭 gpu 分区

在 hyper-v 管理器应用之前设置的检查点

再次设置 gpu 分区（不用 add 了，否则会出现两个显卡）

开机

性能优化

1.启用远程桌面独显加速

在组策略管理器 gpedit.msc 中，计算机配置-管理模板-Windows组件-远程桌面服务-远程桌面会话主机-远程桌面会话环境 ，按下图开启

2.解除 30 帧限制

解除注册表限制

出处：https://learn.microsoft.com/zh-cn/troubleshoot/windows-server/remote/frame-rate-limited-to-30-fps

打开注册表regedit

找到计算机\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations

创建 DWORD(32 位），名称为DWMFRAMEINTERVAL

设置值为十进制的 15 或者 16 进制的 F

多张显卡或者显卡顺序不对的测试问题

这一步显卡 id 对应上一步获取的 NAME的值

正则表达式记录

Tue, 19 Apr 2022 00:00:00 GMT

使用到的正则表达式记录

基本规则记录

来源： Regular Expression Language - Quick Reference

Character Escapes

The backslash character (\) in a regular expression indicates that the character that follows it either is a special character (as shown in the following table), or should be interpreted literally. For more information, see Character Escapes.

Escaped character	Description	Pattern	Matches
\a	Matches a bell character, \u0007.	\a	"\u0007" in "Error!" + '\u0007'
\b	In a character class, matches a backspace, \u0008.	[\b]{3,}	"\b\b\b\b" in "\b\b\b\b"
\t	Matches a tab, \u0009.	(\w+)\t	"item1\t", "item2\t" in "item1\titem2\t"
\r	Matches a carriage return, \u000D. (\r is not equivalent to the newline character, \n.)	\r\n(\w+)	"\r\nThese" in "\r\nThese are\ntwo lines."
\v	Matches a vertical tab, \u000B.	[\v]{2,}	"\v\v\v" in "\v\v\v"
\f	Matches a form feed, \u000C.	[\f]{2,}	"\f\f\f" in "\f\f\f"
\n	Matches a new line, \u000A.	\r\n(\w+)	"\r\nThese" in "\r\nThese are\ntwo lines."
\e	Matches an escape, \u001B.	\e	"\x001B" in "\x001B"
\ nnn	Uses octal representation to specify a character (nnn consists of two or three digits).	\w\040\w	"a b", "c d" in "a bc d"
\x nn	Uses hexadecimal representation to specify a character (nn consists of exactly two digits).	\w\x20\w	"a b", "c d" in "a bc d"
\c X\c x	Matches the ASCII control character that is specified by X or x , where X or x is the letter of the control character.	\cC	"\x0003" in "\x0003" (Ctrl-C)
\u nnnn	Matches a Unicode character by using hexadecimal representation (exactly four digits, as represented by nnnn ).	\w\u0020\w	"a b", "c d" in "a bc d"
\	When followed by a character that is not recognized as an escaped character in this and other tables in this topic, matches that character. For example, \* is the same as \x2A, and \. is the same as \x2E. This allows the regular expression engine to disambiguate language elements (such as * or ?) and character literals (represented by \* or \?).	\d+[\+-x\*]\d+	"2+2" and "39" in "(2+2) 3*9"

Character Classes

A character class matches any one of a set of characters. Character classes include the language elements listed in the following table. For more information, see Character Classes.

Character class	Description	Pattern	Matches
[ character_group ]	Matches any single character in character_group. By default, the match is case-sensitive.	[ae]	"a" in "gray"``"a", "e" in "lane"
[^ character_group ]	Negation: Matches any single character that is not in character_group. By default, characters in character_group are case-sensitive.	[^aei]	"r", "g", "n" in "reign"
[ first - last ]	Character range: Matches any single character in the range from first to last.	[A-Z]	"A", "B" in "AB123"
.	Wildcard: Matches any single character except \n.To match a literal period character (. or \u002E), you must precede it with the escape character (\.).	a.e	"ave" in "nave"``"ate" in "water"
\p{ name }	Matches any single character in the Unicode general category or named block specified by name.	\p{Lu}``\p{IsCyrillic}	"C", "L" in "City Lights"``"Д", "Ж" in "ДЖem"
\P{ name }	Matches any single character that is not in the Unicode general category or named block specified by name.	\P{Lu}``\P{IsCyrillic}	"i", "t", "y" in "City"``"e", "m" in "ДЖem"
\w	Matches any word character.	\w	"I", "D", "A", "1", "3" in "ID A1.3"
\W	Matches any non-word character.	\W	" ", "." in "ID A1.3"
\s	Matches any white-space character.	\w\s	"D " in "ID A1.3"
\S	Matches any non-white-space character.	\s\S	" _" in "int __ctr"
\d	Matches any decimal digit.	\d	"4" in "4 = IV"
\D	Matches any character other than a decimal digit.	\D	" ", "=", " ", "I", "V" in "4 = IV"

Anchors

Anchors, or atomic zero-width assertions, cause a match to succeed or fail depending on the current position in the string, but they do not cause the engine to advance through the string or consume characters. The metacharacters listed in the following table are anchors. For more information, see Anchors.

Assertion	Description	Pattern	Matches
^	By default, the match must start at the beginning of the string; in multiline mode, it must start at the beginning of the line.	^\d{3}	"901" in "901-333-"
$	By default, the match must occur at the end of the string or before \n at the end of the string; in multiline mode, it must occur before the end of the line or before \n at the end of the line.	-\d{3}$	"-333" in "-901-333"
\A	The match must occur at the start of the string.	\A\d{3}	"901" in "901-333-"
\Z	The match must occur at the end of the string or before \n at the end of the string.	-\d{3}\Z	"-333" in "-901-333"
\z	The match must occur at the end of the string.	-\d{3}\z	"-333" in "-901-333"
\G	The match must occur at the point where the previous match ended.	\G$\d$	"(1)", "(3)", "(5)" in "(1)(3)(5)[7](9)"
\b	The match must occur on a boundary between a \w (alphanumeric) and a \W (nonalphanumeric) character.	\b\w+\s\w+\b	"them theme", "them them" in "them theme them them"
\B	The match must not occur on a \b boundary.	\Bend\w*\b	"ends", "ender" in "end sends endure lender"

Grouping Constructs

Grouping constructs delineate subexpressions of a regular expression and typically capture substrings of an input string. Grouping constructs include the language elements listed in the following table. For more information, see Grouping Constructs.

Grouping construct	Description	Pattern	Matches
( subexpression )	Captures the matched subexpression and assigns it a one-based ordinal number.	(\w)\1	"ee" in "deep"
(?< name > subexpression )or(?' name ' subexpression )	Captures the matched subexpression into a named group.	(?\w)\k	"ee" in "deep"
(?< name1 - name2 > subexpression )or(?' name1 - name2 ' subexpression )	Defines a balancing group definition. For more information, see the "Balancing Group Definition" section in Grouping Constructs.	(((?'Open'$)[^\($])+((?'Close-Open'\))[^])+)*(?(Open)(?!))$	"((1-3)(3-1))" in "3+2^((1-3)(3-1))"
(?: subexpression )	Defines a noncapturing group.	Write(?:Line)?	"WriteLine" in "Console.WriteLine()"``"Write" in "Console.Write(value)"
(?imnsx-imnsx: subexpression )	Applies or disables the specified options within subexpression . For more information, see Regular Expression Options.	A\d{2}(?i:\w+)\b	"A12xl", "A12XL" in "A12xl A12XL a12xl"
(?= subexpression )	Zero-width positive lookahead assertion.	\b\w+\b(?=.+and.+)	"cats", "dogs"in"cats, dogs and some mice."
(?! subexpression )	Zero-width negative lookahead assertion.	\b\w+\b(?!.+and.+)	"and", "some", "mice"in"cats, dogs and some mice."
(?<= subexpression )	Zero-width positive lookbehind assertion.	\b\w+\b(?<=.+and.+)———————————\b\w+\b(?<=.+and.*)	"some", "mice"in"cats, dogs and some mice."————————————"and", "some", "mice"in"cats, dogs and some mice."
(?———————————\b\w+\b(?in"cats, dogs and some mice."————————————"cats", "dogs"in"cats, dogs and some mice."
(?> subexpression )	Atomic group.	(?>a\\|ab)c	"ac" in"ac"nothing in"abc"

Lookarounds at a glance

When the regular expression engine hits a lookaround expression , it takes a substring reaching from the current position to the start (lookbehind) or end (lookahead) of the original string, and then runs Regex.IsMatch on that substring using the lookaround pattern. Success of this subexpression's result is then determined by whether it's a positive or negative assertion.

Lookaround	Name	Function
(?=check)	Positive Lookahead	Asserts that what immediately follows the current position in the string is "check"
(?<=check)	Positive Lookbehind	Asserts that what immediately precedes the current position in the string is "check"
(?!check)	Negative Lookahead	Asserts that what immediately follows the current position in the string is not "check"
`(?

Once they have matched, atomic groups won't be re-evaluated again, even when the remainder of the pattern fails due to the match. This can significantly improve performance when quantifiers occur within the atomic group or the remainder of the pattern.

Quantifiers

A quantifier specifies how many instances of the previous element (which can be a character, a group, or a character class) must be present in the input string for a match to occur. Quantifiers include the language elements listed in the following table. For more information, see Quantifiers.

Quantifier	Description	Pattern	Matches
*	Matches the previous element zero or more times.	\d*\.\d	".0", "19.9", "219.9"
+	Matches the previous element one or more times.	"be+"	"bee" in "been", "be" in "bent"
?	Matches the previous element zero or one time.	"rai?n"	"ran", "rain"
{ n }	Matches the previous element exactly n times.	",\d{3}"	",043" in "1,043.6", ",876", ",543", and ",210" in "9,876,543,210"
{ n ,}	Matches the previous element at least n times.	"\d{2,}"	"166", "29", "1930"
{ n m }	Matches the previous element at least n times, but no more than m times.	"\d{3,5}"	"166", "17668"``"19302" in "193024"
*?	Matches the previous element zero or more times, but as few times as possible.	\d*?\.\d	".0", "19.9", "219.9"
+?	Matches the previous element one or more times, but as few times as possible.	"be+?"	"be" in "been", "be" in "bent"
??	Matches the previous element zero or one time, but as few times as possible.	"rai??n"	"ran", "rain"
{ n }?	Matches the preceding element exactly n times.	",\d{3}?"	",043" in "1,043.6", ",876", ",543", and ",210" in "9,876,543,210"
{ n ,}?	Matches the previous element at least n times, but as few times as possible.	"\d{2,}?"	"166", "29", "1930"
{ n m }?	Matches the previous element between n and m times, but as few times as possible.	"\d{3,5}?"	"166", "17668"``"193", "024" in "193024"

Backreference Constructs

A backreference allows a previously matched subexpression to be identified subsequently in the same regular expression. The following table lists the backreference constructs supported by regular expressions in .NET. For more information, see Backreference Constructs.

Backreference construct	Description	Pattern	Matches
\ number	Backreference. Matches the value of a numbered subexpression.	(\w)\1	"ee" in "seek"
\k< name >	Named backreference. Matches the value of a named expression.	(?\w)\k	"ee" in "seek"

Alternation Constructs

Alternation constructs modify a regular expression to enable either/or matching. These constructs include the language elements listed in the following table. For more information, see Alternation Constructs.

Alternation construct	Description	Pattern	Matches
\\|	Matches any one element separated by the vertical bar (\\|) character.	th(e\\|is\\|at)	"the", "this" in "this is the day."
(?( expression ) yes \\| no )or(?( expression ) yes )	Matches yes if the regular expression pattern designated by expression matches; otherwise, matches the optional no part. expression is interpreted as a zero-width assertion.To avoid ambiguity with a named or numbered capturing group, you can optionally use an explicit assertion, like this:(?( (?= expression ) ) yes \\| no )	(?(A)A\d{2}\b\\|\b\d{3}\b)	"A10", "910" in "A10 C103 910"
(?( name ) yes \\| no )or(?( name ) yes )	Matches yes if name , a named or numbered capturing group, has a match; otherwise, matches the optional no .	(?")?(?(quoted).+?"\\|\S+\s)	"Dogs.jpg ", "\"Yiska playing.jpg\"" in "Dogs.jpg \"Yiska playing.jpg\""

Substitutions

Substitutions are regular expression language elements that are supported in replacement patterns. For more information, see Substitutions. The metacharacters listed in the following table are atomic zero-width assertions.

Character	Description	Pattern	Replacement pattern	Input string	Result string
$ number	Substitutes the substring matched by group number .	\b(\w+)(\s)(\w+)\b	$3$2$1	"one two"	"two one"
${ name }	Substitutes the substring matched by the named group name .	\b(?\w+)(\s)(?\w+)\b	${word2} ${word1}	"one two"	"two one"
$$	Substitutes a literal "$".	\b(\d+)\s?USD	$$$1	"103 USD"	"$103"
$&	Substitutes a copy of the whole match.	\$?\d*\.?\d+	$&	"$1.30"	"$1.30"
`$``	Substitutes all the text of the input string before the match.	B+	`$``	"AABBCC"	"AAAACC"
$'	Substitutes all the text of the input string after the match.	B+	$'	"AABBCC"	"AACCCC"
$+	Substitutes the last group that was captured.	B+(C+)	$+	"AABBCCDD"	"AACCDD"
$_	Substitutes the entire input string.	B+	$_	"AABBCC"	"AAAABBCCCC"

工具和资料

Wed, 30 Mar 2022 00:00:00 GMT

chrome dev 修改网页 JS

Thu, 17 Mar 2022 00:00:00 GMT

以百度搜索为例

找到要修改的 js 所在的地方

通过 XHR 断点，点击搜索框后暂停在了发出提示关键词的请求之前

找到 js 文件所在路径

在 js 文件右键会有《在边栏中显示》的选项，会在侧边栏看到 js 文件的路径位置

新建替换目录

在替换（override）处选择任意一个本地目录

添加 js 文件到替换目录

点击保存并覆盖

会在替换处以及本地文件中看到该文件

修改 js 文件

修改 js

会在浏览器覆盖原有的 js 文件，执行 alert(1)

BUUCTF-ciscn_2019_n_1

Mon, 28 Mar 2022 00:00:00 GMT

实际上直接确定溢出位置在 exp 里写 payload 发送就好了 #### 检查下保护情况

放进 ida 分析，搜索字符串，定位到主要函数的位置

可以看到当 v2 等于 11.28125 时就会输出 flag，而且 v2 为 float 类型。 - 只有一个输入点 gets(v1)，没对输入进行限制，存在溢出点 [[python]] 可以判断出本题是通过输入 v1 溢出覆盖 v2 的值为 11.28125 获取 flag。

v1 位置为 rbp-30h,v2 为 rbp-4h,距离为

与 char v1[44]中的 44 相等，所以 v1 填充完 44 后溢出就直接会覆盖到 v2 的位置，只需要在 44 字节后填充浮点数 11.28125 即可（可以先打断点在 if 处，然后在 ida 中动态调试 Hex-view 中按 F2 对溢出位置进行修改为对应数值看下是否可行）

python 中的 pwntool 打开 gdb 调试(方便发送不可输入的字符和查看 stack 变化)

发送 payload 后

可以看到指定位置已经被覆盖为我们需要的字节,然后在 gdb 中继续执行

执行完后可以看到 pwntool 中的交互模式出现了 cat 指令的执行。

基于以上本地实验，可以写出如下 exp: