Qfrost Blog
菜就哭啊，学有什么用！
【Android】OnePlus13 unlock/root via KernelSU
· ☕ 3 min read
Nowadays, more and more phone brands are imposing stricter limitations on bootloader unlocking, adding to the difficulty of root to enhance mobile devices security. I have always used OnePlus because it has fewer restrictions. In this post, I will introduce several approaches to root OnePlus devices. My device version is PJZ110_15.0.0.502. Unlock OnePlus devices can be unlocked via fastboot easily, unlike some brands that require users to submit applications. Preparation:
Rust Global Variable and Impl Singleton elegantly
· ☕ 3 min read
Although the mechanism of Rust Lifetime suggest people using local variable guaranteed to ownership is correct, we inevitably need to use global variables in some situations. Rust designer have added many limitations to guarantee that global variables are safe in terms of memory and threading, compared to other languages such as C/C++ and Python. These limitations indeed help developers avoid lots of crash or unexpected issues that are difficult to
NtQueryObject Deadlock
· ☕ 4 min read
Question Recently, I wanted to enumerate handles from all processes and print the names of the objects corresponding to those handles. I intended to use NtQueryInformationProcess::ProcessHandleInformation to retrieve the handles’ information. After that, I planned duplicate the handles and use NtQueryObject to query the names of objects. However, I unexpectedly discovered that I could not print the names of all handles, and the program got stuck. Let’s review the following code.
【AI】腾讯游戏安全竞赛-机器学习 2021 WriteUp
· ☕ 14 min read
虽然AI在客户端安全上的作用还不是非常显著，但我总觉得不学AI迟早要被淘汰。以一个客户端安全人的视角来看，学习AI的只需要学会用即可：也就是
Windows Ring0 call Ring3 & NepCTF2024 Qriver4.0 WP
· ☕ 7 min read
A Github repository named DoubleCallBack caught my attention. Lots of programs espically game cheats use this library so as to execute Ring3 functions from kernel. I have learned this code, to be frank with you, it is so difficult to understand that I’m surprised it works at all. Therefore, in this blog post, I will talk about DoubleCallBack and how to execute Ring3 functions from kernel gracefully. Background Generally, if
UE Dumper
· ☕ 6 min read
What is known to us is that UnrealEngine uses reflection to achieve various dynamic features, such as object management, garbage collection systems, etc. UnrealEngine generates reflection data during compilation, including class names, class methods, class fields and other class properties. And these data are packed and saved. In this situation, we can retrieve class information and symbols through reverse engineering. Usually, we refer to this process as Dump SDK. In this blog, I downloaded UE4 4.
Windows Dump Analysis
· ☕ 5 min read
The analysis of crash is a very common and difficult problem while programming or testing. I have recorded some of useful tricks to analyze Windows dump. In this blog, I will use a demo crash dump of a Windows kernel shellcode to share some analysis tricks. windows_kernel_shellcode_dump.dmp Basic When we open a dump using windbg, the software will print some basic info about crash automatically. This includes some crucial information. Such as ntoskrnl base address, system startup time and the time from system startup to crash.
【Android】CheatEngine With Kernel Module
· ☕ 3 min read
Sometimes, we have to face the situation where we need to read or write process memory but want the process to be completely unaware. In general, users can achieve this by utilizing the process_vm_readv and process_vm_writev syscalls provided from Android kernel. However, there are several methods to detect such malicious behaviors. Some anti-cheaters insert a type of special memory pages into the game’s memory, they can detect these memory pages being read or written by mincore.
Windows Hide Process
· ☕ 2 min read
Sometimes, we may need hide our process from various programs in order to achieve specific objectives. For instance, we may want to hide our virus from antivirus software, or conceal our cheat from anti-cheat programs. There are lots of different approaches introduced by blogs in internet. In this article, I will introduce a few methods that I believe are both effective and relatively straightforward. Unlink EPROCESS First and foremost, I
Rust FFI
· ☕ 5 min read
Sometimes, we need to implement some libs using rust, and these libs should be loaded by other programs, which means we have to implement some interface for these libs based on the specific foreign interface standard. Usually, this specific standard is called FFI(Foreign Function Interface). It is an important mechanism that allows libraries to access functions from other programming language. In this way, we can use this mechanism call C functions in Rust language or call Rust functions in C language.
NepCTF2023 Qriver3.0出题思路
· ☕ 3 min read
前言 大体设计思路与 Qriver2.0出题思路 差不多，依旧是使用自己写的LLVM混淆编译了一个Windows驱动程序。主要原因是去年是0解，感
Rust Hook
· ☕ 6 min read
With the accelerating advancement of Rust language, more and more tech companies are recompiling their programs using Rust, especially client security software. However, there are few documents available that explain how to hook any functions using Rust. Therefore, I have written this blog to help you understand how to hook programs using the retour-rs crate for Rust. In the C language, two hook libraries, detour and MinHook, are commonly used and both have been implemented in Rust.