user@TUSKEDEV ~/p/x/ZipHacker> john --wordlist=wordlist.txt hash.txt Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 16 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status 357468 (secret.zip/flag.txt) 1g 0:00:00:00 DONE (2023-04-15 09:25) 20.00g/s 5242Kp/s 5242Kc/s 5242KC/s 330487..373254 Use the "--show" option to display all of the cracked passwords reliably Session completed
user@TUSKEDEV ~> ./volatility -h
Volatility Foundation Volatility Framework 2.6
Usage: Volatility - A memory forensics analysis platform.
Options:
-h, --help list all available options and their default values.
Default values may be set in the configuration file
(/etc/volatilityrc)
--conf-file=/home/user/.volatilityrc
User based configuration file
-d, --debug Debug volatility
--plugins=PLUGINS Additional plugin directories to use (colon separated)
--info Print information about all registered objects
--cache-directory=/home/user/.cache/volatility
Directory where cache files are stored
--cache Use caching
--tz=TZ Sets the (Olson) timezone for displaying timestamps
using pytz (if installed) or tzset
-f FILENAME, --filename=FILENAME
Filename to use when opening an image
--profile=WinXPSP2x86
Name of the profile to load (use --info to see a list
of supported profiles)
-l LOCATION, --location=LOCATION
A URN location from which to load an address space
-w, --write Enable write support
--dtb=DTB DTB Address
--shift=SHIFT Mac KASLR shift address
--output=text Output in this format (support is module specific, see
the Module Output Options below)
--output-file=OUTPUT_FILE
Write output in this file
-v, --verbose Verbose information
-g KDBG, --kdbg=KDBG Specify a KDBG virtual address (Note: for 64-bit
Windows 8 and above this is the address of
KdCopyDataBlock)
--force Force utilization of suspect profile
-k KPCR, --kpcr=KPCR Specify a specific KPCR address
--cookie=COOKIE Specify the address of nt!ObHeaderCookie (valid for
Windows 10 only)
Supported Plugin Commands:
amcache Print AmCache information
apihooks Detect API hooks in process and kernel memory
atoms Print session and window station atom tables
atomscan Pool scanner for atom tables
auditpol Prints out the Audit Policies from HKLM\SECURITY\Policy\PolAdtEv
bigpools Dump the big page pools using BigPagePoolScanner
bioskbd Reads the keyboard buffer from Real Mode memory
cachedump Dumps cached domain hashes from memory
callbacks Print system-wide notification routines
clipboard Extract the contents of the windows clipboard
cmdline Display process command-line arguments
cmdscan Extract command history by scanning for _COMMAND_HISTORY
connections Print list of open connections [Windows XP and 2003 Only]
connscan Pool scanner for tcp connections
consoles Extract command history by scanning for _CONSOLE_INFORMATION
crashinfo Dump crash-dump information
deskscan Poolscaner for tagDESKTOP (desktops)
devicetree Show device tree
dlldump Dump DLLs from a process address space
dlllist Print list of loaded dlls for each process
driverirp Driver IRP hook detection
drivermodule Associate driver objects to kernel modules
driverscan Pool scanner for driver objects
dumpcerts Dump RSA private and public SSL keys
dumpfiles Extract memory mapped and cached files
dumpregistry Dumps registry files out to disk
editbox Displays information about Edit controls. (Listbox experimental.)
envars Display process environment variables
eventhooks Print details on windows event hooks
evtlogs Extract Windows Event Logs (XP/2003 only)
filescan Pool scanner for file objects
gahti Dump the USER handle type information
gditimers Print installed GDI timers and callbacks
gdt Display Global Descriptor Table
getservicesids Get the names of services in the Registry and return Calculated SID
getsids Print the SIDs owning each process
handles Print list of open handles for each process
hashdump Dumps passwords hashes (LM/NTLM) from memory
hibinfo Dump hibernation file information
hivedump Prints out a hive
hivelist Print list of registry hives.
hivescan Pool scanner for registry hives
hpakextract Extract physical memory from an HPAK file
hpakinfo Info on an HPAK file
idt Display Interrupt Descriptor Table
iehistory Reconstruct Internet Explorer cache / history
imagecopy Copies a physical address space out as a raw DD image
imageinfo Identify information for the image
impscan Scan for calls to imported functions
joblinks Print process job link information
kdbgscan Search for and dump potential KDBG values
kpcrscan Search for and dump potential KPCR values
ldrmodules Detect unlinked DLLs
lsadump Dump (decrypted) LSA secrets from the registry
machoinfo Dump Mach-O file format information
malfind Find hidden and injected code
mbrparser Scans for and parses potential Master Boot Records (MBRs)
memdump Dump the addressable memory for a process
memmap Print the memory map
messagehooks List desktop and thread window message hooks
mftparser Scans for and parses potential MFT entries
moddump Dump a kernel driver to an executable file sample
modscan Pool scanner for kernel modules
modules Print list of loaded modules
multiscan Scan for various objects at once
mutantscan Pool scanner for mutex objects
notepad List currently displayed notepad text
objtypescan Scan for Windows object type objects
patcher Patches memory based on page scans
poolpeek Configurable pool scanner plugin
printkey Print a registry key, and its subkeys and values
privs Display process privileges
procdump Dump a process to an executable file sample
pslist Print all running processes by following the EPROCESS lists
psscan Pool scanner for process objects
pstree Print process list as a tree
psxview Find hidden processes with various process listings
qemuinfo Dump Qemu information
raw2dmp Converts a physical memory sample to a windbg crash dump
screenshot Save a pseudo-screenshot based on GDI windows
servicediff List Windows services (ala Plugx)
sessions List details on _MM_SESSION_SPACE (user logon sessions)
shellbags Prints ShellBags info
shimcache Parses the Application Compatibility Shim Cache registry key
shutdowntime Print ShutdownTime of machine from registry
sockets Print list of open sockets
sockscan Pool scanner for tcp socket objects
ssdt Display SSDT entries
strings Match physical offsets to virtual addresses (may take a while, VERY verbose)
svcscan Scan for Windows services
symlinkscan Pool scanner for symlink objects
thrdscan Pool scanner for thread objects
threads Investigate _ETHREAD and _KTHREADs
timeliner Creates a timeline from various artifacts in memory
timers Print kernel timers and associated module DPCs
truecryptmaster Recover TrueCrypt 7.1a Master Keys
truecryptpassphrase TrueCrypt Cached Passphrase Finder
truecryptsummary TrueCrypt Summary
unloadedmodules Print list of unloaded modules
userassist Print userassist registry keys and information
userhandles Dump the USER handle tables
vaddump Dumps out the vad sections to a file
vadinfo Dump the VAD info
vadtree Walk the VAD tree and display in tree format
vadwalk Walk the VAD tree
vboxinfo Dump virtualbox information
verinfo Prints out the version information from PE images
vmwareinfo Dump VMware VMSS/VMSN information
volshell Shell in the memory image
windows Print Desktop Windows (verbose details)
wintree Print Z-Order Desktop Windows Tree
wndscan Pool scanner for window stations
yarascan Scan process or kernel memory with Yara signatures
user@TUSKEDEV ~ [2]> vol -h
Volatility 3 Framework 2.4.2
usage: volatility [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]]
[-e EXTEND] [-p PLUGIN_DIRS] [-s SYMBOL_DIRS] [-v] [-l LOG]
[-o OUTPUT_DIR] [-q] [-r RENDERER] [-f FILE]
[--write-config] [--save-config SAVE_CONFIG] [--clear-cache]
[--cache-path CACHE_PATH] [--offline]
[--single-location SINGLE_LOCATION]
[--stackers [STACKERS ...]]
[--single-swap-locations [SINGLE_SWAP_LOCATIONS ...]]
plugin ...
An open-source memory forensics framework
options:
-h, --help Show this help message and exit, for specific plugin
options use 'volatility <pluginname> --help'
-c CONFIG, --config CONFIG
Load the configuration from a json file
--parallelism [{processes,threads,off}]
Enables parallelism (defaults to off if no argument
given)
-e EXTEND, --extend EXTEND
Extend the configuration with a new (or changed)
setting
-p PLUGIN_DIRS, --plugin-dirs PLUGIN_DIRS
Semi-colon separated list of paths to find plugins
-s SYMBOL_DIRS, --symbol-dirs SYMBOL_DIRS
Semi-colon separated list of paths to find symbols
-v, --verbosity Increase output verbosity
-l LOG, --log LOG Log output to a file as well as the console
-o OUTPUT_DIR, --output-dir OUTPUT_DIR
Directory in which to output any generated files
-q, --quiet Remove progress feedback
-r RENDERER, --renderer RENDERER
Determines how to render the output (quick, none, csv,
pretty, json, jsonl)
-f FILE, --file FILE Shorthand for --single-location=file:// if single-
location is not defined
--write-config Write configuration JSON file out to config.json
--save-config SAVE_CONFIG
Save configuration JSON file to a file
--clear-cache Clears out all short-term cached items
--cache-path CACHE_PATH
Change the default path
(/home/user/.cache/volatility3) used to store the
cache
--offline Do not search online for additional JSON files
--single-location SINGLE_LOCATION
Specifies a base location on which to stack
--stackers [STACKERS ...]
List of stackers
--single-swap-locations [SINGLE_SWAP_LOCATIONS ...]
Specifies a list of swap layer URIs for use with
single-location
Plugins:
For plugin specific options, run 'volatility <plugin> --help'
plugin
banners.Banners Attempts to identify potential linux banners in an
image
configwriter.ConfigWriter
Runs the automagics and both prints and outputs
configuration in the output directory.
frameworkinfo.FrameworkInfo
Plugin to list the various modular components of
Volatility
isfinfo.IsfInfo Determines information about the currently available
ISF files, or a specific one
layerwriter.LayerWriter
Runs the automagics and writes out the primary layer
produced by the stacker.
linux.bash.Bash Recovers bash command history from memory.
linux.check_afinfo.Check_afinfo
Verifies the operation function pointers of network
protocols.
linux.check_creds.Check_creds
Checks if any processes are sharing credential
structures
linux.check_idt.Check_idt
Checks if the IDT has been altered
linux.check_modules.Check_modules
Compares module list to sysfs info, if available
linux.check_syscall.Check_syscall
Check system call table for hooks.
linux.elfs.Elfs Lists all memory mapped ELF files for all processes.
linux.envars.Envars
linux.envvars.Envvars
Lists processes with their environment variables
linux.iomem.IOMem Generates an output similar to /proc/iomem on a
running system.
linux.keyboard_notifiers.Keyboard_notifiers
Parses the keyboard notifier call chain
linux.kmsg.Kmsg Kernel log buffer reader
linux.lsmod.Lsmod Lists loaded kernel modules.
linux.lsof.Lsof Lists all memory maps for all processes.
linux.malfind.Malfind
Lists process memory ranges that potentially contain
injected code.
linux.mountinfo.MountInfo
Lists mount points on processes mount namespaces
linux.proc.Maps Lists all memory maps for all processes.
linux.psaux.PsAux Lists processes with their command line arguments
linux.pslist.PsList
Lists the processes present in a particular linux
memory image.
linux.psscan.PsScan
Scans for processes present in a particular linux
image.
linux.pstree.PsTree
Plugin for listing processes in a tree based on their
parent process ID.
linux.sockstat.Sockstat
Lists all network connections for all processes.
linux.tty_check.tty_check
Checks tty devices for hooks
mac.bash.Bash Recovers bash command history from memory.
mac.check_syscall.Check_syscall
Check system call table for hooks.
mac.check_sysctl.Check_sysctl
Check sysctl handlers for hooks.
mac.check_trap_table.Check_trap_table
Check mach trap table for hooks.
mac.ifconfig.Ifconfig
Lists network interface information for all devices
mac.kauth_listeners.Kauth_listeners
Lists kauth listeners and their status
mac.kauth_scopes.Kauth_scopes
Lists kauth scopes and their status
mac.kevents.Kevents
Lists event handlers registered by processes
mac.list_files.List_Files
Lists all open file descriptors for all processes.
mac.lsmod.Lsmod Lists loaded kernel modules.
mac.lsof.Lsof Lists all open file descriptors for all processes.
mac.malfind.Malfind
Lists process memory ranges that potentially contain
injected code.
mac.mount.Mount A module containing a collection of plugins that
produce data typically found in Mac's mount command
mac.netstat.Netstat
Lists all network connections for all processes.
mac.proc_maps.Maps Lists process memory ranges that potentially contain
injected code.
mac.psaux.Psaux Recovers program command line arguments.
mac.pslist.PsList Lists the processes present in a particular mac memory
image.
mac.pstree.PsTree Plugin for listing processes in a tree based on their
parent process ID.
mac.socket_filters.Socket_filters
Enumerates kernel socket filters.
mac.timers.Timers Check for malicious kernel timers.
mac.trustedbsd.Trustedbsd
Checks for malicious trustedbsd modules
mac.vfsevents.VFSevents
Lists processes that are filtering file system events
timeliner.Timeliner
Runs all relevant plugins that provide time related
information and orders the results by time.
windows.bigpools.BigPools
List big page pools.
windows.cachedump.Cachedump
Dumps lsa secrets from memory
windows.callbacks.Callbacks
Lists kernel callbacks and notification routines.
windows.cmdline.CmdLine
Lists process command line arguments.
windows.crashinfo.Crashinfo
windows.devicetree.DeviceTree
Listing tree based on drivers and attached devices in
a particular windows memory image.
windows.dlllist.DllList
Lists the loaded modules in a particular windows
memory image.
windows.driverirp.DriverIrp
List IRPs for drivers in a particular windows memory
image.
windows.drivermodule.DriverModule
Determines if any loaded drivers were hidden by a
rootkit
windows.driverscan.DriverScan
Scans for drivers present in a particular windows
memory image.
windows.dumpfiles.DumpFiles
Dumps cached file contents from Windows memory
samples.
windows.envars.Envars
Display process environment variables
windows.filescan.FileScan
Scans for file objects present in a particular windows
memory image.
windows.getservicesids.GetServiceSIDs
Lists process token sids.
windows.getsids.GetSIDs
Print the SIDs owning each process
windows.handles.Handles
Lists process open handles.
windows.hashdump.Hashdump
Dumps user hashes from memory
windows.info.Info Show OS & kernel details of the memory sample being
analyzed.
windows.joblinks.JobLinks
Print process job link information
windows.ldrmodules.LdrModules
windows.lsadump.Lsadump
Dumps lsa secrets from memory
windows.malfind.Malfind
Lists process memory ranges that potentially contain
injected code.
windows.mbrscan.MBRScan
Scans for and parses potential Master Boot Records
(MBRs)
windows.memmap.Memmap
Prints the memory map
windows.mftscan.MFTScan
Scans for MFT FILE objects present in a particular
windows memory image.
windows.modscan.ModScan
Scans for modules present in a particular windows
memory image.
windows.modules.Modules
Lists the loaded kernel modules.
windows.mutantscan.MutantScan
Scans for mutexes present in a particular windows
memory image.
windows.netscan.NetScan
Scans for network objects present in a particular
windows memory image.
windows.netstat.NetStat
Traverses network tracking structures present in a
particular windows memory image.
windows.poolscanner.PoolScanner
A generic pool scanner plugin.
windows.privileges.Privs
Lists process token privileges
windows.pslist.PsList
Lists the processes present in a particular windows
memory image.
windows.psscan.PsScan
Scans for processes present in a particular windows
memory image.
windows.pstree.PsTree
Plugin for listing processes in a tree based on their
parent process ID.
windows.registry.certificates.Certificates
Lists the certificates in the registry's Certificate
Store.
windows.registry.hivelist.HiveList
Lists the registry hives present in a particular
memory image.
windows.registry.hivescan.HiveScan
Scans for registry hives present in a particular
windows memory image.
windows.registry.printkey.PrintKey
Lists the registry keys under a hive or specific key
value.
windows.registry.userassist.UserAssist
Print userassist registry keys and information.
windows.sessions.Sessions
lists Processes with Session information extracted
from Environmental Variables
windows.skeleton_key_check.Skeleton_Key_Check
Looks for signs of Skeleton Key malware
windows.ssdt.SSDT Lists the system call table.
windows.statistics.Statistics
windows.strings.Strings
Reads output from the strings command and indicates
which process(es) each string belongs to.
windows.svcscan.SvcScan
Scans for windows services.
windows.symlinkscan.SymlinkScan
Scans for links present in a particular windows memory
image.
windows.vadinfo.VadInfo
Lists process memory ranges.
windows.vadwalk.VadWalk
Walk the VAD tree.
windows.vadyarascan.VadYaraScan
Scans all the Virtual Address Descriptor memory maps
using yara.
windows.verinfo.VerInfo
Lists version information from PE files.
windows.virtmap.VirtMap
Lists virtual mapped sections.
yarascan.YaraScan Scans kernel memory using yara rules (string or file).
左侧是备用的说明书，在说明书里寻找相应模块。GNOME terminal（GTK 3版）右上角有搜索工具用于寻找单词。因为我目前需要看看桌面上有啥，所以我需要寻找screenshot这个单词。然后找到了screenshot – Save a pseudo-screenshot based on GDI windows，翻译出来就是这个模块主要作用是保存一个基于GDI的伪截图。什么是GDI？上搜索引擎。读一下wiki第一句话就行。
Note: This is the English version of “对Project Kaleidoscope方诽谤的反驳”. The original artical may be more accurate and I highly recommend you to read that instead of it.
Recently, rumors from TH779 or the whole team Project Kaleidoscope had taken air.
Explain a few questions.
This guy had some personal disputes with @MlgmXyysd in the early years.
That he added the user group of Project Kaleidoscope was purely picking a quarrel and that Project Kaleidoscope banned him was in line with internal interests.
Because of the ban, he started to look for ways to sabotage, which includes adding our user group using an alternative account when recording and spreading it after making it a video, which seriously damaged Project Kaleidoscope’s reputation.
He has a severe mental illness, which was confirmed by Project Kaleidoscope or other people who have a good relationship with @MlgmXyysd. It could be confirmed by this morning’s issue. By the way, @ReallySnow was also spammed by him for a while.
I don’t have any relationship with him ( @TuskedEvening0 or @piowonster in Telegram), but what he did to me could be a slander on me. As a result, I have the right to shadowban what he said or just ban himself.
Argument #1: This guy had some personal disputes with @MlgmXyysd in the early years.
That’s true. In the first year when LSPosed was founded, People11 forked GJZS and named it FuckGJZS, which has a version code called FuckLSP. I mocked it on the bright side and tried to tell them do not promote their competitors in fact, but maybe they didn’t realize and banned me as a result. Screenshots’ source.
Yuze Wu ( MlgmXyysd ): I won’t ban the person who wasn’t in my channel.
Yuze Wu ( MlgmXyysd ): Accurately, I cannot find the actual person
方立业 ( Shell ): Someone has removed the ban on s L
方立业 ( Shell ): Then People11 added the channel and rebanned him
方立业 ( Shell ): And quitted.
Note: s L is one of admins of LSPosed group.
During the corruption of “回形针PaperClip”, I received a ban because of pointing existing possible problems of the team PaperClip.
Note: 回形针Paperclip is a short-video Multi-Channel Network, which belongs to Beijing Dehydration Culture Media Co., Ltd, which caught in controversy due to its unpatriotism and double-standard.
Yuze Wu ( MlgmXyysd ): Isn’t the double-sided rumor-distributor, who was banned from this group?
Yuze Wu ( MlgmXyysd ): I mean Pio
Yuze Wu ( MlgmXyysd ): He is a professional rumor-distributor after all.
Argument #2: That he added the user group of Project Kaleidoscope was purely picking a quarrel and that Project Kaleidoscope banned him was in line with internal interests.
Firstly, I was originally mentioned Project Kaleidoscope on May 14, 2022, which was mainly proposing the immoraty of insisting on inviting MlgmXyysd to ColorOS 圆桌三人行 ( 3-people round table ) when OnePlus was known that MlgmXyysd would take an extremely importand exam called Gaokao. Source.
TuskedEvening0’s Channel:
WTF!
They KNEW MlgmXyysd would take Gaokao, so why didn’t they delay the meeting until Gaokao ends?
Wish myself, and all of students paticipated in the National Higher Education Entrance Examination of 2022, have the highest mark.
On May 15th, I found my main account was banned in the user group of Project Kaleidoscope. Then I use a clearly identifiable alternative account adding the group to ensure they targeted at me. A related video was published in my channel with the tag 1440, and wasn’t published to any online video sharing platform like BiliBili & YouTube due to its particularity. Then I found it’s federal ban.
Argument #3: Because of the ban, he started to look for ways to sabotage, which includes adding our user group using an alternative account when recording and spreading it after making it a video, which seriously damaged Project Kaleidoscope’s reputation.
On Sep 24th, to avoid attacking unrelated people, such as @ReallySnow , I sent an announcement.
If the team Project Kaleidoscope thought it’s a violation that recording everything about adding your user group & waiting for the ban without ANY TIPs which could indicate your secret attribute, my suggestion would be, DO NOT give any chances to users for feedback, or just make your repositories private, which is possible because of your MIT license.
Argument #4: He has a severe mental illness, which was confirmed by Project Kaleidoscope or other people who have a good relationship with @MlgmXyysd. It could be confirmed by this morning’s issue. By the way, @ReallySnow was also spammed by him for a while.
If you thought it’s trusty about everything MlgmXyysd told you, then I have the following screenshot.
Yuze Wu ( MlgmXyysd ): I wish men and testosterones would disappear together.
PROGYNOVA’s recommended dosage is 4mg to 10mg per day, and the maximum possible dosage, someone reported, excesses 20% of maximum recommended dosage. He bought 34 boxes and each box includes 21 pcs, so he bought 714mg. By maximum recommended usage, he could consume them after 71.4 days, and 59.5 days if he obeys the maximum possible dosage.
Spironolactone tablets could be combined with progynova according to mtf.wiki. Its recommended dosage is 40mg to 100mg per day, or 2 to 10 pcs. By maximum recommended usage ( 10 pcs per day ), he could consume them after 30 days, and 25 days if he obeys the maximum possible dosage.
About my spam to @ReallySnow, in my opinion, it could only occurs in Coolapk or Tooruchan’s group.
Screenshot about mention frequency to ReallySnow in Tooruchan’s group:
Argument #5: I don’t have any relationship with him ( @TuskedEvening0 or @piowonster in Telegram), but what he did to me could be a slander on me. As a result, I have the right to shadowban what he said or just ban himself.
Firstly, I don’t recommend Project Kaleidoscope adopt double standards.
TuskedEvening0: I want to ask you some questions about your ban’s reason:
The reason said that I have disorderly sex experience, so now I’m here to state that I currently DISCLOSE NO actual sex experience.
If that’s a grammar error, I think it should be “unreasoned ban” to cover up your lack of words.
Because currently I have no idea why Project Kaleidoscope had banned my main and alternative accounts, I cannot write any more reasons for you to refer.
Kujou Yuko ( TH779 ): The project doesn’t need a reason when ban. If you have personal grievances, please directly tell her. That you send it here only shows your impotent rage. I don’t want to read your explanation and don’t need your explanation, so please don’t bother me. Thanks.
TuskedEvening0: But your federal ban is related to Project Kaleidoscope and it’s from YOUR team. And why you know that’s related to MlgmXyysd?
Kujou Yuko ( TH779 ): Find the person who banned you. Why find me? Didn’t you have problems processing such a simple logic?
TuskedEvening0: Hello, but federal ban cannot show who banned someone, and it could only show the ban comes from your team.
Kujou Yuko ( TH779 ): Hello, and that’s a personal judgement of MlgmXyysd. Please ask him instead.
Secondly, I have no positive relationship with Project Kaleidoscope. Below is the fuse.
I strongly disagree what reason said. The corresponding explanations of my sexual orientation are as follows:
2020 to Feb 15th, 2022, my first Linux distro I formally use is Kali Linux. Because of my avoidance attitude towards fundamentalist women formed in school violence in my junior high school experience, and a bug in plymouth, I defined my sexual orientation as the dragon in Kali Linux’s avatar.
that bug
After Feb 15th, because of bad chatting experience and as bad as MlgmXyysd’s groups’ abusing of power in Taiwanese groups, I started to have related sexual orientation towards Tsai Ing-wen, with secondary creations like TsaiPorn verificating method ( If you need to verify whether it’s me, ask him for a Tsai Ing-wen’s porn photo. If he sent, he would be me.) and the meme #StandWithTsaiPorn itself.
On Feb 10th, though I saw MlgmXyysd’s woman-dressing and censored breast photos in Nonly-JKLO group, I haven’t define MlgmXyysd as my sexual orientation, because of the grotesque ugliness.
用戶使用規定/ユーザー利用規約/User Terms of Use
- 1. 嚴禁發布（中國、俄羅斯和朝鮮除外）針對政體、政黨、社團、團體、國家和主義的侮辱或仇恨性言論。
- 1.政治システム、政党、協会、グループ、国、および教義に対して侮辱的または憎悪的な言論を投稿することは固く禁じられています（中国、ロシア、北朝鮮を除く）。
- 1. It is strictly prohibited to post (except China, Russia and North Korea) insulting or hateful speech against political systems, political parties, associations, groups, countries and doctrines.
但是，它只定义了China这个范围，而且关于俄罗斯也有一个大bug，这个待会儿再说。
只定义封China是一个极度不明智的选择，因为这个世界上还有个流亡国家Republic of China中华民国，也就是说，你可以：
電子郵箱準則/Rules for the use of email addresses in this instance
- 1. 本實例的自域名郵箱使用mail.ru的服務，請遵守mail.ru的相關規定。
2. 在本實例註冊並擁有所有權後，可向管理員申請，郵箱的域名可以從以下中選取 （neko.ci sakura.ci ovo.ci wos.la wi51.cc orz.ci moew.org inu.ci ）。 郵箱用戶名為你在本實例註冊的用戶名。
- 1.このインスタンスのセルフドメインメールボックスは、mail.ruのサービスを使用しています。mail.ruの関連規則を遵守してください。
2.インスタンスの登録と所有權が完了したら、管理者に申請できます。メールボックスのドメイン名は、以下から選択できます（ neko.ci sakura.ci ovo.ci wos.la wi51.cc orz.ci moew.org inu.ci）。 メールのユーザー名は、このインスタンスで登録したユーザー名です。
- 1. The self-domain mailbox of this instance uses the services of mail.ru, please abide by the relevant regulations of mail.ru.
2. After the instance is registered and owned, you can apply to the administrator. The domain name of the mailbox can be selected from the following (neko.ci sakura.ci ovo.ci wos.la wi51.cc orz.ci moew.org inu.ci). The email username is the username you registered in this instance.
9. 嚴禁發布違反倫理及社會共識的成人內容或其他令人不適的內容。 （例如：真實的強姦、真實的幼童、真實亂倫、非常令人不適的文字和文件等）（紙片人的能叫戀童嗎，她只是長得可愛而已！:bili_emoji_aojiao:）。 如果你的帖子中有涉及成人內容或可能令人，包括文字及附件，均需使用CW和NSFW。
9.倫理的および社会的コンセンサスに違反するアダルトコンテンツまたはその他の不快なコンテンツを公開することは固く禁じられています。 （例：本物のレイプ、本物の幼い子供、本物の近親相姦、非常に不快なテキストや文書など）（2Dキャラクターは小児性愛者と呼ぶことができません、彼女はただかわいいです！ :bili_emoji_aojiao: )。 投稿にアダルトコンテンツや不快感を与える可能性のあるコンテンツ（テキストや添付ファイルなど）が含まれている場合は、CWとNSFWを使用してください。
9. It is strictly prohibited to publish adult content or other uncomfortable content that violates ethical and social consensus. (For example: real rape, real young children, real incest, very uncomfortable text and documents, etc.) (Can the 2D character be called a pedophile, she is just cute! :bili_emoji_aojiao:). If your post contains adult or potentially offensive content, including text and attachments, use CW and NSFW.
user@TUSKEDEV ~/p/v/来一把紧张刺激的CS> ./volatility -f memory.raw imageinfo
Volatility Foundation Volatility Framework 2.6
INFO : volatility.debug : Determining profile based on KDBG search…
Suggested Profile(s) : No suggestion (Instantiated with Win2008SP1x86)
AS Layer1 : IA32PagedMemoryPae (Kernel AS)
AS Layer2 : FileAddressSpace (/home/user/projects/vnctf/来一把紧张刺激的CS/memory.raw)
PAE type : PAE
DTB : 0x3L
KUSER_SHARED_DATA : 0xffdf0000L
？？？？？？？？？？？？？
提示：Volatility 3+找到的人名
我tm……
user@TUSKEDEV ~/p/v/来一把紧张刺激的CS> sudo vol -f memory.raw windows.info.Info
Volatility 3 Framework 2.0.1
Progress: 100.00 PDB scanning finished
Variable Value
Kernel Base 0xf8042fc00000
DTB 0x1ad000
Symbols file:///usr/lib/python3.10/site-packages/volatility3/symbols/windows/ntkrnlmp.pdb/CA8E2F01B822EDE6357898BFBF862997-1.json.xz
Is64Bit True
IsPAE False
layer_name 0 WindowsIntel32e
memory_layer 1 FileLayer
KdVersionBlock 0xf8043080f368
Major/Minor 15.19041
MachineType 34404
KeNumberProcessors 2
SystemTime 2023-01-27 09:10:20
NtSystemRoot C:\Windows
NtProductType NtProductWinNt
NtMajorVersion 10
NtMinorVersion 0
PE MajorOperatingSystemVersion 10
PE MinorOperatingSystemVersion 0
PE Machine 34404
PE TimeDateStamp Wed Jan 4 04:27:11 1995
以下图片取自BetaWorld Wiki。
提示：战术目镜，黄色头发，他相信自己的操作天衣无缝，但内存中总会留下脚印
验证码
一堆png文件搅在一起
我最开始是直接GHex一股脑输入的，然而……
啊这……
提示：tupper
可能指向Tupper自指公式，其中那几位数字可能是k值。
然而……
user@TUSKEDEV ~/p/v/验证码 [2]> python -m tupper Traceback (most recent call last): File "/usr/lib/python3.10/runpy.py", line 187, in _run_module_as_main mod_name, mod_spec, code = _get_module_details(mod_name, _Error) File "/usr/lib/python3.10/runpy.py", line 157, in _get_module_details code = loader.get_code(mod_name) File "", line 1017, in get_code File "", line 947, in source_to_code File "", line 241, in _call_with_frames_removed File "/home/user/projects/vnctf/验证码/tupper.py", line 6 def f(x,y): ^ IndentationError: unindent does not match any outer indentation level
