这里会显示出您选择的修订版和当前版本之间的差别。
两侧同时换到之前的修订记录 前一修订版 | 后一修订版 两侧同时换到之后的修订记录 | ||
jaysnote:2345_com [2019/01/21 17:18] jaylee |
jaysnote:2345_com [2019/07/29 14:13] jaylee |
||
---|---|---|---|
行 1: | 行 1: | ||
- | < | + | < |
- | # 2345.com # | + | # gac-350 node development env set up |
- | 浏览器被污,所有主页均设置为2345.com, | + | |
- | ## 网上的一些方法 ## | + | 本文详细介绍基于gac-350 门禁的node windows 开发环境的搭建,以及用以该门禁远程编译调试node工程。 |
- | * 尝试在浏览器中设主页 | + | |
- | [IE主页被改成2345网址大全怎么删除2345网址导航](http://jingyan.baidu.com/article/656db9189f1560e380249c73.html) | + | gac-350 |
- | 无效 | + | |
- | * 确定桌面快方式中,启动浏览器命令被更改。 | + | * [smart-device-node gitlab](http: |
- | 确定未更改 | + | |
- | * 设置注册表 | + | > |
- | 无效 | + | |
- | * 删除注册表中所有2345.com相关项 | + | gac-350 smart-device-node 通过typescript 编码实现,ts通过解释成js后运行。 |
- | 删除后无效 | + | |
- | * 删除浏览器重新安装 | + | - [typestript](https:// |
- | 徐晓 | + | - [TypeScript in 5 minutes](https:// |
- | * 删除2345 安装插件 | + | - [Running and debugging TypeScript](https://www.jetbrains.com/help/idea/running-and-debugging-typescript.html) |
- | [怎么彻底删除2345主页?2345网址导航彻底清理教程!](http://www.sdbeta.com/mf/2014/1128/24207.html) | + | - [Running and Debugging Node.js](https://www.jetbrains.com/help/idea/ |
- | 没有找到该插件 | + | |
- | * 找到2345首页文件,尝试替换后锁定。 | + | 集成开发环境使用itellij,习惯vs的可以选择vs201x/ |
- | [win7系统彻底删除2345网址导航](http://jingyan.baidu.com/article/03b2f78c1bdbd05ea337ae62.html) | + | |
- | 未找到 | + | * [ide itellij idea](https:// |
- | * 卸载谷歌浏览器 | + | |
- | 重装问题依然。 | + | gac-350 门禁通过supervisor守护node 工程运行,程序入口通过supervisor配置文件到npm start 再到 `packge.json` 包管理的start命令。 |
- | ## 尝试自己解决 ## | ||
- | 怀疑是有一个守护进程,以上更改生效后立即被重新更改,导致无效。尝试在`任务管理器`-> | ||
- | ![](http:// | ||
``` | ``` | ||
- | 映像 PID 类型 句柄名称 | + | supervisor-> |
- | explorer.exe 9484 Mutant \Sessions\1\BaseNamedObjects\http: | + | |
- | explorer.exe 9484 File C:\Users\JaysThinkPad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I4IR8LS1\2345_160926[1].eot | + | |
- | explorer.exe 9484 File C:\Users\JaysThinkPad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VFB0GG7W\2345_com[1].htm | + | |
``` | ``` | ||
- | 不难看出这里主要是资源管理器相关,怀疑是有程序直接注入了explorer.exe, | ||
- | 我们尝试按照一线方法结束资源管理器进程的这些Mutex。 | + | ## install |
- | [Kill mutex (mutant) of an other process](https:// | + | |
- | 下载handle.exe | + | |
- | ```bat | + | |
- | Microsoft Windows [版本 6.1.7601] | + | |
- | 版权所有 (c) 2009 Microsoft Corporation。保留所有权利。 | + | |
- | C: | + | ### itellij |
- | H:\Program Files\Handle>handle64.exe -p 9300 -a 2345 | + | itellij 直接通过 [ide itellij idea](https:// |
+ | |||
+ | * 修改本机host文件 | ||
+ | |||
+ | ```bash | ||
+ | 0.0.0.0 account.jetbrains.com | ||
+ | 0.0.0.0 www.jetbrains.com | ||
+ | ``` | ||
+ | |||
+ | * 添加注册码 | ||
+ | |||
+ | ```bash | ||
+ | 56ZS5PQ1RF-eyJsaWNlbnNlSWQiOiI1NlpTNVBRMVJGIiwibGljZW5zZWVOYW1lIjoi5q2j54mI5o6I5p2DIC4iLCJhc3NpZ25lZU5hbWUiOiIiLCJhc3NpZ25lZUVtYWlsIjoiIiwibGljZW5zZVJlc3RyaWN0aW9uIjoiRm9yIGVkdWNhdGlvbmFsIHVzZSBvbmx5IiwiY2hlY2tDb25jdXJyZW50VXNlIjpmYWxzZSwicHJvZHVjdHMiOlt7ImNvZGUiOiJJSSIsInBhaWRVcFRvIjoiMjAyMC0wMy0xMCJ9LHsiY29kZSI6IkFDIiwicGFpZFVwVG8iOiIyMDIwLTAzLTEwIn0seyJjb2RlIjoiRFBOIiwicGFpZFVwVG8iOiIyMDIwLTAzLTEwIn0seyJjb2RlIjoiUFMiLCJwYWlkVXBUbyI6IjIwMjAtMDMtMTAifSx7ImNvZGUiOiJHTyIsInBhaWRVcFRvIjoiMjAyMC0wMy0xMCJ9LHsiY29kZSI6IkRNIiwicGFpZFVwVG8iOiIyMDIwLTAzLTEwIn0seyJjb2RlIjoiQ0wiLCJwYWlkVXBUbyI6IjIwMjAtMDMtMTAifSx7ImNvZGUiOiJSUzAiLCJwYWlkVXBUbyI6IjIwMjAtMDMtMTAifSx7ImNvZGUiOiJSQyIsInBhaWRVcFRvIjoiMjAyMC0wMy0xMCJ9LHsiY29kZSI6IlJEIiwicGFpZFVwVG8iOiIyMDIwLTAzLTEwIn0seyJjb2RlIjoiUEMiLCJwYWlkVXBUbyI6IjIwMjAtMDMtMTAifSx7ImNvZGUiOiJSTSIsInBhaWRVcFRvIjoiMjAyMC0wMy0xMCJ9LHsiY29kZSI6IldTIiwicGFpZFVwVG8iOiIyMDIwLTAzLTEwIn0seyJjb2RlIjoiREIiLCJwYWlkVXBUbyI6IjIwMjAtMDMtMTAifSx7ImNvZGUiOiJEQyIsInBhaWRVcFRvIjoiMjAyMC0wMy0xMCJ9LHsiY29kZSI6IlJTVSIsInBhaWRVcFRvIjoiMjAyMC0wMy0xMCJ9XSwiaGFzaCI6IjEyMjkxNDk4LzAiLCJncmFjZVBlcmlvZERheXMiOjAsImF1dG9Qcm9sb25nYXRlZCI6ZmFsc2UsImlzQXV0b1Byb2xvbmdhdGVkIjpmYWxzZX0=-SYSsDcgL1WJmHnsiGaHUWbaZLPIe2oI3QiIneDtaIbh/ | ||
+ | ``` | ||
+ | |||
+ | ### node | ||
+ | |||
+ | node 解释器和sdk通过[nodejs.org](https:// | ||
+ | |||
+ | ### run | ||
+ | |||
+ | 成功安装itellij后通过New->Project-> | ||
+ | |||
+ | > **提示**: | ||
+ | |||
+ | 如果要在windows上面编译工程,需要添加 Run-> Edit Configurationss->+ npm | ||
+ | |||
+ | * package.json 为工程根目录下的`package.json` 文件; | ||
+ | * command 为`start` | ||
+ | * Node interprter 为如上node安装路径。 | ||
+ | * 详细配置如下:![itellij debug node](intellij_node_debug.png) | ||
+ | |||
+ | 同时可配置远程机器运行直接配置到gac-350门禁上运行调试。 | ||
+ | |||
+ | * 初次使用该功能需要手动添加node.js 远程解释器插件。 | ||
+ | |||
+ | File-> | ||
+ | |||
+ | > **提示**:详细参考[Configure Node.js Remote Interpreter Dialog](https:// | ||
+ | |||
+ | * 成功安装node.js 远程插件过后通过Run-> | ||
+ | |||
+ | * 详细配置如下图: | ||
+ | |||
+ | ![远程调试](note_js_remote_interpreter.png) | ||
+ | |||
+ | > **提示**: 需要提前远程设备root账号和密码,同时允许ssh root账号登录。 | ||
+ | |||
+ | ## troubleshooting | ||
+ | |||
+ | ### 编译失败 | ||
+ | |||
+ | ```bash | ||
+ | Error:(2, 21) TS2307: Cannot find module ' | ||
+ | Error:(6, 16) TS2503: Cannot find namespace ' | ||
``` | ``` | ||
- | ```bat | ||
- | H:\Program Files\Handle> | ||
- | Nthandle v4.1 - Handle viewer | ||
- | Copyright (C) 1997-2016 Mark Russinovich | ||
- | Sysinternals - www.sysinternals.com | ||
- | explorer.exe pid: 1480 type: File F88: C:\Users\JaysThinkPad\A | + | |
- | ppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I4IR8LS1\234 | + | ### 本地运行提示 Cannot find cross-env.js |
- | 5_160926[1].eot | + | |
- | explorer.exe pid: 1480 type: Mutant | + | ```bash |
- | jects\http:// | + | internal/ |
- | explorer.exe pid: 1480 type: File 1228: C: | + | throw err; |
- | ppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UN36B2RC\234 | + | ^ |
- | 5_com[1].htm | + | |
- | explorer.exe pid: 1480 type: File 16EC: G: | + | Error: Cannot find module 'D:\MyProject\smart-device-node\node_modules\cross-env\dist\bin\cross-env.js' |
- | -2345.com | + | at Function.Module._resolveFilename (internal/ |
- | explorer.exe pid: 1480 type: File 16F4: G: | + | at Function.Module._load (internal/ |
- | -2345.com | + | at Function.Module.runMain (internal/ |
+ | at startup (internal/ | ||
+ | at bootstrapNodeJSCore (internal/ | ||
``` | ``` | ||
- | ```bat | + | |
- | > | + | 如上文,已经反复提示,初次安装需要手动解压安装根目录下的node_modules.zip 压缩包。 |
- | ``` | + | |
- | 按照以上方法结束了所有的2345句柄,同时尝试删除注册表和本地文件,问题依然。 | + | ### 远程调试提示Illegal instruction |
- | 但是这里发现一个问题,就是explorer中的句柄并不是一直存在的,是启动浏览器后被主动注入的。 | + | |
- | 但是启动搜狗浏览器的时候却没有改句柄,说明是浏览器程序本身被污染了。 | + | ```bash |
- | 同时不难看出IE浏览器也是同样的方式被注入了句柄。 | + | / |
- | ``` | + | bash: line 1: 11260 Illegal instruction |
- | 映像 PID 类型 句柄名称 | + | |
- | iexplore.exe 4744 File C: | + | |
- | iexplore.exe 4744 File C:\Users\JaysThinkPad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UN36B2RC\2345_com[1].htm | + | |
- | iexplore.exe 4744 Mutant \Sessions\1\BaseNamedObjects\http://www.2345.com/ | + | |
``` | ``` | ||
- | ### Handles and Objects ### | + | 暂时地,门禁版本过于7,不支持debug功能。 |
- | [Pushing the Limits of Windows: Handles](https:// | + | |
- | The kernel-mode core of Windows, which is implemented in the %SystemRoot%\System32\Ntoskrnl.exe image, consists of various subsystems such as the Memory Manager, Process Manager, I/O Manager, Configuration Manager (registry), which are all parts of the Executive. Each of these subsystems defines one or more types with the Object Manager to represent the resources they expose to applications. For example, the Configuration Manager defines the key object to represent an open registry key; the memory manager defines the Section object for shared memory; the Executive defines Semaphore, Mutant (the internal name for a mutex), and Event synchronization objects (these objects wrap fundamental data structures defined by the operating system’s Kernel subsystem); the I/O Manager defines the File object to represent open instances of device driver resources, which include file system files; and the Process Manager the creates Thread and Process objects I discussed in my last Pushing the Limits post. Every release of Windows introduces new object types with Windows 7 defining a total of 42. You can see the objects defined by running the Sysinternals [Winobj ](https://technet.microsoft.com/en-us/sysinternals/bb896657.aspx)utility with administrative rights and navigating to the ObjectTypes directory in the Object Manager namespace: | + | '--inspect=0.0.0.0: |
+ | |||
+ | https://nodejs.org/zh-cn/docs/ | ||
- | ### [Hunting Malware with Memory Analysis](https:// | + | ```bash |
- | ```BAT | + | 在版本 7 以及更早的版本使用 |
- | H:\Program Files\volatility_2.4.win.standalone> | + | |
- | H:\Program Files\volatility_2.4.win.standalone> | + | |
- | H:\Program Files\volatility_2.4.win.standalone> | + | |
- | H:\Program Files\volatility_2.4.win.standalone> | + | |
``` | ``` | ||
- | ### 360 系统急救箱 ### | + | http://mirrors.sohu.com/debian/pool/main/n/nodejs/ |
- | **12/ | + | |
- | 最后还是通过360系统急救箱扫描解决问题,有些异常可能和2345.com有关系。安装过程发现根本没有办法安装系统急救箱工具,因为在不能在 资源管理器中新建 “SuperKiller.exe”,怀疑其和Explorer启动项有关系。将360压缩包中的SuperKiller.exe 重命名后解压正常。 | + | |
- | ![](http://www.leconiot.com/md_res/jaysnote/2345_com/images/ExplorerStartItem.png) | + | |
- | </ | + | 低版本node不支持itellij 调试,需要安装高版本的node->debian Jessie 版本太低不支持高版本node所以需要切换到sid、experimental 源更新libc和gcc-> |
+ | </ |