WorstFit：揭开 Windows ANSI 中隐藏的 Transformers！.pdf

1、BestFitUnveiling Hidden Transformers in Windows ANSI!Orange Tsai Splitline HuangWorstorstOne Day,I Hacked into a BankMade-up story;)$14.50 SET balance=$8$8 DEVCOREDEVCORE Research TeamOrange TsaiSplitline Huang How Windows handles Unicode?貓咪.TXTUCS-2UTF-16UTF-8Evolution of Encoding in MS WindowsSinc

2、e Windows 9xSince Windows 2000(Obsolete)Since May,2019ANSIWindows Code pagesSince NT 3.1Windows internal data stores in this way(Beta)UCS-2UTF-16UTF-8Evolution of Unicode in MS WindowsSince Windows 9xSince Windows 2000Since May,2019ANSIWindows Code pagesSince Windows NTWindows internal data stores i

3、n this way(Obsolete)(Beta)typedef wchar_t WCHAR;UTF-16LEFile NameCommand LineWindows Registry Environment VariableConsole Input(more)typedef wchar_t WCHAR;File NameCommand LineWindows Registry Environment VariableConsole Input(more)int main(int argc,char*argv,char*envp)UTF-16LEtypedef wchar_t WCHAR;

4、File NameCommand LineWindows Registry Environment VariableConsole Input(more)UTF-16LEUCS-2UTF-16UTF-8Since Windows 9x(Obsolete)Since Windows 2000Since May,2019ANSIWindows Code pagesSince NT 3.5GetEnvironmentVariableA Single byte/ANSIGetEnvironmentVariableW Wide char/UnicodeWindows OSHello48 00 65 00

5、 6c 00 6c 00 6f 00On Windows code page 1252(Latin-1)UTF-16GetEnvironmentVariableWWCHAR*env=UTF-16Hello48 00 65 00 6c 00 6c 00 6f 00Windows OSHello48 00 65 00 6c 00 6c 00 6f 00On Windows code page 1252(Latin-1)UTF-16GetEnvironmentVariableAANSIRtlUnicodeStringToAnsiStringchar*env=Hello48656c6c6fWindow

6、s OSOn Windows code page 1252(Latin-1)UTF-16GetEnvironmentVariableAANSIRtlUnicodeStringToAnsiStringv76p70737=3d838char*env=1a 22 c0 03 77 20 64 22 1e 22Bestfit!Windows OSOn Windows code page 1252(Latin-1)UTF-16GetEnvironmentVariableAANSIRtlUnicodeStringToAnsiStringv76p70737=3d838char*env=1a 22 c0 03