跳至主要内容

记一次混淆算法逆向分析

原文来自乌云，备份地址

0x00 前言

小弟最近整理之前的资料，偶然发现半年前的混淆对抗研究以及一道CTF练习题目，故分享以作记录。限于水平，难免会有疏漏或者错误之处，望各位读者批评指正。

0x01 基本分析

jeb打开文件，找到方法校验方法。逻辑很简单，校验函数既是Native函数check.
public native boolean check(String arg1) {
}

protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    this.setContentView(2130903040);
    this.inputCode = this.findViewById(2131099648);
    this.btn_submit = this.findViewById(2131099649);
    this.btn_submit.setOnClickListener(new View$OnClickListener() {
        public void onClick(View v) {
            if(MainActivity.this.check(MainActivity.this.inputCode.getText().toString())) {
                MainActivity.this.startActivity(new Intent(MainActivity.this, ResultActivity.class));
            }
            else {
                Toast.makeText(MainActivity.this.getApplicationContext(), "Incorrect Password!", 
                        0).show();
            }
        }
    });
}
直接使用IDA默认Loader打开直接崩溃，存在畸形ELF文件对抗，使用自定义LOADER加载，也是然并卵的节奏。
使用Tracer动态打印check函数地址，挂起进程，dump出对应的代码段加载到IDA，找到check函数。
seg000:4561E4E8 check
seg000:4561E4E8                 LDR             PC, =sub_4561E4EC
seg000:4561E4E8 ; End of function check
seg000:4561E4E8
seg000:4561E4EC ; =============== S U B R O U T I N E   seg000:4561E4EC sub_4561E4EC                            ; CODE XREF: check j
seg000:4561E4EC                                         ; DATA XREF:    seg000:4561E4EC                 STMFD           SP!, {R0-R12,LR}
seg000:4561E4F0                 LDR             R0, =6
seg000:4561E4F4                 B               loc_4561E444
通过分析发现，其实为一个汇编stub，通过此stub跳到真正的check函数。
seg013:80A0135C sub_80A0135C                            ; DATA XREF: seg013:80A13F98 o
seg013:80A0135C                 B               sub_80A065B8
seg013:80A0135C ; End of function sub_80A0135C
seg013:80A01360
seg013:80A01360 ; =============== S U B R O U T I N E   seg013:80A01360 ; Attributes: thunk
seg013:80A01360
seg013:80A01360 sub_80A01360                            ; DATA XREF: sub_80A065C4+C o
seg013:80A01360                 B               sub_80A065F8
seg013:80A01360 ; End of function sub_80A01360
seg013:80A01364 ; =============== S U B R O U T I N E   seg013:80A01364 ; Attributes: thunk
seg013:80A01364
seg013:80A01364 sub_80A01364                            ; CODE XREF: sub_80A06620 j
seg013:80A01364                 B               sub_80A0663C
seg013:80A01364 ; End of function sub_80A01364
以80A0135C(B sub_80A065B8)为例子，跟进sub_80A065B8，可以看到如下指令：
// 0x80A0135C
seg013:80A065B8                 BEQ             loc_80A0658C
seg013:80A065BC                 BNE             loc_80A0658C

seg013:80A0658C                 STMFD           SP!, {R3-R8,R10,LR} 真实指令
seg013:80A06590                 STMFD           SP!, {R8,LR}
seg013:80A06594                 LDR             R8, loc_80A065A4
seg013:80A06598                 LDR             R8, loc_80A065A8
seg013:80A0659C                 LDR             R8, loc_80A065AC
seg013:80A065A0                 LDR             R8, locret_80A065B0
seg013:80A065A4                 LDR             R8, =(sub_80A065C4 - 0x80A065B0)
seg013:80A065A8                 ADD             R8, PC, R8 ; sub_80A065C4
seg013:80A065AC                 STR             R8, [SP,#4]
seg013:80A065B0                 LDMFD           SP!, {R8,PC}

seg013:80A065C4                 STMFD           SP!, {R8,LR}
seg013:80A065C8                 LDR             R8, =0xFFFFAD25
seg013:80A065CC                 EOR             R8, R8, #0xAD
seg013:80A065D0                 ADD             R8, PC, R8 ; loc_80A01360 //返回到80A01360
seg013:80A065D4                 STR             R8, [SP,#8+var_4]
seg013:80A065D8                 LDMFD           SP!, {R8,PC}
通过分析可以得到真实指令(STMFD SP!, {R3-R8,R10,LR})，其余指令为混淆指令，最终返回到下一条B即80A01360(B sub_80A065F8)指令。通过分析其他B指令，可以得到类似的混淆指令中夹在一条真实指令，只是存在多种混淆的方式。 至此，我们可以得到此混淆的思路：执行"一个B指令"即一条真实的指令，混淆抽象为:
  • 执行前跳转混淆
  • 真实指令
  • 执行后跳转混淆
不难发现，如果仅仅靠一条一条的寻找真实指令，是非常费时费力的。由于执行前后都存在多种模式的混淆，但总的模式是有限的，那么通过提取指令特征匹配即可以自动化实现去混淆，找出真实指令。

0x02 基于指令特征匹配对抗混淆

通过分析找到所有的混淆模式，最后大概几种。限于篇幅，列举一些做说明
// 0x80A0135C
seg013:80A065B8                 BEQ             loc_80A0658C
seg013:80A065BC                 BNE             loc_80A0658C

seg013:80A0658C                 STMFD           SP!, {R3-R8,R10,LR} 真实指令

seg013:80A06590                 STMFD           SP!, {R8,LR}
seg013:80A06594                 LDR             R8, loc_80A065A4
seg013:80A06598                 LDR             R8, loc_80A065A8
seg013:80A0659C                 LDR             R8, loc_80A065AC
seg013:80A065A0                 LDR             R8, locret_80A065B0
seg013:80A065A4                 LDR             R8, =(sub_80A065C4 - 0x80A065B0)
seg013:80A065A8                 ADD             R8, PC, R8 ; sub_80A065C4
seg013:80A065AC                 STR             R8, [SP,#4]
seg013:80A065B0                 LDMFD           SP!, {R8,PC}

seg013:80A065C4                 STMFD           SP!, {R8,LR}
seg013:80A065C8                 LDR             R8, =0xFFFFAD25
seg013:80A065CC                 EOR             R8, R8, #0xAD
seg013:80A065D0                 ADD             R8, PC, R8 ; loc_80A01360
seg013:80A065D4                 STR             R8, [SP,#8+var_4]
seg013:80A065D8                 LDMFD           SP!, {R8,PC}
执行前混淆：B(连续两条条件完全相反的指令) next_jmp 执行后混淆：这里有两组STMFD--LDMFD构成的跳转stub,但其是为一种模式。那如何计算next_jmp呢？这里我采用取巧的方式，通过从LDMFD所在地址反向找到ADD指令，得到";loc_80a01360"，再解析出地址80a01360。当然，存在多种prefix，需要作简单处理获取地址。
def prefix_match(str):
    pattern = ['sub_', 'loc_', 'unk_', 'locret_']
    for prefix in pattern:
        if str.find(prefix) > -1:
            substr = str[str.find(prefix) + len(prefix):]
            return string.atoi(substr, 16)
    return 0xffffffff;
真实指令：通过解析跳转遍历完整个混淆后，通过堆栈平衡原理，提取出真实指令。以上述分析为例，遍历回到下一条指令80a01360后，对指令进行分组即(B)(STMFD SP!, {R3-R8,R10,LR})(STMFD-LDMFD)(STMFD-LDMFD)，非常容易获取真实指令。实现时，可将分组过程可融入到指令的遍历即可。
再接着看另一组混淆，以80A01360(B sub_80A065F8)为例。
// 0x80A01360
seg013:80A065F8                 STMFD           SP!, {R0,LR}
seg013:80A065FC                 LDR             R0, loc_80A0660C
seg013:80A06600                 LDR             R0, loc_80A06610
seg013:80A06604                 LDR             R0, loc_80A06614
seg013:80A06608                 LDR             R0, locret_80A06618
seg013:80A0660C                 LDR             R0, =(loc_80A065E0 - 0x80A06618)
seg013:80A06610                 ADD             R0, PC, R0 ; loc_80A065E0
seg013:80A06614                 STR             R0, [SP,#4]
seg013:80A06618
seg013:80A06618                 LDMFD           SP!, {R0,PC}

seg013:80A065E0                 LDR             R3, [R0] //真实指令

seg013:80A065E4                 STMFD           SP!, {R0,LR}
seg013:80A065E8                 MOV             LR, PC
seg013:80A065EC                 BL              loc_80A065F0
seg013:80A065F0
seg013:80A065F0 loc_80A065F0                            ; CODE XREF: seg013:80A065EC j
seg013:80A065F0                 LDMFD           SP!, {R0,LR}

seg013:80A065F4                 B               sub_80A06620

seg013:80A06620                 B               sub_80A01364
执行前混淆：STMFD-LDMFD跳转到loc_80A065E0。获取next_jmp和上述一致。
执行后混淆：通过STMFD-LDMFD和两次B直接跳转返回到下一条B指令地址sub_80A01364。
真实指令：和上述类似，遍历混淆指令时，对指令进行分组(STMFD-LDMFD)、(LDR R3, [R0])、(B)、(B)。易获取真实指令(LDR R3, [R0])。
通过上述方法，大概分析20个多有的B指令即可找到所有的混淆模式，总的来说混淆的模式是有限的。
通过编写IDAPython脚本，即可实现自动打印真实指令。
0x80a0135c            PUSH            {r3, r4, r5, r6, r7, r8, sl, lr}
0x80a01360            LDR             r3, [r0]
0x80a01364            MOV             r1, r2
0x80a01368            MOV             r6, r2
0x80a0136c            LDR             r3, [r3, #0x2a4]
0x80a01370            MOV             r2, #0
0x80a01374            MOV             r4, r0
0x80a01378            BLX             r3
0x80a0137c            MOV             r7, r0
但存在问题，当IDA并没有识别出指令时，无法通过GetMnem等API获取信息。
p1
由于混淆对IDA指令识别的影响，致使IDA无法自动将指令反汇编出来。可能已经有读者意识到，遇到这种情况直接调用MakeCode将数据转化为指令即可。然而，实际使用MakeCode自动处理时，并不能完成手动按'C'识别指令的功能。那么，是否遇到这种情况后，就手动去完成指令反汇编呢？答案是否定的。由于存在很多这种情况，手动转化也很费时(测试环境IDA6.8)。
到这里可以看到，单纯依靠简单的字符串匹配比较的方法，并不能完全满足自动化提取指令对抗混淆的需求。

0x03 基于指令解析执行对抗混淆

通过上述分析，由于IDA存在无法自动反汇编一部分opcode数据，故单纯依靠IDAPython是无法满足指令解析指令的需求的。为了实现对指令的解析，可采用两种途径：
  1. 对照arm汇编手册，编写常见的opcode解析脚本。以笔者的经验，这部分内容是比较耗时的。
  2. 引入现有的反汇编引擎，且这种反汇编引擎具备对指令的想尽分析的能力。这里，我选用Capstone。
Capstone是一款支持多种架构的反汇编引擎，支持对汇编指令粗略和详细的分析，支持多种语言。当然，Capstone还有很多其他优点，这里就不赘述了。
3.1 ARM处理器模拟
可能有读者马上会问，模拟arm处理器执行不又是一大工程呢。的确，完全模拟确实包含许多工作量。但结合此混淆的一些特性，整个模拟执行可简化许多。
首先，此混淆并不存在流程分支扁平化(与OLLVM相对比)。结合上述分析也可以看到，所有的混淆执行并不会影响条件标志即CPSR寄存器。
再者，结合堆栈平衡原理，SP寄存器仅仅只需要保存堆栈的变化，比如stmfd仅仅对SP寄存器进行减法操作。
最后，根据上述找到的混淆模式，可以发现使用的指令其实很少，实际编写模拟函数工作量也比较小。
def do_emulate(code, base, Rx):
    ret_addr = 0xffffffff
    emu = ARM_emu()
    md = Cs(CS_ARCH_ARM, CS_MODE_ARM)
    md.detail = True

    for i in md.disasm(code, base):
        emu.regs[PC] = i.address + 2 * inst_size
        dst = i.operands[0]
        src = i.operands[1]

        if (i.mnemonic).upper() == 'LDR':
            if dst.type == ARM_OP_REG and src.type == ARM_OP_MEM:
                Rd = conv_reg(dst.value.reg)    
                Rs = conv_reg(src.value.mem.base)
                addr = emu.regs[Rs] + src.value.mem.disp
                emu.regs[Rd] = Dword(addr & 0xffffffff)

                if Debug:
                    print ('\t LDR %s :\t0x%x' %(i.op_str, emu.regs[Rd]))

        elif (i.mnemonic).upper() == 'ADD':
            if i.operands[0].type == ARM_OP_REG and i.operands[1].type == ARM_OP_REG and i.operands[2].type == ARM_OP_REG:
                Rd = conv_reg(i.operands[0].value.reg)
                R1 = conv_reg(i.operands[1].value.reg)
                R2 = conv_reg(i.operands[2].value.reg)
                emu.regs[Rd] = (emu.regs[R1] + emu.regs[R2]) & 0xffffffff

                if Debug:
                    print ('\t ADD %s :\t0x%x' %(i.op_str, emu.regs[Rd]))
        ...
在模拟执行一条真实指令时，首先将所有寄存器的初始值设置为0，通过主流程中的B指令进入到混淆指令。
3.2 真实指令提取
模拟执行时，将混淆中的每条指令都存储到一个指令堆栈中。结合之前直接字符串模式的思路，来实现对真实指令的提取。
以80A01364为例子来说明真实指令的提取方法。
seg013:80A01364 sub_80A01364                            ; CODE XREF: sub_80A06620 j
seg013:80A01364                 B               sub_80A0663C

seg013:80A0663C                 BMI             loc_80A06648
seg013:80A06640                 BPL             loc_80A06644
seg013:80A06644
seg013:80A06644 loc_80A06644                            ; CODE XREF: sub_80A0663C+4 j
seg013:80A06644                                         ; sub_80A0663C:loc_80A06648 j
seg013:80A06644                 B               loc_80A06624
seg013:80A06648 ; 
seg013:80A06648
seg013:80A06648 loc_80A06648                            ; CODE XREF: sub_80A0663C j
seg013:80A06648                 B               loc_80A06644

seg013:80A06624 loc_80A06624                            ; CODE XREF: 
seg013:80A06624                 MOV             R1, R2
seg013:80A06628                 STMFD           SP!, {R0,LR}
seg013:80A0662C                 MOV             LR, PC
seg013:80A06630                 BL              loc_80A06634
seg013:80A06634 ; 
seg013:80A06634
seg013:80A06634 loc_80A06634                            ; CODE XREF: sub_80A0663C-C j
seg013:80A06634                 LDMFD           SP!, {R0,LR}
seg013:80A06638                 B               sub_80A0664C

seg013:80A0664C sub_80A0664C                            ; CODE XREF: sub_80A0663C-4 p
seg013:80A0664C                 B               sub_80A01368
若不在模拟执行中对指令堆栈修正，那么执行完后存储指令如下所示：
80A0663C    BMI     loc_80A06648
80A06648    B       loc_80A06644
80A06644    B       loc_80A06624
80A06624    MOV     R1, R2
80A06628    STMFD   SP!, {R0,LR}
80A06630    BL      loc_80A06634
80A06634    LDMFD   SP!, {R0,LR}
80A06638    B       sub_80A0664C
80A0664C    B       sub_80A01368
对于BMI，虽然形式上和之前分析的(BEQ loc_80A0658C,BNE loc_80A0658C)直接跳到next_jmp，但检测下一条指令即可根据条件相反去处。
对于STM-LDM，当遇到LDM指令时，将STM-LDM及其之间的指令出栈移除。
剩余(B B MOV B)这些指令，根据上述人工分析的结果可知，因为只存在一条真实指令，那么MOV必定是真实指令。另外，存在这种情况(B B BNE B)，产生这种情况的根本原因是混淆前这条指令是if或者循环语句的判定点，直接取出BNE指令即可。
3.3 函数识别
不管是基于指令名称匹配还是解析执行，都需要对函数进行识别。先来看一个函数混淆片段：
seg013:80A067F0 loc_80A067F0                    ; CODE XREF: seg013:loc_80A06838 j
seg013:80A067F0                 ADR             LR, sub_80A06814
seg013:80A067F4                 STMFD           SP!, {R8,R9,LR}
seg013:80A067F8                 LDR             R8, loc_80A067FC
seg013:80A067FC
seg013:80A067FC loc_80A067FC                            ; DATA XREF: seg013:80A067F8 r
seg013:80A067FC                 LDR             R9, =0x1A6016A4
seg013:80A06800                 ADD             R8, R9, R8
seg013:80A06804                 ADD             R8, PC, R8 ; j_strlen
seg013:80A06808                 STR             R8, [SP,#8]
seg013:80A0680C                 LDMFD           SP!, {R8,R9,PC}
对于未混淆的指令，函数通常被编译为BL或者BLX(指令模式切换)。由于B指令本身的跳转地址范围很有限，那么混淆后代码膨胀必定需要对其指令修正，有点类似InlineHook指令修正。另外，函数的返回地址需要显式存放到LR寄存器。
这样，上述代码在模拟执行时，当LR寄存器值不为0时，将后续的函数调用转化为'Call sub_xxx'指令，将PC置为next_jmp(sub_80A06814)接着模拟。
另外，便于更加清晰的分析，将libc.so加载到和进程一致的基地址，通过IDAPython GetFunctionName获取函数名称。
至此，即可提取出真实指令，check函数流程：
0x80a0135c            PUSH            {r3, r4, r5, r6, r7, r8, sl, lr}
0x80a01360            LDR             r3, [r0]
0x80a01364            MOV             r1, r2
0x80a01368            MOV             r6, r2
0x80a0136c            LDR             r3, [r3, #0x2a4]
0x80a01370            MOV             r2, #0
0x80a01374            MOV             r4, r0
0x80a01378            BLX             r3
0x80a0137c            MOV             r7, r0
0x80a01380            call  j_strlen
0x80a01384            ADD             sl, r0, #1
0x80a01388            MOV             r8, r0
0x80a0138c            MOV             r0, sl
0x80a01390            call  j_malloc_0
0x80a01394            MOV             r1, r7
0x80a01398            MOV             r2, sl
0x80a0139c            MOV             r5, r0
0x80a013a0            call  j_memcpy
0x80a013a4            LDR             r3, [r4]
0x80a013a8            MOV             r2, #0
0x80a013ac            STRB            r2, [r5, r8]
0x80a013b0            LDR             r3, [r3, #0x2a8]
0x80a013b4            MOV             r2, r7
0x80a013b8            MOV             r0, r4
0x80a013bc            MOV             r1, r6
0x80a013c0            BLX             r3
0x80a013c4            LDR             R0, =0x12BC4
0x80a013c8            MOV             r1, #0x80
0x80a013cc            LDR             R0, [PC,R0]
0x80a013d0            call  0x80a01048
0x80a013d4            ADD             r5, r5, r0
0x80a013d8            MOV             r0, r5
0x80a013dc            call  0x80a010c0
0x80a013e0            MOV             r4, r0
0x80a013e4            MOV             r0, r5
0x80a013e8            call  j_free_1
0x80a013ec            MOV             r0, r4
0x80a013f0            POP             {r3, r4, r5, r6, r7, r8, sl, pc}

0x04 算法逆向分析

通过简单分析check即可看到算法的核心流程在0x80a010c0这个函数，而0x80a01048函数的功能是对指令路径上的断点进行检测，和其他平台的反调试思路类似，这里把重点放在0x80a010c0的逆向上。自动化分析得到0x80a010c0函数：
0x80a010c0            PUSH            {r4, r5, r6, r7, r8, sb, sl, lr}
0x80a010c4            LDR             R7, =0x12EB4
0x80a010c8            SUB             sp, sp, #0x308
0x80a010cc            ADD             r6, sp, #4 
0x80a010d0            LDR             R7, [PC,R7]
0x80a010d4            LDR             r3, [r7]
0x80a010d8            MOV             r4, r0
0x80a010dc            MOV             r1, #0
0x80a010e0            MOV             r2, #0x100
0x80a010e4            MOV             r0, r6
0x80a010e8            ADD             r5, sp, #0x104 
0x80a010ec            STR             r3, [sp, #0x304]
0x80a010f0            call  j_memset
0x80a010f4            MOV             r1, #0
0x80a010f8            MOV             r2, #0x100
0x80a010fc            MOV             r0, r5
0x80a01100            call  j_memset
0x80a01104            MOV             r0, r4
0x80a01108            call  j_strlen
0x80a0110c            SUBS            sb, r0, #0
0x80a01110            MOVEQ           r0, sb
0x80a01114            BNE             #0x80a01130
0x80a01118            LDR             r2, [sp, #0x304]
0x80a0111c            LDR             r3, [r7]
0x80a01120            CMP             r2, r3
0x80a01124            BNE             #0x80a01334
0x80a01128            ADD             sp, sp, #0x308
0x80a0112c            POP             {r4, r5, r6, r7, r8, sb, sl, pc}

//获取代码段起始256字节作为key
0x80a011bc            LDR             R0, =0x12DC0   //读取代码段起始地址
0x80a011c0            LDR             LR, =0x66666667
0x80a011c4            MOV             r4, #0
0x80a011c8            LDR             R0, [PC,R0]
0x80a011cc            MOV             r3, r0
0x80a011d0            SMULL           r2, ip, lr, r4
0x80a011d4            ASR             r2, r4, #0x1f
0x80a011d8            LDRB            r1, [r3]
0x80a011dc            RSB             r2, r2, ip, asr #1
0x80a011e0            ADD             r2, r2, r2, lsl #2
0x80a011e4            RSB             r2, r2, r4
0x80a011e8            STRB            r1, [r6, r4]
0x80a011ec            ADD             r4, r4, #1
0x80a011f0            CMP             r4, #0x100
0x80a011f4            ADD             r3, r3, r2
0x80a011f8            BNE             #0x80a011d0

//key变换流程
0x80a01218            MOV             r3, #0
0x80a0121c            MOV             r0, r3
0x80a01220            ADD             r4, r4, #1
0x80a01224            ADD             r6, sp, #0x308
0x80a01228            AND             r4, r4, #0xff
0x80a0122c            ADD             r1, r6, r4
0x80a01230            LDRB            r2, [r1, #-0x304] 
0x80a01234            LDRB            r8, [r5, r3] 
0x80a01238            AND             ip, r3, #7 
0x80a0123c            ADD             r0, r2, r0
0x80a01240            AND             r0, r0, #0xff
0x80a01244            ADD             r6, r6, r0
0x80a01248            LDRB            sl, [r6, #-0x304]
0x80a0124c            ASR             sb, r8, #5
0x80a01250            ORR             r8, sb, r8, lsl #3 
0x80a01254            STRB            sl, [r1, #-0x304] 
0x80a01258            STRB            r2, [r6, #-0x304]
0x80a0125c            LDRB            r6, [r1, #-0x304]
0x80a01260            ADD             sl, sp, #0x308
0x80a01264            RSB             r1, ip, #8 // 8 - [0, 7]
0x80a01268            ADD             r2, r2, r6
0x80a0126c            AND             r2, r2, #0xff
0x80a01270            ADD             r2, sl, r2
0x80a01274            LDRB            r2, [r2, #-0x304]
0x80a01278            EOR             r2, r2, r8
0x80a0127c            AND             r2, r2, #0xff
0x80a01280            LSL             r1, r2, r1 
0x80a01284            ORR             ip, r1, r2, asr ip // 循环左移(8 - i)位
0x80a01288            STRB            ip, [r5, r3] 
0x80a0128c            ADD             r3, r3, #1
0x80a01290            CMP             r3, #0x100
0x80a01294            BNE             #0x80a01220

for(i = 0; i < 0x100; i++){
    left_rotate(right_rotate(mid_code[i], 5) ^ key_stream[i], 8 - (i % 8));
...
限于篇幅，就不在一一分析。其中包括RC4算法。最后得到算法编码主流程：
char gen_mid_code[N];
char key_stream[N];

for(i = 0; i < N; i++){
    gen_mid_code[i] = left_rotate(str[gen_index(i, strlen(str))], 8 - (i % 8));
}
gen_key_stream(ori_key, key_stream);
RC4_encrypt(gen_mid_code, key_stream, final_code);
for(i = 0; i < N; i++){
    if(final_code[i] != check_code[i]){
            ...
    }
}
最后，得到flag:Hello Tomorrow!
至此，此ctf题目大致分析完毕。
题目下载地址：http://pan.baidu.com/s/1hrqZH9E
标签：

Popular posts from 产品随想的博客

《Becoming Steve Jobs》Chapter 12 Two Decisions

Jim Collins, the bestselling author of the management classics Built to Last: Successful Habits of Visionary Companies and Good to Great: Why Some Companies Make the Leap … and Others Don’t, has a wonderful phrase to describe an essential characteristic of great leaders: deep restlessness. Collins applies the phrase to Steve, one of the two great leaders who inspire him the most (the other is Winston Churchill, the great English politician who was prime minister during most of World War II, from 1940 to 1945, and again from 1951 to 1955). Collins believes this restlessness is far more important and powerful than simple ambition or raw intelligence. It is the foundation of resilience, and self-motivation. It is fueled by curiosity, the ache to build something meaningful, and a sense of purpose to make the most of one’s entire life. 自己何其有幸，在不到30的年纪，就能感受到乔布斯的心境 “The things he was trying to do,” says Collins, “were always hard. Sometimes those things beat him up. But the response to fighti...
阅读全文

可能比较危险的

全网监控公司： 1）中国厦门的美亚柏科 2）KIS（Knowlesys Intelligence System） 3）除中美之外的第三大AI监控技术供应商是：日本的NEC Corporation 中国的VPN公司： 1）VyprVPN、玲珑加速器 Point： 1）被GFW屏蔽的IP，反向也会无法访问大陆网络
阅读全文

Steve Jobs at 44, By Michael Krantz, 1999

Differences and Similarities Between Apple and Pixar Apple turns out many products--a dozen a year; if you count all the minor ones, probably a hundred. Pixar is striving to turn out one a year. But the converse of that is that Pixar's products will still be used fifty years from now, whereas I don't think you'll be using any product Apple brings to market this year fifty years from now. Pixar is making art for the ages. Kids will be watching Toy Story in the future. And Apple is much more of a constant race to continually improve things and stay ahead of the competition.  His Role At Pixar At Pixar my job is to help build the studio and recruit people and help create a situation where they can do the best work of their lives. And to some degree it's the same at Apple. But at Pixar, I don't direct the movies, whereas at Apple probably, if I had to pick a role out of a film production, I'd be the director. So it...
阅读全文

《Becoming Steve Jobs》Chapter 15 The Whole Widget

What the world did see was an effective and visionary leader at the height of his powers. These were complicated years for Apple, but Steve handled almost every challenge in exactly the manner he wanted. He had fallen into leadership at such a young age, but he was comfortable in that role now, and justifiably sure of his capacity to guide Apple’s tens of thousands of employees to the goals he set for them. During these years, he would ensure the company’s continued success in personal computers by engineering a deft switch to a new kind of microprocessor; ruthlessly and successfully managing some major transitions in his executive team; and optimizing and building upon the efficiency and ambition of the company’s product development “treadmill,” as Tim Cook describes it. This is also when he delivered what is likely to be remembered as the most notable product of his life, the iPhone, and then improved even that by pivoting once again into a strategy he personally had not wanted to pu...
阅读全文

ISSUU使用指南--木喵

作者： 木喵   出处： Wonderworks 问：issuu是什么？ 答：Issuu是国外的一个在线文档共享网站，它是你的PDF文档发布专家。它类似于我们熟悉的youtube，但它共享的是文档、杂志之类的文本。 简而言之、同志们想看国外的各种杂志？ 想找国外的汇报文本么？ 想借鉴国外学生的作品集么？ 那么你就要用到它啦~ 今天主要和大家讲两个方面 一、如何在pc端使用和下载issuu上的pdf文档 首先我们打开issuu的网址 https://issuu.com/ 我们可以很清楚的看到网页上呢都是国外的杂志以及一些作者自己制作的pdf文档 首先我们点击右上角的 sign up  然后填写相关信息注册一个账户： 注册完成之后我们就可以搜索我们想要找的资料： 比如说，我想找一些分析图的资料，我们就搜索： architecture diagram 然后我们就可以看到相关的文档了： 点击你所选择的文档， 好了问题来了： sorry，this publication is not available 这个时候！就需要在用pc端的我们做一件必不可少的事： 翻墙 然后我们就能将页面刷新粗来了 好、接下来是非常有建设性意义的一步 怎样把我们网页上的文件 下载下来 呢？ 截图？ no~no~no~ 接下来，让木喵告诉你怎么下载： 首先你需要复制上面的网址 然后将 https://wenfan.hk/issuu/index_link.php 在另一个网址中打开 将你之前复制的pdf的网址粘贴在下面的对话框中 点击 I‘m not a robot 再点击 get it 然后会出现一堆网址代码 我们 全选 打开你的迅雷点击 新建 将你之前的复制粘贴到下载链接里 然后呢~我们就全都下载成功啦~ 然后我们回到之前的网页向下看 我们可以看到有上传文档的作者（记得要关注哟） 然后还有 info   share   stack   ❤ 如果...
阅读全文

Foobar2000 组件安装教程

 原作者 博客地址   汉化作者 Asion博客   关于foobar 2000的一些资源 前言 foobar2000 由于其软件架构特点以及开放的姿态，使得第三方很容易开发组件（component）来拓展它的功能。由于在官网下载的默认安装文件只带了少量几个默认的组件，满足不了使用的需求，例如：默认不带 ape，tta，tak 等音频文件格式的解码器，很多无损压缩格式音乐没法播放。所以自己下载安装组件是必备的基本技能。 foobar2000 的中文汉化版（Asion 汉化）为了方便使用，集成了无损压缩文件解码器以及一些其它有用的插件，安装时选上即可，不喜欢折腾的建议使用汉化版。 这里组件指的是 foobar2000 标准组件（*.dll 文件），而非 vst 插件等其它插件，姑且把组件分为两类： 官方组件： 英文版安装包自带，安装时可选择； 第三方组件：非官方自带的组件 除了 foo_input_std.dll 和 foo_ui_std.dll 这两个组件是必须的外，其它的所有组件都 非必需 的，可以随需要增删。第三方组件可以去 官网 、 官方论坛 或者 官方 wiki 去找，也可以去贴吧等地逛逛。 下载 还是要强调一下，这里说的是 foobar2000 component ，不是中文网上通常说的 vst 插件。 下载好的组件包一般是 xxx.zip 或 xxx.fb2k-component 格式的文件，也有用 7z 打包的。前两种都是 zip 压缩（只要把 fb2k-component 改成 zip 文件就变成了 zip： 包）。标准状况下压缩包里的内容结构应该是 xxx.zip yyy.dll README.txt (可能没有) LICENCE.txt (可能没有) (其它杂七杂八） 除少数外一般只有一个 xxx.dll 文件.一定要注意压缩包结构不能是: xxx.zip yy folder (文件夹） zzz.dll … 否则要解压缩，提取那个 dll 文件。 安装 方法一（推荐） 打开 foobar2000 的菜单 文件 > 首选项(file >preferences) 的 组件(components...
阅读全文

巴菲特致股东信-1976年

 笔记： 为什么选择轻资产行业：当竞争疯狂时，不会强迫加入降价大战 最终选择了费雪的思想，选择能理解的优秀企业，以合理的价格买入并长期拥有 翻译： 雪球：https://xueqiu.com/6217262310/131440258 备份：https://archive.ph/XLK0S 原文： To the Stockholders of Berkshire Hathaway Inc, After two dismal years, operating results in 1976 improved significantly. Last year we said the degree of progress in insurance underwriting would determine whether our gain in earnings would be "moderate" or "major." As it turned out, earnings exceeded even the high end of our expectations. In large part, this was due to the outstanding efforts of Phil Liesche's managerial group at National Indemnity Company. In dollar terms, operating earnings came to $16,073,000, or $16.47 per share. While this is a record figure, we consider return on shareholders' equity to be a much more significant yardstick of economic performance. Here our result was 17.3%, moderately above our long-term average and even further above the average o...
阅读全文

《Becoming Steve Jobs》Chapter 11 Do Your Level Best

As a mass-market consumer electronics device, the iPod would eventually be sold, of course, all the usual places: Best Buy, Circuit City, big-box department stores, and even the computer retailers like CompUSA. Steve disdained all these outlets. His obsession with his products continued well after they’d been manufactured. The tacky, low-margin hustle of these chains ran completely against the minimalist aesthetic of his products and the clean exuberance of his marketing. There was only one place where he really enjoyed seeing his products sold to the public: his own Apple stores, which had debuted four months ahead of the iPod. 觉得那些喧嚣、嘈杂的零售渠道，配不上自己极美的产品 Going back as far as the debut of the Mac, Steve had always groused about the way Apple computers were sold in its resellers’ stores. The way his computers were displayed and sold represented the very worst of what could go wrong when things weren’t done his way. The salespeople, always interested in quick turnover, seemed to make litt...
阅读全文

产品随想 | 陪读《Make Something Wonderful：Steve Jobs in his own words》1976-1996

  There’s lots of ways to be, as a person. And some people express their deep appreciation in different ways. But one of the ways that I believe people express their appreciation to the rest of humanity is to make something wonderful and put it out there. And you never meet the people. You never shake their hands. You never hear their story or tell yours. But somehow, in the act of making something with a great deal of care and love, something’s transmitted there. And it’s a way of expressing to the rest of our species our deep appreciation. So we need to be true to who we are and remember what’s really important to us. ──Steve, 2007 Introduction by Laurene Powell Jobs Much of what’s in these pages reflects guiding themes of Steve’s life: his sense of the worlds that would emerge from marrying the arts and technology; his unbelievable rigor, which he imposed first and most strenuously on himself; his tenacity in pursuit of assembling and leading great teams; and perhaps, above all,...
阅读全文

《Becoming Steve Jobs》Chapter 16 Blind Spots, Grudges, and Sharp Elbows

Steve could be pretty thin-skinned when someone prominent criticized the aesthetics of his products. He took great umbrage that Neil would, as Steve put it, “pop off in public like that without coming to talk to us about his technical concerns first.” From that point on he had rebuffed all of Neil’s attempts to smoke the peace pipe. 有趣 He had blind spots, grating behavioral habits, and a tendency to give in to emotional impulse that persisted his entire life. These characteristics are often used to make the case that Steve was an “asshole” or a “jerk,” or perhaps simply “binary”—that odd adjective often used to convey the sense that he was half asshole/half genius from birth to death. These aren’t useful, interesting, or enlightening descriptions. What’s more illuminating is to take a look at the specific ways in which Steve failed to do an effective job of tempering some of his weaknesses and antisocial traits, and to consider how, when, and why some of them continued to flare up even...
阅读全文