TendaAX12路由器0-Day栈溢出漏洞挖掘方法

随着 5G 技术对物联网发展的加速, 预计到 2025 年将会有约 250 亿台物联网设备连接到人们的生活。其中承担物联网设备网络管理角色的路由器使用量非常大, 但是路由器存在众多安全问题, 通过路由器设备进行攻击, 可以非法获取用户信息。为了维护网络安全, 提前发现路由器的漏洞具有重要的研究意义。本文以 Tenda AX12 路由器为研究对象, 从固件入手对其进行0-Day 栈溢出漏洞挖掘研究, 并提出了基于危险函数追踪的逆向分析漏洞挖掘方法。首先从危险函数中分析函数所在前端的对应位置, 将前后端对应; 然后对固件中的 Web 服务进行分析, 对其中可能发生栈溢出的 httpd 二进制代码进行危险函数分析, 该方法使用反汇编代码对危险函数的普通形式和展开形式进行定位, 并对危险函数进行参数分析和动态检测; 接着通过搭建仿真模拟机在模拟机上运行该服务的二进制文件, 并在 Web 前端页面对潜在漏洞位置进行数据包捕捉; 最后根据前期分析的危险函数参数情况对包进行改写并发送, 以此来触发漏洞, 验证漏洞的存在性, 同时验证该危险函数是否发生栈溢出。为了更真实地确定漏洞存在, 我们又在真实设备上验证漏洞的真实存在性和可利用性。实验结果表明了该漏洞的挖掘检测方法的有效性, 我们分别在不同型号的路由器上挖掘到 4 个 0-Day 漏洞, 并且经过与 SaTC 工具进行对比实验结果表明该检测方法能够更准确的定位到出现漏洞的函数位置。     

Dynamic Changes in Reactive Oxygen Species in the Shoot Apex Contribute to Stem Cell Death in Arabidopsis thaliana

In monocarpic plants, stem cells are fated to die. However, the potential mechanism of stem cell death has remained elusive. Here, we reveal that the levels of two forms of reactive oxygen species (ROS), superoxide anion free radical () and hydrogen peroxide (H₂O₂), show dynamic changes in the shoot apex during the plant life cycle of Arabidopsis thaliana. We found that the level of decreased and disappeared at four weeks after bolting (WAB), while H₂O₂ appeared at 3 WAB and showed a burst at 5 WAB. The timing of dynamic changes in and H₂O₂ was delayed for approximately three weeks in clv3-2, which has a longer lifespan. Moreover, exogenous application of H₂O₂ inhibited the expression of the stem cell determinant WUSCHEL (WUS) and promoted the expression of the developmentally programmed cell death (dPCD) marker gene ORESARA 1 (ORE1). These results indicate that H₂O₂ triggers an important signal inducing dPCD in stem cells. Given that plays roles in maintaining WUS expression and stem cell activity, we speculate that the dynamic shift from to H₂O₂ in the shoot apex results in stem cell death. Our findings provide novel insights for understanding ROS-mediated regulation during plant stem cell death.     

溢流染色机提布系统的多台电动机同步最优控制方法

根据溢流染色机多台提布电动机运行特点及染色工艺,论述溢流染色机提布系统的多台电动机控制原理及速度检测装置,提出多台提布电动机速度同步递推最优控制算法,实现多台提布电动机协调同步.然后给出多台提布电动机的同步最优控制硬件结构图,并针对六缸溢流染色机实现多台提布电动机速度同步递推最优控制算法的软件设计.应用结果表明,该方法能够使每台提布电动机储布槽的储布量趋向均等,织物的染色效果得到明显提高.     

二滩水电站坝下水垫塘的水力设计

二滩水电站采用坝身泄洪、水垫塘消能方式。本文用模型试验、计算分析和工程类比的方法,对坝下水垫塘的水力设计问题进行了探讨,结果表明,溢流拱坝下游水垫塘的设计是经济合理的,可以满足坝身泄洪消能的要求。     

基于SQL注入的渗透性测试技术研究

为了提高数据库系统的安全性,及时发现、防范网站中可能存在的SQL注入漏洞,分析了基于SQL注入的渗透性测试技术,在此基础上提出了渗透性测试的原型系统,给出了主要的功能,通过对动网论坛的渗透性测试分析比较了原型系统的效能.实验表明,该原型系统能较好发现系统的SQL注入的脆弱点,从而帮助管理员提升系统的安全性.     

堆栈溢出的BLP形式化研究及实现

堆栈溢出是一种在各种操作系统、应用软件中广泛存在普遍且危险的漏洞,可以利用它执行非授权指令,甚至可以取得系统特权,进而进行各种非法操作.从安全操作系统的角度分析了堆栈溢出的原理,以BLP模型为工具对堆栈溢出进行了形式化并在此基础上适当调整了该模型,从安全模型的层次上消除了堆栈溢出的隐患.最后给出了调整后的BLP模型在LSM(Linlux security module)上的实现.     

Autothermal sorption-enhanced steam reforming of bio-oil/biogas mixture and energy generation by fuel cells: Concept analysis and process simulation

A concept of sorption-enhanced steam reforming of bio-oil/biogas for electricity and heat generation by phosphoric acid fuel cells is investigated. The process is modeled using SIMSCI Pro II process simulator. Sorptive removal of the carbon dioxide from the reaction site results in low CO and _CO2 concentrations (<1%) in the reformate, as a result it can be used in the phosphoric acid fuel cell without any further fuel cleanup. High hydrogen concentration and calorific value of the reformate enable the operation of the fuel cell at a high-efficiency mode despite of the high carbon/hydrogen ratio of the bio-fuel. Addition of biogas to the reformer enables autothermal operation of the reformer, as well as significantly improves the efficiency of the process. The simulation shows that the overall efficiency of the proposed system is compatible with the efficiency of the system using “classical” steam reforming of the fuel. The process exhibits 6% lower electrical efficiency compared to the system utilizing natural gas, and 4.6% higher efficiency compared to a system using bio-oil as a fuel.     

Fast computation of the spherical harmonic perturbation on an artificial satellite

Up till now, among the numerical computation methods of the spherical harmonic perturbation on an artificial satellite, the computation speed of Cunningham's method is the fastest However, running programs based on this method easily causes overflow. A method is presented, which has a computation speed higher than that of any other methods, and can avoid overflow in operation, even when the order and degree of the Earth's spherical harmonic perturbation are extended to 100 × 100 or more. It satisfies the requirements of the high-accuracy SLR, GPS, LLR, etc. This method has been programmed and used in practice Now a large-scale calculation related to the satellite precision ephemeris could be done just with a microcomputer.     

硫铵结晶稠化器的优化设计

为解决硫铵结晶稠化器由于设计不合理造成的管线堵塞、溢流问题,通过对稠化器增加蒸汽吹扫、安装视镜、加大稠化器顶部空间、采用可调溢流挡板等措施,确保了管线的畅通、离心机进料的稳定,减少了硫胺产品中己内酰胺的夹带。     

酵母生物合成S-腺苷-L-蛋氨酸的动力学研究

研究了酿酒酵母在葡萄糖和L-蛋氨酸存在时生物合成S-腺苷-L-蛋氨酸(SAM)的规律。在高溶氧(DO>40%)条件下,SAM产率及L-蛋氨酸转化率分别达到了82.2 mgg-1和37.4%。将代谢溢流模型推广应用到包括酵母生长和加前体生物转化过程的动力学研究,结果表明,该模型能较好地描述实验数据。