文化认同与海外统战工作研究

建立海外统一战线,是中国共产党在改革开放新时期发展爱国统一战线做出的重大决策。当前,海外侨情出现若干新特征、新问题,海外统战工作的复杂性和难度加大:华侨华人总数激增,分布状况有很大变化;华侨华人的文化素质、经济实力和社会地位大幅度提升;华侨华人与祖国的各方面联系空前密切。根据海外华侨华人群体呈现出的新特征,需要全面调整海外华侨华人统战工作的整体思路,推进海外统战工作向纵深发展。用海内外同胞认同的同根文化凝聚人心,增强中华文化的感召力,是新形势下海外统战工作的切入点和关键点。     

试论汉语在泰国语言政策中的地位变迁

汉语是泰国的一门重要外语,在泰国经历了自由发展、被限制打压和当前的迅速发展几个不同阶段。本文旨在梳理不同历史时期汉语在泰国语言政策中不同地位的基础上,指出汉语在泰国语言政策中的地位变化与中泰关系的亲疏程度、汉语工具价值的高低、泰国华人国家认同的变化等因素有密切联系。     

Integrity verification of user space code

We present a novel approach for the construction and application of cryptographic hashes to user space memory for the purposes of verifying the provenance of code in memory images. Several key aspects of Windows behaviour which influence this process are examined in-depth. Our approach is implemented and evaluated on a selection of malware samples with user space components as well as a collection of common Windows applications. The results demonstrate that our approach is highly effective at reducing the amount of memory requiring manual analysis, highlighting the presence of malicious code in all the malware sampled.     

从歧视走向平等——非婚生子女法律地位的变迁

非婚生子女作为社会的弱势群体,对其加强法律保护已成为世界各国婚姻家庭法的一个重要课题。综观世界各国亲子立法的发展史,非婚生子女的法律地位经历了受虐待和歧视的“无亲之子”阶段、被消极肯定的“形式平等”阶段、以至于发展到当今一些国家对子女的完全平等保护———实质平等。我国亲子立法应顺应世界先进亲子法的立法趋势,摒弃“非婚生子女”这一不平等称谓,制定统一的自然血亲子女制度,以子女认领制度作为确定无婚姻的父母与自然血亲子女身份关系的证明方法,保护子女的最大利益。     

摹仿签名笔迹特征的识别及鉴定价值分析研究

摹仿签名笔迹鉴定在司法实践中比较常见,它是笔迹鉴定中较难的一种。结合图片说明对摹仿签名笔迹特征的识别及其鉴定价值,以期在司法实践中,对提升鉴定人鉴定水平和能力,提高摹仿签名笔迹鉴定结论的准确性与客观性提供一定的参考依据。     

Robust Linux memory acquisition with minimal target impact

Software based Memory acquisition on modern systems typically requires the insertion of a kernel module into the running kernel. On Linux, kernel modules must be compiled against the exact version of kernel headers and the exact kernel configuration used to build the currently executing kernel. This makes Linux memory acquisition significantly more complex in practice, than on other platforms due to the number of variations of kernel versions and configurations, especially when responding to incidents. The Linux kernel maintains a checksum of kernel version and will generally refuse to load a module which was compiled against a different kernel version. Although there are some techniques to override this check, there is an inherent danger leading to an unstable kernel and possible kernel crashes. This paper presents a novel technique to safely load a pre-compiled kernel module for acquisition on a wide range of Linux kernel versions and configuration. Our technique injects a minimal acquisition module (parasite) into another valid kernel module (host) already found on the target system. The resulting combined module is then relinked in such a way as to grant code execution and control over vital data structures to the acquisition code, whilst the host module remains dormant during runtime.     

Forensic analysis of newer TomTom devices

Today many investigations involve TomTom devices due to the wide-spread use of these navigation systems. The process of acquiring a memory dump from the first generation of TomTom devices was relatively easy by utilising the USB-connection and standard forensic tools. Newer devices, however, do not provide this or any other readily available data connection, making the task much more complex. In addition to existing and relatively complex chip-extraction procedures, an easier data acquisition method was developed without the need to de-solder flash memory chips. The presence of new files and the differences in data formats found in these devices meant that new methods of data analysis and decoding also needed to be developed.     

Scanning memory with Yara

Memory analysis has been successfully utilized to detect malware in many high profile cases. The use of signature scanning to detect malicious tools is becoming an effective triaging and first response technique. In particular, the Yara library and scanner has emerged as the defacto standard in malware signature scanning for files, and there are many open source repositories of yara rules. Previous attempts to incorporate yara scanning in memory analysis yielded mixed results. This paper examines the differences between applying Yara signatures on files and in memory and how yara signatures can be developed to effectively search for malware in memory. For the first time we document a technique to identify the process owner of a physical page using the Windows PFN database. We use this to develop a context aware Yara scanning engine which can scan all processes simultaneously using a single pass over the physical image.     

走之底笔顺识别方法

目的：建立走之底笔顺的科学识别方法。方法：收集实验笔迹样本,由样本书写人报告笔顺,依据形态对样本字分类,归纳各种形态与笔顺间的规律。结果：共获得188份有效样本,书写人报告了3种走之底笔顺,走之底折笔的收笔动向、被包围部件的位置、点笔与折笔的联系等方面可以作为识别笔顺的依据。结论：建立了走之底规范笔顺、通用笔顺和特殊笔顺的识别规则。依据这套规则。可以准确识别40％以上的不连笔走之底的笔顺。