note

本文详细介绍了ActiveMQ中的两种消息存储机制:AMQ消息存储与KahaDB消息存储。AMQ通过日志文件记录消息及命令,而KahaDB则采用更高效的事务日志方式并使用B-Tree布局进行索引存储,两者均支持缓存及归档功能。

The Journal consists of a rolling log of messages and commands (such as transactional boundaries and message deletions) stored in data files of a certain length. When the maximum length of the currently used data file has been reached a new data file is created. All the messages in a data file are reference counted, so that once every message in that data file is no longer required, the data file can be removed or archived. The journal only appends messages to the end of the current data file, so storage is very fast.

• The Cache holds messages for fast retrieval in memory after they have been written to the journal. The cache will periodically update the reference store with its current message ids and location of the messages in the journal. This process is known as performing a checkpoint. Once the reference store has been updated, messages can be safely removed from the cache. The period of time between the cache updates to the reference store is configurable and can be set by the checkpoinInterval property. A checkpoint will also occur if the ActiveMQ message broker is reaching its memory limit.

• The Reference Store holds references to the messages in the Journal that are indexed by their message Id. It is actually the reference store which maintains the FIFO data structure for queues and the durable subscriber pointers to their topic messages. The index type is configurable, the default being a disk based hash Index. It is also possible to use an in-memory hashmap as well. But this is only recommended if the total number of messages expected to be hold in the message store is less than 1 million at any given time. 5.2.1.2. The AMQ Message Store Directory Structure When you start the ActiveMQ with the AMQ message store, a directory will automatically created in which the persistent messages are stored. The AMQ message store directory contains sub-directories for all the brokers that are running on the machine. It is for this reason that it is strongly recommended that each broker use a unique name. In the default configuration for ActiveMQ, the broker name is localhost which needs to changed to something unique. This directory structure is represented in Figure 5.4 - the AMQ Store directory structure.

 

Inside of the directory for a given broker, the following items will be found:

• The data directory contains the indexes and collections used to reference

the messages held in the journal. This data directory is deleted and rebuilt as

part of recovery, if the broker has not shut down cleanly. You can force

recovery by manually deleting this directory before starting the broker.

• The state directory holds information about durable topic consumers. The journal itself does not hold information about consumers, so when it is

 

recovered it has to retrieve information about the durable subscribers first to

accurately rebuild its database.

• A lock file to ensure only one broker can access this data at any given time.

The lock is commonly used for hot stand-by purposes where more than one

broker with the same name will exist on the same system yet only one broker

will be able to acquire the lock and start up, while the other broker(s) remain

in stand-by mode.

• A temp-storage directory is used for storing non-persistent messages that

can no longer be stored in broker memory. These messages are typically

awaiting delivery to a slow consumer.

• The kr-store is the directory structure used by the reference (index) part of

the AMQ message store. It uses the Kaha database by default (Kaha is part

of the ActiveMQ core library) to index and store references to messages in

the journal. There are two distinct parts to the kr-store:

• The journal directory contains the data files for the journal, and a

data-control file which holds some meta information. The data files are

reference counted, so when all the contained messages are delivered, the data

file can be deleted or archived.

• The archive directory exists only if archiving is enabled. Its default

location can be found next to the journal. It makes sense, however, to use a

separate partition or disk. The archive is used to store data logs from the

journal directory which are moved here instead of being deleted. This makes

it possible to replay messages from the archive at a later point. To replay

messages, move the archived data logs (or a subset) to a new journal

directory and start a new broker pointed to the location of this directory. It

will automatically replay the data logs in the journal.

Now that the basics of the AMQ message store have been covered, the next step is

to review its configuration. 

 

 

 

 

The KahaDB message store is a new message store that has been developed to

address some of the limitations in the AMQ message store. The AMQ message

store uses two separate files for every index (there is one index per destination) and

recovery can be slow if the ActiveMQ broker is not shutdown cleanly. The reason

for this is that all the indexes need to be rebuilt, which requires the broker to

traverse all its message logs.

To overcome these limitations, the KahaDB message store uses a transactional log

for its indexes and only uses one index file for all its destinations. It has been used

in production environments with active 10,000 connections, each connection

 

 

 

having a separate queue.

The main components of the KahaDB are very similar to that of the AMQ message

store, namely:

• A cache

• Reference Indexes

• A message journal

All index file updates are also recorded in a redo log. This ensures that the indexes

can be brought back in a consistent state. In addition, KahaDB uses a B-Tree

layout for storage as opposed to AMQ message store which keeps all of its indexes

in a persistent hash table. As the hash indexes have to be resized from time to time,

KahaDB has more consistent performance characteristics.

The difference in architecture is depicted in figure Figure 5.5 below:

 

 

 

The KahaDB store is very straight forward to use as demonstrated in its limited

configuration.

 

 

 

Inside the KahaDB directory, following directory and file structures can be found:
db log files—KahaDB stores messages into data log files nameddb-<Number>.log of a predefined size.
When a data log is full, a new one will be created, the log number being incremented. When there are no
more references to any of the messages in the data log file, it will be deleted or archived.
The archive directory—Exists only if archiving is enabled. The archive is used to store data logs that are
no longer needed by KahaDB, making it possible to replay messages from the archived data logs at a later
point. If archiving is not enabled (the default), data logs that are no longer in use are deleted from the file
system.
db.data—This file contains the persistent BTree indexes to the messages held in the message data logs.
db.redo—This is the redo file used for recovering the BTree indexes if the KahaDB message store starts
after a hard stop.
Now that the basics of the KahaDB store have been covered, the next step is to review its configuration

 

内容概要:本文详细记录了对一个Android ARM64静态ELF文件中字符串加密机制的逆向分析过程。该ELF文件的所有字符串均被加密,无法通过常规strings命令或IDA直接识别。作者通过分析发现,加密字符串存储在.rodata段,其解密所需信息(包括密文地址、长度和16位密钥)保存在.data.rel.ro段的40字节描述符中。核心解密函数sub_10F408采用自反的双pass流密码算法,结合固定密钥KEY_TERM(由.data段24字节数据计算得出),实现字节级非线性、位置与长度相关的加密。文章还复现了完整的Python解密脚本,并揭示了该保护机制的本质为代码混淆而非强加密,最终成功批量解密全部956条字符串,暴露程序真实行为,如shell命令模板、设备标识篡改、网络重置等操作。此外,文中还提及未启用的自定义壳框架及其反dump设计。; 适合人群:具备逆向工程基础的安全研究人员、二进制分析人员及对ELF保护技术感兴趣的开发者。; 使用场景及目标:①学习ELF二进制中字符串加密的典型实现方式与逆向突破口;②掌握从结构识别、函数追踪到算法还原的完整逆向流程;③理解“绑定二进制”的完整性校验设计及其局限性;④实践编写IDAPython脚本自动化提取与解密敏感数据。; 阅读建议:此资源以实战案例驱动,不仅展示技术细节,更强调逆向思维与验证方法,建议读者结合IDA调试环境,逐步跟随文中步骤进行动态分析与算法验证,深入理解每一步的推理依据。
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值