.NET Corner

.NET Code Protectors, Obfuscators And more

debasish — Tue, 23 Jan 2007 14:10:00 GMT

Honestly, I'm a frequent user of infamous .NET decompiler - Reflector (http://www.aisto.com/roeder/dotnet/). Hacking vanilla .NET assemblies are insanely easy with this tool. Now that I'm writing my own .NET based product (which will be launched soon and I'm pretty much sure that it will be immensely popular in Indian music lovers. I will write a fresh post while launching the tool) my attention is turned into the protection of my own assemblies. After researching a bit I came to conclusion that .NET code protection strategies broadly can be divided into these categories.

A. Traditional obfuscators - symbol renaming, control flow obfuscation are generally falls into this category. Visual Studio comes with a community edition of .NET Obfuscator or DotFuscator. But it is not impressive. 9rays, RemoteSoft, Xenocode are some known names in the word of .NET obfuscators.

B. Secure IL Stream - Basic strategy is to impose a secure envelope around the .NET assembly to be protected. Another component (which needs to be deployed to the client spaces) attaches itself to the execution engine (EE) of CLR and decodes the secured IL just before handing over to the JIT compiler. This decoding is extremely specific and on-demand based. Effectively, at a time only a few functions' IL remains decoded into the memory. Details can be found at http://www.secureteam.net/solutionsTechnology.asp

C. This is perhaps the most rigorous endeavor to protect .NET assemblies till date. Basic idea is to get some user information (username or user ID or user's Hardware ID - HID or license file) and use this to encrypt/compress the assembly which needs to be secured (often prior to this, there is a Assembly Packing stage where all non-system referenced assemblies of the main executable are packed into a master assembly with suitable entrypoint). Then the binary image is added to a Win32 stub as a Win32 resource. This stub usually has a specific entrypoint which upon loading extracts the special resource (binary image added earlier on the fly) , asks for the user information (username or user ID or user's Hardware ID - HID or license file) , uses this to decrypt/decompress the extracted resource, hosts the CLR (there could be a policy about the loading of the CLR) , create a secure appdomain , loads the decrypted assembly image into the appdomain and starts executing its entrypoint (which is normally the Main method). Symmetric encryption technique is enforced here. The purpose of this entire process is to build up a native-code wall around the .NET assembly to be protected. Naturally Reflector fails badly. To get an example of this technique visit - http://www.eziriz.com/. Now I was pretty impressed by this tool called .NET Reactor. But like any other shareware it is not free and to be true - expensive. I decided it would be a good idea to jump into my new project - .NETCodeProtector - modeled around this strategy. I'm on the way to finish it and I promise I will publish it into the SourceForge along with a relevant post here at DNJ. Anyway I like to share the solution structure of the project -

1. ClrHostStub : It is the Win32 Stub with CLR hosting code embedded into it.
2. AssemblyPacker: Optionally packs multiple non-system referenced assemblies into a master assembly with suitable entrypoint.
3. PackToStub: This component is used to add the assembly (or packed assembly) into the Win32 stub as a Win32 resource.

Apart from discussing various .NET code protection strategies, this post also shows how I used to pick up my next project. Well, see you soon. Happy programming.

Thanks
Debasish Bose

WindowsDefender Penetrated

debasish — Sun, 14 Jan 2007 12:37:00 GMT

Disclaimer: Opinion mentioned in this post is of my personal one, not Microsoft's. Patching to bypass WGA is illegal, so please proceed with your own responsibility. Please don't install pirated copies of Windows. Always buy genuine one.

Lately, my laptop became infected with so many spywares. It forced me to recall my old friend Microsoft AntiSpyware which is rewritten in Managed C++ and transformed into WindowsDefender. Although I've a MSDN subscription, I was unable to find the download link for it. Normally it is protected under WGA or Windows Genuine Advantage. I don't why the WGA ActiveX(LegitCheckControl.dll) is always redirecting to the 'Unauthorized' page. After I downloaded MGAdiag.exe from http://go.microsoft.com/fwlink/?linkid=52012 , the reason became crystal-clear. VLK blocked! Hmmm... Anyway I got the direct link from http://download.microsoft.com/download/e/d/0/ed099d5e-dc60-4740-8747-1c72f053b800/WindowsDefender.msi. But because of double WGA check, the installation ends prematurely. Now first idea would be to patch LegitCheckControl.dll itself. But it didn't work either. The reason is WGA check library has been embedded into the MSI as a binary module. Following snapshot is found in table 'Binary' at ORCA's dis-assembly

You can find ORCA at Platform SDK. Now I was inspecting the 'ControlEvent' table and it's column header attracts my attention -

The table simply says when you are at 'Dialog', if you press 'Control', a new 'Event' will happen with argument - 'Argument' if 'Condition' is satisfied. Based on this lets judge the following picture -

The highlighted line says, if ((LegitCheckResult <> "0") && (LegitCheckResult <> "6")), then if you press Next button, SetupCompleteWGAError dialog will appear which is nothing but the dialog which says that 'You have a counterfeit version of Windows'. The row just above it, have a condition which is just complement of the current one and proceeds towards LicenseAgreement dialog. So to patch it, simply change the 'SetupCompleteWGAError' to 'LicenseAgreement'. This will install WindowsDefender on the system. But as you know, WindowsDefender works in conjunction with Windows Automatic Update (wuaucpl.cpl) which is important to update the spyware signature database. Happy hacking.

Thanks
Debasish Bose

Recreate gacutil - Part 2

debasish — Sun, 03 Dec 2006 06:16:00 GMT

Get the short introductory part 1 here.

After the initial inspection was finished, I was pretty much surprised by looking at the existing assembly unGACing code. The code expects full path of the concerned assembly, create a temporary appdomain, inject following class(Util) into the appdomain and get the full qualified name(strong name) for the assembly, then uninstall with the help of IRegister interface.

  internal class Util : MarshalByRefObject
{
    internal string FullAssemblyName(string name)
    {
      return Assembly.LoadFrom(name).FullName;
    }
}

Crap to say at least. The first thing I did was to learn something about GACed assembly enumeration. If any COM enumeration interface exist, wrap it up in a .NET enumerator or create a custom GAC assembly enumerator from scratch. The second option needs explicit knowledge about GAC folder hierarchy under the hood of %WINDIR%\assembly folder. This would expose my implementation to break often as GAC changes internally. Not to mention 64 bit GAC handling, because in a typical 64 bit box different GACs can exist - GAC_32(32 bit CLR), GAC_64(64 bit CLR), GAC_MSIL(Any CPU) etc. So the first option wins. Fortunately enough there is a relevant COM enumeration interface.

[SuppressUnmanagedCodeSecurityAttribute()]
[ComImport, Guid("21B8916C-F28E-11D2-A473-00C04F8EF448"), InterfaceType(1)]
internal interface IAssemblyEnum
{
  [PreserveSig]
  int GetNextAssembly([Out] out IApplicationContext ppAppCtx, [Out] out IAssemblyName ppName, uint dwFlags);
  [PreserveSig]
  int Reset();
  [PreserveSig]
  int Clone([Out] out IAssemblyEnum ppEnum);
}

This demands the declarations of the following interfaces - IApplicationContext and IAssemblyName

[SuppressUnmanagedCodeSecurityAttribute()]
[ComImport, Guid("7C23FF90-33AF-11D3-95DA-00A024A85B51"), InterfaceType(1)]
internal interface IApplicationContext
{
  void SetContextNameObject(IAssemblyName pName);
  void GetContextNameObject([Out] out IAssemblyName ppName);
  void Set([MarshalAs(UnmanagedType.LPWStr)] string szName, int pvValue, uint cbValue, uint dwFlags);
  void Get([MarshalAs(UnmanagedType.LPWStr)] string szName, [Out] out int pvValue, ref uint pcbValue, uint dwFlags);
  void GetDynamicDirectory([Out] out int wzDynamicDir, ref uint pdwSize);
}

[SuppressUnmanagedCodeSecurityAttribute()]
[ComImport, Guid("CD193BC0-B4BC-11D2-9833-00C04FC31D2E"), InterfaceType(1)]
internal interface IAssemblyName
{
  [PreserveSig]
  int SetProperty(uint PropertyId, IntPtr pvProperty, uint cbProperty);
  [PreserveSig]
  int GetProperty(uint PropertyId, IntPtr pvProperty, ref uint pcbProperty);
  [PreserveSig]
  int Finalize();
  [PreserveSig]
  int GetDisplayName(IntPtr szDisplayName, ref uint pccDisplayName, uint dwDisplayFlags);
  [PreserveSig]
  int BindToObject(object refIID, object pAsmBindSink, IApplicationContext pApplicationContext, [MarshalAs(UnmanagedType.LPWStr)] string szCodeBase, long llFlags, int pvReserved, uint cbReserved, [Out] out int ppv);
  [PreserveSig]
  int GetName(ref uint lpcwBuffer, [Out, MarshalAs(UnmanagedType.LPWStr)] StringBuilder pwzName);
  [PreserveSig]
  int GetVersion([Out] out uint pdwVersionHi, [Out] out uint pdwVersionLow);
  [PreserveSig]
  int IsEqual(IAssemblyName pName, uint dwCmpFlags);
  [PreserveSig]
  int Clone([Out] out IAssemblyName pName);
}

Now the time for .NET wrapper on top of the COM enumeration interface

internal abstract class AssemblyCacheEnumerator : IEnumerator
{
  protected AssemblyCacheEnumerator(string assemblyName,int cache)
  {
      //Assembly name passed in may be partial, therefore enumerate matching assemblies
      //for uninstallation of each one.
        IAssemblyName fusionName = null;
        int hr = 0;

      //Create the COM enumeration object
        Fusion.CreateAssemblyEnum(out this.m_ae, null, fusionName, (uint)cache, 0);
  }

  bool IEnumerator.MoveNext()
  {
   IApplicationContext context1 = null;
   return (0 == this.m_ae.GetNextAssembly(out context1, out this.m_anCurrent, 0));
}

  void IEnumerator.Reset()
  {
   this.m_ae.Reset();
  }

  // Properties
  object IEnumerator.Current
  {
   get
   {
    return this.m_anCurrent;
   }
  }

  // Fields
  private IAssemblyEnum m_ae;
  private IAssemblyName m_anCurrent;

}

Now this is a generic assembly cache enumerator not a GAC enumerator. Assembly cache has three subzones - GAC, NGenCache and DownloadCache.

[Flags]
internal enum AssemblyCacheFlags
{
  NGenCache   = 0x1,
  GAC     = 0x2,
  DownloadCache  = 0x4
}

For GAC subzone following subclass is defined

internal class GacEnumerator : AssemblyCacheEnumerator
{
  public GacEnumerator(string assemblyName) : base(assemblyName,(int)AssemblyCacheFlags.GAC)
  {
  }
}

It's time for the core Fusion interface - IRegister

[SuppressUnmanagedCodeSecurityAttribute()]
[ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown), Guid("e707dcde-d1cd-11d2-bab9-00c04f8eceae")]
internal interface IRegister
{
    [PreserveSig()]
    int UninstallAssembly(uint dwFlags, [MarshalAs(UnmanagedType.LPWStr)] string pszAssemblyName, IntPtr pvReserved, out uint    pulDisposition);
    [PreserveSig()]
    int QueryAssemblyInfo(uint dwFlags, [MarshalAs(UnmanagedType.LPWStr)] string pszAssemblyName, IntPtr pAsmInfo);
    [PreserveSig()]
    int CreateAssemblyCacheItem(uint dwFlags, IntPtr pvReserved, out /*IRegisterItem*/IntPtr ppAsmItem, [MarshalAs(UnmanagedType.LPWStr)] String pszAssemblyName);
    [PreserveSig()]
    int CreateAssemblyScavenger(out object ppAsmScavenger);
    [PreserveSig()] to be
    int InstallAssembly(uint dwFlags, [MarshalAs(UnmanagedType.LPWStr)] string pszManifestFilePath, IntPtr pvReserved);
}

And here goes the core Fusion API

[DllImport("Fusion.dll", CharSet=CharSet.Auto)]
internal static extern int CreateAssemblyCache(out IRegister ppAsmCache, uint dwReserved);

The main unGAC function basically creates the assembly cache, create the enumerator, get the strong name for each IAssemblyName references and call UninstallAssembly function on IRegister interface. But there was a small problem. While "partial" assembly name was passed, it was not expanding to all its matches. There has to be something missing. MSDN docs were helpless. Then as a fallback I digged into SSCLI. I found following unmanaged(C++) code at http://dotnet.di.unipi.it/Content/sscli/docs/doxygen/tools/gac/gac_8cpp-source.html

//Name passed in may be partial, therefore enumerate matching assemblies
00357     //and uninstall each one. Uninstall API should be called with full name ref.
00358
00359     //Create AssemblyName for enum
00360     if ((hr = (*g_pfnCreateAssemblyNameObject)(&pEnumName, pszAssemblyName, CANOF_PARSE_DISPLAY_NAME, NULL)))
00361     {
00362         BSILENT_PRINTF0ARG("Failure removing assembly from cache: ");
00363         ReportError(hr);
00364         if (pCache) pCache->Release();
00365         return false;
00366     }
00367
00368
00369     //
00370     // For zaps, null out the custom string
00371     if (bzapCache)
00372     {
00373             DWORD dwSize = 0;
00374             //Check if Custom string has been set
00375     hr = pEnumName->GetProperty(ASM_NAME_CUSTOM, NULL, &dwSize);
00376
00377             if (!dwSize)
00378             {
00379             //Custom String not set - set to NULL to unset property so lookup is partial
00380                     pEnumName->SetProperty(ASM_NAME_CUSTOM, NULL, 0);
00381             }
00382     }
00383
00384     hr = (*g_pfnCreateAssemblyEnum)(&pEnum,
00385                             NULL,
00386                             pEnumName,
00387                             bzapCache ? ASM_CACHE_ZAP : ASM_CACHE_GAC,
00388                             NULL);

Note the difference with the AssemblyCacheEnumerator constructor - An extra call to CreateAssemblyNameObject Fusion API which translates to following C# code

IAssemblyName fusionName = null;
int hr = 0;

if (assemblyName != null)
{
     //Create AssemblyName for enumeration
     hr = Fusion.CreateAssemblyNameObject(
                        out fusionName,
                        assemblyName,
                        CreateAssemblyNameObjectFlags.CANOF_PARSE_DISPLAY_NAME,
                        0);
}

//Create the COM enumeration object
Fusion.CreateAssemblyEnum(out this.m_ae, null, fusionName, (uint)cache, 0);

The main uninstall function is given below

static internal int UnRegFile(string assembly)
{
      IRegister ac = null;
      uint n;
      int hr = CreateAssemblyCache(out ac, 0);
      if (hr != 0)
        return hr;
      else
      {
         IAssemblyName name = null;
         IEnumerator enumerator = null;

         //Create the GAC enumerator
         enumerator = new GacEnumerator(assembly);

         string sDisplayName = null;
         while (enumerator.MoveNext())
         {
           //Get the assemblyname from the set of GACed assemblies that matched
            //with the given partial name.If full name is provided this set will
            //contains exactly one element
            name = (IAssemblyName) enumerator.Current;

//Get the displayname of the assembly
sDisplayName = Fusion.GetDisplayName(name,AssemblyNameDisplayFlags.ALL);

#if VS8
           //Here we will count only .NET 2.0 assemblies(which has the processorArchitecture
           //attribute as part of assembly strongname.
           if (sDisplayName.Contains(processorArchitecturex86) ||
               sDisplayName.Contains(processorArchitecturemsil))
           {
#endif
               //The following API always expects a full name instead of a partial name
               hr = ac.UninstallAssembly(0, sDisplayName.ToString(), (IntPtr)0, out n);
               if (hr != 0)
                   break;
#if VS8
                }
#endif

                //Release COM object
    Marshal.ReleaseComObject(name);
   }

   return hr;
  }
}

All the DllImport declarations for Fusion APIs are pushed into an internal class called Fusion which also houses the implementation of the GetDisplayName function

internal class Fusion
{
  [DllImport("Fusion.dll", CharSet=CharSet.Auto)]
  public static extern int CreateAssemblyEnum(out IAssemblyEnum ppEnum, IApplicationContext pAppCtx, IAssemblyName pName, uint dwFlags, int pvReserved);

  [DllImportAttribute("Fusion.dll", CharSet = CharSet.Unicode)]
  public static extern int CreateAssemblyNameObject(
          out IAssemblyName ppEnum,
          string szAssemblyName,              // A string representation of the assembly name or of a full assembly reference that

                                              //is determined by dwFlags. The string representation can be null.
          CreateAssemblyNameObjectFlags dwFlags,
          int pvReserved);                    // Must be null.

  internal static string GetDisplayName(IAssemblyName aName, AssemblyNameDisplayFlags displayFlags)
  {
   uint uiLen = 0;
   string sDisplayName = null;
   aName.GetDisplayName(IntPtr.Zero, ref uiLen, (uint)displayFlags);
   if (uiLen > 0)
   {
    IntPtr ptr1 = IntPtr.Zero;
    byte[] buffer1 = new byte[(uiLen + 1) * 2];
    unsafe
    {
     fixed (byte* numRef1 = buffer1)
     {
      ptr1 = new IntPtr((void*) numRef1);
      aName.GetDisplayName(ptr1, ref uiLen, (uint)displayFlags);
      sDisplayName = Marshal.PtrToStringUni(ptr1);
     }
    }
   }
   return sDisplayName;
  }
}

Congrats! You've successfully recreated the gacutil utility.

Re: Although this utility gives you somewhat similar functionality of gacutil, in a typical production deployment MSI should be used. Aaron Stebner has pointed that out here -
http://blogs.msdn.com/astebner/archive/2006/11/04/why-to-not-use-gacutil-exe-in-an-application-setup.aspx

Enumerating Sound Recording Devices

debasish — Sat, 25 Nov 2006 08:54:00 GMT

In one of my projects I need to enumerate through all the sound recording devices installed in my system. Now to do so logic is simple.

int count := Get the count of sound in devices;
for each i in [0, count - 1]
get the device capabilities(i);
print the name(i);
end for

Retrieving the total count of sound recording devices was the simpler part. Following P/Invoke declaration was enough

[DllImport("winmm.dll")]
public static extern int waveInGetNumDevs();

The tough part was to get the device capabilities. The relevant API was

MMRESULT waveInGetDevCaps(
  UINT_PTR     uDeviceID, 
  LPWAVEINCAPS pwic,      
  UINT         cbwic      
);

Although this link describes the data structure of LPWAVEINCAPS fairly well, the C# declaration was really hard to guess. After a lot of trial & error I finally came accross following signature

[StructLayout(LayoutKind.Sequential, Pack = 4)]
public sruct WaveInCaps
{
     public short wMid;
     public short wPid;
     public int vDriverVersion;

    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 32)]
     public char[] szPname;

     public uint dwFormats;
     public short wChannels;
     public short wReserved1;
}

Keep an eye on the SizeConst=32(MAXPNAMELEN) attribute for the szPname's marsalling requirements. Rest of the story is simple

int waveInDevicesCount = WaveLib.WaveNative.waveInGetNumDevs();
if (waveInDevicesCount > 0)
{
     for (uint uDeviceID = 0; uDeviceID < waveInDevicesCount; uDeviceID++)
    {
           WaveLib.WaveInCaps waveInCaps = new WaveLib.WaveInCaps();
           WaveLib.WaveNative.waveInGetDevCaps(uDeviceID,
                                               out waveInCaps,
                                               Marshal.SizeOf(typeof(WaveLib.WaveInCaps)));

cmbWaveInDevices.Items.Add(new string(waveInCaps.szPname));
}
}

End of quick'n'dirty post

Skype, Recording And .NET

debasish — Wed, 25 Oct 2006 22:26:00 GMT

Lately, I've became an absolute fan of Skype. Some time back Yahoo Messanger was failing, saying..."Mixer Device Initialization Fails"...when 5 people or so were trying to have a voice conference call. We tried Skype. It worked instantly. By then I'm interested in what I do best - hacking. This time skype hacking. Some of the meetings I do over skype is really long. It would be nice to have an utility or plugin(++skype may be) which will record the conference session and compress it to mp3/ogg/flac/wma files. By searching I came to know about following tools -

KishKish SAM
KishKish SAM Skype plug-in records Skype conversations automatically once the incoming Skype call is answered by you. In an Outgoing Skype call you will need to wait until the call is answered by the other party. The voice recording can be stopped or resumed at any time during the call. [$15.95]

PowerGramo Recorder for Skype
PowerGramo Free version is a good option if the Skype conversation involves only two persons. The Skype call can be of any duration and will be recorded in the OGG or WAV format. The por version supports Multiple-call people conference recording. PowerGramo will work on older versions of Skype include Skype 1.1 [Free/$19.95]

HotRecorder for VoIP
Hot Recorder for VoIP is a popular Skype Call recording plugin for the PC. Not just Skype, you can use HotRecorder to record voice conversations from any IM client including Google Talk, AOL AIM, Net2Phone, Yahoo! Messenger or Firefly. The audio recordings can be saved to WAV, OGG or MP3 files. The HotRecorder Voicemail feauture will automatically answer Skype conversations for you. [$14.95]

Pamela 2.0 Professional
While the basic version of Pamela is free and supports voice and video answering machine, the Pro version supports skype voice recording and can also record Skypecasts, Skype Video and Skype Chats. You can also make a local playable copy of your Skype Voicemail with Pamela Skype addon. Pamela also generates HTML template code for posting the recorded Skype audio and video calls as podcasts or blog entries. [$24.95]

Its not doubt that those tools worth have a try and has some nice add-on feature-set. But none is free. So I decided to write my own Skype recorder in my yammi platform - .NET. The only drawback of this nice tool(category: Direct Sound Recorder without a dedicated device driver) is that it's not a plugin. But I will try to convert it to a plugin. It also compresses the conversations into mp3 files.

Dowload SkyRec.zip. To correctly configure SkyRec, please select proper audio recorder from the Mixer Device Selection. For my case it is SoundMax Digital Audio In.

After that, select the "Stereo Mix" section in the "Recording Control" dialog.

As I said I'll make this open source. Please give me feedback. Either post it it here or "Contact" section.

Recreate gacutil

debasish — Tue, 12 Sep 2006 10:22:00 GMT

It is nice to be back at Matrix. The story begins like this -

Couple of days back we were facing some issues regarding GACing and UnGACing our primary assembly. They(install team) were using some in-house tool called ourProductReg.exe for unGACing the primary assembly , let's call it ourProductAssembly.dll. The commandline tool accepts full qualified filepath of the assembly to be uninstalled(installtion - GACing , seemed doesn't have any issue). Strange. Like below

ourProductReg.exe /u c:\....\ourProductAssembly.dll

But the intention was to uninstall all the assemblies given just the filename not the path name. Like

ourProductReg.exe /u ourProductAssembly

So this would uninstall all the assemblies named ourProductAssembly irrespective of cultures, version etc. Sounds pretty gacutil-like. So I was looking into it. Suddenly, after one hour, my assignment was revisited. This time the intention was to match more partial names including cultures or versions which were left earlier.Like

ourProductReg.exe /u ourProductAssembly, Version=1.0.0.1

This should uninstall(unGAC) all the assemblies with name ourProductAssembly and version 1.0.0.1 irrespective of the cultures. Come home to the world of gacutil. I understood that client shouldn't have entire fatty .NET SDK installed for only this management tools like gacutil.exe. But I was not aware of the reason of not distributing gacutil.exe along with our product. Later I came to know that the SDK license does not allow to distribute the tools outside of the SDK, so client will have to download the entire package. Definitely not an option.

Find the part 2 here.

IntPtr, 64 bit Porting and Fun

debasish — Tue, 25 Jul 2006 20:10:00 GMT

Guys I was busy in some HLD for past two weeks or so. I'm back now into my favourite blogspace - DNJ. Yesterday when our 64 bit porting team is working for the immediate 64 bit release of our product, they came to me for suggestion on a topic which I think worth discussing. While they are happily ported unmanaged C++ code, they were facing some difficulties with porting managed code(which should be easier! right?). In unmanaged C++ world they handled pointer disparity between the platforms...(read more)

BearShare Tips

debasish — Sun, 25 Jun 2006 14:06:00 GMT

Amongst all the P2P file sharing softwares I have came accross so far BearShare is the most efficient one. Unlike some other P2P sharing softwares like Morpheus(hosts of viruses) or LimeWare(terribly slow because of its Java Runtime dependency), BearShare is completely written in C++ and hence very lightweight and efficient. P2P softwares often has a "reputation" of being a trojan horse of various viruses, worms and spywares. This threat is very low for BearShare and if appropriate measure has been taken it could do hardly any harm to your system(for one such measure look at this earlier post of mine regarding BearShare). In this post I will discuss some of the tips and tricks that I've learnt on the way of using BearShare.

Tip - 1
Get the pro version of 5.0.2.3. The serach-space of this version is greater and this also take care of broken downloads. How to get the pro. version. Well you have to pay for it. http://www.bearshare.com/. Another tricky way is to use the BearShare Lite(Free) version itself to search for downloading pro. version. It's analogous to crack SoftIce with SoftIce.

Tip - 2
Be a little selfish. Disable uploading to increase the overall download speed and to secure your system. Do this by going Option > Setup > Upload

Tip - 3
Always make sure a file exactly is what it claims to be. Use Bitzi ticket for that. But before going on using that there exists an easier thumb rule for validation. For example if you are searching for "Half-Life 2: Episode 1" game and got a file of size 202,477 bytes you are definitely dealing with a virus or other misleading files unless it points to a valid .torrent file(which are often pretty small) which could be downloaded by any torrent client like BitTorrent. BearShare falls in a Gnutella category and doesn't support downloading through .torrent files.

Tip - 4

Anytime you suspect about a file, use Bitzi ticket. Bitzi is basically a lookup service which compares a unique SHA1 hashid(that the file presents) with its online database to show details of it. As part of the details you could found the feedback and rating of other users about it. To see the SHA1 hashid of a file unhide the metadata column from "Results" button in the search window(top-left)

In one of the Bitzi lookup I found the following feedback/rating

Clearly One souldn't continue with this download.

Tip - 5
Instead of validating each search result(which could be vary tiresome) with Bitzi lookup, Use Bitzi search and find out the most recommended version of the file. Once you have found "most recommended" or "best version" file, go to the section in details page of the file which reads "APPLICATION IDENTIFIERS".

There you should have two category of URLs - Magnet and E2DK. We are interested with the first one.
Now if you click on the link, ideally BearShare should capture that and start downloading. But world is far from being ideal. Instead it will show you following messagebox.

To fix this remove all attributes from the magnet URL except sha1(first) and dn(usually the last). So the modified magnet URL looks like

magnet:?xt=urn:sha1:ROOFD7DSBLGFZVYMNDMFACGUP7PBGZ74&dn=(PC GAME ITA) The Sims 2 CD1.iso

Put that URL to browser's addressbar and BearShare's URL manager pops up

And you know what to do next. By the way my BrainBrush(BB) series on DataStructure will continue. Just I was busy for office-work for a while. Argentina won. Ole-Ole-Oleeeeeeeeeeeeee

Binary Tree, C# and Delegates - Part 2

debasish — Wed, 31 May 2006 20:33:00 GMT

Well the "brain-brush" series continues. One of my favourite binary tree question would be given a preorder and inorder traversal strings write a function to build the tree. Most of the rubbish text books provide non-programmatic solution to this and rest append it as a to-do. Today I will proceed step-by-step to solve this and that too with same ingredients - delegate, generics and C#2.0. Disclaimer still holds: "This is just a fundamental recapitulation of binary tree and data structure as a whole. Geeks excuse me please for this series.

In the earlier post I discussed the simple data structure of treenode and binary tree. Just to repeat once following is the skeleton of my binary tree class

public class BinaryTree
{
//root node
public TreeNode root;

//Algorithms...InOrder etc.
}

Now for simplicity lets assume that the binary treenode contains single character data. So instead of embedding our tree-building algo inside this generic BinaryTree class I specialized ot to create a subclass called CharBinaryTree.

"Whitehorse" in action. Lets construct the base logic Assume we have following binary tree

Preorder traversal string and Inorder traversal strings are 124536 and 425163 respectively Lets now back calculate and see how one might can possibly build the tree. Firstly preorder string always helps to get the root right. VLR. Does it ring a bell? But then how to differntiate between left subtree(LT) and right subtree(RT). Well simple. Split the inorder string based on the pivotal root. Left substring is LT and right substring is RT. Now we have to recurse. That's fine. But what are the pivotal indexes for LT and RT. Simple - if you can see dry-run the first recursion frame

root := 1, LT := 425, RT := 63
pivot(LT) := pivot+1, pivot(RT) := pivot + len(LT) + 1.

Naturally these pivotal characters will be the roots of the respective subtrees. Enough said. Let's dump the C# code right now.

private TreeNode MakeTree(string inorderString, int preOrderIndex)
{
TreeNode p = new TreeNode(' ');

     // terminating condition
     if (inorderString.Length == 1)
     {
         char.TryParse(inorderString, out p.nodeData);
     }
     else
     {
         char pivot = this.preorderString[preOrderIndex];
         int rootIndexInorder = inorderString.IndexOf(pivot);
         string left = "";
         string right = "";

         if (rootIndexInorder > 0)
         {
             left = inorderString.Substring(0, rootIndexInorder);
             right = inorderString.Substring(rootIndexInorder + 1);

p.nodeData = pivot;

if (left.Length != 0)
p.left = MakeTree(left, preOrderIndex + 1);

             if (right.Length != 0)
                p.right = MakeTree(right, preOrderIndex + left.Length + 1);

          }

}

return p;
}

This goes the private "workhorse" function as described in my earlier post of the DS-BrainBrush series. Lets see the driver function

public TreeNode MakeTree(string inorderString, string preorderString)
{
     //Couple of pre-checks
     if ((inorderString.Length == 0) ||
         (preorderString.Length == 0))
     {
         throw new ArgumentException("Traversal strings shouldn't be empty");
     }

     if (inorderString.Length != preorderString.Length)
     {
         throw new ArgumentException("Traversal strings should have identical length");
     }

     //Make a copy of traversal strings
     this.preorderString = preorderString;
     this.inorderString = inorderString;

//Make a call to "workhorse"
this.root = this.MakeTree(this.inorderString, 0);

return this.root;
}

Everything fits nicely in the "workhorse-driver" model. In the next post of this series I will show how to create a special binary tree called Binary Expression Tree(BET) heavily used in world of lexical analyzer, parser and compilers. See you soon.

Photos.Blogger.com

debasish — Tue, 30 May 2006 16:39:00 GMT

This quick post is for just a preview and a short description about a tool I'm building right now. Many bloggers hosts their pages to a thirdparty site like this DNJ or DotNetJunkies , SQLJ etc. In many cases due to restrictions or other reasons some doesn't get access to upload pictures relevant to a specific blog. And no need to tell the importance of screenshots when you are blogging the features of your next crazy invention or experiment. But some blog-host do allow to upload photos but it happens so that you don't like that domain. Earlier my primary .NET blog was hosted by blogspot which is now blogger(Googled). But I always preferred DNJ for obvious reasons. But my account in DNJ initially has no permission to upload images or to use gallery. So I decided to write a small utility that will wrap up blogspot's photo-uploader webpage in a nice, cute C# Winform application and will return the image URLs which I can paste in any of my the DNJ's blog-posts. Initially I used to do it manually but later I devised this small application :-

Do you like it? Once finished I will publish the full source code here at DNJ. DNJ rocks.

Binary Tree, C# and Delegates - Part 1

debasish — Sat, 27 May 2006 07:56:00 GMT

During the last week I was brushing up my Data Structure fundamentals. It was great to get back the days of C style pointers, link list, binary trees etc. But at the same time I want to play around the anonymous delegates of C# 2.0. Both my wishes were granted...My data structures were based on C# generics. The TreeNode structure and the action delegate were both templatized(i.e. based on Generics

public delegate void Action<T>(TreeNode<T> p);
public class TreeNode<T>
{
//Data
public T nodeData;

        //Self pointers
        public TreeNode<T> left;
        public TreeNode<T> right;

//More stuff...
}

Pretty simple stuff. The task I wanted to implement first is to do a inorder walk down the tree without using recursion. My primary objective in this blog is to resurrect the dying spirit of Data Structure fundamentals ,not to show a new discovery or geeky stuff. Now to do an Inorder walk non-recursively we need a stack. You name it , System.Collections.Generic has it.

//declare a stack
Stack<TreeNode<T>> s = new Stack<TreeNode<T>>();
TreeNode<T> ptr = nodePtr;

do
{
  while (ptr != null)
  {
     s.Push(ptr);
     ptr = ptr.left;
  }

ptr = s.Pop();

action(ptr);

ptr = ptr.right;

}while (s.Count != 0);

Let's give the interface of the function.

private void InOrder(Action<T> action, TreeNode<T> nodePtr)

Another short pointer for the usage of private qualifier. For all(well almost) traversal algorithms of the tree it is always wise to keep two versions. One private method taking a generic TreeNode*(in C) or TreeNode(in C#) and another top level public function calling the private counterpart with the root as a value of the TreeNode* or TreeNode refrence variable. The private function is often called "workhorse.

public void InOrder(Action<T> action)
{
this.InOrder(action, root);
}

Now the funniest part. The calling portion

tree.InOrder(delegate(TreeNode<int> p)
             {
                 lblPrintTree.Text += p.nodeData.ToString();
             });

We are injecting our own callback function to the InOrder tree traversal algorithm through the anonymous generic delegate . C#2.0 is cool. Soon I will publish couple of posts in the context of same topic - "Data Structure Fundamentals" brain-brush. See part 2.

SQL Injection Attack, Inference Attack and an E-Commerce Site

debasish — Fri, 26 May 2006 20:45:00 GMT

If you want to learn real attacking techniques(SQL Injection Attack or Inference Attack) used for hacking real e-commerce sites by real hackers watch this:-

http://www.rockyh.net/AssemblyHijacking/AssemblyHijacking_media/AssemblyHijacking.wmv

AI RoboForm, BHO and C#

debasish — Sat, 20 May 2006 20:44:00 GMT

Remember the awesome AI RoboForm. Its the smartest of all web form fillers exist on earth. In case you haven't used it you can found it here. From password memorization (I'm extremely shaky about trusting any third party software expecially those deals with password, CCs etc.), to secure transfer of user data profile to removable devices by Pass2Go RoboForm has it all. Although its seems easy until I myself went on creating some proof of concept equivalent to this.
To achieve anything closer to this I need to create something called plugin. You must be saying a - 2yr-old kid also know about plugins. What's your point? To be exact I need to create something called BHOs or browser helper objects. These are some browser specific extensibility modules for doing things that the core browser engine not supposed to do. But this same thing can open up a whole new dimension to virus writers and hackers. You know its easy to sit into the lap of Internet Explorer and watch your credit card number and CCV passing by. At certain point of time(most probably around 5.5 release) Microsoft stopped the support for writing IE plugins but the model came back in the name of BHOs. As a part of SP2 patchset of XP, a BHO control manager option has been added to IE. My BHO has to be listed there in order to justify itself as a BHO!

The first thing you should do to write a BHO in managed language is to recreate the C++/COM interface signature of IObjectWithSite in C#.

[ComVisible(true),
InterfaceType(ComInterfaceType.InterfaceIsIUnknown),
Guid("FC4801A3-2BA9-11CF-A229-00AA003D7352") ]
public interface IObjectWithSite
{
  [PreserveSig]
  int SetSite ([MarshalAs(UnmanagedType.IUnknown)]object site);

  [PreserveSig]
  int GetSite (ref Guid guid, out IntPtr ppvSite);
}

Now I'm going to implement this interface. To supply the GUID for this class I called up guidgen.exe which could easily be accessed from Tools >> Create GUID

My class implementing the IObjectWithSite interface is following. Now as the same GUID has to be registered with windows registry I made the declaration of it as const string(just like static but accessible from attribute)

[ComVisible(true),
ClassInterface(ClassInterfaceType.None),
Guid(SiteWatcherBHO.BHO_GUID)]
public class SiteWatcherBHO : IObjectWithSite
{
public const string BHO_GUID = "FFF9DE52-E5A5-4217-B938-DFF5EA95B4CD"; // << Your GUID goes here
//SetSite(), GetSite() impl...
}

Before implementing meat of our BHO lets set the framework of its registration. While registering the BHO we have to create a subkey at
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ with name same as of the generated GUID tagged around the class implementing IObjectWithSite. To simplify the registering process of COM modules(BHOs fall into this category) written as a .NET module Microsoft has provided an utility called RegAsm. One of the interesting switches associated with RegAsm is /codebase. Upon providing this with the commandline, RegAsm automatically searches for a public static method in the assembly which is tagged with the ComRegisterFunction attribute. The benefit is tremendous. You can do any kind of registration work inside the function. As some COM modules require the creation of some special key at some special location this technique proves to be very useful. But if required you can go online, update your online database, call webservice ..anything inside this special method and the fun part is that all this is being done under the cosy corner of .NET. But to be good citizen and play fair you shold pair up your registration function and should provide a static method tagged with ComUnregisterFunction attribute. Reason is simple when your uninstaller calls to unregister the module, depending upon your scenario you should partially or totally undo what you have done in the registration function.

public class SiteWatcherBHO : IObjectWithSite
   {
      [ComRegisterFunction]
      internal static void RegisterFunction(Type typeToRegister) {}

      [ComUnregisterFunction]
      internal static void UnregisterFunction(Type typeToRegister) {}
   }

Below I will show the code I used in my BHO class

[ComRegisterFunction]
  public static void RegisterBHO(Type t)
  {
   try
   {
    Microsoft.Win32.Registry.LocalMachine.CreateSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{" + SiteWatcherBHO.BHO_GUID + "}");
   }
   catch(Exception e)
   {
#ifdef DEBUG
    System.Windows.Forms.MessageBox.Show(e.ToString());
#endif
   }
  }

See the const declaration of the GUID comes handy here. Another important point is the presence of preprocessor directives. Now in the production release of my CCNumberCollector BHO I'm not supposed to show any messages. Not even a log. Just devour the entire exception like what has been shown here. "Leave no trace" is The mottow for all "underground" guys. Now GetSite() and SetSite() both will be called during the creation and termination of the object we are implementing here(means our BHO object) but each time with a different argument for the site parameter. For SetSite() the site will be non-null while creation and null while termination. Now lets fix the job of our BHO. In this sample BHO I will fillup the username and password of my yahoo mail account and auto-login into it. Saying this I need an appropriate place to do all the fillup stuff. DocumentComplete event is an ideal for such scenario. Now the site object passed at SetSite() is very very precious. Because it is our beloved SHDocVw.WebBrowser instance. Once we have this at our disposal and we added a reference to MSHTML module(through Interop obviously) we can play anything with IE. To generate the Winform equivalent of IE ActiveX you have to use the AxImp tool. For the second task tlbimp is necessary.

1. aximp c:\windows\system\shdocvw.dll

2. tlbimp mshtml.tlb

The code at SetSite() implementation should look something like below

                 if (site != null)
                {
                    webBrowser = (WebBrowser)site;
                    if (webBrowser != null)
                    {
                        webBrowser.DocumentComplete += new DWebBrowserEvents2_DocumentCompleteEventHandler(webBrowser_DocumentComplete);
                    }
                }
                else
                {
                    if (webBrowser != null)
                    {
                        webBrowser.DocumentComplete -= new DWebBrowserEvents2_DocumentCompleteEventHandler(webBrowser_DocumentComplete);
                        webBrowser = null;
                    }
                }

We store the IE web browser instance in a private member of type SHDocVw.WebBrowser. Now what our DocumentComplete event handler does is very simple. If the current URL looks like a yahoo mail, it fills the username and password boxes and auto-login by executing JScript code dynamically on the parent window containing the HTML document.

IHTMLDocument2 document = (IHTMLDocument2)webBrowser.Document;

   if (document != null)
   {
      //See if we are in codeproject
      string url = document.location.href;

      if (url.IndexOf("mail.yahoo.com") >= 0)
      {
          string sJScript = @"var ctlUserID = document.getElementById('username');
                               var ctlPassword = document.getElementById('passwd');

                                if ((ctlUserID != null) && (ctlPassword != null))
                                {
                                    ctlUserID.value = 'debasish.bose@gmail.com';
                                     ctlPassword.value = '*******;
                                }";

document.parentWindow.execScript(sJScript, "JScript");

sJScript = "login_form.submit();";
document.parentWindow.execScript(sJScript, "JScript");

          return;
       }
    }

Hardcoding the password is the crudest method I can imagine right now. It just for demonstration purpose. In reality you should be fetching it into a SecureString from some encrypted password repository(which may prove useful in building something like a master password or SSO system)
That's it. Now how to capture the CC numbers is upto you. Oh by the way I bought a cute PSP and enjoying every moment with it. My N-Gage is crying like anything.

Once my "play boy" moments are over, I will start hacking it. Although with current Firmware version hacking seems little impossible at this point, lets be optimistic. Another Monday, another week..damn.

Electrified !!!

debasish — Sun, 14 May 2006 15:47:00 GMT

It feels good really good. The last post has been listed here in "interesting finding" section with my "idol" Don Box. I'm elctrified !!!.
I will post more sane and insane experiments to keep the standards up. Thanks you guys

WinDbg , Crash Dump .. Associated Headches

debasish — Thu, 11 May 2006 17:05:00 GMT

For a long tome I kept myself away from this wonderful but ugly looking tool as I was the die-hard fan of a Compuware(Numega then) masterpiece - SoftIce. Hey I still have it installed inside of a Win98 Virtual Box in my XP host. Though SoftIce has got its new incarnation - DriverStudio, not the WinDbg. If you haven't downloaded it, get it Debugging tools for Windows. But I'm not going to give basics of WinDbg usage here. Nop. But quality articles are galore. One thing I must mention that if your technology stack contains anything .NET, there is a nice WinDbg extension DLL(always keep an eye on software extensibility model) exists at the .NET framework installation folder. It's sos.dll(Son Of Strike). This guy will help to inspect virually anything in .NET world from method table to managed stack

This encounter with Windbg is actually initiated from requirements at my office. I was analyzing some crash dump generated by our driver library. Boy they are fatty. But still they are smaller than the earlier days. Actually these beasts are tagged as Mini Dump which is much light-weight than the full fledged dumps often called Core Dump. Mini Dumps are very different than their older counterparts in the following way

Instead of saving the entire process space, only certain sections are saved. There is no point in saving copies of modules such as Kernel32.dll; if the version number is included, it is easy to get a copy from a Windows CD. The actual memory heap of the application is by default not saved in a minidump; it is not required to debug a surprisingly high percentage of crashes. You can save the heap if you need to, however.
The minidump save code works to get accurate and full information for modules, including their names, paths, version information, and internal timestamps.
The minidump save code also gets the list of threads, their contexts (that is, register sets), and the memory behind their stacks.
The whole file is compressed, further reducing its size. A minidump for Notepad is around 6K on Windows XP, almost 300 times smaller than the previous crash dump of the same process.

Now when do we generates dump? Certainly not always. Instead one of these scary moments when your software "sees" end of days at customer premises. Most of the softwares now-a-days employs structure exception handling(SEH) and displays custom user-friendly UI if a fault occurs. But sometimes it is necessary for the developers to analyze what's exactly happened when the fault occurred. Handling the exception is certainly not the answer. Instead with some configuration changes(may be application configuration or infamous Windows Registry backdoor) the "on site" guy enables the dump generation facility and reproduces the fault once more. Following is a vanilla piece of code found somewhere in this context.

[C#]
try
{
     //where fault occurs...
}
catch(Exception e)
{
   if (TraceLevel == TraceLevel.GenerateDump)
   {
          DumpGenerator.WriteCrachDump();
   }
}

Couple of pointers here. First the check inside the exception handler is very important..I repeat..very very important. Here dump is generated as an elevated level of application(or driver) tracing configuration(again done by our beloved "on site" guy). Not always your application(or driver) should inflate the customer disks with fatty DMP files. Another subtle point - I didn't pass the exception object as a parameter to the dump generator function. As this is managed code the exception object will only contain the exception information pertaining to the managed stack. But we need an unmanaged Exception_Pointers struct to pass around. That could be generated within the function with the help of GetLastError() API. Still there is a catch - if you P/Invoke the GetLastError call from C#, always remember that there is chance that CLR will invalidate the error while doing its own stuff when control returns from unmanaged world(where error occurred) to managed world by Interop Marshallar. Look at this entry of Adam Nathan's blog for more detail.

The most important parameter to the MiniDumpWrite function is the first and second.

typedef struct _MINIDUMP_EXCEPTION_INFORMATION {
DWORD ThreadId;
PEXCEPTION_POINTERS ExceptionPointers;
BOOL ClientPointers;
} MINIDUMP_EXCEPTION_INFORMATION, *PMINIDUMP_EXCEPTION_INFORMATION;

Naturally the exception pointers parameter is what I was talking about a liitle bit ago and its retrieval by GetLastError or Marshal.GetLastWin32Error. The first parameter identifies the thread which throws the exception.

Now from here the fun begins. I successfully able to analyze all but one DMP file by inspecting managed and unmanaged stack. But whenever I tried to open the offending DMP file, my WinDbg crashed. Oh God! Who will analyze the dump that WinDbg will generate? Purplexing !
Just before crash I saw a strange output at the WinDbg's console. Something related to invalid thraed id.

ERROR: Unable to find system thread 2
ERROR: The thread being debugged has either exited or cannot be accessed
ERROR: Many commands will not work properly

Now I was performing a suite of test cases while dump was generated. It was utmost important to me to know which process actually generated the dump so that I could narrow down the troubled section. Fortunately there is a tool in the same folder where WinDbg usually resides - dumpchk.exe. With

>> dumpchk -e "offending_dump_file.dmp"

I was instantly presented with enough information to determine the offending test case. But that doesn't solve the problem of WinDbg's unusal crash. Later I found out(through debugging - without dumpchk that even would have been impossible) that when ExceptionPointers parameter is not null(means exception actually happened at unmanaged layer of our code) we are pushing the "passed" thread id to this structure before calling the write dump function.Although if you pass null or 0 to this ExceptionPointers parameter dump will be generated but its unmanaged stack will be ignored. So to track back how we were passing the thread id to this function, I discovered following code

#ifdef DOTNET20
threadId = System.Threading.Thread.ManagedThreadId();
#else
threadId = AppDomain.GetCurrentThreadId();
#endif

Surely the Appdomain.GetCurrentThreadId API has been deprecated but It does something the newer API doesn't and neither supposed to that.
Managed threads has nothing to do with unmanaged threads. The mapping between managed thread to unmanage thread is tricky. The newer API is just a hash value used to determine a managed threads uniquely. It doesn't corresponds to the unmanaged thread. The mapping between these thraeds of two worlds could be controlled by a CLR host or could be changed by future versions of .NET Fx. Due to this unstability Microsoft recommends that you are not supposed to assume 1:1 correspondence between manage and unmanaged thread while using AppDomain.GetCurrentThreadId() in your code. Although in 2.0 it happens to return the unmanaged id but who knows. Sonner or later this code will definitely break. Check at this blogs about manage and unmanaged threads - 1, 2

With "not-so-offending" dump files your "!analyze -v" session will be peaceful. It's 3 AM here at India. I'm tired..See you guys.