Archived posts

If you've ever been interested in interfacing with shared libraries and DLL using Python, then there are basically three ways you can achieve it. One is to use Python/C API, second is to use SWIG and the third which I will demonstrate is to use ctypes. ctypes is a great companion to keep around as it allows one to call functions and extract data as C types from a shared library without leaving the pleasant world of Python. Without further ado, let me roll some code. //ctypedemo.c


#include 
#include 
#include 
char* getenv2(char * environment)
{
  fprintf(stdout,"getenv2(%s)\n",environment);
  fflush(0);
  
  return getenv(environment);
}

int _init()
{
  printf("%s\n","Loaded ctype shared library");
  return 0;
}

#ctypedemo.py
from ctypes import *
from ctypes.util import find_library
import sys

ctype_sl = cdll.LoadLibrary('./libctypedemo.so.1') # load library

getenv_ = ctype_sl.getenv2(sys.argv[1]) # get 1st arg
ret = c_char_p(getenv_) # cast to char*
if ret:
    print "\{0}={1}".format(sys.argv[1],ret.value)

#sharedlibcompile.sh
gcc -Wall -fPIC -c ctypedemo.c
gcc -shared -nostartfiles -Wl,-soname,libctypedemo.so.1 -o libctypedemo.so.1 -lc ctypedemo.o
export LD_PRELOAD=./libctypedemo.so.1

$ls
ctypedemo.c
ctypedemo.py
sharedlibcompile.sh

$./sharedlibcompile.sh
$ python ctypedemo.py PATH                                                        
Loaded ctype shared library
getenv2(PATH)

value for PATH=/usr/local/bin:/usr/local/sbin/:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/sbin:/bin:/usr/games

Hope you enjoyed the tiny intro. Feedbacks are welcome (constructive or destructive otherwise).

I was going through the details about socktress[0][1] on Slashdot[1] today. I could not believe that TCP/IP specification itself could be distorted yet again. By starting a 3-way handshake in userspace, an attacker would exhaust remote systems' connection table (similar to SYN Floods of the old days[2]) filling up with arbritrary SYN packets on the remote end. On receiving the first ACK from the remote end, the attacker would presumablyn gets hold of the packet in userspace using libpcap[3] and manipulates it however the attacker wishes because theoretically as the paper points out the kernel is suppose to panic and send RST to the remote end (the one the attacker is attacking) because fore sure kernel didn't ask for an ACK packet now did it[4]? :-)

The patch to fix SYN DoS in kernel[3] was invented by Daniel Bernstein. It basically did not establish (read: connection state in ESTABLISHED state/3-way handshake complete) the connection until a 3-way handshake was completed in totality - SYN, SYN/ACK, ACK and it used extra crufts to calculate if it was _really_ completed. And what about the one way before SYN flooding? I remember reading a paper about TCP/IP Sequence ID prediction. I do not remember majority of that paper but it essentially pinned down that a remote attacker could predict the sequence ID number of the next packet coming in and hence forge a prepared reply (a spoofed packet destined for somewhere else).

All these brings me to the deep question seated within me. How much more problems/inherent weaknesses can TCP/IP itself handle? Do we need a new specification AND implementation? That I don't know and I do not have enough years on my belt to design one but it sure sounds like TCP/IP _really_ isn''t designed for today's network security standard of how easy it might be for an attacker to establish DoS. This sure isn't the 70s, 80s or the 90s when programmers were a happy hacker[6]. Thankfully, CISCO IOS and Microsoft Windows has released a patch today. :-)

[0] http://www.sockstress.com

[1] http://it.slashdot.org/story/09/09/08/1839258/Microsoft-Cisco-Finally-Patch-TCP-DoS-Flaw

[2] http://insecure.org/stf/tcpdos/outpost24-sect-sockstress.pdf (A really good paper if you are interested in network security/programming and system administrator. It is also good for learning the intricacies of TCP/IP stack from a real-world perspective as TCP off-loading implementation _in_ hardware could possibly peruse this knowledge).

[3] I remember someone implemented SYN cookies or "canaries"? code for Linux kernel (I read about this only couple of years ago after I got more interested in network codes). Yep. it is DJB :-) the inventor of syncookies; who can forget 44 vulnerabilities that his students found in unix kernel? :-) http://marc.info/?t=110321890800003&r=1&w=2.

[4] If you were curious and flipped here, then you'd obviously know that the userspace started all this hohalla. Post to get an ACK'ed reply in attackers machine, having a libpcap event handler that notifies the userspace code of the incoming packets and sniff the header/payload and then reply back without ever hitting the kernels' tcp stack! This is a bit confusing to me since libpcap itself would need to interact with the kernel using normal execution syscall path via libc right? Or, am I dreaming?

[6] The original "hacker" term. Yes the one that describes someone as being curious, benign and prides in intellectual drive. Who knows some day our aliens overlords might try bringing with them a system that only an hacker understand :-)

Just so that I do not forget, I need to do some reading for android and starting coding up apps for it. Its just an urge because Java is pretty cool language itself :-) and one can make a lot of productive apps using it very quickly.

$ lsusb | grep Log Bus 004 Device 002: ID 046d:089d Logitech, Inc. I sat down couple of hours ago to make it work on my Linux box; Couple of head banging for not remembering the module parameters and it was finally done. The following are the steps I took to make it work - 1) Downloaded gspca source * wget http://mxhaard.free.fr/spca50x/Download/gspcav1-20071224.tar.gz * tar -xvf gspcav1-20071224.tar.gz 2) Downloaded a patch specific to my webcam - * wget http://forums.quickcamteam.net/attachment.php?aid=86 -O patch.tar.gz * tar -xvf patch.tar.gz * cd gspcav1-20071224 * patch -p1 < ../quickcamE2500.diff 3) Compiled and installed the patched kernel module - * cd gspcav1-20071224; * make; * sudo cp gspca.ko /lib/modules/2.6.24-19-generic/ubuntu/media/gspcav1/ 4) Reloaded the gspca module with additional parameters - * sudo modprobe -r gspca; * sudo modprobe gspca autoexpo=0 gamma=2 5) Installed gstfakevideo for skype since it used 90% of my CPU when video was enabled. More info is available here * svn checkout http://gstfakevideo.googlecode.com/svn/trunk/ gstfakevideo ('subversion' package must be installed) * cd gstfakevideo * make * sudo make install * sudo mv /dev/video0 /dev/video1 * ./gstfakevideo v4lsrc device=/dev/video1 ! ffmpegcolorspace (this will fire off skype) (Say cheese! :>) 5) Tried each of the following - * xawtv (worked) * mplayer tv:// -tv driver=v4l:width=352:height=288:outfmt=yv12:device=/dev/video0 (worked) * skype (worked after I provided the module parameters "autoexpo=0 gamma=2") * ekiga (worked) * cheese ( this didn't work for me )

Basically, all one has to in ubuntu/debian is to install 'xbindkeys' package- $ aptitude install xbindkeys Check for the keycode- $ xbindkeys -mk # -h for more info Press combination of keys or/and click under the window. You can use one of the two lines after "NoCommand" in $HOME/.xbindkeysrc to bind a key. --- Press "q" to stop. --- "(Scheme function)" m:0x8 + c:153 Alt + XF86AudioNext (In the above instance, I've pressed Alt and Dell's Next button) Then create ~/.xbindkeysrc and dump those lines from above- $ vim ~/.xbindkeysrc 1 # forward 10 secs 2 "dcop amarok player seekRelative +10" 3 m:0x8 + c:153 4 Alt + XF86AudioNext 5 6 # rewind 10 secs 7 "dcop amarok player seekRelative -10" 8 m:0x8 + c:144 9 Alt + XF86AudioPrev Then add it to autostart (when KDE session starts)- $ vim ~/.kde/Autostart/xbindkeys 1 #!/bin/sh 2 /usr/bin/xbindkeys;

On xterm: bikal@zebra:[~] time cat /usr/share/dict/words ...(((snip)))... real 0m11.080s user 0m0.000s sys 0m0.056s bikal@zebra:[~] time find /usr/src/linux/ real 0m3.759s user 0m0.064s sys 0m0.092s On konsole: bikal@zebra:[~] time cat /usr/share/dict/words ...(((snip)))... real 0m2.555s user 0m0.004s sys 0m0.056s bikal@zebra:[~] time find /usr/src/linux/ ...(((snip)))... real 0m1.136s user 0m0.072s sys 0m0.064s

- Absolutely no open hardware and software specification available to the public. - Costs sub US $100 dollars [thumbs up for that]. - Is hyped up as the next "big" cheap solution - Customer's data is stored on the server [yikes!] - Will be sold back to some tech giant/s some day. [Read: NOVA NETPC userbase could be screwed] - Has no documentations available to the public. - Anyone's got any clue how hackable* it is?

$ cat /proc/cpuinfo (info deemed uncessary stripped out) processor : 0 vendor_id : GenuineIntel model name : Intel(R) Pentium(R) M processor 1.50GHz cpu MHz : 600.000 cache size : 2048 KB flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat clflush dts acpi mmx fxsr sse sse2 ss tm pbe nx est tm2 bogomips : 1198.27 $ time perl memoizing.pl Fibo of 30 => 832040 real 0m0.071s user 0m0.048s $ time perl unmemoizing.pl Fibo of 30 => 832040 real 0m2.877s user 0m2.832s Woahhh!!!

#memoizing.pl #!/usr/bin/perl -w use Memoize; memoize('fib'); #comment this line and see the difference in `time` ;) #$_=<stdin>; chomp; print "Fibo of 30 => ",fib(30), "\n"; #fib function is already memoized # Compute Fibonacci series sub fib { my $n = shift;return $n if $n < 2; fib($n-1) + fib($n-2); #unmemoizing.pl #!/usr/bin/perl -w #use Memoize; memoize('fib'); #comment this line and see the difference in `time` ;) #$_=<stdin>; chomp; print "Fibo of 30 => ",fib(30), "\n"; #fib function is already memoized # Compute Fibonacci series sub fib { my $n = shift;return $n if $n < 2; fib($n-1) + fib($n-2);

// project created on 24/12/2007 at 5:55 AM using System; /* * A minimal linked list implementation. * Simple data model to aid understanding of singly-linked list: [node1:next==]==>[node2:next==]==>[....nodeN:next==]==>NULL * * The furthest this code can do I believe is help you understand singly-linked list. :-) * It's krismas time and I am a little bit drunk so spare the bugs if any [given that * it was coded in ~1 hour] * */ namespace LinkedList { class Node { public int data; public Node next; public Node(int d, Node n) { this.data = d; this.next = n; } } class LL { public Node firstnode; public LL() { firstnode = new Node(-1,null); } /* * Insert a value at the end of the list. */ public void insertLast(int data) { Node insertion_node = new Node(data,null); //the temporary object to be inserted in the end. Node current_node = firstnode; while (current_node.next != null) { current_node = current_node.next; } current_node.next = insertion_node; insertion_node.next = null; //nullify the last node's next pointer } /* * return the size of the linked list */ public int size() { Node thisnode = this.firstnode; int counter = 0; while (thisnode.next !=null) { thisnode = thisnode.next; counter++; } return counter; } /* * return the 'data' (int32) at the given position */ public int at(int position) { Node thisnode = this.firstnode; int counter = 0; while (thisnode.next != null) { if (counter == position) { return thisnode.next.data; } else { thisnode = thisnode.next; } counter++; } if (thisnode.next == null) { return thisnode.next.data; } return -1; } } class MainClass { public static void Main(string[] args) { LL linkedlist = new LL(); Console.WriteLine("Inserting some dummy values....."); for (int i = 0; i < 10; i++) { linkedlist.insertLast(i); } //Debugging only. //Console.WriteLine(linkedlist.size()); Console.WriteLine("Printing out the values...."); for (int i = 0; i < linkedlist.size(); i++) { Console.WriteLine("At " + i + ": " + linkedlist.at(i)); } } } }

#!/usr/bin/env python
# This one-liner code prints combination of (x,y) values such that (x%2==0 and y%2==1) from from 0..19 inclusive.
print [(x,y) for x in range(20) if x % 2 == 0 for y in range(20) if y % 2 == 1]

/* Check user entered password's strength based using
* cracklib (http://sourceforge.net/projects/cracklib/)
*/

#include "crack.h"
#include "stdlib.h"
#include "unistd.h"
#include "stdio.h"

#define OK 1
#define NOTOK 0

int main(int argc, char *argv[]) {
char* why;
char* passwd;
int status = NOTOK;
printf("\nPress Ctrl-D or enter an empty password to quit.\n");
while ((passwd = getpass("\nPassword: ")) != NULL && *passwd ) {
//check for user entered password with the dictionary.
if ((why = FascistCheck(passwd, CRACKLIB_DICTPATH)) != NULL) {
printf("Password is bad: %s.\n",why);
status = OK; //reset status
}
else {
printf("Nice password\n");
}
//spit out the passwd for debugging
//printf("\nYou entered: %s \n", passwd);
}
exit(status);
}