> python generator.py --help
Opening --help
Outputting start code...
Outputting template...
Writing out finish...
Done

Do'h!!

> ls
--help generator.py

> rm --help
rm: illegal option -- -
usage: rm [-f | -i] [-dPRrvW] file ...
unlink file

> rm "--help"
rm: illegal option -- -
usage: rm [-f | -i] [-dPRrvW] file ...
unlink file

Gah! and hooray for GUIs

Share/Bookmark

Once getting through stage 2 you will have an EXE file. It requires windows (I ran it in a VirtualBox VM seeing as I had no idea what it would do - can't be too careful!), cygwin and the crypt library when installing cygwin.

Running the EXE you will see that you require some kind of license.txt - if you create an empty one then you get an error about it being invalid. The next stage is working out what is required to make the license.txt file valid. Being new to this realm of reverse engineering, but being comfortable with work with ASM I tried a number of tools - strace, objdump and strings. Each yielded useful bits of information - especially strings.

However the real breakthrough came when I ran the exe file through a tool called IDA Pro - the freeware version is sufficient for this exercise.

Running the binary through IDA Pro produces a very comprehensive flow of the program. If you navigate this flow you will being to see calls to printf which relate to the message we get on the screen.

Entry Point of Code Check for argument count

Manually following the flow allows you to ascertain what the programme is checking for in license.txt. After seeing a call to fopen64 you will find a cmp instruction on the first 4 bytes of the file. It compares it with this 32 bit hex value 0x71686367 - if you convert this into an ASCII string you will see that it translates to 'gchq'. This is the 'magic word' that the license.txt file begins with.

File read and magic word check

Adding the those four characters to the license.txt file will result in you getting the message about license.txt being invalid - it needs something more. So continue to follow the program flow and we see the following steps -

Loading salt, calling crypt and doing the comparison

• Load a string from memory - the string is hqDTK7b8K2rvw
• Pass the above string as the salt and the string from license.txt to the crypt(3) function
• Compare the result to hqDTK7b8K2rvw and set a flag if it they match using strcmp()

The challenging step here is to decrypt the password. There are a couple of helpful clues - crypt(3) uses DES the result is used in the salt. The output of crypt(3) includes the salt at the beginning of the string. So the salt is 'hq'. We also know that crypt(3)does not allow a password of more than 8 characters, and we can assume that this isn't going to be too challenging so an attack on it with a lower case string / dictionary is a good place to start. We also know that the password is 8 characters long as the pointer to the read in string from license.txt is incremented by 8 later one.

I'll leave this part of the challenge as an exercise to the reader - there are plenty of tools - think rainbow tables, john the ripper, crack etc... (as an aside, it took my Macbook Pro around 2 hours to crack it).

The program continues -

Generating the URL to get the final solution

• It prints out two loading "stage 1" and "stage 2" keys - which is a massive clue as to what goes next in the license.txt file. I always wondered what those unused values in the previous challenge were kicking around for...
• If we are successful in the above password step then the program processes four values - the above crypt hash, and the three 32 words read from the text file (note you have to have these in the license.txt file as binary values, not text - so you'll need a script to output that or a hex editor to create the file).
• The four values are formatted into a URL (as per the other challenges) which will lead you to the final solution to the entire problem.

Now, sit back... relax, and enjoy a well earned break or apply for the job... your call...

I just thought I would present some personal comments/reflections on this challenge - firstly as an engineer who works day to day with very low level embedded this was an interesting tangent to that circle of work. I often have to dig assembly and understand the finer points of computer architectures, so much of the above feels familiar - albeit with a very different architecture and slant on what you are trying to achieve. All in all it was a bit of fun, I learnt some stuff and walked out of my usual circles. I might even continue to expand on these skills when I find a suitable project...

Share/Bookmark

There has been a lot of news about the "Can you crack it?" challenge that is currently to publicise GCHQ recruiting. Here is my solution for stage 2 - the implementation of the Virtual Machine, or emulator. It's actually pretty straight forward when you get a hold of a few of the nuances. I'll put a list of hints here, and then present the full solution after the fold.

1. As of stage 1 - everything is centred around the x86 architecture, this means that your instructions need to mirror the behaviour of their x86 equivalents
2. Firmware seems to be irrelevant - don't worry about it.
3. There is no real trickery here - it's just a straight forward instruction set simulator implementation
4. The programme will finish on a HALT instruction

This is actually quite a neat little program that works by decrypting itself further programme code which it then runs and decrypts the message to get to the next stage... enjoy...

My implementation is in C... I don't like javascript - it is tested using GCC on an Intel Mac. It's a rough and ready implementation, so don't judge me too much.

#include <stdio.h>
#include <stdlib.h>

#define MEM_LEN 768
#define FW_LEN  8

unsigned char mem[] = {
    0x31, 0x04, 0x33, 0xaa, 0x40, 0x02, 0x80, 0x03, 0x52, 0x00, 0x72, 0x01, 0x73, 0x01, 0xb2, 0x50,
    0x30, 0x14, 0xc0, 0x01, 0x80, 0x00, 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

    0x98, 0xab, 0xd9, 0xa1, 0x9f, 0xa7, 0x83, 0x83, 0xf2, 0xb1, 0x34, 0xb6, 0xe4, 0xb7, 0xca, 0xb8,
    0xc9, 0xb8, 0x0e, 0xbd, 0x7d, 0x0f, 0xc0, 0xf1, 0xd9, 0x03, 0xc5, 0x3a, 0xc6, 0xc7, 0xc8, 0xc9,
    0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, 0xd8, 0xd9,
    0xda, 0xdb, 0xa9, 0xcd, 0xdf, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9,
    0x26, 0xeb, 0xec, 0xed, 0xee, 0xef, 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9,
    0x7d, 0x1f, 0x15, 0x60, 0x4d, 0x4d, 0x52, 0x7d, 0x0e, 0x27, 0x6d, 0x10, 0x6d, 0x5a, 0x06, 0x56,
    0x47, 0x14, 0x42, 0x0e, 0xb6, 0xb2, 0xb2, 0xe6, 0xeb, 0xb4, 0x83, 0x8e, 0xd7, 0xe5, 0xd4, 0xd9,
    0xc3, 0xf0, 0x80, 0x95, 0xf1, 0x82, 0x82, 0x9a, 0xbd, 0x95, 0xa4, 0x8d, 0x9a, 0x2b, 0x30, 0x69,
    0x4a, 0x69, 0x65, 0x55, 0x1c, 0x7b, 0x69, 0x1c, 0x6e, 0x04, 0x74, 0x35, 0x21, 0x26, 0x2f, 0x60,
    0x03, 0x4e, 0x37, 0x1e, 0x33, 0x54, 0x39, 0xe6, 0xba, 0xb4, 0xa2, 0xad, 0xa4, 0xc5, 0x95, 0xc8,
    0xc1, 0xe4, 0x8a, 0xec, 0xe7, 0x92, 0x8b, 0xe8, 0x81, 0xf0, 0xad, 0x98, 0xa4, 0xd0, 0xc0, 0x8d,
    0xac, 0x22, 0x52, 0x65, 0x7e, 0x27, 0x2b, 0x5a, 0x12, 0x61, 0x0a, 0x01, 0x7a, 0x6b, 0x1d, 0x67,
    0x75, 0x70, 0x6c, 0x1b, 0x11, 0x25, 0x25, 0x70, 0x7f, 0x7e, 0x67, 0x63, 0x30, 0x3c, 0x6d, 0x6a,
    0x01, 0x51, 0x59, 0x5f, 0x56, 0x13, 0x10, 0x43, 0x19, 0x18, 0xe5, 0xe0, 0xbe, 0xbf, 0xbd, 0xe9,
    0xf0, 0xf1, 0xf9, 0xfa, 0xab, 0x8f, 0xc1, 0xdf, 0xcf, 0x8d, 0xf8, 0xe7, 0xe2, 0xe9, 0x93, 0x8e,
    0xec, 0xf5, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

    0x37, 0x7a, 0x07, 0x11, 0x1f, 0x1d, 0x68, 0x25, 0x32, 0x77, 0x1e, 0x62, 0x23, 0x5b, 0x47, 0x55,
    0x53, 0x30, 0x11, 0x42, 0xf6, 0xf1, 0xb1, 0xe6, 0xc3, 0xcc, 0xf8, 0xc5, 0xe4, 0xcc, 0xc0, 0xd3,
    0x85, 0xfd, 0x9a, 0xe3, 0xe6, 0x81, 0xb5, 0xbb, 0xd7, 0xcd, 0x87, 0xa3, 0xd3, 0x6b, 0x36, 0x6f,
    0x6f, 0x66, 0x55, 0x30, 0x16, 0x45, 0x5e, 0x09, 0x74, 0x5c, 0x3f, 0x29, 0x2b, 0x66, 0x3d, 0x0d,
    0x02, 0x30, 0x28, 0x35, 0x15, 0x09, 0x15, 0xdd, 0xec, 0xb8, 0xe2, 0xfb, 0xd8, 0xcb, 0xd8, 0xd1,
    0x8b, 0xd5, 0x82, 0xd9, 0x9a, 0xf1, 0x92, 0xab, 0xe8, 0xa6, 0xd6, 0xd0, 0x8c, 0xaa, 0xd2, 0x94,
    0xcf, 0x45, 0x46, 0x67, 0x20, 0x7d, 0x44, 0x14, 0x6b, 0x45, 0x6d, 0x54, 0x03, 0x17, 0x60, 0x62,
    0x55, 0x5a, 0x4a, 0x66, 0x61, 0x11, 0x57, 0x68, 0x75, 0x05, 0x62, 0x36, 0x7d, 0x02, 0x10, 0x4b,
    0x08, 0x22, 0x42, 0x32, 0xba, 0xe2, 0xb9, 0xe2, 0xd6, 0xb9, 0xff, 0xc3, 0xe9, 0x8a, 0x8f, 0xc1,
    0x8f, 0xe1, 0xb8, 0xa4, 0x96, 0xf1, 0x8f, 0x81, 0xb1, 0x8d, 0x89, 0xcc, 0xd4, 0x78, 0x76, 0x61,
    0x72, 0x3e, 0x37, 0x23, 0x56, 0x73, 0x71, 0x79, 0x63, 0x7c, 0x08, 0x11, 0x20, 0x69, 0x7a, 0x14,
    0x68, 0x05, 0x21, 0x1e, 0x32, 0x27, 0x59, 0xb7, 0xcf, 0xab, 0xdd, 0xd5, 0xcc, 0x97, 0x93, 0xf2,
    0xe7, 0xc0, 0xeb, 0xff, 0xe9, 0xa3, 0xbf, 0xa1, 0xab, 0x8b, 0xbb, 0x9e, 0x9e, 0x8c, 0xa0, 0xc1,
    0x9b, 0x5a, 0x2f, 0x2f, 0x4e, 0x4e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};

unsigned char firmware[] = {
    0xd2, 0xab, 0x1f, 0x05, 0xda, 0x13, 0xf1, 0x10
};

typedef struct S_CPU_STATE
{

    unsigned int ip;

    unsigned int r[4];

    unsigned int cs;
    unsigned int ds;

    unsigned int fl;
} s_cpu_state;

int stop_cpu = 0;

void dump_cpu( s_cpu_state cpu )
{
    int i;

    printf("ip        => %d\n", cpu.ip);
    for (i = 0; i < 4; i++)
    {
        printf("r%d       => %d\n", i, cpu.r[i]);
    }
    printf("cs        => %d\n", cpu.cs);
    printf("ds        => %d\n", cpu.ds);
    printf("fl        => %d\n\n", cpu.fl);

    for (i = 0; i < MEM_LEN; i++ )
    {
        if (i % 16 == 0)
            printf("\n");

        printf("0x%02x, ", mem[i]);
    }

    for (i = 0; i < MEM_LEN; i++ )
    {
        if (i % 16 == 0)
            printf("\n");

        printf("%c", mem[i]);
    }

    return;
}

int read_reg( unsigned int *v, s_cpu_state *cpu, unsigned int ix )
{
    if (ix < 4)
    {
        *v = cpu->r[ix];
        return 0;
    }
    else if (ix == 4)
    {
        *v = cpu->cs;
        return 0;
    }
    else if (ix == 5)
    {
        *v = cpu->ds;
        return 0;
    }
    else
        return 1;
}

int write_reg(s_cpu_state *cpu, unsigned int ix, unsigned int v )
{
    if (ix < 4)
    {
        cpu->r[ix] = v;
        return 0;
    }
    else if (ix == 4)
    {
        cpu->cs = v;
        return 0;
    }
    else if (ix == 5)
    {
        cpu->ds = v;
        return 0;
    }
    else
        return 1;
}

void siginthandler(int param)
{
    stop_cpu = 1;
}

unsigned int decode_instruction( unsigned char instr[2], s_cpu_state *cpu )
{
    unsigned char opcode = (0xE0 & instr[0]) >> 5;
    unsigned char mod = (0x10 & instr[0]) >> 4;
    unsigned int op1 = 0xF & instr[0];
    unsigned int op2 = 0xFF & instr[1];
    unsigned int ip_inc = 0;
    unsigned int v1, v2, tmp, addr;

    printf("ibuf = 0x%02x %02x => ",instr[0], instr[1]);

    /* mod 0 instructions */
    if (mod == 0)
    {
        switch (opcode)
        {
        case 0x0:
            /* jmp r1 */
            printf("jmp r[%d]\n",op1);

            if (read_reg(&v1, cpu, op1))
                return 1;

            cpu->ip = (cpu->cs*16) + v1;

            printf("\tjump to %d\n", cpu->ip);

            ip_inc = 0; // 0 increment as we modify IP
            break;
        case 0x1:
            /* movr r1,r2 */
            printf("movr r[%d],r[%d]\n", op1, op2);

            if (read_reg(&v2, cpu, op2))
                return 1;
            if (write_reg(cpu, op1, v2))
                return 1;
            printf("\twrote %x to r[%d]\n", v2, op1);

            ip_inc = 2;
            break;
        case 0x2:
            /* movm r1, [ds:r2] */
            printf("movm r[%d], [ds:r[%d]]\n", op1, op2 );

            if (read_reg(&v2, cpu, op2))
                return 1;

            addr = (cpu->ds * 16) + v2;
            while (addr > MEM_LEN)
            {
                printf("\toutside of memory\n");
                return 1;
            }
            tmp = mem[addr];

            if (write_reg(cpu, op1, tmp))
                return 1;

            printf("\tfrom addr: 0x%x got val: 0x%x\n", addr, tmp);

            ip_inc = 2;
            break;
        case 0x3:
            /* add r1,r2 */
            printf("add r[%d], r[%d]\n", op1, op2);

            if (read_reg(&v1, cpu, op1))
                return 1;

            if (read_reg(&v2, cpu, op2))
                return 1;

            tmp = v1 + v2;

            if (write_reg(cpu, op1, tmp))
                return 1;

            printf("\t 0x%x + 0x%x = 0x%x \n", v1, v2, tmp);

            ip_inc = 2;
            break;
        case 0x4:
            /* xor r1,r2 */
            printf("xor r[%d], r[%d]\n", op1, op2);

            if (read_reg(&v1, cpu, op1))
                return 1;

            if (read_reg(&v2, cpu, op2))
                return 1;

            tmp = v1 ^ v2;

            if (write_reg(cpu, op1, tmp))
                return 1;

            printf("\t 0x%x ^ 0x%x = 0x%x \n", v1, v2, tmp);
            ip_inc = 2;
            break;
        case 0x5:
            /* cmp r1, r2 */
            printf("cmp r[%d], r[%d]\n", op1, op2);
            if (read_reg(&v1, cpu, op1))
                return 1;

            if (read_reg(&v2, cpu, op2))
                return 1;

            if (v1 == v2)
                cpu->fl = 0;
            else if (v1 < v2)
                cpu->fl = 0xff;
            else if (v1 > v2)
                cpu->fl = 0x1;

            printf("\tv1 = %d, v2 = %d, fl is now 0x%x\n", v1, v2, cpu->fl);

            ip_inc = 2;
            break;
        case 0x6:
            /* jmpe r1 */
            printf("jmpe r[%d]\n", op1);
            if (cpu->fl == 0)
            {
                if (read_reg(&v1, cpu, op1))
                    return 1;

                cpu->ip = (cpu->cs*16) + v1;
                printf("\tjump to %d\n", cpu->ip);

                ip_inc = 0; // jump, no increment
            }
            else
            {
                printf("\tNOP\n");
                ip_inc = 1; // jump, nop
            }

            break;
        case 0x7:
            /* halt */
            printf("halt\n");
            return 1;
        default:
            return 1;
        }
    }
    else if (mod == 1)
    {
        switch (opcode)
        {
        case 0x0:
            /* jmp r2:r1 */
            printf("jmp %d:r[%d]\n", op2, op1);

            if (read_reg(&v1, cpu, op1))
                return 1;

            tmp = (op2*16) + v1;

            cpu->cs = op2;
            cpu->ip = tmp;

            printf("\tjump to %d\n", cpu->ip);

            ip_inc = 0;
            break;
        case 0x1:
            /* movr rx, imm */
            printf("movr r[%d], 0x%x\n", op1, op2);

            if (write_reg(cpu, op1, op2))
                return 1;

            printf("\twrote 0x%x to r[%d]\n", op2, op1);

            ip_inc = 2;
            break;
        case 0x2:
            /* movm [ds:rs], r2 */
            printf("movm [ds:r[%d]], r[%d]\n", op1, op2);

            if (read_reg(&v1, cpu, op1))
                return 1;
            if (read_reg(&v2, cpu, op2))
                return 1;

            addr = (cpu->ds * 16) + v1;

            while (addr > MEM_LEN)
            {
                printf("\toutside of memory\n");
                return 1;
            }

            mem[addr] = v2;

            printf("\twrote 0x%x to mem[%d]\n", v2, addr);

            ip_inc = 2;
            break;
        case 0x3:
            /* add r1, imm */
            printf("add r[%d], 0x%x\n", op1, op2);

            if (read_reg(&v1, cpu, op1))
                return 1;

            tmp = v1 + op2;

            if (write_reg(cpu, op1, tmp))
                return 1;

            printf("\t 0x%x + 0x%x = 0x%x \n", v1, op2, tmp);

            ip_inc = 2;
            break;
        case 0x4:
            /* xor r1, imm */
            printf("xor r[%d], 0x%x\n", op1, op2);

            if (read_reg(&v1, cpu, op1))
                return 1;

            tmp = v1 ^ op2;

            if (write_reg(cpu, op1, tmp))
                return 1;

            printf("\t 0x%x ^ 0x%x = 0x%x \n", v1, op2, tmp);

            ip_inc = 2;
            break;
        case 0x5:
            /* cmp r1, imm */
            printf("cmp r[%d], 0x%x\n",op1, op2);

            if (read_reg(&v1, cpu, op1))
                return 1;

            if (v1 == op2)
                cpu->fl = 0;
            else if (v1 < op2)
                cpu->fl = 0xff;
            else if (v1 > op2)
                cpu->fl = 0x1;

            printf("\tv1 = %d, op2 = %d, fl is now 0x%x\n", v1, op2, cpu->fl);

            ip_inc = 2;
            break;
        case 0x6:
            /* jmpe r2:r1 */
            printf("jmpe 0x%x:r[%d]\n",op2, op1);
            if (cpu->fl == 0)
            {
                if (read_reg(&v1, cpu, op1))
                    return 1;

                cpu->cs = op2;
                cpu->ip = (op2 * 16) + v1;
                printf("\tjump to %d\n", cpu->ip);

                ip_inc = 0; // jump, no increment
            }
            else
            {
                printf("\tNOP\n");
                ip_inc = 2; // jump, nop
            }
            break;
        case 0x7:
            /* halt */
            printf("halt\n");
            return 1;
        default:
            return 1;
        }
    } else return 1;

    cpu->ip += ip_inc;
    return 0;
}

int main (void)
{
    unsigned char instr_buf[2] = {0,0};
    int i;

    s_cpu_state cpu;

    /* initialise CPU state */
    cpu.ip = 0x0;

    cpu.r[0] = 0x00;
    cpu.r[1] = 0x00;
    cpu.r[2] = 0x00;
    cpu.r[3] = 0x00;

    cpu.cs = 0;
    cpu.ds = 0x10;

    cpu.fl = 0;

    signal(SIGINT, siginthandler);

    while (cpu.ip+1 < MEM_LEN  && stop_cpu == 0)
    {
        instr_buf[0] = mem[cpu.ip];
        instr_buf[1] = mem[cpu.ip+1];

        printf("@ 0x%x -> ", cpu.ip);
        if (decode_instruction( instr_buf, &cpu ))
        {
            printf("error! Dumping...\n");
            dump_cpu( cpu );

            exit(1);
        }
        printf("\n");

    }

    if (stop_cpu)
    {
        printf("Interrupted... dumping - \n");
        dump_cpu(cpu);
        exit(0);
    }

    printf("left the bounds of memory!!\n");
    exit(0);

    return 0;
}

Share/Bookmark

I usually totally ignore these 419 emails, they drop right into my Spam box - but this one was really quite funny, and oddly came from HK/China (they usually appear from Africa!).

Anyway, I was massively excited by a whole $17.3 - wow! And he has done the underground works - totally legal - awesome!

Attn:

 

I am contacting you as the senior manager in a bank in China and financial advisor and account officer to a private investor about fund deposit totaling $17.3. I assure that the transaction is 100% risk free and legal having done all the underground works.

 

As soon as I receive a response for your interest, I will send you the complete details of the successful completion of this transaction. Please contact on my private email below for further clarification.

Best regards,

 

Jan Yiun

Share/Bookmark

I recently wanted to compile several images into a single PDF document - after searching for a relevant tool and discounting Word or iWork as too time consuming I hit upon the following very simple solution...

1. Open one of the images you want to put into your document in Preview
2. Now open the 'Sidebar' (if it isn't already open)
3. Drag the rest of the images into sidebar in the order you wish them to appear in your PDF document
4. Select all the images in the sidebar (Cmd+A)
5. Do 'File -> Print' and click the 'Save as PDF'
6. Follow the prompts to save the file and you should now have a PDF containing all your images!

Share/Bookmark

I like using Git for my projects and I tend to host them outside of the computer I work on. I was finding the current way I was managing projects a bit cubersome so I decided to install Gitorious which gives you a nice web interface to manage it all!

Here are some instructions on installing Gitorious on your own Ubuntu 10.04 LTS server. The instructions from gitorious were a little out of date/confusing so I thought I would show you what I did to get it working successfully. It is based upon instructions from both gitorious' own instructions and some others they link to, plus some other digging/googling around [1], [2] and [3].

Updated: Added some fixes/clarifications from the comments below! (If you spot any errors do please tell me!)

A few notes on this tutorial: Firstly - This tutorial is approaching it's first birthday which means (as with all things like this) it is getting somewhat outdated. With that in mind - approach with trepidation. I would read up on the relevant documentation from the developers yourself and make up your mind how helpful / relevant to you this whole process is.

Secondly - I have now moved to indefero (see http://www.indefero.net/open-source/) this is a lot easier to install and manage - offers all of the functionality that I have needed - which more than makes up for the lack of prettiness that gitorious had...

This is all done as root unless otherwise specified (a root prompt is indicated with a # and a normal user prompt is indicated with a $).

1. Install some packages using Apt:
   # apt-get update
# apt-get install build-essential zlib1g-dev tcl-dev libexpat-dev libcurl4-openssl-dev postfix apache2 mysql-server mysql-client apg geoip-bin libgeoip1 libgeoip-dev sqlite3 libsqlite3-dev imagemagick libpcre3 libpcre3-dev zlib1g zlib1g-dev libyaml-dev libmysqlclient15-dev apache2-dev libonig-dev phpmyadmin libmagick++-dev zip unzip memcached git-core git-svn git-doc git-cvs irb sphinxsearch
2. Setup ActiveMQ:
   # apt-get install uuid uuid-dev openjdk-6-jre
# wget http://www.powertech.no/apache/dist/activemq/apache-activemq/5.2.0/apache-activemq-5.2.0-bin.tar.gz
# tar xzvf apache-activemq-5.2.0-bin.tar.gz -C /usr/local/
# echo "export ACTIVEMQ_HOME=/usr/local/apache-activemq-5.2.0" >> /etc/activemq.conf
# echo "export JAVA_HOME=/usr/" >> /etc/activemq.conf
# adduser --system --no-create-home activemq
# chown -R activemq /usr/local/apache-activemq-5.2.0/data
3. Now to turn off the default multicasting activemq does, or other brokers on the same network will receive your queue items. Edit the networkConnectors setting in /usr/local/apache-activemq-5.2.0/conf/activemq.xml to something like this:
   <networkConnectors>
<!-- by default just auto discover the other brokers -->
<!-- Example of a static configuration: -->
<networkConnector name="localhost" uri="static://(tcp://127.0.0.1:61616)"/>
</networkConnectors>
4. Now setup the startup script for ActiveMQ
   # cd /tmp
# wget http://launchpadlibrarian.net/15645459/activemq
# mv activemq /etc/init.d/activemq
# chmod +x /etc/init.d/activemq
# update-rc.d activemq defaults
# service activemq start
5. Download Ruby Enterprise Edition and install:
   # dpkg -i ruby-enterprise_1.8.7-2010.02_amd64_ubuntu10.04.deb
6. Now get the latest version of the RubyGems software (download into a temporary directory):
   # cd /tmp
# wget <ruby gems>
# tar xzvf rubygems-1.3.7.tgz
# cd rubygems-1.3.7
# ruby setup.rb
# ln -s /usr/bin/gem1.8 /usr/bin/gem
7. Now time to install the required gems:
   # gem install -b --no-ri --no-rdoc rmagick chronic geoip daemons hoe echoe ruby-yadis ruby-openid mime-types diff-lcs json rack ruby-hmac rake stompserver passenger rails ultrasphinx mysql
# gem install -b --no-ri --no-rdoc -v 1.0.1 rack
# gem install -b --no-ri --no-rdoc -v 1.3.1.1 rdiscount
# gem install -b --no-ri --no-rdoc -v 1.1 stomp
8. Setup links to the correct versions:

# ln -s /var/lib/gems/1.8/gems/rake-0.8.7/bin/rake /usr/bin/rake
# ln -s /var/lib/gems/1.8/gems/stompserver-0.9.9/bin/stompserver /usr/bin/stompserver

1. Download the gitorious package:
   # git clone git://gitorious.org/gitorious/mainline.git /var/www/gitorious
2. Copy the required init.d files:
   # cp /var/www/gitorious/doc/templates/ubuntu/git-daemon /etc/init.d/
# cp /var/www/gitorious/doc/templates/ubuntu/git-ultrasphinx /etc/init.d/
3. Change /etc/init.d/git-daemon to have the following line:
   GIT_DAEMON="/usr/bin/ruby /var/www/gitorious/script/git-daemon -d"
4. Create the git-poller and stomp initialisation scripts from the gitorious tutorial
5. Set the correct permissions and activate the initialisation files:
   # chmod 755 /etc/init.d/git-ultrasphinx /etc/init.d/git-daemon /etc/init.d/stomp /etc/init.d/git-poller
# update-rc.d stomp defaults
# update-rc.d git-daemon defaults
# update-rc.d git-ultrasphinx defaults
# update-rc.d git-poller defaults
6. Run apache setup script and follow the instructions:
   # /usr/local/bin/passenger-install-apache2-module
7. Create /etc/apache2/mods-available/passenger.load with the following contents:
   LoadModule passenger_module /usr/local/lib/ruby/gems/1.8/gems/passenger-2.2.14/ext/apache2/mod_passenger.so
PassengerRoot /usr/local/lib/ruby/gems/1.8/gems/passenger-2.2.14
PassengerRuby /usr/local/bin/ruby
8. Enable apache2 modules and default ssl site:
   # a2enmod passenger
# a2enmod rewrite
# a2enmod ssl
# a2ensite default-ssl
9. Restart apache:
   # service apache2 restart
10. Add a 'git' user to MySQL with global create privileges. Also give it all privileges on gitorious_production.
11. Create /etc/apache2/sites-available/gitorious and /etc/apache2/sites-available/gitorious-ssl using the listings on the gitorious tutorial (the SSL is required for login!)
12. Enable and disable the appropriate sites as follows:
    # a2dissite default
# a2dissite default-ssl
# a2ensite gitorious
# a2ensite gitorious-ssl
13. Add a user 'git' to the system:
    # adduser --system --home /var/www/gitorious/ --no-create-home --group --shell /bin/bash git
14. Set permissions on the gitorious tree:
    # chown -R git:git /var/www/gitorious
15. Now run the following sequence of commands:
    # su - git
$ cd /var/www/gitorious
$ mkdir .ssh
$ touch .ssh/authorized_keys
$ chmod 700 .ssh
$ chmod 600 .ssh/authorized_keys
$ mkdir tmp/pids
$ mkdir repositories
$ mkdir tarballs
$ cp config/database.sample.yml config/database.yml
$ cp config/gitorious.sample.yml config/gitorious.yml
$ cp config/broker.yml.example config/broker.yml
16. Edit config/database.yml: Remove every section but production
17. Edit config/gitorious.yml: Remove every section but production (so at the top tab level only production: should exist)
18. Set the gitorious.yml lines configurations like so (other entries not listed are to be left as defaults):
    cookie_secret: [set to output of apg -m 64]
repository_base_path: "/var/www/gitorious/repositories"
gitorious_client_port: 80
gitorious_client_host: your.gitorious.domain.here
gitorious_host: your.gitorious.domain.here
archive_cache_dir: "/var/www/gitorious/tarballs"
archive_work_dir: "/tmp/tarballs-work"
hide_http_clone_urls: true
is_gitorious_dot_org: false
19. Run the following (note if you have to drop out to root again because it tells you that you missed some gems then remember to do the export again when you have su'd back into the git user!):
    $ export RAILS_ENV=production
$ rake db:create
$ rake db:migrate
$ rake ultrasphinx:bootstrap
20. Add the following line to the crontab:
    * * * * * cd /var/www/gitorious && /usr/bin/rake ultrasphinx:index RAILS_ENV=production
21. Now create an admin user:
    $ env RAILS_ENV=production ruby script/create_admin
22. Exit being the 'git' user and restart apache as root
    # service apache2 restart
23. Now start the git-daemon service:
    # service git-daemon start
24. Now you may find the login page not working, to fix this do the following (thanks to [2]):
    # gem uninstall i18n
# gem install i18n -v=0.1
# service apache2 restart
25. Now create the adminstrator user:
    $ env RAILS_ENV=production ruby script/create_admin

Share/Bookmark

Introduction
This tutoral/HOWTO is designed to help you setup an rsync back/dropbox style synced folder on the Netgear stora. The aim of this is to have a synced folder that will automatically back up to a remote location. The main reason that I wanted to do this was so that I could have a folder of documents backed up to my VPS and synced to my work machine and laptops.

It is similar in style to the 'dropbox' service. It is largely based on this HOWTO. It just covers a number of points for installing on the Stora!
This guide assumes you have a fully working package management system as described here - Installing a package manager and also assumes that you have SSH fully working.

1. Generate your keys (don't enter a password - this enables you to have the syncing done without user intervention!) ssh-keygen -N -f ~/.ssh/id_dsa
2. Copy public key to server so you can login ssh-copy-id -i ~/.ssh/id_dsa.pub user@REMOTE_SERVER
3. Tidy up permissions ssh user@REMOTE_SERVER 'chmod 700 .ssh'
4. Check you can login without a password ssh user@REMOTE_SERVER

Software Install

1. Now prepare for the lsyncd build by installing the following packages by running the command sudo ipkg install <pkg name>
   1. gcc
   2. lua
   3. make
   4. pkgconfig
   5. rsync
2. Download and untar lsyncd from the lsyncd project
3. Configure the build by running ./configure --prefix=/opt/local --exec-prefix=/opt (this assumes your addition software is on /opt, otherwise tailor to your needs, but avoid the onboard flash!)
4. Modify the Makefile to set the following:
   1. LDFLAGS = -ldl
5. Assuming you got no errors from the configure do make all
6. Now do sudo -E make install (the -E just utilises the same environment settings of the current user as when doing sudo PATH seems to disappear and it won't be able to find the commands!)
7. Now run sudo ln -s /opt/lib/liblua.so /usr/lib/liblua.so so that lsyncd can locate the library
8. Now run lsyncd -help to see if all is well (you should get a list of options)!

Configuration

(Please refer to the lsync manual for comprehensive guidance)

1. Copy example/lrsyncssh.lua to a location of your choice (I created $HOME/sync_config)
2. Fill out the configuration file sync_conf.lua with the appropriate details (the file can be put anywhere):

sync{default.rsyncssh, source="/path/to/src", host="user@REMOTE_SERVER", targetdir="/path/to/dst", rsyncOps=""}

1. Run lsyncd in no daemon mode to check for errors:

lsyncd -nodaemon sync_conf.lua

1. Drop some files in the watched directory and make sure they get uploaded properly with no errors
2. Run lsyncd in daemon mode to have it watch the folder:

lsyncd sync_conf.lua

Reverse Sync

Adding the following crontab line is particularly useful if you want to have your laptop or other machines sync up, or at least have the Stora pull from the remote server.

* * * * * rsync -ltur user@REMOTE_SERVER:/path/to/src/ /path/to/dst >> /path/to/log/dir/rsync_pull.log

Final Comments

This setup can be replicated on your laptop and work machines to create the full dropbox like experience.

Share/Bookmark

So I decided to take a leap and move VPS providers. Moving servers turns out to be hard work. Here is a list of useful stuff that I had to dig out again when setting up the new one -

• Spamassasin Setup
• Gitosis setup
• Some lighttpd alias setup info - leading to a whole host of other server admin tutorials

As I find more of these I will update them as and when...

Share/Bookmark

Having just got a Netgear Stora I wanted to use it as my time machine backup (I have an old ibook G4 and 10.5 so some of this may or may not work for 10.6 - i haven't tried it!). It turns out this isn't a simple operation (despite ease of use supposedly being a big selling feature of the Stora...). Here are the steps I eventually worked my way through to get this working:

1. Enable unsupported time machine devices. In the Mac terminal type:
   defaults write com.apple.systempreferences TMShowUnsupportedNetworkVolumes 1
2. Enable "Computer Backups" on the Stora through the web interface - this is an option in preferences. Select a password and set the changes through "Submit"
3. Mount the share in finder by going to Finder -> Go -> Connect to Server. Use smb://ComputersBackup@Stora/ComputersBackup
4. Enter the password (username should be ComputersBackup)
5. Open up a terminal and create a "sparsebundle" image locally by following the steps below:
   1. In a local directory run:
      hdiutil create -library SPUD -size $SIZESPEC -fs HFS+ -type SPARSEBUNDLE $MACHINENAME_$MAC_ADDRESS.sparsebundle
      where $SIZESPEC is the size (in bytes, or suffixed with g or t for Gigabytes and Terabytes - note you can resize it later, but you can't make it bigger than the space on your HD. $MACHINENAME is the 'name' of your machine and $MAC_ADDRESS is the mac address (seen in Network Preferences) in the form aabbccddeeff (i.e. no colons!).
   2. Copy it to your network drive by typing
      cp -r $MACHINENAME_$MAC_ADDRESS.sparsebundle /Volumes/ComputersBackup\$/
      you can now delete the local .sparsebundle file
   3. Resize to the size of backup you want by running the following command on the network mount:
      hdiutil resize -size $SIZEg $MACHINENAME_$MAC_ADDRESS.sparsebundle
      where $SIZE is the size in GB (note the g after the size number
   4. Load up time machine and select the ComputersBackup mount for backup. It should now detect the image and start backing up to it, using only the size of image that you have created (e.g. 200GB, rather than filling the entire drive!)
6. Pat yourself on the back get a cup of tea which it backs up and wonder why it wasn't easier!

Share/Bookmark

A while ago I spotted the Open Workbench Logic Sniffer on Hackaday. A logic sniffer . analyser is a useful tool have around the place and at ~$50 with some flying leads to make it up to the free shipping threshold. Seeing as it arrived the other day I thought I would share my first impressions of it...

The Board

The system comes shipped as a bare board - so I need to get some self adhesive rubber feet for it really - I will also keep my eye out for a potential case as well.

The main components is a Xilinx Spartan FPGA. The whole thing is based on the SUMP FPGA base logic analyser - so no big surprises that this is the main work horse!

It also has a Microchip 18F24 which looks like it is handling the USB interface.

The board also has several non-populated through hole headers which are for PIC ICSP, FPGA JTAG and some kind of expansion pins (as well as a set of four labelled TRG1 CK1 TRG0 and CK0). There is also a populated set of ROM ISP headers and what looks like some UART pin headers.

Alongside all this we have a number of indicator LEDs for ARM, Trigger, Power and USB Activity. Also some buttons for update and reset actions.

At the end of the board we have the analyser bus. This has a GND connection at both ends and 16 signals available for connecting flying leads to. The signals are fed into a LCX16245 - which is a low voltage bidirectional buffer (so in theory the FPGA could drive the the signals out if you wanted to re-purpose the board!)

Anyway, for more detailed information on the project see the Gadget Factory page - this has the user guide, schematics, board design and software on it as well as installation videos and a video tutorial on UART analysis (something I will be trying soon!).

Installation

Once I had dug out a USB A to Mini-B cable and downloaded the software I was set to go. I had tried getting it to run on Linux (Ubuntu 10.04), but I gave up after about 20 minutes of fiddling and getting nowhere and decided to revert to good old windows XP - so if anyone has any easy to follow instructions on that one let me know!

After extracting the archives I plugged in the device, at which point windows requests a driver. Find the inf folder from the OpenLogic binaries archive, select that and the correct driver will be installed. This creates a virtual COM port. The number of the COM port can be found in the Device Manager (it is the one with Manufacturer = "Microchip Technology, Inc." and Location = "Location 0 (CDC RS-232 Emulation Demo)").

Once this is installed run the OB_Logic_Sniffer.exe file and you get the client.

Select Device -> Capture and you get the Capture setup menu. This enables you to setup triggers, sampling rate and recording size.

Testing

To test it I grabbed my XMOS XC-3 and connected 8 of the the lines to the GPIO port (XS1_PORT_8C on Core 0). I wrote a simple XC program to simply count up in a sequence continuously in a loop at 25Mhz. Here is the setup I used for testing.

After fiddling around wondering why Bank 1 wasn't working, I enabled all the banks and discovered that the signals were on bank 3 (channels 16 -24). I have no idea why this is... but hey ho. It is working and the output is below.

Conclusion

Overall this has the all the makings of a strong tool. It is very affordable @ $45 shipped (available from Seeed Studio) and 16/32 channels of logic analyser @ 100MSPS is certainly not to be sniffed at.

Quality of the software is one of the most important things in a logic analyser as without good analysis software they are a waste of time. The Logic Sniffer doesn't disappoint in this area- It has the capabilities to do simple single trigger or a complex 4 stage triggering and the analyser Java based client is easy and intuitive to use. While basic in the professional logic analyser world they are pretty good for most peoples needs. Extension of the triggering modes would be well worth the development time. Also simple improvements such as the ability to type in Hex values would be nice, rather than having to build a trigger mask with tick boxes.

Alongside the triggering features is the systems ability to analyse SPI, I2C and UART signals. Expanding this protocol analysis is something that should be actively worked on, though it has a good base (these features will hopefully be subject to another review at a later date).

However, the project in its entirety is currently it is a little rough around the edges. A couple of pointers for simple improvements would be:

• an integrated installer - especially the windows stuff. It's a small point, but they aren't hard to make and it makes the whole software installation process a lot less painful (rather than downloading two zips and having to extract them!)
• a simpler firmware upgrade process ( i.e. more integrated PC side software) - the current one looks fairly daunting (even for someone like me who is a relatively experienced user of embedded hardware).

Over all, as an open source hacking tool, I would give this project 8/10, a few minor improvements would push it up. Open source hardware like this can be functionally good, but is often let down by the lack of polish in the user experience.

Share/Bookmark