stas'den - console

"keyboard injection" under Linux

Wed, 15 Aug 2007 21:20:27 -0300

What to do if you want to pass some data into STDIN of some process, and it doesn't accepts it?! One of the most (un)famous example is ssh; who never tried to do a "echo password | ssh host"?! So, you just want to inject characters as there were someone typing them. Remember: TIOCSTI ioctl() call is your friend
Just google it to see what it does. And now, some actually working code:

#!/usr/bin/perl -w
use strict;
use Fcntl;
use constant TIOCSTI => 0x5412;

unless (@ARGV >= 1) {
 print "usage: $0 [vt] <input>\n";
 exit;
}

my $vt = shift @ARGV;
my $buf = join '', <>;
&writevt ($vt, $buf) || die "can't write to $vt: $!\n";
exit;


sub writevt {
 my ($vt, $buf) = @_;
 sysopen (VT, $vt, O_RDONLY) || return 0;
 for (my $i = 0; $i < length $buf; $i++) {
 ioctl (VT, TIOCSTI, substr ($buf, $i, 1)) || return 0;
 }
 close (VT) || return 0;
 return 1;
}

And this is how it works (Linux-specific!!!):

[stas@home stas]$ echo id | ./catvt.pl /dev/pts/0
id
[stas@home stas]$ id
uid=?????(stas) gid=?????(stas) groups=?????(stas)

Kinda awesome

ACFTools (for X-Plane)

Wed, 10 May 2006 01:09:12 -0300

The Plane-Maker from X-Plane v7.x is fun and easy to use... Although I found it a bit limited to edit my planes' fuselage. 20 cross-sections aren't enough, sometimes. It would be nice to export the fuselage shape into any 3D-editor and fine-tune it there... This is exactly what my ACFTools are supposed to do. Please note that X-Plane v8.x is unsupported, unless you create & edit a v7 model and then import it to Plane-Maker v8. But I believe this isn't a problem: X-Plane v8 is able to use OBJ format files (which can be imported/exported by AC3D and Blender plugins) as parts of an aircraft, thus, extremely weird shapes are perfectly possible without even touching the ACF file.
Now, what exactly ACFTools does? It is able to process the file that stores all the aircraft data (except the textures), in the binary ACF format, and dump all the data in the human-readable TXT format. It is the same format as for Tony Gondola's ACF2Text utility, which inspirited my ACFTools. Then, ACFTools can extract the 3D model of the aircraft from this data, and export it in the AC3D format. After that you can edit the aircraft's shape as you want using AC3D and make the inverse process: from .ac to .txt, and then from .txt to .acf. Here comes the brief set of ACFTools features:

Convert from ACF (aircraft) & WPN (weapon) formats to TXT format and vice-versa.
Extract AC3D model from TXT file, along with wings and propellers (using the real airfoils!).
Import AC3D model into TXT file (fuselage, nacelles, wheel fairings & external fuel tanks only)

3D model extractor is also useful if you want to use X-Plane generated aircrafts somewhere else; as in your own Computer Graphics compositions.
ACFTools was written in Perl, thus it is able to work under Linux, MacOS & Windows. And it is Open-Source & highly modular, so you can modify it as you want, or use my functions for your own needs. When you start ACFTools, this is what you get at your console:

##############################################################################
[ACFTools v0.62a] Set of tools to play with ACF files outside of Plane-Maker
Perl script and modules coded by Stanislaw Pusep 
Site of this and another X-Plane projects of mine: http://xplane.sysd.org/

Allows you to:
 * export X-Plane (www.x-plane.com) aircraft data files to human-editable
   plaintext format and 3D mesh editable in AC3D modeler (www.ac3d.org).
 * import plaintext/3D mesh back to ACF file.
##############################################################################

Usage: acftools.exe  [parameters]
 o Commands:
	-extract [DEF]	: extract TXT from ACF (opt: using DEF definition)
        -generate       : generate ACF from TXT
        -merge          : merge body from AC3D file to TXT
 o Parameters:
        -acffile FILE   : name of ACF file to process
        -txtfile FILE   : name of TXT file to process
        -ac3dfile FILE  : name of AC3D file to process
        -noorder        : DO NOT sort vertices while merging bodies
        -noac3d         : DO NOT generate AC3D
        -(min|max)body N: write all bodies in specified range to AC3D
        -force LIST     : force extraction of bodies LIST (comma-separated N)
        -normalize N    : normalize wings to N vert/surface (N>=2 or no wings!)
 o Notes:
        * You can use abbreviations of commands/parameters (-gen or even -g
          instead of -generate).
        * The only required parameter for "extract" command is -acffile.
          Both -txtfile and -ac3dfile are derivated from it.
        * "generate" command and -txtfile has the same relation.
        * By default "extract" uses the latest DEF file.
        * "generate" doesn't need DEF at all (it is implicit in TXT)
        * If file to be created already exists backup is made automatically.
 o Examples:
        acftools.exe --extract=ACF700 --acffile="F-22 Raptor.acf"
        (extract 'F-22 Raptor.txt' from 'F-22 Raptor.acf')

        acftools.exe -e -acf "F-22 Raptor.acf"
        (same as above)

        acftools.exe -me -ac3d ladar.ac -txt "F-22 Raptor.txt"
        (merge *single* 3D body from 'ladar.ac' to 'F-22 Raptor.txt')

        acftools.exe -g -txt "F-22 Raptor.txt"
        (reverse operation; generate 'F-22 Raptor.acf' from 'F-22 Raptor.txt')

The most important thing you should know is that to convert from the binary ACF format to TXT, ACFTools uses one of the files stored in the defs directory. By default, it is a ACF740.def, which works for X-Plane v7.40 and later. You can specify any definition file you want, as shown on the screen above. You can also write your own definition files, if you have the structure specification. Note that to convert TXT back to ACF, no definition is necessary, as the TXT format itself holds all the data necessary to build the binary file. The second thing is to specify the file that ACFTools should convert. The name of the converted file and every of the intermediary files will be generated from this name. When converting from ACF to AC3D formats, TXT file is generated automatically. Please note that when you want to put the edited aircraft part back into the .acf file, you must save this part as a .ac separate file, then merge it into the TXT file, and after that convert it into ACF! Yes, it would be nice to have a GUI to automate the entire process, but I'm too lazy to do that! Anyway, may the source be with you
I strongly recommend you to read the docs\README.txt file contained in the ACFTools package before you start using it!

I.E. 'hidden image' maker

Fri, 05 May 2006 17:47:18 -0300

If you are using Internet Explorer (any version able to load this page , just select the above image (or go to "Edit => Select All", or press Ctrl-A). You may see a watermark with white letters forming a word "TEST". This only happens in IE, due to the specific way it masks the selected images to show their selected state. Firefox, for example, simply tints the image with bluish color. There are lots of jokes one can make using this simple principle. For example, all images on your homepage may have some "subliminal" messages. Adobe PhotoShop is perfectly suitable to make such 'Hidden Images' by hand; in fact, my inspiration was a tutorial made by Matt Kment to do this. But if you are too lazy and/or do not have PhotoShop installed (UN*X users, for example), you can use this small program I wrote in Perl to automate the "steganographic" process. I wrote it using ImageMagick^TM library (so it's required to successfully run the program). It is a command line program, but it is simple enough to use, and it has an advantage to be integrable into your own scripts/programs (you can even setup your server to embed your company logo into all graphics of your site, but this will overload the server's CPU and RAM too quickly). I called my program "Internet Explorer Mask'O'Matic". Take a look at it's startup screen:

Internet Explorer Mask'O'Matic v1.0 by Stas 
Grab yours at http://sysdlabs.hypermart.net/ 

Inspirated by some mad stuff by Lem0nHead
Based on Photoshop 'Hidden Image' Guide (http://www.atomicwienerdog.com/ot/)
made by Matt Kment & suggested to me by xfalmp


ERROR: please give us --visible


 * Usage: MaskOMatic.pl 
 * Options (note that you can use syntaxes like --vis= --hid -out -p):
 --visible filename of image normally seen (required)
 --hidden filename of image seen when selected in IE (required)
 --output filename to write out, format is selected automatically
 using suffix provided (required)
 --percentage float value between 0 & 100; how much of hidden appears
 (optional, defaults to 50%)
 --quality JPEG/MIFF/PNG compression level (optional, DON'T USE!)
 --contrast flag, internal contrast reduction (optional)
 --test filename to dump preview of selected image (optional)

 * Notes:
 # Visible & hidden images doesn't need to have same size, when size
 doesn't matches then hidden image is rescaled using Lanczos filter
 # A huge set of image formats is supported (JPG, GIF, PNG for example)
 but I strongly advice you to write output in loseless format *only*
 (BMP, PNG, TGA) and *then* fine-tune contrast/brightness & save
 compressed in your favourite image editor (like GIMP)

 * Example:
 MaskOMatic.pl --vis bush.jpg --hid death.jpg --out sublim.bmp

Only 3 options are obligatory: --visible, --hidden & --output. You can abbreviate them as -v, -h & -o, respectively. "Visible" is an image that user sees by default. "Hidden" is what user sees when he/she selects the image. And "output" is the resulting image you can embed into your pages. It is also possible to use the "--test" option to preview the selected state of the output image without starting Internet Explorer. If it looks bad, you may play around with "--percentage" option, which specifies the 'weight' of the hidden image. The higher is this value, the greater is the hidden image visibility. If that's not enough to hide your image well (some things are pretty difficult to hide!), you can try to tune the output image with "--contrast" option, but I suggest you to use some GUI program to do that as you get the visual feedback instantly. I also suggest you to always save your output in the non-compressed lossless format (like BMP, TGA, TIFF), and then fine-tune the compression in some program specialized in it (GIMP has a nice compressor with visual feedback).

Alternatives:

Hidden Image Photoshop tutorial
Magic Image Generator C#/VS.NET2003 program (with source)

"ps auwx" faker

Fri, 05 May 2006 01:57:41 -0300

"Process Stack Faker" (psf for short) is able to hide the real executable name and it's parameters from the output of "ps auwx", "ps -ef" & "top" (on UN*X machines), without any superuser privileges. Why should one wish to hide the stuff he/she executes is a complete different topic
Let's take a look at the options that psf itself accepts:

$ ./psf
Process Stack Faker (a.k.a. Fucker) v0.03
Coded by Stas; (C)opyLeft by SysD Destructive Labs, 1997-2003

Usage: psf [options] command arg1 arg2 ...
Where options can be:
-s string fake process name
-p filename file to write PID of spawned process - optional
-d try to start as daemon (in background, no tty) - optional
-l DO NOT exec through link (detectable by 'top'!!!) - optional
-u uid[:gid] (format just like in chown(1)) reset UID/GID - optional
-n priority renice process - optional

Example: psf -s "pine -i" -d -n 19 ./john -session:websrv
$

I hope this is self-explanatory. psf will execute "command arg1 arg2", and it will appear to "ps" & "top" utilities as "string". All other options are... Uhm, optional! They are only useful to detach processes not designed to run as daemons. "-l" is a 'compatibility' switch that disables the weird trick used to override the detection of the real filename by some process listers (notably "top"). The default option may work unexpectingly on some systems (by the way, psf works fine on FreeBSD 4.3, Linux 2.4, NetBSD 1.5 & Solaris 2.7). To test psf, try this:

$ psf -s "pine -i" sleep 30 &
[1] 440
$ ps auwx
...
stas 84 0.0 0.6 2012 1232 pts/0 S 19:12 0:00 bash -rcfile .bashrc
stas 440 0.0 0.1 1204 376 tty2 S 20:09 0:00 pine -i

stas 450 0.0 0.4 2544 816 tty2 R 20:12 0:00 ps auwx
...


"sleep 30"

process was spoofed as "pine -i". Please note the white line between PIDs 440 and 450. This occurs because psf uses whitespace (0x20) characters to shift the original process arguments away from the visible area
To understand how does psf works and learn how to compile it, just read the comments inside the source.

ttysnoop for kernel 2.6

Thu, 04 May 2006 13:09:40 -0300

This project was made by a friend of mine, Vinicius Anselmo. He discontinued it's development (as it showed to be incompatible with later Linux kernels), so I proposed to host his work on my site.

ttysnoop is a small program made by Carl Declerck that allows an administrator to snoop on login terminal through another. It worked until kernel 2.4 because they still with BSD-style pty's support. Here it is a solution for 2.6.

Screenshot:

SSH:

Is ttysnoop compatible with sshd? ttysnoop was created to work with inetd, however, there is a way to make it work with sshd.
First you will need the source code of the sshd. Edit the file configure and add these lines:

LOGIN_PROGRAM="/sbin/ttysnoops"
export LOGIN_PROGRAM

Now it is necessary to verify the paths, so that the new executable uses the same configuration files of your system. For my system I solved making this modification in pathnames.h:

// #ifndef SSHDIR
#define SSHDIR	ETCDIR "/ssh"
// #endif

And executing the script configure specifying a null prefix:

./configure --prefix=

Now compile the program. Make a backup copy of your /usr/sbin/sshd and put your new sshd in the place. That should work. If you are using RedHat or Fedora Core you can try to use my executable (see below).

Bugs:

After log out, it doesn't remove the pseudo-terminal entry. Meaning people showed up as still logged in when they weren't.
I use: who -u | grep -v ?
to see who really is on my system. I don't know how to solve it.

rockin' PC speaker

Thu, 20 Apr 2006 02:06:04 -0300

Well, good old PC speaker is the only default hardware, easily available on almost all PC systems, and virtually unmuteable (actually, one can connect PC speaker output to his/her sound card instead of default buzzer, but this rarely happens . Thus, it is perfect for communicating critical states. But the default system beep is quite boring, and makes difficult to distinguish different events that are being communicated. So, here's my humble attempt to make a highly portable function that is able to play simple non-polyphonic music on the PC speaker. I used it originally to advise when someone tried to log in to my system through SSH daemon (thus the name "daemoniac" - demoniac . It was tested (and worked fine!) under:

DOS (DJGPP, Turbo C)
Windows 9x/NT/2K/XP (Borland C, Microsoft Visual C, MinGW)
Linux (gcc)
FreeBSD (gcc)

By default, demoniac will play Iron Maiden - Fear Of The Dark beginning. You can also compile it to play the simple "A#4 D#5 G5 A#5 G5 A#5" melody. Note that on UN*X systems, demoniac accesses hardware directly, and thus requires to run as root user. It's safe, through: it won't accept any command line arguments and neither process environment variables, so, at least, it can't be exploited with some buffer overflow technique. For detailed instructions about compiling demoniac on different compilers/systems, read the comments at the start of the source. Note that my package provides all the binaries generated on compilers/systems listed above.

ASCII code explorer

Thu, 20 Apr 2006 01:52:32 -0300

Designed to be the freakin' best ASCII table viewer for DOS platform, LOL!!!

It accesses the console font bitmaps directly from the BIOS and amplifies them 16 times (bitmaps in a hex form are shown, also). User can navigate the character map using his/her mouse or the cursor keys. For every character, it's ASCII code in decimal, hexadecimal & binary formats is displayed. One can also build strings of ASCII characters, just like in Windows' "Character Map". Foreground/background colors for the character, magnified character & character string are also editable through the GUI (there are 16 colors available for background, instead of default 8 . It's pretty useless today, but helped me a lot to develop my elder programs. By the way, this ASCII explorer was written using QBasic 4.5...

ptBR nums2words()

Thu, 20 Apr 2006 01:37:14 -0300

Uma função que programei para retornar strings com números escritos por extenso. Por exemplo: nums2words(2006) retorna "dois mil e seis".
Não que não exista mais nenhum algoritmo para isso; acontece que quis criar o meu próprio de tal forma que ele seja de fácil implementação em C, e que seja portável para outras linguagens, no sentido mais extenso (tanto linguagens computacionais, como Perl, Java, PHP; como linguagens humanas, como inglês, espanhol, russo).
Funciona da seguinte maneira: os números são "decompostos" em sub-unidades maiores possíveis às quais nós, humanos, damos nomes. No exemplo do 2006, há 2 unidades: "dois mil" e "seis". Essa operação é feita através do velho e bom resto da divisão, sem ter que converter o número em string e processá-la dígito por dígito.
Na realidade, comecei programando-o em Perl, depois traduzi para C, refinei, otimizei, aí traduzi de volta para o Perl
Não sei se está gramaticalmente correto; porém está perfeitamente compreensível. Acredito que o mesmo algoritmo poderá ser reaproveitado para inglês e russo. Porém isso fica a cargo do leitor!

knuckle cracker

Wed, 19 Apr 2006 02:42:33 -0300

This project is a response to the urge to make small changes to the big binary files. For text files, there are diff/patch utilities; and for big changes, rsync is perfect. Now, if you're sharing something like a game mod, where you need to swap a single bit inside a huge data file (just like in a Hot Coffee Mod for GTA San Andreas , you're frequently forced to share the entire file. By the other side, if you need to update some firmware glitch, why should you rewrite the entire flash chip?! So, here's my proposal.
bin_diff utility will compare two binary files and output a human-readable (and writable script file, just like this:

[bb35cc23dda6737d181a63ea3203f0ff engine.dll]
50	"This program must be run under Win32\xd\xa$"
d60a	EB
d77b	90 90
da3f	E9
da41	1 0
ea44	90
# Patch length: 0000007A

First line contains a name of the file to be patched, and it's MD5 checksum value. Following lines start with a hex offset inside this file, and the new byte(s) value. Note that strings with C-like escaping style are supported! You may also comment each line, using the hash character (#). Several files may be patched by a single patch-script. The last string in the last line is a hex value of the patch data length. It is useful to make self-applicable patches.
Then, knuckle_cracker may be used to parse the patch-script and apply modifications to the files. It will check the MD5 checksum for each file automatically (and will refuse to patch unmatched files). You can also make the self-applicable patches, concatenating the patch-script directly at the end of the knuckle_cracker executable (following example works on UN*X systems, for Windows box, use any hex editor, it works just the same):

cat knuckle_cracker engine.bin_patch > engine_patcher

Both bin_diff & knuckle_cracker are very portable: I tested them on Linux, FreeBSD (gcc) & Win32 (Borland C/CYGWIN/MinGW/MSVC).

P.S. - all sources has DOS line endings (CRLF), use
"unzip -aa knuckle_cracker.zip" to extract on UN*X systems.