theme change

Being the age of the Cloud I decided to retheme this blog.

Hope you like it :-)

PS. There's a new review of Melancholia over at the popcorn stand.

Context-keyed Payload Encoding - AthCon 2010

This Thursday I will be doing a talk on "Context-keyed payload encoding" at AthCon 2010.

AthCon is a fresh IT security conference that will take place on June 3rd 2010, in Athens, Greece.

My presentation will cover both shellcode detection and NIDS evasion themes, but will mostly focus on the "Context-keyed payload encoding" technique, that allows attackers to bypass many of today's state of the art intrusion detection systems.

I must say that I'm quite excited about this event, since I've been yearning for a Greece-based technical ITsec conference for many years now..

AthCon also gives us the opportunity to meet up with old friends and respected colleagues from the field. So yes, it's going to be both interesting and fun! :^)

Hope to see you there!

P.S. registration ends today; you may want to sign up fast!

the new yada yada operator

Perl 5.12 is out!

This release introduces a new operator, called the "yada yada" which looks like an ellipsis (...) and implements a placeholder for code.

So, the following snippet is now valid perl :-)

do {
    steal_underpants;
    ...;
    profit;
};

canaries, black hats and other magic tricks

Haven't updated my blog for some time now. Hmm, maybe it needs a new look.

I've been spending most of my free time on census research projects and PhD stuff. Hopefully I'll be finishing the darn thing this year.

Anyway, I recently did a quick writeup on how canary gets randomised nowadays in Linux apps. You can find it over here.

In other news, my workmate argp will be presenting both stack and heap smashing techniques for FreeBSD kernel exploitation at this year's BlackHat Europe (woohoo!). This will be a thorough examination for both attack vectors along with notes on safe kernel continuation. You don't wanna miss this!

That's all for now.

The Netflix prize

For those of you that participated in the Data Mining session of the recent ellak workshop, there are some new developments regarding the Netflix data mining contest.

According to Slashdot and the Netflix Prize Leaderboard, there may be a winning team.. :-)

Concert Audio in Lossless formats

etree.org hosts an amazing list of concert recordings in lossless formats. There's also a mailing list and RSS to keep you updated on new .torrent files.

Nice!

Full Concert Audio online!

wolfgangsvault.com has some amazing rock n' roll concerts online.

The quality is decent, the streaming is good and .. it's free.

Be sure to check it out!

Ibrahim Electric

This band is amazing. I've been listening to their music for almost a year now and I can't get them out of my daily roster.



You might wanna check these ones as well [1] [2] [3]...

Kudos to George and Alex for introducing me to these fine Jazz-Afro-Surf grooves!

P.S. I wonder if we'll ever get to see them in Athens.

Questionable Content Marathon

I was introduced to this comic by two friends, around a year ago, and started reading it backwards, because:
a) The stories that were running back then, were really good
b) There were 1000 or so strips in total
c) It seemed doable (it wasn't).

Anyway, a friend was recently reading the first strips and from her enthusiasm I gathered that they must be equally as good. So last night, I did the proper thing and started reading it from the beginning. On issue #128 I felt a bit sleepy and so I headed off to bed.

I woke up way too early this morning, and read up to #256.

It seems that I'm hooked, so I guess I should continue with this powers-of-two Marathon, by reading up to #512 tomorrow :-)

How to force a reboot when you have a RAID array attached

When the system gets stuck (yes, this happens in our beloved operating system too) who do you call?

- Sysrq of course!

My usual approach would be:
1) sync all filesystems: alt + sysrq + s (multiple times, the actual value depends on my mood :-)
2) remount all filesystems read-only: alt + sysrq + u
3) cause a reboot: alt + sysrq + b

BUT, this comes with an issue if you're doing software RAID (md).

md devices register themselves (via register_reboot_notifier) to be sync'ed whenever a reboot is about to occur. Also, if the array was being reconstructed (or re-synced) during the reboot operation, you get a nice checkpoint, so that after reboot the operation will continue off from where it left. This is all fine and dandy, but it seems that the sync/checkpointing operation does not occur if you've previously called for an emergency read-only remount of filesystems.

[ It seems that alt + sysrq + u, also makes the raid devices read-only... and thus, not being able to perform any writable operation (such as a sync or checkpoint). BUT, I've yet to find the part of the code that is the cause of this. I'll have another look though, as soon as I figure out what's going on with libata lately. Since 2.6.25 I've been having timeout troubles with my SATA drive (yes, a seagate one). The lkml-suggested 'noncq' option hasn't helped much.. ]

ANYWAY, back to our subject. So you have a raid-array and you want to reboot?
- Just sync (alt + sysrq + s) and reboot (alt + sysrq + b) without doing any RO-remounting.

Read the sign

A message from the (post-Katrina) city of New Orleans to our young vandals in Greece..

Leeching Picassa Albums

Here's a tiny python script for downloading Picassa photo albums!

It requires two parameters: the album's RSS URL (there's
a link to this at the bottom of each album page) and the pathname
of the directory where the downloaded photos will be stored.

Enjoy :-)

#!/usr/bin/env python

import urllib
import feedparser
import sys
import os

if len(sys.argv) != 3 :
   print >> sys.stderr, (("usage: %s " + 
      "<picassa-album-rss> <local-dir>") % sys.argv[0])
   sys.exit(1)

album_rss = sys.argv[1]
local_dir = sys.argv[2]

if not os.access(local_dir, os.W_OK | os.X_OK):
   print >> sys.stderr , ("error: dir %s is not writable" %
                          local_dir)
   sys.exit(1)

abs_dir = os.path.realpath(local_dir)

feed = feedparser.parse(album_rss)

total_items = len(feed.entries)
if total_items == 0:
   print >> sys.stderr , ("error parsing url %s" % album_rss)
   sys.exit(1)

for i in range(total_items):
   # of course this breaks once Picassa change their rss format..
   website = feed.entries[i]["enclosures"][0]["href"]
   slash_pos = website.rindex("/")
   pic_name = website[slash_pos+1:]
   urllib.urlretrieve(website, "%s%s%s" % (abs_dir, os.path.sep,
                                           pic_name))
   print "downloaded: %s (%i/%i)" % (pic_name, i+1, total_items)

"Software Libre Society events" report

What was missing?

There was a need (for some time now) for a real discussion forum on Software-related issues, targeted towards the growing Free Software community in Greece. A place where developers could meet on a regular basis, present their work and exchange ideas with other members of the local community. A place where sysadmins could talk about "best practices" in their line of work and receive valuable feedback. A "computer club" that would present new developments in hardware, software and in the tech-y world at large. A place where the recreational hacker would feel at home :)

How did the "Software Libre Society events" cοme to be?

In October 2007, two 1st-year students from the Department of Informatics of the University of Piraeus dropped the following question to the administration team of the CS-laboratories: "Why don't we do a local OSS event?". Although we had been hosting 1-or-2 such events each year (install fests, distro demo's, MySQL 5.0 show by David Axmark and friends), I was thinking that maybe this time we should be going for something more of a community event.

Having some previous experience from "Δαίμων" (a software forum that was hosted at the University of Athens, a few years ago), the "ΕΛΛΑΚ workshops" (www.ellak.gr) and the support of friends from the local Linux User Group (www.hellug.gr), we set out to empower both the local university community (oss.cs.unipi.gr) and ultimately the Greek OSS community, by creating a weekly event that was targeted specifically for this audience.

What does a "Software Libre Society event" look like?

Every Friday at 18:00pm to 21:00pm (EET) we have 2 (sometimes 3) presentations in a Computer Science Laboratory at the University of Piraeus (the room has a 50-person quota which is OK for now but we might have to move to a bigger place if needed).

Each presentation takes approximately 45' and is followed by a 15' Q&A session. We try to organise the presentations so that we first have a technical subject which is then followed by some lighter subject, or an introductory subject followed by a more advanced one. We also try to group similarly themed presentations together.

Each session has its own documentation page on the community's wiki. The wiki contains the event schedule, presentation files, various flyers, related links and other information related to the presentations.

During the presentations, there's a live video stream for all those who couldn't make it to the event. Once the captured video's have been edited, they become available on the wiki.

There's a 10' break between presentations so you can strech your legs, socialise, grab a cup of tea/coffee/beer.. Once the presentations are over, we usually go out and have something to eat. This has become quite a tradition and some may even argue that it constitutes half of the event :)


EventZero

In the initial event I did an intro on Free Software and GNU/Linux which was followed by the remarkable team of "iloog" developers (Giorgos Kargiotakis, Leuteris Zafiris) who presented their distribution (and the distro it's based on, Gentoo). The event was a big success, with a 40-person attendance, half of them coming from greek OSS communities (unipi.gr, ntua.gr, upatras.gr, ilug.gr, hellug.gr, ubuntu.gr, linuxformat.gr and GRnet's #linux/#linuxhelp) and the other half being mainly university students.

Unfortunately there was no video capture of this event, but we managed to get a few photos such as the one below:



The event was followed by a beer drinking session at "The Stand" in Exarcheia.

EventOne

In this session Dimitris Glezos introduced us to the Fedora platform and his own work on the (GSoC sponsored) software called Transifex! Lambros Papadimitriou went on to present the wonderful packet manipulation library called "scapy", which he used in his own project Pluto.



The event was well attended (approx 30 persons). It was recorded to digital video and a small sample can be found here.

The event organisers went on to watch a show of the "Night on Earth" band at the Small Music Theater in Athens.

EventTwo

This was the first event of these series to be broadcast over the internet (and have questions fed over irc).

Lambros did an introduction to Source Code Management tools and explained the Subversion SCM. Giorgos Keramidas (of FreeBSD fame) continued on with a presentation on distributed SCMs with a focus on Mercurial.



Although the stream was available over the internet we had a wopping 35-person attendance! Our tiny webserver got 2120 hits and there were 10 people watching over the net.

Once the event was over we headed towards "Rozalia" at Exarcheia to have something to eat.

EventThree

This time Giorgos Keramidas took on a different subject (one he knows by heart), the FreeBSD project! He was followed by Nikos Kokkalis who explained a few things about the greek FreeBSD documentation project. The event ended with Zafiris Galanopoulos' (poetic?) presentation on the XeLaTeX typesetting system, whose features were much anticipated by the greek-typesetting community for some time now.



The event was well attended (almost 30 persons) and got great reviews!

IIRC we had dinner at "Hardalia's Koutouki" in Kalithea that night.

EventFour

Last Friday's event was a big success. We met with lots of people we hadn't seen in ages (kudos to the AWMN OSS guys!) and the attendance could only be compared to that of the initial event (40+ persons there, 15 viewers from the internet). What is really important is the fact that as the events continue on, the percentage of the OSS community within the attending parties is growing strong, thus allowing for more technical questions during the Q&A and later discussions.

As far as the presentations are concerned, Gregory Potamianos presented the Debian GNU/Linux distribution and a few tricks for the already initiated, while Apollon Oikonomopoulos presented the MacOS X platform, from the Unix user's point of view.



Discussions continued on in a beer drinking session at "Ostria" in Exarcheia and we later moved to a tavern called "Efimeron" for dinner. For some strange reason we kept on bumping into people from the events during our walk in the center of Athens. Seems the community is everywhere..beware! :o)

xmas special event

This Friday we will be having a special event dedicated to computer graphics!

Giannis Tsiompikas (aka Nuclear in the Demo scene world) will be presenting the principles behind the Design and Implementation of 3d graphics engines, along with a demo of his older engine "3dengfx". Christos Smailis will follow, taking us on a trip to the world of 3d modelling with Blender!

There's a good chance there's going to be a surprise at the end of the event, so don't miss it! :)

Preparing a DivX movie for your standalone DivX player

Here's an avidemux guide for processing DivX movies to make them suitable for playback on standalone DivX/DVD players.

You can use a shell script to prepare all of your movies, since Avidemux can be configured to perform most (if not all) operations from the command line!

Cool stuff.

Tip for saving printing paper

One can save on paper supplies, by printing multiple pages in single A4 paper sheets.

On GNU/Linux you can do this with the pdfjam utilities.

# apt-get install pdfjam

The following cmdline turns file[1-3].pdf into a single pdf file

$ pdfjoin --outfile single.pdf file1.pdf file2.pdf file3.pdf

We now put two pages into one (in landscape mode)

$ pdfnup --outfile 2_pages_in_one.pdf single.pdf

You may wish to enable double sided printing through CUPS at this point.

Your job is now ready for printing.

$ lp -d printer_name 2_pages_in_one.pdf

My Little Obsessive Compulsive Friend

An animated short from a young talented artist. Enjoy :)

Farewell Costas

One of my favorite drummers, Κώστας Κουβίδης, was lost in a car accident in the early morning hours of April 26th, 2007.

I can still hear his signature rhythm in my head, like that time with Kontrafouris in Athens, or with Tilemachos in Thessaloniki..

Costas, you will be missed..

Bjork & P. Diddy

Sylphis3D has been GPL'ed!

I still can't believe it.. We were all hoping for this to happen sometime, but the actual news took us by storm! Sylphis3D, one of the most advanced 3D engines out there, has been made OpenSource!

Congrats to the lead developer Harry Kalogirou, who turned a part-time project into a landmark in the gamedev world. I hope the project will flurish in many exciting ways, bringing the "cream of the crop" in 3D to the OpenSource community.

Bravo Harry!

Implementing Polymorphism in C

A few months ago I was doing some work on Linux /proc fs. As you may already know, procfs (just like any other filesystem in Linux) implements the VFS API. The VFS API groups together common concepts between filesystems (e.g. retrieving an i-node from a pathname, assigning permissions to an i-node etc.). This allows for some polymorphism in the kernel code: a module requiring a VFS operation upon a file, does not need to know the actual type or inner-workings of the filesystem hosting this file.

In order to apply Objected Oriented Programming concepts to C code, one could map classes to structs, attributes to struct members and methods to function pointers. Having said this, there exists a small issue here that can be quite disturbing (other than the OOP->C mapping :-). A function pointer restricts (via the function prototype) the type of parameters passed to the function it is pointing to.

One can use void pointer parameters to allow for varying parameter types, but this decreases the code readability (i.e. function prototypes include void pointer arguments instead of meaningful types) and disables parameter type checking.

Another approach is to introduce a common structure, which will be passed as parameter to the polymorphic function, hiding all type-dependant data in a special field of this structure. This special field is usually a void pointer or a union and is used as private storage space for each implementation of the polymorphic function. This is common practice and can be found in many TCP/IP stack implementations. Should a void pointer technique be used, there would be some code readability issues regarding the structure definition. The union approach, although more verbose in nature, ties the definition of the special field with all possible types of private data and in this way, forces an update on the struct definition each time a new type is introduced.

So, how can we keep the function prototype as generic as possible and at the same time have descriptive parameter types without changing too much code?

Instead of employing a one-level inheritance scheme, where a base struct contains a special field for use by "sub-classes", we can reverse this model to allow for arbitrary inheritance levels (and get multiple inheritance as a bonus!):

"struct mydriver" is a struct used by an imaginary device driver. This driver adheres to some driver API and as such inherits "struct driver_API" from this API. The driver makes use of a character device and hence inherits some utility functions from "struct char_driver". Thus, "struct mydriver" would look something like this:

struct mydriver {
  struct driver_API d_api;
  struct char_driver char_dev;
  time_t timeout;
  int fd;
};

struct members "timeout" and "fd" are mydriver-specific. Now, let's say that we wish to override a function found in the "struct driver_API" with a mydriver-specific one which makes use of the "timeout" field. The function pointer "update_pci_timeout" yields this function's prototype as follows:

struct driver_API {
  ...
  time_t (*update_pci_timeout)(struct driver_API *d_api,
                               time_t new_timeout);
  ...
};

The mydriver implementation of this function would look something like this:

time_t mydriver_update_pci_timeout(struct driver_API *d_api,
                                   time_t new_timeout)
{
  struct mydriver *mydriver_data;
  ...
  mydriver_data = get_mydriver_ref(d_api);
  if ((mydriver_data->timeout) < 1900){
    ...
  }
  ...
}

Hmmm, what is this magical "get_mydriver_ref"? It returns a pointer to the child (outer "struct mydriver") given a pointer to the parent (inner "struct driver_API"). Of course this only works if "struct driver_API" was previously instantiated as a member of a "struct mydriver", but this is a safe assumption since the scope of our code is limited to the "mydriver" driver.

What follows is the code for "get_mydriver_ref". It uses a bit of GCC magic (macro "container_of") to get the address of the outer struct.

#define container_of(ptr, type, member) ({ \
  const typeof( ((type *)0)->member ) *__mptr = (ptr); \
  (type *)( (char *)__mptr - offsetof(type,member) );})

struct mydriver *get_mydriver_ref(struct driver_API *api){
  return container_of(api, struct mydriver, d_api);
}

"container_of" is defined in <linux/kernel.h> of the kernel sources. You can see an example of its use with PROC_I (returns procfs-specific data for an i-node) in linux/fs/proc/inode.c