Pages

Wednesday, November 30, 2011

RTTTL Player

The code runs at a clock frequency of 8 MHz. The controller is programmed using STK500 in ISP programming mode. RTTTL is a text encoding containing the information about the characteristics of a song. Here is a sample tone in RTTTL format given below and in that mentioned the default duration (d), octave(o), and beats per minute (b) information is specified.

Happy Birthday Song:d=4,o=5,b=125:8g.,
16g,a,g,c6,2b,8g.,16g,a,g,d6,2c6,
8g.,16g,g6,e6,c6,b,a,8f6.,16f6,e6,
c6,d6,2c6,8g.,16g,a,g,c6,2b,8g.,16g,
a,g,d6,2c6,8g.,16g,g6,e6,c6,b,a,
8f6.,16f6,e6,c6,d6,2c6

       Songs have been stored in the Flash memory of the microcontroller using the macro PROGMEM.

char song1[] PROGMEM = "Happy Birthday
Song:d=4,o=5,b=125:8g.,16g,a,g,c6,
2b,8g.,16g,a,g,d6,2c6,8g.,16g,g6,e6,
c6,b,a,8f6.,16f6,e6,c6,d6,2c6,8g.,
16g,a,g,c6,2b,8g.,16g,a,g,d6,2c6,
8g.,16g,g6,e6,c6,b,a,8f6.,16f6,e6,
c6,d6,2c6";

      Here is the code for decoding the format according to the RTTTL specifications:
// format: d=N,o=N,b=NNN:
// find the start (skip name, etc)
while(pgm_read_byte(p) != ':')
p++;                                            // skip ':'
p++;                                            // Moving to 'd'
// get default duration
if(pgm_read_byte(p) == 'd')
{
p++;                // skip "d"
p++;          // skip "="
num = 0;
while(isdigit(pgm_read_byte(p)))
{
num = (num * 10) + (pgm_read_byte(p++) - '0');
}
if(num > 0)
default_dur = num;
p++;                                            // skip comma
}
// get default octave
if(pgm_read_byte(p) == 'o')
{
p++;                                      // skip "o"
p++;                                      // skip "="
num = pgm_read_byte(p++) - '0';
if(num >= 4 && num <=8)
default_oct = num;
p++;                 // skip comma
}
// get BPM
if(pgm_read_byte(p) == 'b')
{
p++;                                      // skip "b="
p++;                                      // skip "b="
num = 0;
while(isdigit(pgm_read_byte(p)))
{
num = (num * 10) + (pgm_read_byte(p++) - '0');
}
bpm = num;
p++;                                      // skip colon  
}
// BPM usually expresses the number of quarter notes per minute
wholenote = (((60.0 * 1000.0) / (float)bpm) * 4.0);
// this is the time for whole note (in milliseconds)
// now begin note loop
while(pgm_read_byte(p))
{
// first, get note duration, if available
num = 0;
while(isdigit(pgm_read_byte(p)))
{
num = (num * 10) + (pgm_read_byte(p++) - '0');
}
if(num)
duration = wholenote / (float)num;      //milliseconds of the time to play the note
else
duration = wholenote / (float)default_dur;
// we will need to check if we are a dotted note after
// now get the note
note = 0;
switch(pgm_read_byte(p))
{
case 'c':
note = 1;
break;
case 'd':
note = 3;
break;
case 'e':
note = 5;
break;
case 'f':
note = 6;
break;
case 'g':
note = 8;
break;
case 'a':
note = 10;
break;
case 'b':
note = 12;
break;
case 'p':
note = 0;
}
p++;
// now, get optional '#' sharp
if(pgm_read_byte(p) == '#')
{
note++;
p++;
}
octave = top[note];
// now, get optional '.' dotted note
if(pgm_read_byte(p) == '.')
{
duration += duration/2;
p++;
}
// now, get scale
if(isdigit(pgm_read_byte(p)))
{
scale = pgm_read_byte(p) - '0';
p++;
}
else
{
scale = default_oct;
}
/* Process octave */
switch (scale)
{
case 4 : /* Do noting */                // x>>y = x/2*y
break;
case 5 : /* %2 */
octave = octave >> 1;
break;
case 6 : /* %4 */
octave = octave >> 2;
break;
case 7 : /* %8 */
octave = octave >> 4;
break;
case 8 : /* %16 */
octave = octave >> 8;
break;
}
if(pgm_read_byte(p) == ',')
p++;                 // skip comma for next note

         After we get the scale and duration of a note, we play the note for the specified duration. This is achieved by two timers, Timer0 for duration and Timer1 in PWM mode, to produce a square wave of a particular frequency by setting the TOP value of the OCR1C register.

DDRB |= (1<<PB3);                           //Setting the PWM channel output pin
TCCR0A &= ~(1<<WGM00);                       //Normal mode
TCCR0B |= ((1<<CS02) | (1<<CS00));            //Prescalar 1024
if(note)                                    //If a note occurs
{
TCCR1A |=  ((1<<COM1B1) | (1<<PWM1B));        //Non inverting mode, Fast PWM
TCCR1B |=  ((1<<CS13) | (1<<CS10));     //Prescalar 256
TCCR1C |= (1<<COM1B1);                 //Clear on compare match
TCCR1D &=~((1<<WGM11) | (1<<WGM10));
OCR1C = octave;                        //setting up Top value
OCR1B = (OCR1C>>1);                    //50% duty cycle
TCNT0L = 0;
for(;;)
{
if(TCNT0L >= 78)                 //Duration checking
{
duration = duration - 10.0;
TCNT0L = 0;
}
if(duration <= 0.00)
break;
}
TCCR0B = 0x00;
}
else                                        //If a pause occurs
{
TCNT0L = 0;
for(;;)
{
if(TCNT0L >= 78)                 //Duration checking
{
duration = duration - 10.0;
TCNT0L = 0;
}
if(duration <= 0.00)
break;
}
TCCR0B = 0x00;
}

Enjoy...

Saturday, November 26, 2011

Microsoft Windows shmedia.dll Division By Zero, Explore.exe DOS Exploit

The shmedia.dll module, serves as shell media extension for Windows, which provides statistics and thumbnails for media files. The dll has also got the ability to acts as media file property extractor of the Windows shell(explorer.exe) to extract custom attribute information from audio, video, midi, and video thumbnail files including MPEG, MPE, MPG, ASF, ASX, AVI, and WMV.

 The shmedia.dll application calculates the bit-rate of the file and creates a thumbnail preview for the Properties. So when a user open a folder containing AVI,MPEG file extensions the Shmedia.dll loaded with explorer.exe will automatically calculate the files details and make a preview of the properties.

 A Div by Zero bug is found when shmedia.dll handles malformed AVI file which when viewed or explored produces a crash. No user triggering is required except dragging the mouse pointer on top of files. Currently it is just (a fun bug ) with causes just DOS condition. The only issue would be as all applications uses windows file explorer to open a file (File + Open) all applications would be crash when attempting to open this file.

Technical Details:
 The GetAViInfo is responsible for reading the file information , a primarily check is done to verify the AVI file headers to ensure the presence of right AVI headers. If returned true will move on to the file size bit rate calculation and all.


shmedia!GetAviInfo:
5cad6f8e 8bff mov edi,edi 5cad6f90 55 push ebp
5cad6f91 8bec mov ebp,esp
5cad6f93 53 push ebx
5cad6f94 56 push esi
5cad6f95 57 push edi
5cad6f96 ff7508 push dword ptr [ebp+8]
5cad6f99 bbffff0080 mov ebx,8000FFFFh 5cad6f9e e803f5ffff call shmedia!_ValidAviHeaderInfo (5cad64a6)
5cad6fa3 85c0 test eax,eax


Get AVI info function is responsible for calculating the file size and AVI files bit rate

5cad6fa5 7463 je shmedia!GetAviInfo+0x7c (5cad700a)
5cad6fa7 33ff xor edi,edi
5cad6fa9 57 push edi
5cad6faa 6880000000 push offset +0x7f (00000080) 5cad6faf 6a03 push 3
5cad6fb1 57 push edi
5cad6fb2 6a01 push 1
5cad6fb4 6800000080 push 80000000h
5cad6fb9 ff7508 push dword ptr [ebp+8] 5cad6fbc ff154c10ad5c call dword ptr [shmedia!_imp__CreateFileW (5cad104c)]
5cad6fc2 8bf0 mov esi,eax
5cad6fc4 83feff cmp esi,0FFFFFFFFh
5cad6fc7 7518 jne shmedia!GetAviInfo+0x53 (5cad6fe1)
5cad6fc9 ff157810ad5c call dword ptr [shmedia!_imp__GetLastError (5cad1078)] 5cad6fcf 3bc7 cmp eax,edi
5cad6fd1 7437 je shmedia!GetAviInfo+0x7c (5cad700a)
5cad6fd3 7e37 jle shmedia!GetAviInfo+0x7e (5cad700c)
5cad6fd5 25ffff0000 and eax,offset +0xfffe
(0000ffff)
5cad6fda 0d00000780 or eax,80070000h 5cad6fdf eb2b jmp shmedia!GetAviInfo+0x7e (5cad700c)
5cad6fe1 57 push edi
5cad6fe2 56 push esi
5cad6fe3 ff15ac10ad5c call dword ptr [shmedia!_imp__GetFileSize (5cad10ac)]
5cad6fe9 56 push esi


Once AVI file size is determined the function will move on and read the AVI data streams

5cad6fd5 25ffff0000 and eax,offset +0xfffe
(0000ffff)
5cad6fda 0d00000780 or eax,80070000h 5cad6fdf eb2b jmp shmedia!GetAviInfo+0x7e (5cad700c)
5cad6fe1 57 push edi
5cad6fe2 56 push esi
5cad6fe3 ff15ac10ad5c call dword ptr [shmedia!_imp__GetFileSize (5cad10ac)]
5cad6fe9 56 push esi


5cad6ffb ff7508 push dword ptr [ebp+8] # 5cad6ffe e8cffbffff call shmedia!ReadAviStreams (5cad6bd2)
# Our crash file contains Null butes which would be feteched.
5cad7003 8bd8 mov ebx,eax #
5cad7005 e85c3e0000 call shmedia!AVIFileExit (5cadae66) # 5cad700a 8bc3 mov eax,ebx #


 Division by Zero error occurs here. When the Null bytes from the stack are loaded on to registers.

shmedia!_aulldiv:
5cadac40 53 push ebx
5cadac41 56 push esi
5cadac42 8b442418 mov eax,dword ptr [esp+18h]
5cadac46 0bc0 or eax,eax
5cadac48 7518 jne shmedia!_aulldiv+0x22 (5cadac62) 5cadac4a 8b4c2414 mov ecx,dword ptr [esp+14h]
-------------------> Data from the stack got from the file, null
5cadac4e 8b442410 mov eax,dword ptr [esp+10h]
-------------------> Stack data,
5cadac52 33d2 xor edx,edx
5cadac54 f7f1 div eax,ecx
-----------------------------> Division by Zero Error

eax=0000001e ebx=03cc0054 ecx=00000000 edx=00000000 esi=01c6eb64 edi=00000000
eip=5cadac54 esp=01c6e6e8 ebp=01c6eb08 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
shmedia!_aulldiv+0x14:

Possible Attack Vector:
 It is possible for an attacker to load few number of the crash files into a pen drive and make the pen drive unusable, when tried to view file pen drive contents will crash the user's explorer.

The information has been provided by Rahul Sasi .

Friday, November 25, 2011

Mobile Hacking

Hey Guys tomorrow I have an exam of Wireless Communication,I am just reading a book of it and I just think about this technique which I am sharing here...

When 1G or AMPS network invited, it has so many vulnerabilities like eavesdropping and handset cloning because it was work on analog domain. But 2G network works on digital and uses different sort of encryption algorithm to protect the data.

Here I am going to give you some brief idea about the GSM architecture...


VLR-Visited Location Register 
HLR-Home Location Register
AuC-Authentication Center 
EIR-Equipment Identity Register 
BSC-Base Station Controller 
PSTN-Public Switched Telephone Network
SIM-Subscriber Identity Module
MS-Mobile Station
BTS-Base Transceiver Station
MSC-Mobile services Switching Center
ISDN-Integrated Services Digital Network

GSM network  use some authentication process which allows to SIM (Subscriber Identity Module) to enter into the network, because mobile can detect all the signals of all operators but your cell phone can connect to the network of that appropriate service provider. SIM has some flash memory also in which it stores  information (contacts and messages) and programming which contains a temporary cipher key for encryption, Temporary Subscriber Identity(TIMSI), International Mobile Subscriber Identity (IMSI), PIN (Personal Identification Number) and a PUK (PIN unblocking key).

Here SIM stores a 128-bit authentication key provided by the service provider, IMSI is a unique 15-digit number that has a three part.
3 digits of Mobile Country Code (MCC)
10 digits of Mobile Network Code(MNC)
2 digits of Mobile Subscriber Identity (MSIN)

Here interface of the handset to BTS is encrypted by A5 algorithm so we can not do any thing between this layer, but the interface of the BTS to BSC and BSC to MSC is usually does not encrypted, so if someone start sniffing on this link than its easy.


So this is the main hole in GSM network....

To Improve FireFox Speed

Firefox is already pretty damn fast but did you know that you can tweak it and improve the speed even more?

That's the beauty of this program being open source.
Here's what you do:
In the URL bar, type “about:config” and press enter. This will bring up the configuration “menu” where you can change the parameters of Firefox.

Note that these are what I've found to really speed up my Firefox significantly - and these settings seem to be common among everybody else as well. But these settings are optimized for broadband connections - I mean with as much concurrent requests we’re going to open up with pipelining.

Double Click on the following settings and put in the numbers below - for the true / false booleans - they'll change when you double click.

Code:
browser.tabs.showSingleWindowModePrefs – true
network.http.max-connections – 48
network.http.max-connections-per-server – 16
network.http.max-persistent-connections-per-proxy – 8
network.http.max-persistent-connections-per-server – 4
network.http.pipelining – true
network.http.pipelining.maxrequests – 100
network.http.proxy.pipelining – true
network.http.request.timeout – 300


One more thing… Right-click somewhere on that screen and add a NEW -> Integer. Name it “nglayout.initialpaint.delay” and set its value to “0”. This value is the amount of time the browser waits before it acts on information it receives. Since you're broadband - it shouldn't have to wait.

Now you should notice you're loading pages much faster now!

Related Posts Plugin for WordPress, Blogger...