Unconscious

This blog post highlights an interesting part of this factual video (available only in the UK). I'd highlight another part, from the end of the video, that I find also interesting.

One part of the video was about data overload, and how the brain filters the information we need. There was an experiment where satellite images taken of Afghanistan, to locate enemy hosts. But the images are so large and hunting through the pictures cannot be done with computers, and it's very monotonic and slow by doing it manually. In the experiment, the satellite images were randomly separated to hundreds of sub images. Few showed building that the the professor wanted to find. The professor got an EEG cap that monitored his brain activity on the certain part of the brain. He looked at the sample image containing the building and brain signals were recorded by EEG cap. The satellite images started flashing up on the screen, and the professor didn't immediately realize any buildings on them. They created a color map of the brain activity where, for example, the red meant something grabbed his attention. They matched the brain activity with the pictures. When they looked the corresponding picture to the red region, there were buildings on there.

I was smiling when saw this. Not because I don't believe it but on the contrary. Actually, I've been doing this with the exception that I don't wear EEG cap, and I don't look at satellite images. I look at hex dump or at interpreted machine code or at source code. These tend to be huge amount of information to look at by eye. I usually scroll through them quickly and I know that I might miss something but carry on anyway. I just don't know if my unconscious picks up something that I don't immediately realize but I have no reason to disbelieve this video.

One byte heap overflow

The following code snippet copies the content of source buffer to the destination buffer. Since the source buffer is one-byte-larger than the destination buffer it overflows the heap by one byte.

void main(void)
{
    char* pDest = new char[4];
    char pSrc[] = {"Bytes"};
    memcpy(pDest, pSrc, 5);
    delete pDest;
}

Let's see the source code again matching the blocks to their native counterparts.

void main(void)
{
 push        ebp
 mov         ebp,esp
 sub         esp,8
    char* pDest = new char[4];
 push        4
 call        dword ptr [__imp_operator new (10E209Ch)]
    char pSrc[] = {"Bytes"};
 mov         ecx,dword ptr [string "Bytes" (10E20F4h)]
 mov         dx,word ptr ds:[10E20F8h]
    memcpy(pDest, pSrc, 5);
 mov         dword ptr [eax],ecx ;Copy 4 bytes to destination buffer
 mov         cl,dl
    delete pDest;
 push        eax
 mov         word ptr [ebp-4],dx
 mov         byte ptr [eax+4],cl ;Copy the 5th byte out of destination buffer
 call        dword ptr [__imp_operator delete (10E20A4h)]
 add         esp,8
}
 xor         eax,eax
 mov         esp,ebp
 pop         ebp
 ret

In this example one byte overflow didn't lead to crash on my machine, and in reality, the error would have remained undetected. These errors can be detected by enabling full page heap verification by setting up global flags like below.

gflags /p /enable TestSilentCorrupt.exe /full

When you execute the program it now crashes when delete() is called.

It remains a question for me that the copy of 5th byte why it is associated in the block with delete() rather with memcpy().

Finding the appropriate ReadFile

There are applications reading data from numerous files when they're running. If you want to intercept when the certain file is being read, one possibility is to put breakpoint, let's say, on ReadFile() and wait for the debugger to break in. It happens that the debugger constantly breaks in on ReadFile() that you're not interested in. It can be extremely time consuming to ignore the unwanted debugger breaks until the certain file is being read.

This is a Windbg script that I usually use it as a template to intercept when a certain file is being read. It checks for specified value in the buffer of ReadFile(), and if the vaule matches the debugger can break in.

Fuzzing Control Transfer Instructions

Earlier last year, I wrote about my Flash fuzzer for example here and here.

This weekend I just added a little improvement to it. Since I was able to reach the byte codes of DoABC tag and to parse them, there is a lot of possibility to implement fuzzing opportunities by little changes.

What I did is the ability to alter control transfer instructions for ifeq, iffalse, ifge, ifgt, ifle, iflt, ifnge, ifngt, ifnle, ifnlt, ifne, ifstricteq, ifstrictne, iftrue, jump to change the target address of them. These instructions take only one operand that is fixed-length: 24-bit signed integer that is 3 bytes, so it was very straightforward to parse and change them.

One thing I wanted to pay attention that is the target of jumps should be within the region of the method but it was quick to implement this because the method addresses and sizes are already available from the parser info.

Unexpected Thickness of SplitContainer

I haven't really been involved in C# apart from spent the whole 2011 to reverse engineer MSIL code at work but that wasn't about programming; it was about to debug .NET code without using reference to source code, but in fact, none of real programming experience.

My role has been changed at work, and it's unlikely I will continue with .NET anyhow. This is a great opportunity for me to fill my freetime with C# programming - I find .NET interesting, have the (low-level) basics of the virtual machine after all, and people say it's (very) straightforward to get on with it at development point of view.

Here is the first impression involving SplitContainer.

I needed to split the screen into three panels. SplitContainer divides the display area into two panels, but when you use only one instance, you cannot really use it to divide the display area into three panels. I managed to use two SplitContainers to divide the display area into three panels. There is the main SplitContainer, and there is the secondary SplitContainer put on one panel of the main SplitContainer's. I had three panes and I thought that was it.

I set SplitterWidth to 1 on both of SplitContainers to narrow the thickness of the splitter. Launched the program to check if it looked as expected, but in reality, it didn't. Here is how it looked.

As you can see above that the splitter of the secondary SplitContainer was not as thick as the splitter of the main SplitContainer. It's interesting because, on the design view, it looked good.

I set SplitterWidth to 2 and checked the result but the thickness of the splitters have different sizes when started the program.

I set SplitterWidth to 4 and surprisingly the result looked good. The splitters, however, were too wide to use it in a program. You can see ot on the picture below.

The solution is as follows. I don't know the root cause of this but I realized if I set SplitterWidth to 1 in the constructor of the Form, the splitters' wide have the same size, as seen below.

Above experiences are with Microsoft Visual C# 2010 Express.

Software and Visual Thinking

Being said that the design of Graphical User Interface should not introduce new functionality in the application. The GUI and the functionality should be separated, and implemented on different levels which pretty much seems to be logical for me, but I'd add something important to this general claim.

There are people, including me, who are more of visual types. For me, visual things excite the imagination and when representing things visually, I can create new things from them that have some kind of value.

It happened to me numerous times to get new ideas involving awesome functionalities during the design of GUI. These ideas didn't come to my mind when I was focusing exclusively on functionality design.

Freedom inhibits creativity. When you're on the design of GUI, there are many restrictions (that you can see) and this stimulates the brain to create some new ideas.

I've imagined an application consists of multiple functions. Actually, it is a mix and improvement of some tools I wrote earlier. I'd put these small ideas into one application, by doing so, there is the possibility to connect those small functions to work together and would take the advantage of it. Also, I have some ideas about functionalities that I've seen in other applications, albeit that need change according to imagination.

The basic is as follows. The input is the (unknown) binary file. You can browse the file, can discover the structure of it, can display distribution diagrams and others. Also, can apply particular algorithms on data such as decoding compressed stream or display multimedia content.