Wednesday, March 04, 2015

Wednesday, June 04, 2014

HTML5 Flappy Bird Tutorial

As part of my job as Technical Architect, I try to introduce our developers into parts of development which they won't really get involved in with their normal development activities, out of the topics suggested, an HTML5 Game was highest for the first week

I had signed up to lessmilk.com's mailing list which shows his games he made with the Phaser Framework and one of those was a Flappy Bird clone which he also wrote a tutorial for, I found this one perfect to pique the interest of the developers, so here are the links to all 3 tutorials.

Here are the tutorials

I also use Mongoose Web Server as it is simple to run these tutorials as they need a web server to allow showing the resources.

This is the final one you get to play Final Flappy Bird Clone

And here is a picture of the set up of the night showing it off.

Tuesday, May 27, 2014

Cracking a PDF from a Nigerian Bank.

I have recently been getting lots of legitimate emails from companies using my email address for someone who isn't me, showing me companies aren't verifying emails before setting them up on their mailing lists such as:

  • Skype (really Microsoft...still?)
  • Zara
  • Telstra
  • 100s of Loan companies.
  • NIGERIAN UNION BANK

The last one should make you smile at least, it did me. Obviously looking at is, it is spam... but nope looking at all the emails, it seems someone had actually signed up and used my email to sign up. THANKS.

I therefore emailed their customer services, to see about them removing my email and closing their account. They replied (I then checked the email headers from the customer support and the account email and they were the same, proving it was a legitimate email). In one of the emails, there was a PDF which was password protected with the account number of the person's account who had signed up my email, so I didn't have it. Being the inquisitive person I am, I thought I'd try and see if there was an online tool that could do it for me, but they all said they could remove the password...if you knew it. Which is fair enough. I was not ok with this, I wanted to know the person to see if I could find them and email them telling them, my email isn't there's... So I found pdfcrack

I downloaded it and ran it against the pdf, using the default options. 

pdfcrack "account.pdf"
The problem was that it wasn't correct number of characters, it was going through all combinations of characters from 0-n, since I actually knew how long the password was... they told us in the email, they replaced the numbers with *. Thanks Bank, counting it all, there are 10 characters for "001*****83". Running pdfcrack, shows you the arguments it accepts. 
Usage: pdfcrack -f filename [OPTIONS]
OPTIONS:
-b, --bench             perform benchmark and exit
-c, --charset=STRING    Use the characters in STRING as charset
-w, --wordlist=FILE     Use FILE as source of passwords to try
-n, --minpw=INTEGER     Skip trying passwords shorter than this
-m, --maxpw=INTEGER     Stop when reaching this passwordlength
-l, --loadState=FILE    Continue from the state saved in FILENAME
-o, --owner             Work with the ownerpassword
-u, --user              Work with the userpassword (default)
-p, --password=STRING   Give userpassword to speed up breaking
                        ownerpassword (implies -o)
-q, --quiet             Run quietly
-s, --permutate         Try permutating the passwords (currently only
                        supports switching first character to uppercase)
-v, --version           Print version and exit

So from this, I can set the charset of the account number (0-9) and min/max numbers of the password (10). 

pdfcrack -c 0123456789 -n 10 -m 10 "account.pdf"
This then will start trying all the passwords but this still will take far too long for me, but going back to the email, I know the start and the end of the string. This means I can generate a dictionary of all possible combinations of the account number, which will make pdfcrack a little faster. By googling "number list generator" I found this site.

http://textmechanic.com/Generate-List-of-Numbers.html

I set up my options like this to generate the numbers with padding, prefixing the start of the account number and suffixing the end of it with saving the file after its done.

I then saved the file as output.txt, I then updated pdfcrack to use this dictionary, called a wordlist in its options. 

pdfcrack -w output.txt "account.pdf"
This took 3 seconds to find the password on my box, I think pdfcrack doesn't support multi-core threading, so that was pretty fast and here is the output. 
PDF version 1.4
Security Handler: Standard
V: 2
R: 3
P: -1852
Length: 128
Encrypted Metadata: True
FileID: e620bf3e3b2adfc0b842251b2e43778f
U: 69f457abbb40358fb69b6f75f2c258ac6162636465666768696a6b6c6d6e6f70
O: db0a102b17407083e77f5bbe9d11ff416d81f0f437ef8a6cda83964c51ae4e5d
found user-password: '0019999983'

Here is a screenshot of the pdf opened with the information hidden, note the bottom phrase "Big, Strong, Reliable"... Alanis Morissette would be proud of that.

Emmanuel Sarki,
S.D.A. Church Kadamo Jengre Bassa L.G.C.

Since Mr Sarki is currently a footballer playing in Poland... http://en.wikipedia.org/wiki/Emmanuel_Sarki I probably think it is fake and a Church being one of the random scammer who want money for but who knows.

I did this post to show companies, if you don't verify emails, send details with enough information that can be gleaned, it would be easy to steal off your customers. After emailing them numerous times to tell them of their error, I resorted to adding money to my Skype account and calling their customer service and they assured me they'd stop, (they didn't), I rang again with the account number from the PDF, they were then able to stop the emails, not until I'd found out everything I'd need to.

Steps to stop this:

  1. Ask your user for their email
  2. Ask to validate it by entering it again
  3. Email them a verification link
  4. User clicks emails
  5. Create account

Friday, February 21, 2014

Sending Java Sealed Objects via Sockets

Since I couldn't find a single example, this is a few examples put together into one working example, thought it'd be useful if I put it on the web

Here's a link to the Gist and below is the code https://gist.github.com/Sarkie/9138396

Server.java

import java.net.InetSocketAddress;
import java.nio.channels.ServerSocketChannel;
import java.nio.channels.SocketChannel;
import javax.crypto.*;
import javax.crypto.spec.*;
import java.io.*;
import java.security.spec.*;
import java.security.*;

public class Server {  
 
  
    public static void main(String[] args) throws Exception {
     System.out.println("Server Started");
  
  // Create key
  final char[] password = "secret_password".toCharArray();
  final byte[] salt = "random_salt".getBytes();
  SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
  KeySpec spec = new PBEKeySpec(password, salt, 1024, 128);
  SecretKey tmp = factory.generateSecret(spec);
  SecretKey secret = new SecretKeySpec(tmp.getEncoded(), "AES");

  Cipher dcipher = Cipher.getInstance("AES");
  dcipher.init(Cipher.DECRYPT_MODE, secret);   

     ServerSocketChannel ssChannel = ServerSocketChannel.open();
     ssChannel.configureBlocking(true);
     int port = 12345;
     ssChannel.socket().bind(new InetSocketAddress(port));

     while (true) {
   System.out.println("Waiting for a connection...");
      SocketChannel sChannel = ssChannel.accept();

   System.out.println(sChannel.getRemoteAddress().toString() +" connected");
      
   ObjectInputStream ois = new ObjectInputStream(sChannel.socket().getInputStream());

   SealedObject s = (SealedObject)ois.readObject();
   
   SecretObject decryptedSecretObject = (SecretObject) s.getObject(dcipher);     
   
      System.out.println("Server - Packet Data is: '" + decryptedSecretObject.getSecretMessage() + "'");
   
   ois.close();

      System.out.println("Connection ended");
     }
    }
}

Client.java

import java.net.InetSocketAddress;
import java.nio.channels.ServerSocketChannel;
import java.nio.channels.SocketChannel;
import javax.crypto.*;
import javax.crypto.spec.*;
import java.io.*;
import java.security.spec.*;
import java.security.*;

public class Client {

    public static void main(String[] args) throws Exception {
 
  String server = "localhost";
  
  if(args.length == 1){
   server = args[0];
  }
 
     System.out.println("Receiver Started");
  
  // Create key
  final char[] password = "secret_password".toCharArray();
  final byte[] salt = "random_salt".getBytes();
  SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
  KeySpec spec = new PBEKeySpec(password, salt, 1024, 128);
  SecretKey tmp = factory.generateSecret(spec);
  SecretKey secret = new SecretKeySpec(tmp.getEncoded(), "AES");

  Cipher cipher = Cipher.getInstance("AES");
  cipher.init(Cipher.ENCRYPT_MODE, secret);   

     SocketChannel sChannel = SocketChannel.open();
     sChannel.configureBlocking(true);
  
     if (!sChannel.connect(new InetSocketAddress(server, 12345))) {
   System.out.println("Cannot connect to Server, make sure it is running");
  }
   
  ObjectOutputStream  oos = new ObjectOutputStream(sChannel.socket().getOutputStream());

  SecretObject secretObject = new SecretObjectImpl("007");

  SealedObject so = new SealedObject(secretObject, cipher);

  oos.writeObject(so);
  System.out.println("Sent Sealed Object");

  oos.close();     

     System.out.println("End Receiver");
    }
}

SecretObject.java

import java.io.*;

public interface SecretObject extends Serializable {
   String getSecretMessage();
}

SecretObject.java

import java.io.*;

public class SecretObjectImpl implements SecretObject {
 
 private String _secretMessage = "";
 
 public SecretObjectImpl(String secretMessage) {
  _secretMessage = secretMessage;
 }

 public String getSecretMessage() {
  return _secretMessage;
    }

}

Wednesday, November 13, 2013

“Unable to locate tools.jar” when running ant

You need to set your JAVA_HOME environment variable.

Try this before the ant command

set JAVA_HOME=JDK LOCATION HERE

JDK Location is the root of the JDK installed, such as on mine.

C:\Program Files\Java\jdk1.7.0_45


set JAVA_HOME=C:\Program Files\Java\jdk1.7.0_45

then type SET to check if it worked, and now try your ant command. I also changed my PATH to point to the JDK\bin folder before my JRE\bin folder, but I think Java check JAVA_HOME first.

Thursday, March 21, 2013

XYZ.sln(1, 1): error MSB4025: The project file could not be loaded. Data at the root level is invalid. Line 1, position 1.

If you are getting this error 

XYZ.sln(1, 1): error MSB4025: The project file could not be loaded. Data at the root level is invalid. Line 1, position 1.


Look inside the file for invalid Project or EndProject. Usually it is missing an EndProject, because it works in Visual Studio but fails on our Build Server.

Thursday, December 13, 2012

could not load microsoft windows media player firefox plugin in Chrome


I was having this issue.


  1. Check Windows Media Player is installed on your box. Control Panel - Windows Features - Media Features - Windows Media Player.
  2. Install the Firefox Plugin from here http://www.interoperabilitybridges.com/windows-media-player-firefox-plugin-download
  3. Install the Windows Media Player HTML5 Extension for Chrome from here http://www.interoperabilitybridges.com/wmp-extension-for-chrome


Try now

Wednesday, December 12, 2012

Google Play services won't update and can't remote install

I have been having issues for a few months with Google Play and my Nexus One running MIUI. Whenever I went to Google Play Store I'd get the following error.
 But checking the phone showed that I have the latest version, (I even got the apk and installed manually), also I can't remote install any app that I used to. I wiped Google Play, uninstalled updates, also wiped Google Play Services data, still nothing. I had given it up as because I was on a custom rom, but I noticed the other day that my Google Talk app wasn't working, no matter what I did it wouldn't work.

So decided to reinstall the gapps from. Goo.im Downloads This fixed my Google Talk issues and it fixed my Google Play issues, I assume Google sends down messages using Google Talk, which then uses IPC to call Google Play to start off the downloads, or not. Hope this helps someone else.

Monday, December 10, 2012

Least amount of permissions for creating scheduled tasks in Windows 7

I am currently looking at creating Scheduled tasks and I needed to find the permissions needed for creating Schedudled Tasks, usually I would use ProcMon and look for ACCESS_DENIED but it wasn't helping me. Firstly I created a user with zero permissions and ran my tool that would create a Task, it threw an error saying it can't.
runas /user:NoPerms TaskScheduler.exe
I then gave permissions to "%SystemRoot%\Tasks" and it still wouldn't work, after some searching I figured out there is another Tasks folder in "%SystemRoot%\System32\Tasks" That is all that is needed.

Tuesday, November 20, 2012

Disable OpenFeint in Android for Rooted Phones

I really despise OpenFeint integration in any of my games, I noticed on Play store there was an app called CloseFeint which would disable it but the comments aren't great for it.

I therefore looked into it, it is adding a few entries to my hosts file.

127.0.0.1 api.openfeint.com
127.0.0.1 *.openfeint.com
127.0.0.1 *.scoreloop.com

If you know anything about hosts file, you'll know wildcards aren't supported.

So my solution?

Get this amazing ad blocking hosts app.

https://play.google.com/store/apps/details?id=org.adaway

Then if you click Settings/Your Lists you can add your own, so in there add.

openfeint.com
api.openfeint.com
gree.net
api.gree.net
scoreloop.com
api.scoreloop.com

The gree.net stuff is there because gree.net have recently bought OpenFeint and scoreloop seems to be another one.

Once you have added these, you'll have to re-apply the lists, its also good for blocking ad's in games and easy to disable if there are apps that **need** access to OpenFeint in order to work.

Monday, November 12, 2012

failed to load sesison ubuntu

I just came across this issue with upgrading packages in 12.04 before I made the upgrade to 12.10 (since I've been having issues with ATi graphics drivers). On load I couldn't get into my session. What I did was CTRL+ALT+F1 to get to console, logged in and then ran sudo apt-get update && sudo apt-get upgrade This seemed to installed XWindow stuff that was missing that I think was causing my issue.

Tuesday, October 30, 2012

Thursday, September 20, 2012

hg mecurial abort: path is inside nested repo error

Just been having to use Mecurial to get the Orchard source code. I first used TortoiseHg to get the source and then used the Update command to switch to 1.x "branch" but I'd always get this error. abort: path 'src\Orchard.Web\Modules\Orchard.Alias\AdminMenu.cs' is inside nested repo 'src\\Orchard.Web\\Modules\\Orchard.Alias' So after a few attempts, all I did was delete everything apart from the .hg folder and then tried to update, this managed to work. Who knows if this is the "correct" way to fix it.

Tuesday, August 07, 2012

System WindowsFirewall: "query user incoming"

Or just Windows Media Player Network Sharing failing over mixed network on Windows 7, by default if you are on the same subnet it'll work. I had Xbox on 192.168.0.250 and sharing it on to my Wireless network of 192.168.1.x range, so I was getting the above error. I had to go to Windows Firewall in Control Panel, click Advanced Settings, Inbound Rules. "Windows Media Player Network Sharing Service (HTTP-Streaming-In)" This is running on Port 10243 and enable the one for "Public" profile. Then you should be good to go.

Monday, August 06, 2012

Instant Upload continually syncing

I was having an issue with Google+'s feature of Instant Uploading all my pictures, it would never complete so I had to disable it. To fix this, disable Instant Upload in Accounts & Sync settings, go into Programs and find Google+, clear the data of it and then re-enable it. This should fix it.

Thursday, July 26, 2012

Redgate ANTS Performance Profiler - Could not start IIS.

I have had this issue a few times and I always forget how to fix it.

Could not start IIS. RedGate.Profiler.Engine.Exceptions.CannotStartSessionException at  . .Launch() at ? . . ? () Caused by: Could not start IIS. RedGate.Profiler.Engine.Exceptions.CannotStartIisSessionException at  . . () at  . .Launch() Caused by: Could not start w3wp as the specified user. Win32 error code: 1385 RedGate.Profiler.Engine.Exceptions.CannotStartIisSessionException stack trace: at ? . ? .?? () at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Int32 methodPtr, Boolean fExecuteInContext, Object[]& outArgs) at System.Runtime.Remoting.Messaging.StackBuilderSink.SyncProcessMessage(IMessage msg, Int32 methodPtr, Boolean fExecuteInContext) rethrown at [0]: at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg) at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type) at . .?? () at  . .?? ( ) at  . . () Caused by: Could not start w3wp as the specified user. Win32 error code: 1385 RedGate.Profiler.Engine.Startup.IIS.IISException stack trace: at . .StartProfilingIIS(String , String ) at RedGate.Profiler.Engine.Startup.IIS.IISStarter`1.StartProfilingIIS(String currentUserName, String subprocessVariableValue) at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Int32 methodPtr, Boolean fExecuteInContext, Object[]& outArgs) at System.Runtime.Remoting.Messaging.StackBuilderSink.SyncProcessMessage(IMessage msg, Int32 methodPtr, Boolean fExecuteInContext) rethrown at [0]: at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg) at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type) at RedGate.Profiler.Engine.Startup.IIISActuator`1.StartProfilingIIS(String currentUserName, String subprocessVariableValue) at ? . ? .?? ()
So I need to run my IIS as a network user in order for it to work through SQL Auth etc, the reason it is failing, is because the user isn't an admin user on my box. So go to Administrator Tools -> Groups -> Administrators and add your network user here, check names and it should work!

Monday, July 16, 2012

Solr 3.5 spatial (geofilt) search with distance in results

Took a bit of tinkering around but here's my query.

LatLong is my field in my document with a "latitude,longitude" in it.

d=30. Distance is KMs.


http://solrserver/select?
indent=true&
fl=Name,LatLong,score&
fq={!geofilt pt=50000,-0.11111 sfield=LatLong d=30}&
sfield=LatLong&
pt= 50000,-0.11111&
sort=score asc&
q={!func}geodist()

This gets you all documents near a point (pt) and returns them with the distance stored in the score field.


Friday, July 13, 2012

Android not picking up MP3's

My Android Phone (Nexus one running MIUI) sometimes doesn't find my MP3's, especially after a ROM update.

I loaded up the MP3 using  http://www.mp3tag.de/en/  and I either update it or just save it, it then seems to fix the ID3 tags and then it is picked up on my phone.

You may also need to run an app like  https://play.google.com/store/apps/details?id=com.addz.mediascanner 

Tuesday, February 21, 2012

Monday, February 13, 2012