nodereality

node c0re

Antivirus is overpriced

written by Ghirai, on Jul 4, 2009 9:23:00 AM.

Not necessarily by the meaning of the actual cost of a certain solution.

Roughly speaking, in a company, you're paying for the actual software, for the man hours to deploy it, troubleshoot it, and work around the occasional bugs/quirks, to keep it updated, and you also pay for the hardware to run it (directly or indirectly). Then you also use up more of the IT department's time by having them monitor the whole mess. You also might be paying for support as well.

Now think about the benefit, in a world where the custom malware market is booming. It seems that you're using all those resources to detect old stuff.

There are countless examples, essays, papers, etc. that show how easy it is, even for relatively unskilled malware writers, to make custom binaries.

Then there's the response time, which is infinity for custom malware. Think about that.

Also, heuristics kind of contribute to the uselessness of the solution, contrary to what they would want you to believe. In an attempt to score high in the various charts, vendors ramp up their heuristics up to the point where you need to disable the solution entirely to be able to do any real work.

There are various other aspects which have been discussed over the years in great detail.

I'm not saying antivirus solutions are totally worthless. But they cost too much money and resources, while providing a marginal benefit.

It seems to me, that as a whole, you could be spending these resources on something more useful, something that actually contributes to the overall security of your assets.

The risk gets higher when you start to rely on antivirus software to protect your ass. It won't.

Experimenting with gravity

written by Ghirai, on Jun 26, 2009 5:24:00 PM.

In an attempt to make a stabilizing platform without too much hassle, i recently bought some phidgets.

As far as a quick test goes, the idea is simple - having an accelerometer move a servo. The fact that the APIs are ridiculously easy to use (don't need to write your own firmware, analog to digital converters, drivers, etc.), makes this task pretty simple.

The finality of the project will consist in being able to stabilize a surface on 2 axes, using 2 servos. I'll follow up on this post when the project is done.

For now, i wanted to see if i can control the movement of a servo based on the tilt registered by the accelerometer. This is in itself trivial.

However, suppose you'd want to stabilize a plane surface on 1 axis, with 1 servo. The 'level' position (when the accelerometer measures an acceleration of 0 on the specified axis), needs to be in the middle of the servo's range, because you should be able to tilt the plane in both directions, while attempting to keep it level.

The servo motor is extremely cheap, and it doesn't seem to have a 180 degrees range, which is fine. You still have to know its exact limits though.

For this, you use the phidgets servo interface application, and find out how far you can go with the position, before the servo starts to shutter and make funny noises. The one i had worked fine between position 30 and 225, which means the middle position is the mean of the two. This is where we want to keep the servo when we're leveled, and at this exact position the blue line and the red line in the following picture should be parallel.

In the picture below, the red line is level, and the grey cross represent the servo's 4 'blades' ; one blade is marked to be able to tell the blades apart. Assume the blue line is a plane surface attached to the blade. As the servo moves, the plane is tilted. So the level position would be when the blue line and the red line are parallel, at servo position (min+max)/2 (assuming the servo is positioned properly, which should be easy to do in your project).

servo

All this means it's a little more to it than simply passing the tilt angle to the servo directly; our reference point is the middle of the servo range, which means that for negative tilt angles we have to subtract from the level position, and for positive angles we have to add to the level position, so that the servo tilts our imaginary plane surface right or left, if you're looking at the picture above. The 90 degrees angle is also a reference point.

The next requirement is calculating (basic trigonometry, phidgets accelerometer documentation contains a decent explanation and a pretty picture) the tilt angle: arcsin(acceleration). The result will be in radians, so we should convert to degrees, with the help of your language's math library or by doing it yourself (degrees = radians*180/pi).

Because we're using an accelerometer to get tilt, readings out of the [-1;1] range will be ignored.

Also, because all the different types of servos, you might need to adjust the final value; this can be easily done via experiments. /

The relevant Python code is the AccelerometerAccelerationChanged event:

def AccelerometerAccelerationChanged(e):
  if (e.acceleration >= -1 or e.acceleration <= 1) and e.index == 0:
    print e.acceleration
    deg = math.degrees(math.asin(e.acceleration))
    print "Deg: %f | Acc: %f" % (deg, e.acceleration)
    
    #asv is the servo object
    #setPosition takes 2 parameters - servo motor index, and position

    if deg < 0:

      #because we can't go to a negative position, we also multiply by -1
      asv.setPosition(0, (min+max)/2-deg*(-1)*((min+max)/2)/90)

    else:

      asv.setPosition(0, (min+max)/2+deg*((min+max)/2)/90)

The accelerometer sensitivity is set to 0.02, which means it will only trigger the event if the acceleration changes by more than 0.02g, which is about 1.146 degrees of tilt.

This short clip (AVI, 888.5KiB) shows everything in action (notice the top blade of the servo has a pinkish dot - that's where the blue plane surface would be attached).

To make things more smooth you could sample the accelerations and act on say the mean of 2 successive events, use a gearbox for the servo (the code would need a bit of adjustments for that), get a more expensive and precise servo, etc.

Stop with the stupid scams!

written by Alan, on Jun 22, 2009 8:47:00 AM.

Well normally I keep things to myself, but this has gone too far. Most of the websites I visit I see someone called Mary telling me she makes $5500 a month and what is the best part? She wants to share this with me...

Sounds great but sadly straight away I can tell its a scam. If I was Mary making $5500 a month I'm sorry but fuck you guys I'm not going to share it with you, how stupid would I be?

So anyway lets just say I didn't pickup on this sign and I clicked the advert where do I end up? Well you will get to a news/blog styled site (http://fremontgazette.com). Someone who is really interested in the idea of making $5500 a month might miss some more signs that we can now see. So lets take a step back and go over what is there.. Or should I say lack of.

We have a news/blog style website, it has a very clean design but something isn't right.. Where are the other articles? This can't be the only article on the website can it? Well sorry to tell you it is the only article (Heh even node has more articles when I press the publish button). So its not a news website at all is it, what we have here is one page trying to sell me something. Lets carry on.

Oh so this is called 'Google Cash Club' and guess what it is available for free online, but it costs $1 shipping. But its free online? Ahh I don't know.

Lets get a bit more technical and see what other clues our so called news website can offer. There is a comments section; Some people say they use it and it works! "Thanks for the info, just started this 3 weeks ago. I've gotten 2 checks for a total of $1900, pretty cool."

Others are unsure and are wanting someone to confirm. "Has anyone tried this yet? Looks promising."

And there is the one that wants to show off how much he makes with a image.. Well its a image so its real right? AdSense
Hold on its hosted on the same domain, I'm sure its really nice of fremontgazette to host an image for that person who as commented on their story. Or it could all be a set-up.

The website even has small print telling you that chances are you will earn nothing, it's just a shame many people would of already fallen for this scam before they got to the bottom of the page.

Mary Steadman you're a big fat liar.

Demystifying C/C++ in Assembly

written by abstorted, on Jun 22, 2009 3:51:00 AM.

C/C++ is mysterious in a way that you don't really know what is going on unless you look at its low level translation. I'm going to show you what is actually going on when you call a simple C/C++ function and explain it as simply as I can.

Don't be scared! Assembly is not difficult to understand and it demystifies the code that you write.

Let us start out with a simple C/C++ function that adds two arguments together and returns the sum.

int AddInts(int x, int y)
{
  return x + y;
}

When we call this function from main() a stack frame is created on the runtime stack. This is not the abstract data type that you have heard about in programming classes, it is the stack that the processor directly accesses, and which your C/C++ programs use after your code is translated to assembly.

The stack frame from this function looks like this:

When Addints is called, this is how the stack looks. If we look at it in assembly, we can see how it is constructed:

push ebp
mov  ebp,esp
...

First, push ebp saves the base pointer from main() onto the stack.

Second, mov ebp,esp saves the current stack pointer to ebp.

When a function is called the arguments are loaded on the stack in reverse order, then the return address is placed on the stack.

Looking at the diagram above we can see the return address [EBP + 4], which sits 4 bytes above (higher memory location) EBP. The +4 indicates the OFFSET from EBP. An OFFSET is a memory location (in RAM) referenced in terms of bytes from another memory location (in RAM). In the case of stack frames we will reference the arguments and locale variables (if any) via the OFFSET of EBP.

For example if any local variables are created, they will be pushed onto the stack below EBP (at a lower memory location) and referenced by EBP - N (where n is the offset of bytes where the local variable is located).

Moving on, the next thing our C/C++ function does is add the two parameters together. In order to do this for our example, we must first move the value that is going to be returned to main() into EAX then add it to the first parameter. ADD and MOV are an opcodes built into Intel-based processors that allows you to add or copy (mov) values or memory locations from one place another.

AddInts PROC
push ebp
mov  ebp,esp
mov  eax, [ebp + 12] ;place the second argument into EAX to prepare it to be added
add  eax, [ebp + 8]  ;add first parameter [ebp + 8] to the value in EAX, producing the sum 
leave 8              ;clean up stack, same as adding 8 bytes to ESP so there are no memory leaks
ret                  ;return EAX which contains the sum
AddInts ENDP

I hope that clears a few things up