Instruction at 0x00401310 checks if there is a command line argument. There is an irritating sleep function, you could either NOP the function or change the argument to 0. Next there is a reference to 0x417550 and then a Jump to the actual code.

On inspecting the memory at 0x417550, a plain text is received (274 bytes) when XOR-ed with 0x55.

“Good job! Keep going….Good luck!”

Next, it checks that the name of the program is princesswarrior.exe, you can just bypass that or rename the executable, then the length of the string is checked, it should be 0x32.

Lastly, the fun part, so

x1 = your string.

x2 = string at 4174E8

x3 = string at 417664

So the key => x1  = (x3 xor x2) – 12

All right so the solution that I came up with; was developing a font, with which I can exactly replicate my handwriting and can simply convert the code by selecting that font. :)

The above pic is a sample conversion. The results are super awesome believe me. This picture is a screen shot of the very first attempt that i made, the first line is written in Calibri and the second in “JUGAAD”  and with a little rework one can do wonders.  Especially, for a subject like compiler where you had to write “code” in your handwriting this is extremely full proof! ;)

Now comes the main question!! How! You’d probably already know it and if you don’t, believe me its very VERY easy!.

Step1. Download a template file from www.paintfont.com by clicking on “create template”. Basically this template contains small boxes with characters printed inside them in light gray color. The characters you want to create are already selected if you want anymore characters you can add those as well!

Step2. Take a print out of the template and fill the template. Take a bold marker and overwrite the light gray characters.

Step3. Now scan the two files. For instance here are the files I created.
FILE 1:

FILE 2:

Step 4 : Now you need to upload these files at http://www.paintfont.com/#tabUpload, select OTF format and click on “Send File”.

Step 5 : The font is ready and you get a screen like :

Step 6: Now just download the myfont.otf and on the downloaded file, right click > install. You can now go to your favorite editor and type in your handwriting! :)

It is about a minor project that i recently completed. That is writing a virtual machine to slow down the process of reverse engineering. This is not a tutorial to do the same however I have included the presentation that i used during the final presentation, the PDFs for System Design and Sample Runs and one step by step sample run.

#Presentation

#Code

#Sample Run

In this sample run I am going to implement the POC expansion algorithm that was the final program that was written for OIVM.1. Make sure bootrom.txt and OIVM.exe are in the same folder.
2. Open the Bootrom.txt using a Hex Editor (example : Hex Workshop) and write the following hex stream to it.

3F 11 25 00 2F 08 3F 38 3F 38 41 3D 09 1B 3C 4C 21 25 00 2F 14 7C 67 63 55 64 61 38 67 7C 63 38 55 64 61 38 37 41 3D 15 C9 45 3F 11 3F 12 18 68 3C 25 00 2F 08 12 86 C5 38 41 3D 09 00 02 04 06 08

3. Save the file. This is basically in the format of [STUB][Compressed Code]. The stub is 60 Bytes long and extends till the 0x09 in the second line of the hexadecimal stream. The parallel assembly for this code is as follows :

[EXPANSION STUB]
scanf(“%d”,&STACK[SP])
MOV A,STACK[SP]
FLAG=A-ROM[++IP]
JE 8 BYTES
scanf(“%d”,&STACK[SP])
++SP
scanf(“%d”,&STACK[SP])
++SP
–A
JMP -9 BYTES
MOV B,ROM[++IP] //STUB LENGTH
A = fileLen
A=A-B
FLAG=A-ROM[++IP]
JE 14 BYTES
MOV C ,ROM[B]
MOV D,SP
MOV SP,C
MOV C,STACK[SP]
MOV SP,D
MOV STACK[SP],C
++SP
MOV D,SP
MOV C,ROM[B]
MOV SP,C
++SP
MOV C,STACK[SP]
MOV SP,D
MOV STACK[SP],C
++SP
++B
–A
JMP -21 BYTES
ROM=(char *)realloc(ROM,ROM[++IP]) //FILE EXPANDED
scanf(“%d”,&STACK[SP])
MOV A,STACK[SP]
scanf(“%d”,&STACK[SP])
MOV B,STACK[SP]
MOV SP,B
MOV C,ROM[++IP]
FLAG=A-ROM[++IP]
JE 8 BYTES
MOV B,STACK[SP]
MOV ROM[C],B
++C
++SP
–A
JMP -9 BYTES
[COMPRESSED FORM]
00 02 04 06 08

4. Now run the program.If however you dont speak assembly that doesnt matter here is the algorithm for it :

1. Enter the Number of elements in the dictionary.
2. Enter the dictionary.
(Dictionary is stored on the stack)
(The dictionary is looked up for values corresponding to compressed code)
(The new Values are updated over the stack)
3. Enter the New Size.
4. Enter the SP (which could have been hardcoded as well)
(The code expands)
(The execution is now passed on to the expanded program)
5. Enter the first element. Hit Enter.
6. Enter the second element. Hit Enter.
7. The sum is Displayed.
8. OIVM halts.

Results/Output

#Thanks

Special thanks to Mr. Atul Alex Cherian, Ms. Nishtha Jatana and Ms. Kritika Sobti.

#Orginally, created and put up by 2nd Shift IT/CSE ~ MSIT  for farewell of batch 2009-2013.

#Reused by BCA :

I hope they did not name their farwell Au Revoir :D

EQUALS

XSS on NSD’s website :D

Here is the alumni’s section. :)

All right how did I find it. ?

So for obvious reasons (look at the url , id=some integer) , I thought there could be a possible sqli vulnerability, though i knew i had a very little chance, i still pushed in the url to both havij and sqlmap. Havij failed however sqlmap listed that a boolean based blind could be executed in the format of 1=1, so for abvious reasons i tried a=a. Which did not work… ah…then finally came to me that and i executed the ‘a’=’a’. Finally replace the ‘a’ with a script and tada! :D

About the disclosures.

I wrote a mail to  indiaportal@gov.in, nationalschoolofdrama@gmail.com and info@cert-in.org.in. I also submitted it to thehackernews.com, xssed.com and null.co.in
However I do not expect a reply any time soon.

Now we hadour viva for the project on 29th of September 2012. And obviously 28th was going to be the day for its final completion. The binding and printing was destined to be done on 29th itself. That’s the general trend we go by, here in colleges in Delhi, India.

So late till 4:30 i had completed my projected. I was a little relaxed with the printing because I had a colored printer at home and it was working fine. So the very next morning at around 8:30 i started the printing of the project.
The first disappointment that I had was that there was not going to be any kinds of project presentation it was only and only a viva. But this was not that harmful as if i talk about only and only me…. my project required setting up hardware and yes that could have been cumbersome for an on the spot kind of a thing plus it was not enough to write a blog post…things like this happen a million times when you are in IP university. The disappointment came as follows:-

I had been making an excuse for not scoring really good in exams, for getting up late in the morning, for always being on my laptop to friends and family that I was doing “security”, and this right here was going to be my very first project about security. So I had nerved myself for this viva. This was the right moment where I would have been tested on grounds that I consider my grounds.

Not that I was prepared and all set to face the music, I was scared too, I was as afraid as I would have been if I were giving a viva related to java programming, but the only difference was that i am going to test myself here, and it was happening the way it was supposed to be, people were being questioned like hell each viva being conducted for a span of 20 minutes. And finally i was the next in line for viva, but then suddenly a different teacher entered the room who is supposedly a lenient teacher but a really knowledgeable one. She was going to take my viva. I was both happy and sad. I was happy that the viva was going to be a comfortable one, on the other hand i was sad, and here comes the disappointment, because it was over in 5 minutes. All I was asked was what a PBX is and what is your project about. Then randomly i was asked about what one of the attacks were. I wasnt asked what codes are used, should be used, what are the tradeoffs in the communication channel, i wasnt asked  protocol compositions, I wasnt asked really anything technical.
A lot of my friends who I told about this, said that if they were in my place they would have been more than just super happy and would have danced as they walked out of the room. Yes i would have done that too if it were not about security.

Anyways case close. Move on.

So in this case your serial would be 560CB598 (and not 560C-B598)

Step2: Now when you know your hard disk volume serial, you need to download a license in our case a student license. To do that go to http://www.altera.com/download/licensing/lic-university-form.jsp click on continue, then in the text box enter your serial and click on continue, after you do that, you need to fill out a form that comes up… Please enter your correct email id as that is the place where you would receive the license.

Step3: Now you need to download the software from https://www.altera.com/servlet/download?swcode=WWW-SWD-MP2-102-PC&referer=https://www.altera.com:443/altera/download/legacy/maxplus2/dnl-baseline.jsp and you need to download your license from your email id.
If the download link does not give you software directly then on the website look for the option “one time access” that would give you and easy download option.

Step4: Now you need to install the software… just double click on the exe you downloaded and install with the normal next next yes yes method. :D
Step5: To install the license file go to control panel > system and security > system > advanced system settings (from left hand side column) > under advanced tab > environment variable, now click the System Variable list to highlight it, and then click New. Type LM_LICENSE_FILE in the Variable box. Type <path to license file>\license.dat in the Value box. Click OK and now run the software. :)

And yeah run the software as administrator.

Though I had in my mind that 2 periods! thats long …am I really gonna be able to make it till then..! Allright so this time the presentation in the seminar hall and all my classmates present there! :) The best part is that I knew they were bored like hell… obviously its not of there interest … but they supported me… they were quite and occasionally tried listening as well.. :) Thanks to them for being awesome. :) Now I started with the presentation (this time only I was doing it) and noticed that even my proctor Saba maam was present there… Then it went on ….things worked fine.. one of examples took time hence was not completed on the spot… like you know when your software does not recognize the version of the DBMS on the server… But apart from that it was nice… it went how i had planned… and also i loved the complements … in fact I got the best compliment from my proctor. She said that it was really practical… and generally seminars are not so practical!!! And that pretty much is the motto of my life… to keep things practical. :) Then my classmates’ comments… which actually gave me the right feedback and scope for improvement… Things like i need to take breaks in between, i have to interact more with the audience, include less of backtrack and I could use the zoom tool’s bar feature rather than zooming the entire screen. I would keep that in mind next time :) … and lastly the shocking part was i fucking took the entire too periods!! sorry classmates. :D
Also my offer of sharing the resources for a total of more than 12 types of sql injections is still open if you buy me a coke. :D

 Yes i hate my college, you take away my friends from the college.. and there is nothing left …. I hate it and i have  reasons to hate it…and they are not studies

Lemme List Out a few.

1. They take stupid judgements and boss around for the fact they can suspend students without a reason. I was suspended for a week for holding a ball in the corridor. Not just that, have a look at the suspension letter… It gives some interesting facts.

Shoutling Loudly, at 2:00 pm, problem to other faculty members. SERIOUSLY! THERE WAS NO OTHER CLASS GOING ON. AND ITS WAS 5:00 pm and shouting loudly… yeah sure!. When the same was pointed out to the discipline committee they said “arrey aap koi case thodi lad rahe ho”

2. They do not care about your future. My friend had to do an internship under a professor of IIT who were to come to msit for 3 weeks, my college asked the students to pay for his residence in the college and for his travel. The professor strictly said no to this as off course he too had not experienced this anywhere else. Plus when being requested, the management said “Arrey tumhe or kahi nahi mil rahi kya internship.”
They dont posses any sort of manners etc. I fail to understand what do they expect from us after this.

3. every year more than two hundred lakh rupees goes into other expenses. Check out the following data.

And these are the statistics for 2008 the fees has increased quite a bit after that.

Download link for detailed file: File (browse to the bottom)

4. They told the organizing team of avensis that only a particular amount of the sponsorship will be given to them …that is even if you get 50 lakh rupees you would be given only 3 lakh. Yeah this is why we cannot get the “crowd” to our college. Also had to get everything in kind.

5. They humiliate parents. My friends were suspended because they opened their lunch boxes during the short time when a period changes and there is no teacher in the class. Their parents were called and made to wait for hours before they could meet the committee … also the students went up and down the entire week requesting authorities to take back the suspension. Even if they had broken a glass window i could have accepted this, but here the reason they stated was just unacceptable.

6. For attendance issues they devised their own intuitive methods on who to suspend and who not to. When a case was filled by one of the students who was suspended, it hurt their ego rather than their minds. And everybody was suspended again. Well till now what i have come to know is that they really do not want to punish you rather mentally torture you to your limits. And yes this was done in the first week of the semester exams.

7. They have discriminated the entire second shift as a diffrent college and I am quoting the words of a member of many departments of the college. “Aap ye man k chalo aap is college ka hissa nahi ho”.

I still remember when last semester their were a large number of students being suspended.. for second shift students below 65% were suspended however in morning shift. less than 40% attendance. FTW!!

8. They do not give importance to extra curricular and students go on begging for attendance for events that are organised within the colleges. I know this happens in every college that extra curricular becomes a responsibility of the students, however here i talk about the official events… Also when once i tried to get attendance for an official event… (Certificate distribution) I was asked for a written permission from the director. Well yeah.. here’s the permissions… F U!

9. I remember i had read that taking a photo graph or movie of a person without permission was illegal.

10. They talk about discipline as of great concern… Lets talk about the 5 honeycombs…homing 1000 bees each on the front wall of the college. Well now 3 of them were cleared. I was shocked at this progress, i am sure one of the management members was bitten after which such a step was taken.

11.I won the best technical event award in the college but neither do i have a proof nor acknowledgement of the same… I hope the cost they saved in printing a certificate helped in their “all round development”.

Sometimes I feel like taking a revenge from the college but the unordered distribution of staff… in terms of “how good/bad” they are…makes me not do it… and what i would do is… simple ask for two documents under my right to information from the college.

1. List of all the students that have been suspended ever by the college and reason.
2. Accounts for each penny spent.

After all this that I said I am not sure if someone from the management reads this will I be in the college or not. Its my right to express my views. Its my website. Its more secure than msit.in.