Instruction at 0x00401310 checks if there is a command line argument. There is an irritating sleep function, you could either NOP the function or change the argument to 0. Next there is a reference to 0x417550 and then a Jump to the actual code.

On inspecting the memory at 0x417550, a plain text is received (274 bytes) when XOR-ed with 0x55.

“Good job! Keep going….Good luck!”

Next, it checks that the name of the program is princesswarrior.exe, you can just bypass that or rename the executable, then the length of the string is checked, it should be 0x32.

Lastly, the fun part, so

x1 = your string.

x2 = string at 4174E8

x3 = string at 417664

So the key => x1  = (x3 xor x2) – 12

It is about a minor project that i recently completed. That is writing a virtual machine to slow down the process of reverse engineering. This is not a tutorial to do the same however I have included the presentation that i used during the final presentation, the PDFs for System Design and Sample Runs and one step by step sample run.

#Presentation

#Code

#Sample Run

In this sample run I am going to implement the POC expansion algorithm that was the final program that was written for OIVM.1. Make sure bootrom.txt and OIVM.exe are in the same folder.
2. Open the Bootrom.txt using a Hex Editor (example : Hex Workshop) and write the following hex stream to it.

3F 11 25 00 2F 08 3F 38 3F 38 41 3D 09 1B 3C 4C 21 25 00 2F 14 7C 67 63 55 64 61 38 67 7C 63 38 55 64 61 38 37 41 3D 15 C9 45 3F 11 3F 12 18 68 3C 25 00 2F 08 12 86 C5 38 41 3D 09 00 02 04 06 08

3. Save the file. This is basically in the format of [STUB][Compressed Code]. The stub is 60 Bytes long and extends till the 0x09 in the second line of the hexadecimal stream. The parallel assembly for this code is as follows :

[EXPANSION STUB]
scanf(“%d”,&STACK[SP])
MOV A,STACK[SP]
FLAG=A-ROM[++IP]
JE 8 BYTES
scanf(“%d”,&STACK[SP])
++SP
scanf(“%d”,&STACK[SP])
++SP
–A
JMP -9 BYTES
MOV B,ROM[++IP] //STUB LENGTH
A = fileLen
A=A-B
FLAG=A-ROM[++IP]
JE 14 BYTES
MOV C ,ROM[B]
MOV D,SP
MOV SP,C
MOV C,STACK[SP]
MOV SP,D
MOV STACK[SP],C
++SP
MOV D,SP
MOV C,ROM[B]
MOV SP,C
++SP
MOV C,STACK[SP]
MOV SP,D
MOV STACK[SP],C
++SP
++B
–A
JMP -21 BYTES
ROM=(char *)realloc(ROM,ROM[++IP]) //FILE EXPANDED
scanf(“%d”,&STACK[SP])
MOV A,STACK[SP]
scanf(“%d”,&STACK[SP])
MOV B,STACK[SP]
MOV SP,B
MOV C,ROM[++IP]
FLAG=A-ROM[++IP]
JE 8 BYTES
MOV B,STACK[SP]
MOV ROM[C],B
++C
++SP
–A
JMP -9 BYTES
[COMPRESSED FORM]
00 02 04 06 08

4. Now run the program.If however you dont speak assembly that doesnt matter here is the algorithm for it :

1. Enter the Number of elements in the dictionary.
2. Enter the dictionary.
(Dictionary is stored on the stack)
(The dictionary is looked up for values corresponding to compressed code)
(The new Values are updated over the stack)
3. Enter the New Size.
4. Enter the SP (which could have been hardcoded as well)
(The code expands)
(The execution is now passed on to the expanded program)
5. Enter the first element. Hit Enter.
6. Enter the second element. Hit Enter.
7. The sum is Displayed.
8. OIVM halts.

Results/Output

#Thanks

Special thanks to Mr. Atul Alex Cherian, Ms. Nishtha Jatana and Ms. Kritika Sobti.

Hi, non technical reader.

Introduction

So basically this is the small program I wrote, which we are going to play with. In this program there are two functions : func1() and func2(). func1() is called from main, but func2() is never called.

So our aim is to execute func2 at run time.Here is the first run :

As you can see we do not go inside func2.

Reverse Engineering solution The first and the lot easier approach to this is, a RE solution. In this solution i just change some return addresses on the stack and we are done. Lets go step by step.

Step1 : Loading the program in OllyDbg

As can be seen there are three functions main, func1 and func2. These are indicated by the square brackets. The order of these functions is func1, func2 and lastly main.

Step2 : Now I am going to put a breakpoint on func1 and then observe the stack.

We have two images here the first one represents the assembly view of print2.cpp when i hitthe breakpoint and the second one represents the stack when I hit the breakpoint. In figure 1 it can be seen that the func1 starts at 401334 and it(the address) is in read with black background. Which indicates that we have hit the breakpoint. In figure two we can see that the return address for func1() is 0040139A. If we look up this address in the assembly dump, it is the one just after func1() is called that is 401395. Hence, things are fine here, the function always returns to the immediate expression after a call to it. So we have two deductions from here. First that the return address is 40139A which can be changed to make the func1() jump somewhere else. and secondly that this address is placed on the memory address starting 28FF0C.  

Step3 : Now we are going to edit 40139A to 401359 so that we can jump over to func2().

After the modification even the comment changes to print2.00401359, which suggests that it is call. And as expected we enter the func2().

However this is not enough. In a similar way we have to edit the return address of func2 to 40139A which was the original return address of func1. Now to be able to identify where is the return address of func2, we single step through func2 till we reach RETN.

Step4 : Here the top address on the stack is the return address for the stack. We need to change this address. In order to return and exit normally.

As can be seen on the stack 0028FF10 is the address where the return address 00403050 is stored. We modify this and then run the program.

We are able to do it neatly. :)

Program Solution

Now the RE solution was though easy, it wasn’t automated, and i had no fuckin idea about how do i make a permanent modification. What i mean here is like if you want to completely change an instruction you can do that and simply save changes to the new executable. But the stack is a dynamic memory region, it is not a part of the exe file that you save. So there was something more, some workaround that was needed. And thanks to Atul Alex Cherian, who told me about loader. So a loader is basically a program that lets the entire exe load in memory and then plays around with it. I first thought about using a tool for this, but then why not just code this shit out. So here is the algorithm that i followed for this.

Step1. Use fread to read the bytes of print2.exe to an array.

Step2. In this array modify the byte that represents beginning of func1 to CC (breakpoint).

Step3. Save this array to a new myf.exe

Step4. Detach pointer to myf.exe and open process myf.exe as a DEBUG_PROCESS

Step5. Waitforadebugevent and use a simple condition to check that it orignates from the one that you forced.

Step6. On receiving the EXCEPTION_BREAKPOINT DEBUG_EVENT suspend the thread using process information of myf.exe

Step7, Now change the CC that you placed to the original byte

Step8. Getthreadcontext of this thread and access the context structure to decrement EIP.

Step9. Now change return addresses of func1 and func2. For func1 only one byte is edited and for func2 one has to edit 2 bytes.

Step10. Resume thread. Myf.exe should exit after you press the first enter, then loader.exe should exit after you press the second enter. Here is the code :

Here is the screen shot showing its execution.

And special thanks to Dhanesh sir. :)

H3LL Y34H! :)

#include “stdafx.h”
#include “windows.h”

void antidebug();
void antidebug()
{
HMODULE lib;
FARPROC _ZwSetInformationThread;
lib = LoadLibrary(“ntdll.dll“);
_ZwSetInformationThread = GetProcAddress(lib, “ZwSetInformationThread“);
(_ZwSetInformationThread)(GetCurrentThread(),0x11,0,0);
MessageBox(NULL, “Debugger Detached“, “Debugger Detached“, MB_OK);
}

int _tmain(int argc, _TCHAR* argv[])
{
antidebug();
MessageBox(NULL, “Double Check…“, “Double Check“, MB_OK);
return 0;
}

Before I get into the BUGs lemme just try and explain what is happening here, so we are basically loading a handle to ntdll.dll by calling the LoadLibrary process and then we load the callback to _ZwSetInformationThread which is of datatype FARPROC[more on FARPROC] then we call ZwSetInformationThread routine which has four parameters as per http://msdn.microsoft.com/en-us/library/windows/hardware/ff567101%28v=vs.85%29.aspx .

The firstparameter is the handle to the current thread and since we want to run this function within our program we use the GetCurrentThread() function call which returns a handle to the current thread. Next is a value 11. This is basically the value because of which the debugger would get detached from the process. Now how did i get this value. As per documentation on msdn the second parameter is of the enumeration type _THREADINFOCLASS which is as follows [source] :

typedef enum _THREADINFOCLASS {
ThreadBasicInformation,
ThreadTimes,
ThreadPriority,
ThreadBasePriority,
ThreadAffinityMask,
ThreadImpersonationToken,
ThreadDescriptorTableEntry,
ThreadEnableAlignmentFaultFixup,
ThreadEventPair_Reusable,
ThreadQuerySetWin32StartAddress,
ThreadZeroTlsCell,
ThreadPerformanceCount,
ThreadAmILastThread,
ThreadIdealProcessor,
ThreadPriorityBoost,
ThreadSetTlsArrayAddress,
ThreadIsIoPending,
ThreadHideFromDebugger,
ThreadBreakOnTermination,
MaxThreadInfoClass
} THREADINFOCLASS;

So ThreadHideFromDebugger is 17 which is basically 11 in hex. And the remaining two parameters are obviously not of importance to us. :D

Now coming to the bugs. “|17|error: too many arguments to function|” But MSDN said that it needed four :O and now i started removing one parameter at a time and the function ran when i did not pass any arguments. After having searched a lot! The only solution that i could think of was to use the asm function and pass these arguments manually.

So i made the following changes.

(_ZwSetInformationThread)();
GetCurrentProcess();
asm(“pushl 0“);
asm(“pushl 0“);
asm(“pushl 0x11“);
asm(“pushl %eax“);

Oh and by the way the assembly syntax utilized on GCC is the AT&T asm. So yeah! I had to first read that because i have being doing the intel format. I read [this]

So this was some success because atleast the exe compiled, i had already though that now i would easily debug everything on OllyDbg and get it through. But this is what GCC(or i) had done to the code. :

So this wasnt the best solution.But it was some success since i was atleast able to compile the exe now and look it up in Olly (Somehow i am more comfortable with that.)

I decided that since the value passed as the handle to the process is the only thing that i do not know lemme pass other values by modifying the assembly code manually in Olly and changed the code to the following :

HANDLE hndle = GetCurrentThread();
(_NtSetInformationThread)();

The exe did compile and i was getting the pop up messages too.

Next thing was to immediately load this exe into my dearest OllyDbg and get started. Here is the very first look.

You can see that a call gets made to GetCurrentThread at 00401365 and the value is returned into EAX which is them moved to our variable “handle” (EBP-14). So after a couple of runs i realized that this value was always the same and always returning FFFFFFFE i am not sure if this is a fixed constant for a each system or is it just the local handle to every thread. But this is what it was in the case that I had in front of me. Then later you can see that a different value is moved into EAX and at 00401370 we make a call to that address (call eax) hence this is the handle to the ZwSetInformationThread.

So far so good. Next i had to modify the code so that i could push values to the stack before the call eax is executed. If you at the address 00401362 you would see that MOV EBP-10,EAX instruction is executed just after GetProcAddress so basically this is the place where the handle to ZwGetInformationThread is placed on the stack hence we can only modify the code after this. That is from 401365 to 40136D where the value is pushed back into EAX. (Or we could NOP both of these so that the value remains unchanged)

So here are the modifications that i did, wait and after this modification i clicked analyse code. So you’d see that now Olly recognizes this as a function ^_^

so we have obviously overwritten the call to GetCurrentThread but the code seems to fit just fine! :)

Now do you see a push -2 at 0040136B i had assembled PUSH 0xFFFFFFFE. :) And also since this is windows you would have to push the last argument first… just in case you did not know this.
Now before you run the code remember to save all modifications to exe because if the code is successful you would be detached from the debugger.
And finally we run the program. We Get the pop ups. And next we are detached from the debugger. :) (The code screen goes blank. Try reloading with << button.
The Blank Screen :

The Error :

H3LL Y34H! B)

I am currently working on anti-debugging techniques which will also be my project for this year in college.Though i know for a fact  most basic anti-debug techniques are  API based techniques, but i am still doing this post because firstly i did not find any working code and whatever non-working code was present was also implemented locally… By the way I am really impressed by the work compiled by Tyler Shields in 2009 and he has put up some of the best resources out there!

This post is basically about one of those standard API’s > CheckRemoteDebuggerPresent function. Now there is enough stuff on msdn and other websites that you can find about its implementations and about the working of the function however for some reason they did not work for me! So here is what finally worked. And I have done a remote process example too.

Implementation for process locally 

#ifndef _WIN32_WINNT
#define _WIN32_WINNT 0x0601
#endif
#include<windows.h>
#include<stdio.h>
#include<conio.h>

int main()
{
BOOL pblsPresent = FALSE;
HANDLE hndle = NULL;

CheckRemoteDebuggerPresent(GetCurrentProcess(),&pblsPresent);
if(pblsPresent){
printf(“Being Debugged\n“);
}
else{
printf(“Not being debugged\n“);
}
getch();
return 0;
}

Implementation For Remote Process (with PID 2800)

#ifndef _WIN32_WINNT
#define _WIN32_WINNT 0x0601
#endif
#include<windows.h>
#include<stdio.h>
#include<conio.h>

int main()
{
BOOL pblsPresent = FALSE;
HANDLE hndle = NULL;

hndle=OpenProcess(PROCESS_ALL_ACCESS,FALSE,2800);

if(hndle){
printf(“Done getting a handle \n“);
}else {
printf(“Invalid PID \n“);
}
CheckRemoteDebuggerPresent(hndle,&pblsPresent);
if(pblsPresent){
printf(“Being Debugged\n“);
}
else{
printf(“Not being debugged\n“);
}
getch();
return 0;
}

So as a community what do we do?
As hackers or security enthusiasts we are always indulged in something or the other. Trying things and all possible combinations of those things… we accomplish things and get stuck at many places too…and at the end of the we are the kind of geeks who like to have fun and mean no harm. All this. All of it is what is null about. We meet. Monthly. Present what we have learned. Learn what others show. Discuss our technical problems. And have the chit chat we like to have. :D So this is what a null meet is about.

Coming to the humla session. “Humla” is a hindi word meaning “attack“. Or mapping it to our domain it simply means “offensive-security“. Now when u are a working in security u can specialize in any of its sub domains like web application security, reverse engineering, network security, forensics, auditing etc. And if for example I wish to try out a diff sub domain then that means I would have to dedicate some time each day and start learning from scratch. Not that we would not love to do it or can not do it.. but instead we have the concept of a “humla” session. This is  basically a workshop wherein u are given a kick start in that sub domain by someone who is already an expert. He is called the “humla champion” by the way, the trainer for that day. The duration of the workshop is typically 6 to 8 hours with small breaks in between. And all of this is organized free of cost but yes their is a selection process prior to this. And that is because there is only limited space available plus since advance concepts are covered so people with atleast a little pre requisite knowledge are preferred.

Now a little about the venue. This is how you reach the building. If you are coming for the first time you might need this.

Reached till here ? Cool. Next you have to get yourself a pass made at the reception and the guard there would tell you where do you need to go. At the entrance of the section where you were guided to by the previous gurad, sits another guard who would give you a document on which particulars of your laptop are to be mentioned. *security reasons* . Hehe. And he’d further guide you to “Tlabs“. And you’d realize that you have reached the place because generally its just us in there! :D If you dont, just in case, then look for either Sandeep Bhaiya or Vaibhav Bhaiya. The honorable mods of our chapter! :) From the inside the place is really nice just as one would imagine any office.

Coming back to the topic of this post! :D This time’s session was on “linux exploitation” & our trainer or the humla champion was “mr. sohail”.(read 1337). I was really really excited. There have been a few subdomains of security I havent touched or infact touched and left them for a full fledged research to be done later. Exploit writing was one of them. I did try doing it… just read a few tutes from https://www.corelan.be/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/ and some stuff here and there to back it up. The stuff was really great but when I had started reading this, I did not know enough to go further. So kinda left that in between but this was the chance for me..as some one was there to spoon feed all of that to me! What better ?
Hence, I reached the venue half an hour early. :D Its just the excitement that can do this to me. Usually i am late. Serious Late. No problem. Since perhaps there was this one other guy who was, i guess, more excited than I was.. and had reached earlier to me. Cool.! Around an hour later Vaibhav Bhaiya came and told us that this session would not be conducted at the place we usually sit. It would be conducted in a room that was at the end of the place we usually are in the beginning of. But when we went there it was a conference room YAY! a conference room! I was already getting the feel. :D

Now everybody started coming in I am only going to talk about the ones I know :D So the first surprise was to see rahul gurnani sir there. He is currently pursuing his ms in information security from IIIT ahemdabad so he is generally not able to join us for all the meets. Then there was ashutosh bhaiya… sandy bhaiya came in.. and the star rishi narang sir, the most interesting guy since the last two meets came in… and there was anupam sir… aah about anupam sir.. the very first time you see him you’d feel he is the kind of strict disciplined guy you’d rather not talk to… but then you gotta look at his presentation on cloud forensics!! maahnn! That was one hilariously put together presentation. You would rather come to know about his fun loving side.! :) i can almost go on writing about each member present there… (i obviously miss shubham bhaiya the most.)

In a conference table… the u shaped one… as you would already know … they have ports(3 inside one small box covered with a white coloured lid in the table itself…for every 3 chairs they would have one such box) to charge your laptops (or anything else for that matter). So there was this one lid that wont open.. and i figured it was all the lids that had the same problem. So on looking at it carefully i learned that it wasnt actually a problem.. that was THE locking mechanism. All you need to do it put your finger inside it and push a stick towards the opposite side. TADA!! it opened.

All right so finally came in our champion *drum roll please* the humla champion and he told us that he wasn’t prepared and wasn’t able to complete his sleep too because of some work…  sorry about the second part… but not being prepared… that was even better… because this just means we would do a lot more practicals and very less theory.. and that’s exactly what happened. We started of with very basics of virtual memory, stack, stack frames, calling conventions etc. Then there was the first hands on… it was basically about overwriting the return address by exploiting the strcpy function. Was nice but yes just the beginning.  Ahh! Also we were told to install virtual box on our machines so that sohail sir could equip us with the right tools. Now we started off with copying the “vdi” file to pendrives and distributing the software… this took about half an hour till we all had copies of the file. Normally a vmware workstation user would just just double click on the vdx file and it would run with the workstation software but this was a vdi file we had with us.. so what we needed to do was basically add this as a hardrive while creating a machine on virtual box…The operating system was ubuntu 6. We used this particular version because it does not have “Address Space Layout Randomization“. That is, now we can code our exploit without using registers we could directly use memory addresses. And we used gdb to do all the reverse engineering on the program we were running. Ohkay, after all of this was done.. Then we had our first break. We ordered pizzas and subs.(only ordered during the first break) and had coffee. Then we came back and did our second hands on which was putting in the shell code at the return address. So we the did the typical putting in the shellcode at in the input string then loading the address where the shellcode starts as the return address. Nicely done. By the way we used metasploit’s tools every now and then. We used the pattern-create and pattern-offset to get the string that we fed into the strcpy function. This done basically to get the exact address in memory of the place where the return address gets overwritten. All about number. ;) Now generating the shellcode was also fun since we first tried using metasploit’s payloads for that but later we used a shell-gen script and that quickly gave us the 96byte shell code and we used that in our code. Was really nice doing all this. By the way sohail sir also told us that the code is generally called shell code because back in the days this kind of code would generally be used to return a shell. YOU MUST GIVE IT A SHOT!.

After this we had our second break! We had pizza’s in this break and after a small wait the subs arrived for those who ordered them, they were definitely much tastier now! :D  And then was the third and the last section where we took an exploit and sohail sir explained that exploit by sort of going step by step and discussing how that was developed. In this exploit we did not use hard coded memory addresses but rather an address of an instruction that would call the register which would have the value of the offset to our entered code. ;)

Sohail sir was very expressive and i was getting everything that he was saying. And yes one more thing… i now knew most of the concepts that were required as I have been studying Reverse Engineering for a lot of time now! and that is probably why it all sounded very familiar.

All in all it was one nice experience and for the Null Delhi Chapter. #Achivement Unlocked.

EQUALS

XSS on NSD’s website :D

Here is the alumni’s section. :)

All right how did I find it. ?

So for obvious reasons (look at the url , id=some integer) , I thought there could be a possible sqli vulnerability, though i knew i had a very little chance, i still pushed in the url to both havij and sqlmap. Havij failed however sqlmap listed that a boolean based blind could be executed in the format of 1=1, so for abvious reasons i tried a=a. Which did not work… ah…then finally came to me that and i executed the ‘a’=’a’. Finally replace the ‘a’ with a script and tada! :D

About the disclosures.

I wrote a mail to  indiaportal@gov.in, nationalschoolofdrama@gmail.com and info@cert-in.org.in. I also submitted it to thehackernews.com, xssed.com and null.co.in
However I do not expect a reply any time soon.

What is the TOR browser?
It is a browser that looks like mozilla firefox and can give you a completely anonymous browsing.

What is anonymous browsing?
When you access the websites they can have scripts running to capture you IP address or your location. To be able to hide that is called as anonymous browsing in the simplest form.

Can you host other Services Using the same process?
Yes just run the service on the correct virtual port and then use the appropriate client to access the service.

Do you need to forward the particular port on the gateway?
Yes, you need to forward the particular port in order to be able to host the service.

Can this site be accessed outside TOR?
No, this site can only and only be accessed by the TOR browser.

so I reached sector 16A by 4:00pm and was looking was the “Times Internet Limited” however there was no such building… I realised that after having walked for 3 kms around the same building… so I showed the exact address to one of gaurds (you will see a lot of them if you are in this area). He could locate where the plot FC-6 is.. so i had to walk back the entire boundary wall to reach the enterance gate of Times India Limited. (not times internet limited). So finally i confirmed with the gaurds of the building weather tlabs was in the same building or not they said it was and I was finally relaxed! I reached the place, it was huge…looked almost like a 5 star hotel’s reception. So when i entered the first floor they gave me a slip which was required for exit. :O So when I reached the lab the Tlabs the entire room was larger than the auditorium we have at MSIT. I was a bit nervous then getting to question myself …weather my presentation would be good enough.. are they gonna like it… But man awesome building. :D So now I had talk with my friend who motivated me to go there and just do it… so I just went there… and actually there were two events going on simultaneously some hacking event and our meet… that mean have of the crowd was actually going to be my audience…

aah there i saw mr. Aseem…. pulled up a chair.. and sat near the “group”. Now in the large room… there were only around 15 people who had come for the meet…so it more of a drawing room chit chat kind of a thing.. we had been bags sofas and chairs… in the shape of a U facing this LED tv where we were supposed to connect the laptop to give the presentation.. The first part of the presentation was Newsbyte … it was basically the “new stuff” and “update” section. I liked the part… the guy delivered his part nicely. :) Then there was a problem that we did not have much time for two presentations …hence only one of the two speakers me or shubham bhaiya could speak… So mr. aseem asked the duration of our presentations and my presentation was a shorter one so I was told to give it :) So i just got up and connected my laptop and started with my thing… now this presentation was different from any presentation i have ever given… i could see people understanding what i am saying :D that was nice…. plus yes.. i perhaps was the only one who was from college here… other people who came here were already working at different places… But offcourse my presentation was different… off beat… hence deserved the small round of applause :) So i did what i was here to do… then came back to my seat… and we started discussing about “things” and “stuff” :D Was a nice experience all together… Just that the duration was really less… we were actually almost kicked out of the building :D But i liked the whole concept of hackers meeting like this and presenting stuff …talking about security.. developments in the industry and the problems they are facing .. :) was cool really cool. Apart from that I also made good friends… the nice nature hackers.

Though I had in my mind that 2 periods! thats long …am I really gonna be able to make it till then..! Allright so this time the presentation in the seminar hall and all my classmates present there! :) The best part is that I knew they were bored like hell… obviously its not of there interest … but they supported me… they were quite and occasionally tried listening as well.. :) Thanks to them for being awesome. :) Now I started with the presentation (this time only I was doing it) and noticed that even my proctor Saba maam was present there… Then it went on ….things worked fine.. one of examples took time hence was not completed on the spot… like you know when your software does not recognize the version of the DBMS on the server… But apart from that it was nice… it went how i had planned… and also i loved the complements … in fact I got the best compliment from my proctor. She said that it was really practical… and generally seminars are not so practical!!! And that pretty much is the motto of my life… to keep things practical. :) Then my classmates’ comments… which actually gave me the right feedback and scope for improvement… Things like i need to take breaks in between, i have to interact more with the audience, include less of backtrack and I could use the zoom tool’s bar feature rather than zooming the entire screen. I would keep that in mind next time :) … and lastly the shocking part was i fucking took the entire too periods!! sorry classmates. :D
Also my offer of sharing the resources for a total of more than 12 types of sql injections is still open if you buy me a coke. :D