Windows – Endpoint 101

Using Wireshark and MITM to explore a STB

I’ve recently bought a new Freeview HD box from 3view. It has a whole host of features and can be considered a “connected” device. As with most high-end set-top-boxes (STB) it pulls software firmware updates from the web, and I was interested to see where it went to get these updates & how it knew they were available.

I know about using tools to sniff network traffic, but have only done this to sniff traffic coming directly out of the PC I’m running the capture software on. Buying this 3view box gave me more of an inventive to expand my knowledge & figure out how to capture the traffic from other devices.

It was actually relatively easy. I decided to do a Machine in the Middle (MITM) ‘attack’ which was documented over at the Wireshark wiki.

In my case I didn’t have 2 network cards, but did have a laptop with one network card, and a wireless card. In Windows XP I bridged the NIC to the Wireless adapter, then plugged in a cross-over cable that linked the 3view box to my laptop. Then, after a bit of messing about with IP addresses it started working.. my 3view box was accessing my wireless router via my laptop.

Now that all the traffic from the 3view box was going via my laptop, all I then needed to do was fire up Wireshark & take a look at the packets.

Intercepting the traffic allowed me to see where the box was going for it’s updates, and the User Agent. That’s been documented over at the 3viewer community website I set up for 3view owners.

http://3viewer.elementfx.com/

Power Meter Plus 1.6 Released

This release of Power Meter Plus – the popular replacement for the standard Windows power meter – adds 4 new features/settings. These have been added after feedback from users.. a lot after it was featured on Lifehacker.com and in PC Pro magazine :)

The features/settings now available are:

Hide the meter instead of switching sides.. it then fades back a few moments later
Change the transparency level of the message that appears across the screen for certain warnings
Flash the warning message (optional)
Start the meter on the right of the screen (which is where it will stay if you set it not to move sides)

Click here for the Power Meter Plus download page.

Power Meter Plus

Power Meter Plus featured on Lifehacker

Lifehacker is one of my daily visits, so it was brilliant to see that it had Power Meter Plus as the Featured Windows Download :-D

Netvibes UWA

Netvibes is a pretty awesome personal homepage web app. It’s very similar to iGoogle, but IMO it’s a lot more stable & a lot better looking. Netvibes offer a unified API that allows you to write using their API and deploy your gadget to multiple providers, such as iGoogle, Opera, iPhone, MacOSX and Vista.

I’ve been writing a gadget for my company but decided I also wanted one to take the first image out of an RSS feed and present so that it takes up all the space in the gadget. Useful for things like LOLcats. It was surprisingly simple to create.. so with some UWA coding, and a simple pipe at Yahoo Pipes, I’m now able to bring in the first image from a specified RSS feed.. assuming the image’s URL has been put into the item.content tag.

Here’s the finished gadget.. and the source code is below…

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:widget="http://www.netvibes.com/ns/"  >
	<head>
		<title>Single Image Display</title>
		
		<meta name="author" content="Matt Collinge" />
		<meta name="author_email" content="gadget@mattcollinge.co.uk" />
		<meta name="description" content="Display an image from the content section of the first item in an RSS feed. Useful for feeds like those from LOLCats. Use Yahoo Pipes to get the image URL (only) into the item.content tag." />
		<meta name="version" content="1.1" />
		<meta name="website" content="http://www.mattcollinge.co.uk/" />
		<meta name="keywords" content="image, rss, lolcats, single, full width" />
		<meta name="autoRefresh" content="15" />
		
		<link rel="stylesheet" type="text/css" href="http://www.netvibes.com/themes/uwa/style.css" />
		<script type="text/javascript" src="http://www.netvibes.com/js/UWA/load.js.php?env=Standalone"></script>
		
		<style type="text/css">
			.imageDisplay {
				margin:0;
				padding:0;
			}
		</style>
		
		<widget:preferences>
			<preference name="title" type="text" label="Title" defaultValue="Single Image Display" />
			<preference name="url" type="text" label="URL" defaultValue="" />
		</widget:preferences>
	
		<script>
			var BasicRSSReader = {};
			 
			BasicRSSReader.feed = false;
			 
			widget.onLoad = function() {
				if (widget.getValue('url') === '' || widget.getValue('url') == undefined) {
					widget.setBody('Please edit the preferences and enter the URL of the RSS feed where you want to take the image from.<br><br>The image URL must be in the item.content tag otherwise this will not work. Use feed a reformatter like Yahoo Pipes if you need to tinker with a 3rd party RSS feed such as LOLcats.');
				} else {
					widget.body.addClassName('imageDisplay');
					widget.setTitle(widget.getValue('title'));
					UWA.Data.getFeed(widget.getValue('url'), BasicRSSReader.display);
				}
			}
			
			BasicRSSReader.display = function(feed) {
				var feedList = 'Unable to load feed.';
				if (feed) BasicRSSReader.feed = feed;
				var item = BasicRSSReader.feed.items[0];
				feedList = '<img src="' + item.content + '" width="' + widget.body.getDimensions().width + '" />';
				widget.setBody(feedList);
			}
		</script>			
	
	</head>
	<body>
		<p>Loading...</p>
	</body>
</html>

Using JSLint with Notepad++

I’m doing a fair amount of development using the ExtJS framework. IE is a bit picky about getting JavaScript properly formatted (otherwise it refuses to render the page). That’s why I’ve found JSLint really useful for locating stray commas or semi-colons.

To make it a bit quicker to put the file contents in the JSLint box I decided to hook it up to the Run menu in Notepad++. However, the JSLint web page doesn’t allow us to pass in data to it. To get around this you can copy the HTML + JS files from the authors website an copy them locally. Once you’ve got them locally you can modify the source to allow the passing of data.. here’s the change I made to do it on my system:

jslint.php changes.. add this right near the end

<script src="javascript.js"></script>

You’ll then need a way to take the file contents and fire it off to the page. At first I tried passing the file contents via the GET request, but it’s limited in length. Also, Notepad++ won’t let you send the file contents via the Run command. In the end I chose to use a piece of VBScript to bring up the webpage in the default browser, and some JavaScript to read in the file & place it into the page.

launchJSLint.vbs

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.OpenTextFile(wscript.Arguments(0), 1)

Dim strCharacters

Do Until objFile.AtEndOfStream
    strCharacters = strCharacters + objFile.Read(1)
Loop

strCharacters = Escape(strCharacters)

Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objOutputFile = objFileSystem.CreateTextFile("c:\progra~1\notepad++\jslint\javascript.js", TRUE)
objOutputFile.WriteLine("document.getElementById(""input"").value = unescape(""" & strCharacters & """);")

Dim wShell
Set wShell = CreateObject("WScript.Shell")
wShell.Run "c:\progra~1\notepad++\jslint\jslint.html", 9

Finally, this is the Run command you can use in Notepad++ to launch the script…

wscript "C:\Program Files\Notepad++\launchJSLint.vbs" "$(FULL_CURRENT_PATH)"

Switching FoxyProxy Profiles using Script

FoxyProxy is a useful extension to Firefox, but I’m always having to switch profiles back and forth as I take my laptop from work to home, and vice versa. I experimented with proxy PAC files without any success (mainly because laptops have multiple network adapters and the PAC scripts only detect your first IP address). Plus, as far as I can tell, PAC files are checked for every single HTTP request which must be a hit on browser performance.

Anyway, what I decided to do was directly modify the FoxyProxy config file before Firefox was run, and this would then select which FoxyProxy profile was used. The script below detects the host of something on my local network (which doesn’t exist at work) and switches accordingly. You could get it to switch on anything you like, but this works for me.

runfirefox.vbs

Set WshShell = WScript.CreateObject("WScript.Shell")

' Code to determine where you are and switch profiles accordingly
if (Ping("somehost") = "201.69.34.132") then
	ModifyFoxyProxy("3402440320")
else 
	ModifyFoxyProxy("patterns")
end if

' Run Firefox - this uses a specific profile.. your command line can simply exclude it
ReturnCode  = WshShell.Run("""C:\Program Files\Mozilla Firefox\firefox.exe"" -profile ""z:/firefox/profiles/qtxjee58.default""", 6, False)



sub ModifyFoxyProxy(sProfile) 
	' Path to your foxyproxy.xml file
	xmlfile="Z:\Firefox\Profiles\qtxjee58.default\foxyproxy.xml"
	outfile="Z:\Firefox\Profiles\qtxjee58.default\foxyproxy.xml"
	set oparser=createobject("msxml2.domdocument")
	with oparser
	    .async=false
	    .validateOnParse=false
	    .resolveExternals=false
	    .load xmlfile
	end with
	    
	if oparser.parseerror.errorcode<>0 then
	    wscript.echo "xml file " & xmlfile & " is not well-formed." & vbcrlf & "Operation aborted."
	    wscript.quit 999
	end if
	
	set oroot=oparser.documentElement
	oroot.setAttribute "mode", sProfile
	oparser.save outfile
	    
	set oparser=nothing 

end sub


function Ping(strHost)

    dim objPing, objRetStatus

    set objPing = GetObject("winmgmts:{impersonationLevel=impersonate}").ExecQuery ("select * from Win32_PingStatus where address = '" & strHost & "'")

    for each objRetStatus in objPing
        if IsNull(objRetStatus.StatusCode) or objRetStatus.StatusCode<>0 then
    		Ping = ""
            'WScript.Echo "Status code is " & objRetStatus.StatusCode
        else
            'Ping = True
            'Wscript.Echo "Bytes = " & vbTab & objRetStatus.BufferSize
            'Wscript.Echo "Time (ms) = " & vbTab & objRetStatus.ResponseTime
            'Wscript.Echo "TTL (s) = " & vbTab & objRetStatus.ResponseTimeToLive
            Ping = objRetStatus.ProtocolAddress 
        end if
    next
    
end function

IBM Thinkpad Hardware Control

The ‘Access IBM’ button on my laptop doesn’t get much use, so I decided to map it up to the PC release of XBMC (Xbox Media Centre). That’s the easy part, because you either set that in the registry, or use this small app.

When XBMC fires up I’d also like to set the volume levels of the laptop so that they output properly for the AV equipment I’ve got hooked into it. Once XMBC shuts down I’ll set back down so that the sound is at a lower level. The IBM laptops use a hardware volume control (independent to the Windows volume control) so I’m using some Python scripts to access the IBM hardware.

Here’s the finished scripts (the first one calls the second):

xbmc.vbs

Set WshShell = WScript.CreateObject("WScript.Shell")

'Set windows volume level
SetSoundLevel 90

'Set IBM ThinkPad volume level
ReturnCode  = WshShell.Run("C:\win32app\startup\thinkpadsetvolume.pyw 14", 1, true)

'Run XBMC and wait until it exits
ReturnCode  = WshShell.Run("C:\Progra~1\XBMC\XBMC.exe -fs -p", 1, true)

'Set IBM ThinkPad volume level
ReturnCode  = WshShell.Run("C:\win32app\startup\thinkpadsetvolume.pyw 3", 1, true)

'Set windows volume level
'SetSoundLevel 30

' ------------------------------------------------------------------------
' Function to set the Windows sound level
' ------------------------------------------------------------------------
Sub SetSoundLevel ( iMyLevel )

On Error Resume Next
Err.Clear 

Dim blSoundDevicePresent
Dim objSoundDevice

blSoundDevicePresent = False

For Each objSoundDevice In GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf ("Win32_SoundDevice")
 blSoundDevicePresent = True
 Exit For
Next

If Not blSoundDevicePresent Then Exit Sub

Dim iDefaultLevel, iSoundLevel, objSoundLevel

iDefaultLevel = 5

If Not IsNumeric ( iMyLevel ) Then iMyLevel = iDefaultLevel

MyLevel = CInt ( iMyLevel )
If Err.number  0 Then iMyLevel = iDefaultLevel

If iMyLevel  100 Then iMyLevel = iDefaultLevel

Err.Clear
set objSoundLevel = CreateObject ( "SetSoundLevel.SoundLevel" )
If Err.number  0 Then Exit Sub

iSoundLevel = iMyLevel * ( objSoundLevel.GetMaxSoundLevel - objSoundLevel.GetMinSoundLevel ) / 100

objSoundLevel.SetSoundLevel iSoundLevel

set objSoundLevel = Nothing

End Sub

thinkpadsetvolume.pyw

import thinkpad
import time
import sys

if __name__ == '__main__':
    try:
        c = int(sys.argv[1])
    except IndexError:
        c = 14
    hk = thinkpad.Hotkeys()
    hk.set_volume(c)

USB Detect & Launch Version 1.5 Released

USB D&L USB Detect & Launch allows you to automatically execute a script or application each time a USB storage device is plugged into your PC. Different scripts can be executed for different devices and it’s the volume label that determines what action to perform.

Version 1.5 contains new functionality to monitor for any device being plugged in; useful when you have no control over what memory stick is being inserted, but need to fire off a script to perform a particular action.

e.g.

label:(any)
exec:”c:batchbatch-any.cmd” %1 %2

You can find the download on the USB Detect & Launch page.

File Mover 1.9 Released

File mover is useful little utility that will move files from one folder to another. This is useful when a program (or remote server) dumps files into a folder & you want to move them somewhere else. An added bonus with this utility is that it’ll (optionally) run a program each time a file is moved; this could be useful for firing off email notification.

Version 1.9 has been released and includes some small fixes and enhancements. E.g. copy from log now works, and the app doesn’t freeze when executing a script in ‘Wait for executed process’ mode.

You can find the download on the File Mover page.

Drive Map Pro 1.6 Released

Drive Map Pro is a great piece of Windows software for organising all the servers you connect to. It’s primary purpose is to give you easy access to mapping a network drive with the minimum of fuss, however it does a lot more that that, including managing your VNC/Radmin connections too!

The latest version of Drive Map Pro (version 1.6) is now available to registered users and includes the following:

Lots of bug-fixes :-D
Ability to have multiple UNC drive mappings under one entry, syntax is ‘\serverc$,d$,whatever’, which gives you the ability to map to any/all 3 of those drives without clogging up your list of servers!
Middle-click launches the application you’ve associated with the server.. saves a click or two!
Store notes against each entry.. handy for storing box info, like who’s the administrator
More application preferences (like auto-hide DriveMapPRO after launching an application)

Click here for more information on Drive Map Pro.

Drive Map Pro 1.6

Mapping a drive has never been easier!!

File Mover 1.7 Released (bugfix only)

This is a minor bugfix release. I noticed that when multiple files are moved during 1 iteration of the timer, the same piece of exec script is run each time, i.e. it didn’t run for each individual file, just the first one it moved.

Click over to the software page for the download.

File Mover Version 1.6 Released

This is a minor release and gives the application more resilience around folder availability, i.e. it can handle when a UNC drive isn’t available for copying from/to.

Click over to the software page for the download.

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this: