Asine Mezzanine

So, it project time again... While there are several tools and techniques available for putting together a solid toolkit out there already, I felt the need to create something tailored to my specific requirements. Also in creating the framework I hope to be able to understand with precision as much as I can about the way the browser(s) processes and accesses local filesystem. Where to start? Starting analysis begins in the base user's User Data directory:

Linux:

Google Chrome: ~/.config/google-chrome/Default

Chromium: ~/.config/chromium/Default

Mac OS X:

Google Chrome: ~/Library/Application Support/Google/Chrome/Default

Chromium: ~/Library/Application Support/Chromium/Default

Windows XP:

Google Chrome: C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Google\Chrome\User Data\Default

Chromium: C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Chromium\User Data\Default

Windows Vista or later:

Google Chrome: C:\Users\%USERNAME%\AppData\Local\Google\Chrome\User Data\Default

Chromium: C:\Users\%USERNAME%\AppData\Local\Chromium\User Data\Default

Most of the data of interest can be found in the following directory (the analysis for this project will be done on a default windows install using the default user using the default profile):

C:\Users\<USERNAME>\AppData\Local\Google\Chrome\User Data\Default\

It should be noted here however, Chrome/Chromium can be configure to start from custom directories (--user-data-dir), so it pays to check for flags on the application launcher. The "User Data\Default\"  folder (and subfolders of files) contains files of several formats, the main ones of interest are:

SQLite3

JSON

SNSS

Binary

Protocol Buffers

These formats are all pretty standard with the exception of Protocol Buffers. The developer overview can be found here: https://developers.google.com/protocol-buffers/docs/overview

Revisiting an old project and trying to breathe life into it again, I decided to start from scratch and do it properly this time. I'm working on set of image forensic analysis tools and hope to end up with a range from simple Exif, IPTC and XMP manipulation to Error Level Analysis and beyond (eventually I want to see just what can be packed into the headers of various image format headers). I decided to use the Exiv2 library (http://www.exiv2.org/) to get things started as it is well regarded and well documented.

mkdir exiv2

cd exiv2

svn checkout svn://dev.exiv2.org/svn/trunk

The dependencies are listed on the site and in the README:

sudo apt-get install zlibc gettext libiconv-hook-dev expat

cd trunk

Note: Because of the svn method there is no configuration file included so:

make config

./configure

make

sudo make install 

Everything should go well. To test it the libraries though grab another terminal and enter the sample folder and build the samples:

cd exiv2/trunk/samples

make

Run one of the binaries:

./exifprint <path/to/image.file>

Platform: Linux

Flash Player Version: 11.2.202.235

NVIDIA Driver Version: 295.40

Server Version Number: 11.0

Server Vendor Version: 1.11.3 (11103000)

NV-CONTROL Version:1.27

grep -i glx /var/log/Xorg.0.log

[    13.420] (II) LoadModule: "glx"

[    13.420] (II) LoadModule: "glx"

[    13.420] (II) Loading /usr/lib/x86_64-linux-gnu/xorg/extra-modules/libglx.so

[    14.112] (II) Module glx: vendor="NVIDIA Corporation"

[    14.137] (II) NVIDIA GLX Module  295.40  Thu Apr  5 21:57:38 PDT 2012

[    14.137] (II) Loading extension GLX

[    15.542] (II) Loading extension NV-GLX

[    15.636] (II) Initializing extension GLX

An interesting flash bug appeared today after doing a system update. Flash video streams but the hue/tint is off (everything is mostly blue). After doing some searching it became apparent that this is a known issue and has been for some time for folks running Nvidia binaries and having libvdpau installed, see: https://bugbase.adobe.com/index.cfm?event=bug&id=3136745 

https://bugs.launchpad.net/ubuntu/+source/adobe-flashplugin/+bug/967091  After reading through, I tried to disable hardware acceleration from within flash itself but was unable to select anything as the popup menu seemed to be frozen. It is mentioned in the above articles and at various other places where the bug has been reported that there is a quick fix, and this is what I had to resort to doing:  sudo mkdir /etc/adobe

echo -e "EnableLinuxHWVideoDecode=1\nOverrideGPUValidation=true" | sudo tee /etc/adobe/mms.cfg > /dev/null

While this fix may seem to work and allows for VDPAU hardware acceleration, it resulted in making running flash objects quite unstable and caused unpredictable crashes. If this makes flash player totally unusable changes can be reverted by: sudo rm /etc/adobe/mms.cfg

Or:

sudo rm -r /etc/adobe

Additionally it is suggested that the /etc/adobe/mms.cfg can be trimmed to just hold:

OverrideGPUValidation=true

It doesn't look like this will be patched in a hurry and nobody seems to want to take credit for what is happening.

It's not an Nvidia issue:

The problem only happens when Flash uses software decoding but VDPAU for presentation; it swaps two arguments of the call to upload the video data into VDPAU in that case. The libvdpau-trace patch linked above fixes that. If it doesn't work for you, odds are you probably installed it wrong.  - Pierre-Loup Griffais from Nvidia. http://www.nvnews.net/vbulletin/showpost.php?p=2541629&postcount=6

It's not a libvdpau issue:

Jan, this definitely isn't a libvdpau problem; libvdpau is just a wrapper library that is used to locate the vendor-specific VDPAU driver. The problem is either in the Ubuntu desktop environment (window manager/compositor), the application which uses VDPAU (e.g. Adobe Flash) or the VDPAU driver itself (e.g. NVIDIA driver)

- Stephen Warren (srwarren)

https://bugs.launchpad.net/ubuntu/+source/unity/+bug/968489/comments/14

It doesn't seem to be a Debian distro family only issue:

https://bbs.archlinux.org/viewtopic.php?id=137877

Adobe seems to be blaming everyone from Nvidia to clueless users:

https://bugbase.adobe.com/index.cfm?event=bug&id=3077076

https://bugbase.adobe.com/index.cfm?event=bug&id=3097844

https://bugbase.adobe.com/index.cfm?event=bug&id=3109467

https://bugbase.adobe.com/index.cfm?event=bug&id=3120888

https://bugbase.adobe.com/index.cfm?event=bug&id=3136745

The most recent bug report however still remains open, so there may be some hope:

https://bugbase.adobe.com/index.cfm?event=bug&id=3164063

Compiling reaver-wps today I ran into a bit of a stumbling block. After grabbing the source file from http://code.google.com/p/reaver-wps/ and extracting it I tried to configure it but it threw back an error stating that the pcap library was not found:

./configure

checking for gcc… gcc

checking whether the C compiler works… yes

checking for C compiler default output file name… a.out

checking for suffix of executables… 

checking whether we are cross compiling… no

checking for suffix of object files… o

checking whether we are using the GNU C compiler… yes

checking whether gcc accepts -g… yes

checking for gcc option to accept ISO C89… none needed

checking for pcap_open_live in -lpcap… no

error: pcap library not found!

This was odd because I knew for a fact that I had both libpcap0.8 and libpcap0.8-dev installed. After some quick searching I found that what was actually missing was the libsqlite3-dev files, so after running:

sudo apt-get install libsqlite3-dev

Grabbing a new terminal and starting again everything compiled fine.

./configure

checking for gcc... gcc

checking whether the C compiler works... yes

checking for C compiler default output file name... a.out

checking for suffix of executables... 

checking whether we are cross compiling... no

checking for suffix of object files... o

checking whether we are using the GNU C compiler... yes

checking whether gcc accepts -g... yes

checking for gcc option to accept ISO C89... none needed

checking for pcap_open_live in -lpcap... yes

checking for sqlite3_open in -lsqlite3... yes

checking how to run the C preprocessor... gcc -E

checking for grep that handles long lines and -e... /bin/grep

checking for egrep... /bin/grep -E

checking for ANSI C header files... yes

checking for sys/types.h... yes

checking for sys/stat.h... yes

checking for stdlib.h... yes

checking for string.h... yes

checking for memory.h... yes

checking for strings.h... yes

checking for inttypes.h... yes

checking for stdint.h... yes

checking for unistd.h... yes

checking for stdlib.h... (cached) yes

checking for stdint.h... (cached) yes

checking for string.h... (cached) yes

checking pcap.h usability... yes

checking pcap.h presence... yes

checking for pcap.h... yes

checking sqlite3.h usability... yes

checking sqlite3.h presence... yes

checking for sqlite3.h... yes

configure: creating ./config.status

config.status: creating Makefile

make

sudo make install

which reaver

The makefile that comes with the sift archive calls for pkg-config to include the gtk-engines-2 headers and libraries, however you will need to change these entries to use gtk+-2.0. You should have these installed but it pays to check.

pkg-config --list-all | grep gtk

gtk+-unix-print-2.0            GTK+ - GTK+ Unix print support

gtk+-x11-2.0                     GTK+ - GTK+ Graphical UI Library (x11 target)

gtk+-2.0                            GTK+ - GTK+ Graphical UI Library (x11 target)

Edit the following lines in sift/src/Makefile from:

INCL = -I$(INC_DIR) `pkg-config --cflags opencv gtk-engines-2`

LIBS = -L$(LIB_DIR) -lfeat `pkg-config --libs opencv gtk-engines-2`

To:

INCL = -I$(INC_DIR) `pkg-config --cflags opencv gtk+-2.0`

Interestingly enough, the Aircrack-ng suite seems to have been removed from the standard Ubuntu repos. It's best to keep current and compile from source anyway I guess although, if I can be lazy and grab something with a single line I will just about every time. I ran into a bit of trouble compiling the source and had to edit a file. So, this is what I did:

sudo apt-get install build-essential libssl-dev

cd ~/Downloads

wget http://download.aircrack-ng.org/aircrack-ng-1.1.tar.gz

tar -zxvf aircrack-ng-1.1.tar.gz

cd aircrack-ng-1.1

vim common.mak

Search for this line:

CFLAGS ?= -G -W -Wall -Werror -03

Remove the -Werror:

CFLAGS ?= -G -W -Wall -03

make

sudo make install

I have recently had to do multiple installs of OpenCV on a few systems and noticed that there wasn't one site that suited my needs for a quick install for everything I needed. I decided to fully document my steps and put this up here for future reference.

Installing OpenCV

This guide was written and compiled with the help from the following pages:

https://ffmpeg.org/trac/ffmpeg/wiki/UbuntuCompilationGuide

http://thebitbangtheory.wordpress.com/2011/10/23/how-to-install-opencv-2-3-1-in-ubuntu-11-10-oneiric-ocelot-with-python-support/

So, let's get started...

Remove any existing packages:

sudo apt-get remove ffmpeg x264 libvpx-dev libx264-dev

sudo apt-get update

Install base dependencies:

sudo apt-get install build-essential checkinstall git pkg-config cmake libpng12-0 libpng12-dev libpng++-dev libpng3 libpnglite-dev libfaac-dev libjack-jackd2-dev libjasper-dev libjasper-runtime libjasper1 libmp3lame-dev libopencore-amrnb-dev libopencore-amrwb-dev libsdl1.2-dev libtheora-dev libva-dev libvdpau-dev libvorbis-dev libx11-dev libxfixes-dev libxvidcore-dev texi2html yasm zlib1g-dev zlib1g-dbg zlib1g libgstreamer0.10-0 libgstreamer0.10-dev libgstreamer0.10-0-dbg gstreamer0.10-tools gstreamer0.10-plugins-base libgstreamer-plugins-base0.10-dev gstreamer0.10-plugins-good gstreamer0.10-plugins-ugly gstreamer0.10-plugins-bad gstreamer0.10-ffmpeg pngtools libtiff4-dev libtiff4 libtiffxx0c2 libtiff-tools libjpeg8 libjpeg8-dev libjpeg8-dbg libjpeg-progs libavcodec-dev libavcodec53 libavformat53 libavformat-dev libxine1-ffmpeg libxine-dev libxine1-bin libunicap2 libunicap2-dev libdc1394-22-dev libdc1394-22 libdc1394-utils swig python-numpy  libpython2.7 python-dev python2.7-dev libjpeg-progs libjpeg-dev libgtk2.0-0 libgtk2.0-dev gtk2-engines-pixbuf

-->x264

H.264 video encoder. The following commands will get the current source files, compile, and install x264.

cd

git clone git://git.videolan.org/x264

cd x264

./configure --enable-static

Note: I ran into trouble and had due to x64 error so I had to change configure line to add --enable-pic and --enable-shared.

./configure --enable-static --enable-pic --enable-shared

make

sudo checkinstall --pkgname=x264 --pkgversion="3:$(./version.sh | \

  awk -F'[" ]' '/POINT/{print $4"+git"$5}')" --backup=no --deldoc=yes \

  --fstrans=no --default

-->libvpx

VP8 video encoder and decoder.

cd

git clone http://git.chromium.org/webm/libvpx.git

cd libvpx

./configure

make

sudo checkinstall --pkgname=libvpx --pkgversion="1:$(date +%Y%m%d%H%M)-git" --backup=no --deldoc=yes --fstrans=no --default

-->ffmpeg

cd

git clone --depth 1 git://source.ffmpeg.org/ffmpeg

cd ffmpeg

./configure --enable-gpl --enable-libfaac --enable-libmp3lame --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-libtheora --enable-libvorbis --enable-libvpx --enable-libx264 --enable-nonfree --enable-version3 --enable-x11grab

Note: I ran into trouble and had due to x64 error so I had to change configure line to add --enable-pic and --enable-shared.

./configure --enable-gpl --enable-libfaac --enable-libmp3lame --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-libtheora --enable-libvorbis --enable-libx264 --enable-libxvid --enable-nonfree --enable-postproc --enable-version3 --enable-x11grab --enable-pic --enable-shared

make

sudo checkinstall --pkgname=ffmpeg --pkgversion="5:$(date +%Y%m%d%H%M)-git" --backup=no --deldoc=yes --fstrans=no --default

hash x264 ffmpeg ffplay ffprobe

-->v4l

Download and install v4l – download any recent stable snapshot from http://www.linuxtv.org/downloads/v4l-utils/ (I used v4l-utils-0.8.5.tar.bz2) and extract it to a folder. Then enter the folder and build it:

make

sudo make install

-->OpenCV

mkdir release

cd release

cmake -D CMAKE_BUILD_TYPE=RELEASE -D CMAKE_INSTALL_PREFIX=/usr/local -D BUILD_PYTHON_SUPPORT=ON -D BUILD_EXAMPLES=ON ..

make

sudo make install

-->Add OpenCV libs to system path

vim ~/.bashrc

export LD_LIBRARY_PATH=/usr/local/lib

sudo vim /etc/bash.bashrc

PKG_CONFIG_PATH=$PKG_CONFIG_PATH:/usr/local/lib/pkgconfig

export PKG_CONFIG_PATH

-->Check python install

python

import cv2

-->Compile all samples

chmod +x build_all.sh

./build_all.sh

-->To compile using pkg-config

g++ `pkg-config --cflags opencv` my_code.cpp -o my_code `pkg-config --libs opencv`

-->cvBlob

Grab the latest version from: http://code.google.com/p/cvblob/downloads/list

At the time of writing the current version is here: http://cvblob.googlecode.com/files/cvblob-0.10.3-src.tgz

cmake . -DOpenCV_DIR=<path_to_OpenCV>

Note:cmake . -DOpenCV_DIR=/usr/local/include/opencv

make

sudo make install

Output should be:

Install the project...

-- Install configuration: "Release"

-- Installing: /usr/local/lib/pkgconfig/cvblob.pc

-- Installing: /usr/local/include/cvblob.h

-- Installing: /usr/local/lib/libcvblob.so

Parov Stelar - Wake Up Sister (feat. Max the Sax)