Showing posts with label way. Show all posts
Showing posts with label way. Show all posts
Monday, March 6, 2017
Monday, February 20, 2017
new book on the way
new book on the way
http://abenmaler.dk/b%C3%B8ger/flere-post-it-monstre/
Available link for download
Thursday, February 16, 2017
No Way Back
No Way Back
No Way Back
When F.B.I. Agent Zack Grants partner is killed during a blown-up operation, he attempts to find the person responsible. Mafiaso Frank Serlano believes Zack is responsible for his only.
Director:Frank A. Cappello
Writer:Frank A. Cappello (as Frank Cappello)
Stars:Russell Crowe, Helen Slater, Etsushi Toyokawa
Storyline
When F.B.I. Agent Zack Grants partner is killed during a blown-up operation, he attempts to find the person responsible. Mafiaso Frank Serlano believes Zack is responsible for his only sons death in the same operation and kidnaps Zacks son to hold as bait. The action gets wild when airline stewardess Mary is taken hostage to add what seems an another insurmountable problem for Zack. There appears to be No Way Out.Viewers Reviews
Botching a huge bust has just dealt Special Agent Zack Grant a hand he wasnt expecting. His department considers him a disgrace. The Mafia have his son hostage, and now to clear his name and save his son, he has to get involved with the Japanese Yakuza, and bring back one of their top men. In too deep and way over his head, Zack Grant is in a spot he cant get out of, and now theres No Way Back.
No Way Back stars Russell Crowe as Zack Grant, a special agent who is called upon to lead a federal unit to bring down the son of a huge mob boss, Frank Sariano (played by Michael Lerner). But after making a bad judgment call, and sending in a rookie agent who goes haywire, Zack lands himself in some hot water with his department. Yet, after figuring out that the agent he sent in was actually working with the Yakuza, and using a little detective work, Zack finds a way to clear his name. However, to do so wont be easy. Zack must journey to Japan and go undercover to bring back one of Yakuzas big bosses, Yuji (Japanese actor Etsushi Toyokawa). Bringing Yuji back to justice wont be easy because, not only will Zack have to deal with the Yakuza gunmen, Sariano has taken Grants son, and is offering a trade for the life of Yuji, whom he believes to be the man responsible in his sons murder. Making the choice for Zack wont be easy but along for the ride is a flighty stewardess (Helen Slater in the worst form of her career), who may be able to inspire Zack in to making the right choice. What ensues is an action road comedy, with a three-way twist when Zack is put in the middle of a three way "war", with no side to call his own.
Here is a movie that could have actually been something really good, but just happens to fall short. The acting isnt the main problem, with Crowe turning in his usual good performance, and Toyokawa helping out with a good show. Then, however, we get to Slaters ridiculous Stewardess character, Jenny. Even though its not really her fault she puts in a bad performance. Her character in this movie is just so down right ridiculous and typical that even a quality actress like Ellen Barkin couldnt pull it off. Yet I will blame her for taking such a ludicrous role in the first place. But maybe she just wanted to hurt her career. Writer/director Frank Capello does boast a very ambitious beginning by throwing in a heavy portion of action and gunplay and that was also the films downfall, as it looks like the producers ran out of money by the halfway point.
I could easily pick out other members of the crew, like the stunt coordinator who didnt have much of a job to do after the beginning, but still botched up his job, or the set design crew who couldnt have possibly made the movies surroundings any blander, but today Im feeling particularly nice so I wont mention those people. After doing this easily forgotten actioner, Russell Crowe must really be happy about the turn his career has taken. However, like Helen Slaters career, if you rented this flick from the video store, you just lost money and there is absolutely, No Way Back.
No Way Back stars Russell Crowe as Zack Grant, a special agent who is called upon to lead a federal unit to bring down the son of a huge mob boss, Frank Sariano (played by Michael Lerner). But after making a bad judgment call, and sending in a rookie agent who goes haywire, Zack lands himself in some hot water with his department. Yet, after figuring out that the agent he sent in was actually working with the Yakuza, and using a little detective work, Zack finds a way to clear his name. However, to do so wont be easy. Zack must journey to Japan and go undercover to bring back one of Yakuzas big bosses, Yuji (Japanese actor Etsushi Toyokawa). Bringing Yuji back to justice wont be easy because, not only will Zack have to deal with the Yakuza gunmen, Sariano has taken Grants son, and is offering a trade for the life of Yuji, whom he believes to be the man responsible in his sons murder. Making the choice for Zack wont be easy but along for the ride is a flighty stewardess (Helen Slater in the worst form of her career), who may be able to inspire Zack in to making the right choice. What ensues is an action road comedy, with a three-way twist when Zack is put in the middle of a three way "war", with no side to call his own.
Here is a movie that could have actually been something really good, but just happens to fall short. The acting isnt the main problem, with Crowe turning in his usual good performance, and Toyokawa helping out with a good show. Then, however, we get to Slaters ridiculous Stewardess character, Jenny. Even though its not really her fault she puts in a bad performance. Her character in this movie is just so down right ridiculous and typical that even a quality actress like Ellen Barkin couldnt pull it off. Yet I will blame her for taking such a ludicrous role in the first place. But maybe she just wanted to hurt her career. Writer/director Frank Capello does boast a very ambitious beginning by throwing in a heavy portion of action and gunplay and that was also the films downfall, as it looks like the producers ran out of money by the halfway point.
I could easily pick out other members of the crew, like the stunt coordinator who didnt have much of a job to do after the beginning, but still botched up his job, or the set design crew who couldnt have possibly made the movies surroundings any blander, but today Im feeling particularly nice so I wont mention those people. After doing this easily forgotten actioner, Russell Crowe must really be happy about the turn his career has taken. However, like Helen Slaters career, if you rented this flick from the video store, you just lost money and there is absolutely, No Way Back.
Available link for download
Monday, February 6, 2017
Non Standard Way to Get Inaccessible Data from iOS
Non Standard Way to Get Inaccessible Data from iOS
Now I must apologize for posting so many source codes. To begin with, let us recall how it was earlier, in iOS 5.*. Then you could use Apple System Log facility to get the system messages that are displayed when connecting to a network. The encryption mode and signal power data appeared in the messages. And you could get them this way:
aslmsg asl, message;
aslresponse searchResult;
int i;
const char *key, *val;
NSMutableArray *result_dicts = [NSMutableArray array];
asl = asl_new(ASL_TYPE_QUERY);
if (!asl)
{
DDLogCError(@"Failed creating ASL query");
}
asl_set_query(asl, "Sender", "kernel", ASL_QUERY_OP_EQUAL);
asl_set_query(asl, "Message", "AppleBCMWLAN Joined BSS:", ASL_QUERY_OP_PREFIX|ASL_QUERY_OP_EQUAL);
searchResult = asl_search(NULL, asl);
while (NULL != (message = aslresponse_next(searchResult)))
{
NSMutableDictionary *tmpDict = [NSMutableDictionary dictionary];
for (i = 0; (NULL != (key = asl_key(message, i))); i++)
{
NSString *keyString = [NSString stringWithUTF8String:(char *)key];
val = asl_get(message, key);
NSString *string = [NSString stringWithUTF8String:val];
[tmpDict setObject:string forKey:keyString];
}
[result_dicts addObject:tmpDict];
}
aslresponse_free(searchResult);
asl_free(asl);
But, as Apple usually does, the company closed the access to the system messages in ASL once it knew about them. So we had to find a new way to get these data. The question was stated differently: how can you get these data in Mac OS and iOS?
First of all, you can use scutil, which allows getting the system configuration data including the information we need. Testing jailbroken iPhone on iOS 6 proved that the tool works quite well. For me it was a clue, and I started to look for a way to reach SystemConfiguration on iOS.
It was as simple as pie: SystemConfiguration.framework. It allows connecting to Mac OS value storage and get a property list, which includes wireless networks data.
However, when you look at the header files of the library, you get upset: using the required method is restricted.
CFPropertyListRef
SCDynamicStoreCopyValue (
SCDynamicStoreRef store,
CFStringRef key
) __OSX_AVAILABLE_STARTING(__MAC_10_1,__IPHONE_NA);
First, make sure that the method is functional.
void *handle = dlopen("/System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration", RTLD_LAZY);
CFArrayRef (*_SCDynamicStoreCopyKeyList)(int store, CFStringRef pattern) = dlsym(handle, "SCDynamicStoreCopyKeyList");
NSLog(@"Lib handle: %u", handle);
NSString *key = @"State:/Network/Global/DNS";
CFArrayRef testarrray = _SCDynamicStoreCopyKeyList(0, CFSTR("State:/Network/Interface/en0/AirPort"));
NSLog(@"Tested array res: %@", testarrray);
Everythings fine. The result returns. So theres no blocks, only formal Apples restrictions, which wont allow passing validation in App Store. Anyways, why dont we write a piece of the library by our own.
The source code was easy to be found: it was a part of the daemon configd. The most interesting stuff begins when reading description of SCDynamicStoreCopyValue.
#include "config.h" /* MiG generated file */
...
/* send the key & fetch the associated data from the server */
status = configget(storePrivate->server,
myKeyRef,
myKeyLen,
&xmlDataRef,
(int *)&xmlDataLen,
&newInstance,
(int *)&sc_status);
OK. A request is passed to the file generated using MACH Interface Generator. We have description in MIG in the file located nearby.
routine configget ( server : mach_port_t;
key : xmlData;
out data : xmlDataOut, dealloc;
out newInstance : int;
out status : int);
Now you have two options — the way of a common person and the way of the Jedi. You can run mig on the file config.defs and get the codes to be entered into the project. But unfortunately we did not discover the file during the research so we had to do some reverse engineering :) However, Dmitry Sklyarov did show his jedi skills and managed to restore the process of sending the request to the MACH port, configd. So the method was completely restored.
#define kMachPortConfigd "com.apple.SystemConfiguration.configd"
-(NSDictionary *)getSCdata:(NSString *)key
{
if(SYSTEM_VERSION_LESS_THAN(@"6.0"))
{
// It does not work on iOS 5.*
return nil;
}
struct send_body {mach_msg_header_t header; int count; UInt8 *addr; CFIndex size0; int flags; NDR_record_t ndr; CFIndex size; int retB; int rcB; int f24; int f28;};
mach_port_t bootstrapport = MACH_PORT_NULL;
mach_port_t configport = MACH_PORT_NULL;
mach_msg_header_t *msg;
mach_msg_return_t msg_return;
struct send_body send_msg;
// Make request
CFDataRef extRepr;
extRepr = CFStringCreateExternalRepresentation(NULL, (__bridge CFStringRef)(key), kCFStringEncodingUTF8, 0);
// Connect to Mach MIG port of configd
task_get_bootstrap_port(mach_task_self(), &bootstrapport);
bootstrap_look_up2(bootstrapport, kMachPortConfigd, &configport, 0, 8LL);
// Make request
send_msg.count = 1;
send_msg.addr = (UInt8*)CFDataGetBytePtr(extRepr);
send_msg.size0 = CFDataGetLength(extRepr);
send_msg.size = CFDataGetLength(extRepr);
send_msg.flags = 0x1000100u;
send_msg.ndr = NDR_record;
// Make message header
msg = &(send_msg.header);
msg->msgh_bits = 0x80001513u;
msg->msgh_remote_port = configport;
msg->msgh_local_port = mig_get_reply_port();
msg->msgh_id = 20010;
// Request server
msg_return = mach_msg(msg, 3, 0x34u, 0x44u, msg->msgh_local_port, 0, 0);
if(msg_return)
{
if (msg_return - 0x10000002u >= 2 && msg_return != 0x10000010 )
{
mig_dealloc_reply_port(msg->msgh_local_port);
}
else
{
mig_put_reply_port(msg->msgh_local_port);
}
}
else if ( msg->msgh_id != 71 && msg->msgh_id == 20110 && msg->msgh_bits <= -1 )
{
if ((send_msg.flags & 0xFF000000) == 0x1000000)
{
CFDataRef deserializedData = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, send_msg.addr,send_msg.size0, kCFAllocatorNull);
CFPropertyListRef proplist = CFPropertyListCreateWithData(kCFAllocatorDefault, deserializedData, kCFPropertyListImmutable, NULL, NULL);
mig_dealloc_reply_port(msg->msgh_local_port);
mach_port_deallocate(mach_task_self(), bootstrapport);
mach_port_deallocate(mach_task_self(), configport);
mach_msg_destroy(msg);
NSDictionary *property_list = (__bridge NSDictionary*)proplist;
if(proplist)
CFRelease(proplist);
CFRelease(deserializedData);
CFRelease(extRepr);
return property_list;
}
}
mig_dealloc_reply_port(msg->msgh_local_port);
mach_port_deallocate(mach_task_self(), bootstrapport);
mach_port_deallocate(mach_task_self(), configport);
mach_msg_destroy(msg);
CFRelease(extRepr);
return nil;
}
The data we needed were located in the key @«Setup:/Network/Interface/en0/AirPort».
So we have implemented the part SystemConfiguration.framework on our own and got the data without jailbreaking and illegal use of libraries. The interesting thing is that there are more than 100 open MACH ports with various names in iOS 6. I guess it sets the stage for researches. Unfortunately, for the time being I cannot say, whether such code can be used in App Store, but it is worth trying anyway.
Thanks for your attention.
Links:
— MACH Kernel programming guide
— iOS Hackers handbook
— Mac OS X internals
Author: Kirill Ermakov [Twitter], Positive Research.
Available link for download
Subscribe to:
Posts (Atom)