Gtk# Window

Gtk window with widgets.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
using System;
using Gtk;
 
class WindowTester
{
   static void Main ()
   {
      Application.Init ();
      TreeStore store = new TreeStore (typeof (string), typeof (string));
 
      Window theWindow = new Window (”Transinux”);
      theWindow.SetDefaultSize (550, 400);
 
      VBox theBox = new VBox(false, 4);
 
      // Toolbar
      Toolbar theTb = new Toolbar();
      theTb.ToolbarStyle = ToolbarStyle.Both;
 
      // Add Button
      ToolButton tb = new ToolButton(”Add”);
      tb.Label = “Add”;
      tb.IconName = Stock.Add;
 
      // Remove Button
      ToolButton tb1 = new ToolButton(”Remove”);
      tb1.Label = “Remove”;
      tb1.IconName = Stock.Remove;
 
      theTb.Insert(tb, 0);
      theTb.Insert(tb1, -1);
 
      // Statusbar
      Statusbar theSb = new Statusbar();
      theSb.Push(1, “The Statusbar”);
 
      // TreeView
      TreeView theTree = new TreeView();
      theTree.Model = store;
 
      TreeViewColumn theColumn1 = new Gtk.TreeViewColumn ();
      theColumn1.Title = “Name”;
      theColumn1.MinWidth = 150;
 
      TreeViewColumn theColumn2 = new Gtk.TreeViewColumn ();
      theColumn2.Title = “Path”;
      theColumn2.MinWidth = 250;
 
      TreeViewColumn theColumn3 = new Gtk.TreeViewColumn ();
      theColumn3.Title = “Status”;
 
      theTree.AppendColumn(theColumn1);
      theTree.AppendColumn(theColumn2);
      theTree.AppendColumn(theColumn3);
      theTree.HeightRequest = 400;
 
      theBox.PackStart(theTb, false, false, 0);
      theBox.PackStart(theTree, false, false, 0);
      theBox.PackStart(theSb, false, false, 0);
 
      theWindow.Add(theBox);
      theWindow.ShowAll();
      Application.Run ();
   }
}

Sys_call_table 2.6.x

I’m working on a project based on a LKM which uses rootkit like features, for example to hide processes, ports, files and things like that, which requires hijacking various system calls. There are a couple of examples flying about on how to get the address of sys_call_table, like using loops_per_jiffy etc., but alot where out dated, or I personally couldn’t get them to work and show the correct address. However using a sprinkle of asm and a pinch of system call, then the magic happens.


uname -r
2.6.26-1-686

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
unsigned int *get_sys_call_table(void)
{
   int cnt;
   unsigned int sys_offset;
   char pattern[] = "\xff\x14\x85";
 
   struct
   {
      unsigned short limit;
      unsigned int base;
   } __attribute__ ((packed)) idtr;
 
   struct idt_gate
   {
      unsigned short off1;
      unsigned short sel;
      unsigned char none,flags;
      unsigned short off2;
   } __attribute__ ((packed)) *idt;
 
   asm("sidt %0" : "=m"(idtr));
   idt = (struct idt_gate *)( idtr.base + 0x80*8 );
   sys_offset = ((idt->off2) << 16) | (idt->off1);
 
   for(cnt = 0 ; cnt < 500 ; cnt++, sys_offset++)
   {
      if(!strncmp((char *)sys_offset , pattern , strlen(pattern)))
         return (unsigned int *)(*((unsigned int *)(sys_offset +strlen(pattern))));
   }
   return NULL;
}

[C++] Polymorphic Encryption

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
#include <sstream>
#include <vector>
 
class Polly
{
   public:
   Polly() { srand(::GetTickCount()); }
   ~Polly() { /* Deconstructor */ }
 
   std::string Polly::Encrypt(std::string szText)
   {
      std::string szTemp;
      std::vector<int> nArray;
      std::vector<int>::iterator itInt;
 
      for(std::string::size_type sz = szText.size(), i = 0; i < sz; i++)
      {
         int nKey = rand() % 0x7A + 0x44;
 
         nArray.push_back(szText[i] + nKey);
         nArray.push_back(nKey);
      }
 
      for(itInt = nArray.begin(); itInt != nArray.end(); itInt++)
      {
         szTemp.append(int2chr(*itInt));
      }
 
      return szTemp;
   }
 
   std::string Polly::Decrypt(std::string szText)
   {
      std::string szTemp;
      int *nStore = new int[szText.length()];
 
      for(std::string::size_type sz = szText.size(), i = 0; i < sz; i++)
      {
         nStore[i] = szText[i];
      }
 
      for(std::string::size_type sz = szText.size(), i = 0; i < sz; i += 2)
      {
         szTemp.append(int2chr(nStore[i] - nStore[i + 1]));
      }
 
      delete[] nStore;
      return szTemp;
   }
 
   private:
      std::string Polly::int2chr(int nNumber)
      {
         std::ostringstream ss;
         ss << static_cast<char>(nNumber);
 
         std::string szTmp = ss.str();
         ss.clear();
 
         return szTmp;
      }
};

WAH 1.0

Main Menu

Main Menu

I’ve had this in development since the blue moon, but have never found the time to finish it. I’ve done a massive overhaul this time, and started from scratch, which only took about five days to code and an extra one for testing. I’ve tried to test this application as best as I can, but looking at the source for so long has warped my mind. If you do find a bug, or would like to see summit added, please drop me a line.

Read the rest of this entry »

Updating Multiple ListView Boxes

I have a program running multiple ListView boxes. Each box is exactly the same, they all have the same number of columns and are using View.Details. Obviously I want different data in each ListView box, but the format is the same.

public void update_listview(ListView listview, string[] data)
{
   ListViewItem listViewItem1 = new ListViewItem();
   ListViewItem.ListViewSubItem listViewSubItem1 = new ListViewItem.ListViewSubItem();
   ListViewItem.ListViewSubItem listViewSubItem2 = new ListViewItem.ListViewSubItem();
 
   listViewItem1.Text = data[0];
   listViewSubItem1.Text = data[1];
   listViewSubItem2.Text = data[2];
 
   listViewItem1.SubItems.Add(listViewSubItem1);
   listViewItem1.SubItems.Add(listViewSubItem2);
   listview.Items.Add(listViewItem1);
}

Read the rest of this entry »