Thursday, April 27, 2017
Saturday, March 4, 2017
pyWall
A simple script for periodically changing windows desktop wallpaper written in Python 3.5
It took me 2 days to bring it to "completion".
The UI was very difficult to write, especially with multithreading.
The primary reason I chose python instead of say, C#, was the easy availability and ease of use of libraries such as Requests, BeautifulSoup and the like; and while the core functional part of the program was completed relatively quickly, actually polishing the program further, I found, was very tough in python.
Needless to say, there's a lot of stuff that could be improved on but I don't think I will be continuing this project with python any more. I found it very cumbersome to say the least.
Anyway, here is the UI of the program:
The actual script is available here
Installing Anaconda with Python >= 3.5 is recommended since that's what it was written under.
It took me 2 days to bring it to "completion".
The UI was very difficult to write, especially with multithreading.
The primary reason I chose python instead of say, C#, was the easy availability and ease of use of libraries such as Requests, BeautifulSoup and the like; and while the core functional part of the program was completed relatively quickly, actually polishing the program further, I found, was very tough in python.
Needless to say, there's a lot of stuff that could be improved on but I don't think I will be continuing this project with python any more. I found it very cumbersome to say the least.
Anyway, here is the UI of the program:
Installing Anaconda with Python >= 3.5 is recommended since that's what it was written under.
Saturday, December 31, 2016
Simple Single Layer Perceptron in VBA
I've been tinkering with machine learning and AI for some days now. I've come across TensorFlow, what seems to be the standard library to use for machine learning these days. But to use it and to understand what it was actually doing underneath the high level APIs it provides, I searched for the most basic of machine learning codes on the internet.
I found a great C source for a single layer perceptron(a simple linear classifier based on artificial neural network) here by Richard Knop. I studied it and thought it was simple enough to be implemented in Visual Basic 6. And because it would be useful to represent training and test data in a graphical form, I thought Excel VBA would be better.
So, here it is.
What's being done in the excel file is this: 20 $(x,y)$ data that fall in the $(-,+)$ quadrant of the XY plane are generated in random with the constraint $x \in [-5,0]$ and $y \in [0,10]$ and 20 that lie in the $(+,-)$ quadrant with the constraint $x \in [0,5]$ and $y \in [-10,0]$. These fill the first two columns X and Y of the worksheet. The next column is the $y$ data from the line $y=x$ for checking the prediction validity later whether a given $(x,y)$ falls above or below this line, which we know beforehand and with certainty that divides the two classes of data linearly. So, the fourth column Bool represents what the prediction should be i.e. it is a column of the boolean expression : column 2 $>$ column 3, for use as a benchmark and more importantly for use as the training data for the algorithm. The next column Prediction is the actual output of the perceptron after being fed all the 40 training datasets of $(col.1,col.2,col.4)$. The remaining two columns are only auxiliary and show a measure of the overall accuracy of the predictions it made on the same training datasets used as test.
And, since the activation function used in this single layer perceptron is just a unit step/threshold function $$t(p(x,y)) \text{ where,}\\ p(x,y)=w_1x+w_2y+w_3$$ that returns 1 for any non-negative input i.e. $>=0$, the function $p(x,y)$ is essentially the equation of the line that, the algorithm guesses, best separates the two classes of data.
I found a great C source for a single layer perceptron(a simple linear classifier based on artificial neural network) here by Richard Knop. I studied it and thought it was simple enough to be implemented in Visual Basic 6. And because it would be useful to represent training and test data in a graphical form, I thought Excel VBA would be better.
So, here it is.
What's being done in the excel file is this: 20 $(x,y)$ data that fall in the $(-,+)$ quadrant of the XY plane are generated in random with the constraint $x \in [-5,0]$ and $y \in [0,10]$ and 20 that lie in the $(+,-)$ quadrant with the constraint $x \in [0,5]$ and $y \in [-10,0]$. These fill the first two columns X and Y of the worksheet. The next column is the $y$ data from the line $y=x$ for checking the prediction validity later whether a given $(x,y)$ falls above or below this line, which we know beforehand and with certainty that divides the two classes of data linearly. So, the fourth column Bool represents what the prediction should be i.e. it is a column of the boolean expression : column 2 $>$ column 3, for use as a benchmark and more importantly for use as the training data for the algorithm. The next column Prediction is the actual output of the perceptron after being fed all the 40 training datasets of $(col.1,col.2,col.4)$. The remaining two columns are only auxiliary and show a measure of the overall accuracy of the predictions it made on the same training datasets used as test.
And, since the activation function used in this single layer perceptron is just a unit step/threshold function $$t(p(x,y)) \text{ where,}\\ p(x,y)=w_1x+w_2y+w_3$$ that returns 1 for any non-negative input i.e. $>=0$, the function $p(x,y)$ is essentially the equation of the line that, the algorithm guesses, best separates the two classes of data.
Wednesday, February 10, 2016
Plane Truss solver
This is a simple program to solve determinate plane trusses with point loading at pins.
There is a lot of room for improvement: the interface is basic, more features could be added, but it works.
Download here
There is a lot of room for improvement: the interface is basic, more features could be added, but it works.
Sunday, January 10, 2016
OpenProcess API hook in MSVC++(C)
This is a C program I've written in Visual Studio 2015 to hook OpenProcess API calls to prevent a target application from obtaining a handle to a ProcessId of our choice which can render other APIs dependent on process handles useless(such as TerminateProcess) when acting on the ProcessId.
I was trying to do inline assembly injection in Delphi 7 to this very effect but the disassembler viewer, and the IDE in general was not very smooth. So I gave Microsoft Visual C++ a go recalling I had a copy of the latest Visual Studio 2015. The IDE was just amazingly productive. So, working on and off, with a lot of debugging and disassembling and hours of scouring the internet for answers to questions that arose along the way, I finally managed to write a functioning program.
The code is, I think, fairly well commented. So it should be easy enough to understand:
I was trying to do inline assembly injection in Delphi 7 to this very effect but the disassembler viewer, and the IDE in general was not very smooth. So I gave Microsoft Visual C++ a go recalling I had a copy of the latest Visual Studio 2015. The IDE was just amazingly productive. So, working on and off, with a lot of debugging and disassembling and hours of scouring the internet for answers to questions that arose along the way, I finally managed to write a functioning program.
The code is, I think, fairly well commented. So it should be easy enough to understand:
//the characterset property is set to "Not Set" which defaults everything to ANSI(non-unicode)
//disable optimization under C/C++=>Optimization from Project=>Project Properties. otherwise a lot of variables
//are "optimized away" when debugging; you can't see their values from the IDE while debugging.
//also, optimize for small code under C/C++=>Optimization. otherwise, the compiler will append
//a ton of INT 3 instructions to your assembly functions.
//so, make a custom optimization profile with the above criteria met
#include "stdafx.h"
#include <conio.h>
#include <Windows.h>
void jmp();
void trampoline();
void fake();
int main()
{
/*This part isn't very relevant to the above code but is still informative and is something I wrote when I was trying a simple mov and jmp combination.
//Process Killer program
repeat:
DWORD pid = 0;
HANDLE hProcess = 0;
printf("Enter PID to terminate ");
scanf_s("%d", &pid);
hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
if (hProcess == 0)
{
printf("Cannot get a handle to the PID!\n");
printf("Error : %d\n\n", GetLastError());
goto repeat;
}
if (!TerminateProcess(hProcess, 0) )
{
printf("Cannot terminate PID : %d\n", pid);
printf("Error : %d\n\n", GetLastError());
goto repeat;
}
else
{
printf("Killed!\n\n");
}
goto repeat;
*/
DWORD protectpid;
DWORD hookpid;//process to inject to
printf("Enter the PID to inject to : ");
scanf_s("%d", &hookpid);
printf("Enter the PID to protect : ");
scanf_s("%d", &protectpid);
LPVOID OPPt = GetProcAddress(GetModuleHandle("kernel32.dll"), "OpenProcess");
/****************Read the raw jmp and trampoline functions from own memory************/
HANDLE myhProcess = OpenProcess(PROCESS_ALL_ACCESS, false, GetCurrentProcessId());
SIZE_T size = SIZE_T((long)(&fake) - (long)(&trampoline));//size of trampoline
SIZE_T size2 = (SIZE_T)(((long)(&trampoline) - (long)(&jmp)));//size of jmp
SIZE_T readbytes;
char *jmpBytes = (char *)calloc((size_t)size2,sizeof(char));
ReadProcessMemory(myhProcess, &jmp, jmpBytes, size2, &readbytes);//read the jmp function into jmpBytes
char *trampolineBytes = (char *)calloc((size_t)size, sizeof(char));
ReadProcessMemory(myhProcess, &trampoline, trampolineBytes, size, &readbytes);//read the trampoline function into trampolineBytes
/*************************************************************************************/
/************Allocate space in the remote process for trampoline function************/
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, hookpid);
LPVOID hAddress = VirtualAllocEx(hProcess, (LPVOID)0, size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);//address of trampoline
/************************************************************************************/
/**********************Fix the jmp address and the pid to filter********************/
memcpy(&jmpBytes[1], &hAddress,(size_t) 4);
memcpy(&trampolineBytes[5], &protectpid, (size_t)4);
/***********************************************************************************/
CloseHandle(myhProcess);
/********************Shellcode read!*************************************/
SIZE_T writtenbytes;
if (WriteProcessMemory(hProcess, hAddress, trampolineBytes, size, &writtenbytes))//write the fixed trampoline
{
if (WriteProcessMemory(hProcess, OPPt, jmpBytes, size2, &writtenbytes))//write the fixed jmp
{
//jmp was written
MessageBox(0, "Patched!", ":D", 0);
}
}
DWORD laterror = GetLastError();
return 0;
}
__declspec(naked) void jmp()
/* the __declspec(naked) suppresses the extra opcodes the compiler would automatically add
before and after a function which would be bad for our to-be-injected asm block */
{
__asm
{
mov eax, 0x93250000//trampoline address to be patched
call trick
trick:
pop esi//esi=address of this statement
jmp eax
/*
Must be careful not to do a partial overwrite:
The normal opcodes before overwriting the OpenProcess code in kernel32.dll are:
75891952 > 8BFF MOV EDI,EDI ; ucrtbase.60682104
75891954 55 PUSH EBP
75891955 8BEC MOV EBP,ESP
75891957 5D POP EBP
75891958 EB 05 JMP SHORT <JMP.&API-MS-Win-Core-Synch-L1-1-0.OpenProcess> ; relative jump to the JMP below
7589195A 90 NOP
7589195B 90 NOP
7589195C 90 NOP
7589195D 90 NOP
7589195E 90 NOP
7589195F -FF25 54098975 JMP DWORD PTR DS:[<&API-MS-Win-Core-Synch-L1-1-0.OpenProcess>] ; KERNELBA.OpenProcess
Say we have only a mov and a jmp code. It ends up overwriting the above opcodes starting from the
first byte 8B. The corresponding opcodes are:
00C7118C B8 00 00 25 93 mov eax,93250000h
00C71191 FF E0 jmp eax
Clearly, the size of opcodes to be written is 7(one byte each for B8, 00, 00, 25, 93, FF, E0)
After being overwritten, the modified OpenProcess code in kernel32.dll looks like:
75891952 > B8 00002593 MOV EAX,93250000
75891957 FFE0 JMP EAX
75891959 05 90909090 ADD EAX,90909090
7589195E 90 NOP
7589195F -FF25 54098975 JMP DWORD PTR DS:[<&API-MS-Win-Core-Synch-L1-1-0.OpenProcess>] ; KERNELBA.OpenProcess
Clearly, the original bytes 8B, FF, 55, 8B, EC, 5D, EB, a total of 7 bytes have been overwritten
as expected by our mov and jmp. But the remaining 05, 90, 90... bytes give a different opcode
altogether, the ADD EAX,90909090 thing, which is unwanted. So, the 05 byte is replaced with an extra
opcode, a simple nop i.e. 90 so that the modified version looks like:
75891952 > B8 00002593 MOV EAX,93250000
75891957 FFE0 JMP EAX
75891959 90 NOP
7589195A 90 NOP
7589195B 90 NOP
7589195C 90 NOP
7589195D 90 NOP
7589195E 90 NOP
7589195F -FF25 54098975 JMP DWORD PTR DS:[<&API-MS-Win-Core-Synch-L1-1-0.OpenProcess>] ; KERNELBA.OpenProcess
which is what we would want if we needed only a mov and jmp injected.
*/
/*
Now what our code does:
Original contents inside the OpenProcess procedure in the target process' kernel32:
76571952 > 8BFF MOV EDI,EDI ; ucrtbase.74772104
76571954 55 PUSH EBP
76571955 8BEC MOV EBP,ESP
76571957 5D POP EBP
76571958 EB 05 JMP SHORT <JMP.&API-MS-Win-Core-Synch-L1>
7657195A 90 NOP
7657195B 90 NOP
7657195C 90 NOP
7657195D 90 NOP
7657195E 90 NOP
7657195F -FF25 54095776 JMP DWORD PTR DS:[<&API-MS-Win-Core-Sync>; KERNELBA.OpenProcess
The disassembly of our jmp() code:
00B91218 B8 00 00 25 93 mov eax,93250000h
00B9121D E8 00 00 00 00 call 0B91222h
00B91222 5E pop esi
00B91223 FF E0 jmp eax
The OpenProcess routine after injection:
76571952 > B8 00002593 MOV EAX,93250000
76571957 E8 00000000 CALL kernel32.7657195C
7657195C 5E POP ESI
7657195D FFE0 JMP EAX
7657195F -FF25 54095776 JMP DWORD PTR DS:[<&API-MS-Win-Core-Sync>; KERNELBA.OpenProcess
*/
}
}
__declspec(naked) void trampoline()
{
__asm
{
pop edx
pop ecx
pop ebx
pop eax
cmp eax, 14902//pid to protect
jne skipper
xor eax, eax
skipper:
push eax
push ebx
push ecx
push edx
add esi,3//coz instruction at esi is followed by a jmp which is 2 bytes
jmp esi
}
}
__declspec(naked) void fake()
{
__asm
{
}
}
Sunday, December 27, 2015
MsgBoxTimeOut function module
'//MsgBoxTimeOut module
'//Author : s0ft
'//Contact : aayush.babu@yahoo.com
'//Blog : c0dew0rth.blogspot.com
'//Usage Example : MsgBoxTimeOut "Sample msgbox content",vbOkOnly,"Title",5000,500 'timeout of 5 seconds with initial delay of 0.5 seconds
'//Compile type : P-Code. A lot of problems with CreateThread API in Native mode
'//Date/Time : 2015/12/27 - 10:12 PM
Option Explicit
Private Declare Function CreateThread Lib "kernel32.dll" (lpThreadAttributes As Any, ByVal dwStackSize As Long, ByVal lpStartAddress As Long, ByRef lpParameter As Any, ByVal dwCreationFlags As Long, ByRef lpThreadId As Long) As Long
Private Declare Function MessageBox Lib "user32" Alias "MessageBoxA" (ByVal hwnd As Long, ByVal lpText As String, ByVal lpCaption As String, ByVal wType As Long) As Long
Private Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)
Private Declare Function TerminateThread Lib "kernel32.dll" (ByVal hThread As Long, ByVal dwExitCode As Long) As Long
Dim strContent_ As String
Dim boxType_ As Long
Dim strTitle_ As String
Dim TimeOut_ As Long
Dim initialDelay_ As Long
Public Sub MsgBoxTimeOut(ByVal strContent As String, ByVal boxType As Long, ByVal strTitle As String, ByVal TimeOut As Long, ByVal initialDelay As Long)
strContent_ = strContent
boxType_ = boxType
strTitle_ = strTitle
TimeOut_ = TimeOut
initialDelay_ = initialDelay
Dim threadID As Long
CreateThread ByVal 0&, ByVal 0&, AddressOf step1, ByVal 0&, ByVal 0&, threadID
End Sub
Private Sub step1()
Dim threadID As Long
Dim hThread As Long
Sleep initialDelay_ '//the initial delay must be here, not inside the msgbox thread. that would be silly
hThread = CreateThread(ByVal 0&, ByVal 0&, AddressOf step2, ByVal 0&, ByVal 0&, threadID)
Sleep TimeOut_
TerminateThread hThread, 0
End Sub
Private Sub step2()
MessageBox 0, strContent_, strTitle_, boxType_
End Sub
Saturday, November 28, 2015
PokemonShowdown Helper
I'm back. It's been a long time, over a year. Lot of things have happened, lot have changed in RL. But a blog has to go on.
Today, browsing through my desktop HD, I found this project that I remember I had undertaken some months back, maybe a month after the quake, so that's May. I sometimes liked to play pokemonshowdown, still do. It was fun, very fun, until it wasn't. I used to be so interested for a while and when I had got enough, I used to stop. And this, I created when I was head over heels into it. Some point down the road, I lost interest and left it. And today, there it was, lying there on my desktop. I tested to see how well and if it worked. And it did, exactly as I remember it had.
About what it is all about, it parses through your ongoing battle and displays information that may be useful to you as a player, in real time(obviously). The pokemons involved, their attacks and their speeds are what are shown. Pressing the F9 key toggles display of some basic info regarding the currently active pokemons(their base stats) loaded from a txt file. F8 toggles the main window.
Optionally, it allows the pokemons and their attacks encountered in battles to be recorded or "learn"t in a file. This I probably added to make the recorded data more usable to players in future versions. Currently, this "knowledge vault" file serves no purpose within the program.
Oh, one thing, it only works with internet explorer.
Anyway, here it is.
Today, browsing through my desktop HD, I found this project that I remember I had undertaken some months back, maybe a month after the quake, so that's May. I sometimes liked to play pokemonshowdown, still do. It was fun, very fun, until it wasn't. I used to be so interested for a while and when I had got enough, I used to stop. And this, I created when I was head over heels into it. Some point down the road, I lost interest and left it. And today, there it was, lying there on my desktop. I tested to see how well and if it worked. And it did, exactly as I remember it had.
About what it is all about, it parses through your ongoing battle and displays information that may be useful to you as a player, in real time(obviously). The pokemons involved, their attacks and their speeds are what are shown. Pressing the F9 key toggles display of some basic info regarding the currently active pokemons(their base stats) loaded from a txt file. F8 toggles the main window.
Optionally, it allows the pokemons and their attacks encountered in battles to be recorded or "learn"t in a file. This I probably added to make the recorded data more usable to players in future versions. Currently, this "knowledge vault" file serves no purpose within the program.
Oh, one thing, it only works with internet explorer.
Anyway, here it is.
Subscribe to:
Posts (Atom)