Midnight blogging : News

Back online

yiangos — Tue, 07 Sep 2010 15:13:46 +0300

My subscription with lunarpages expired sometime in August. Since we're practically broke (hence the LONG pause in the blog, no free time due to working overtime and double jobs to make ends meet), I decided to shut down my hosting with them, and move the site to a friend's and partner's server.

We'll see how this goes.

Glad to be of help.

yiangos — Mon, 28 Dec 2009 23:26:30 +0200

Remember this guy? Well, I just finished helping him make his website look spiffy. Anyone reading this blog, go to http://www.henningludvigsen.com and show him some love. He's a REALLY talented artist!

Querystring obfuscation. my take.

yiangos — Thu, 27 Aug 2009 02:24:34 +0300

At one point, it was required to obfuscate the data in the querystring. Hiding it (i.e. using different methods to pass data to a page) was not an option, as the pages needed to be able to stand alone (e.g. give a fully functional link for an offer banner). So I built an obfuscation scheme.
My first attempt was to use a gzip stream on the entire querystring and base64-encode the resulting binary data. However, I found out through trial and error that this method has a lower boundary. The resulting string is never less than 200 characters long. The queristrings I was trying to obfuscate were typically 40-50 characters long (including parameter names, equal signs and ampersands). Moreover, the base64 encoding introduced charaxters that could never appear in a querystring value (equal signs). So I dumped that idea, as it seemed too much of an overkill to obfuscate a 40 character string and come up with a 200 character string as a result. I had to find a different algorithm.

The algorithm I came up with, is quite simple and straight forward, yet to my eyes beautiful in its simplicity.

First of all, I noted that most (if not all) data passed via GET are either strings or numbers (there's a caveat here, which I'll cover at the end).

Next there was a decision to make, i.e. whether to include parameter names in the final string or not. I opted not to include them, and rather use some application wide structure (e.g. cache) to store the parameter names. Since the obfuscation/parsing of the querystring would occur within the same class, it would be easy to maintain the correspondence between values in the querystring and names in the list structure kept at application level.

So, having made that decision, I started designing the algorithm.

To obfuscate, we distinguish between numbers and strings.
If a parameter value is a number, then convert the value to hex.
If the parameter value is a string, then convert it to a byte array, then convert each byte to its hex representation (2-digit).
Prepend the now obfuscated value with a letter (other than a-f which are used in hex) to tell whether the value that follows is a number or a string, e.g. use U for numbers and L for strings.
Finally, concatenate all values (with their distinguishing letter) using a third letter as a delimiter (e.g. M) and using the order imposed by the list that contains the parameter names.

To parse an obfuscated string, we reverse the steps:
First we split on the delimiter letter.
For each value, we check the first letter. If it signifies number, then convert the value directly from hex to decimal, and you're done. If it signifies string, then convert each pair of characters to a number (essentially a byte), and thus populate a byte array. Finally encode the bytearray using the encoding used to create the bytearray during obfuscation and you're done.
Each value is finally assigned to its corresponding parameter name.

code to come...

Towards Steganography III: a class that manipulates RGB colors

yiangos — Wed, 22 Jul 2009 01:14:00 +0300

In my two previous posts (here and here), I showed how to create two of the components needed for my steganography project. This post is about the part where we manipulate the least significant bits of the RGB components of a pixel.

This has two parts: A "getter" part, where we get the values of the least significant bits, and a "setter" part, where we change these bits so that they represent a particular number.

Each color component is actually a byte. So, getting the least significant bit of the R,G or B component of a pixel's color, is the same as getting the least significant bit of a byte. This is quite easy as an algorithm: simply grab the byte, and bitwise AND it with 1. It's pretty easy to see that a bitwise AND between 1 and any (positive) number results in 1 (if the number is odd) or 0 (if the number is even). In VB.NET, the result of a bitwise operation between two integers is an integer of the same type (in our case, a byte), so we need to further cast the result (1 or 0) to boolean. The function is as follows:

    Protected Shared Function GetComponentLastBit(ByVal num As Byte) As Boolean
        Return CBool(num And 1)
    End Function

That's ok if we have the color component. However, we're more likely to have just the pixel's color. The following function comes in handy:

    Protected Shared Function GetColorComponent(ByVal pixelColor As System.Drawing.Color, ByVal colorComponent As Integer) As Byte
        Dim returnValue As Byte = 0
        Select Case colorComponent
            Case 0
                returnValue = pixelColor.R
            Case 1
                returnValue = pixelColor.G
            Case 2
                returnValue = pixelColor.B
        End Select
        Return returnValue
    End Function

This simply gets a color, and returns one of its three components, according to the second parameter. For that parameter, 0 stands for Red, 1 stands for Green and 2 stands for Blue.

Putting things together, we finally get this function:

    Public Shared Function GetNumFromColor(ByVal pixelColor As System.Drawing.Color) As Byte
        Dim returnValue As Byte = 0
        For i As Integer = 0 To 2
            returnValue += CByte(GetComponentLastBit(GetColorComponent(pixelColor, i)) And 1) << i
        Next
        Return returnValue
    End Function

A lot of things take place here. First of all, we get a color as a parameter. From the previous function, we've already mapped 0 to Red, 1 to Green and 2 to Blue. Therefore, we iterate over these three values, and so we're able to get the last bit of each color component by means of the GetComponentLastBit() method. This information is returned as a boolean. We cast the boolean as byte (a True value corresponds to 11111111, or 256, while a false value corresponds to 0) and grab its least significant bit (the "And 1" part). So now we have either 1 (for true) or 0 (for false). We need to place this value at the corresponding position of a 3-bit word. Since we've already chosen implicitly an order (0-Red, 1-Green, 2-Blue), we follow that for consistency, and assign the red bit to the least significant bit of the 3-bit word, the green bit to the middle one and the blue bit to the most significant bit od the 3-bit word. That part is taken care of by the left shift (<<). Adding the three values, we get a 3-bit word. In other words, we get a number from 0 to 7 inclusive.

Apparently, this function will also come in handy in the decryption process.

This sums up the "getter" part.

The "setter" part, has three equivalent functions. First, a function that toggles the last bit of a specific color component (i.e. of a byte):

    Protected Shared Function ToggleLastBit(ByVal num As Byte) As Byte
        If GetComponentLastBit(num) Then
            Return num - 1
        Else
            Return num + 1
        End If
    End Function

Not much to note here. If the least significant bit (LSB) is 1, then the result of a toggle would be that the LSB becomes 0 and all other bits remain as they were. Changing the LSB from 1 to 0 without any other changes is the same as subtracting 1 from the original number. If the LSB is 0, then changing it to 1 without any other changes is the same as adding 1 to the original number. Since the LSB was 0, there will be no carry, so no other bit is affected and therefore an overflow can't occur either.

The previous function blindly toggles the LSB of any byte it receives as its parameter. To toggle on demand, we use the following function

    Protected Shared Function SetColorComponent(ByVal num As Byte, ByVal setFlag As Boolean) As Byte
        If setFlag Then
            Return ToggleLastBit(num)
        Else
            Return num
        End If
    End Function

All this function does, is toggle the LSB if the flag (the second argument) is True. Now, what we need, is a way to set or unset this flag.

The flag we just mentioned, when set, states that "this particular component doesn't have its last bit set to the desired value, and needs to be toggled". In other words, this flag should be set when the corresponding bits of the 3-bit word we get from the "getter" part of the original color are different to the 3-bit word we need to store. This is easy to know. If we use XOR between the 3-bit word of the original and the 3-bit word we need to store, then the bits of the result that are 1 are the ones that correspond to the components that need their LSB toggled. So, putting it all together:

    Public Shared Function SetNumToColor(ByVal pixelColor As System.Drawing.Color, ByVal number As Byte) As System.Drawing.Color
        Dim colorNumber As Byte = GetNumFromColor(pixelColor)
        If number < 8 And number >= 0 Then
            'Find which components need toggling
            colorNumber = colorNumber Xor number
            'Colornumber is now a number from 0 to 7, where the bits equal to 1 
            'represent the color components that need to toggle their last bit, with red in the
            'least significant bit and blue in the most significant bit
            'To get the Red bit, we rightshift 0 times and then bitwise AND this number with 1.
            'To get the Green bit, we rightshift 1 times and then bitwise AND this number with 1.
            'To get the Blue bit, we rightshift 2 times and then bitwise AND this number with 1.
            Return System.Drawing.Color.FromArgb( _
                    pixelColor.A, _
                    SetColorComponent(pixelColor.R, CBool(colorNumber >> 0 And 1)), _
                    SetColorComponent(pixelColor.G, CBool(colorNumber >> 1 And 1)), _
                    SetColorComponent(pixelColor.B, CBool(colorNumber >> 2 And 1)) _
                    )
        Else
            Return pixelColor
        End If
    End Function

One thing to note here, is that in the resulting color, we use the original alpha channel unchanged. That means that we can use semi-transparent images without really any issues. The transparency will carry through unaffected.

This is the end of the "setter" part. The attached zip contains these functions as parts of a class in a separate project.

Towards Steganography II: a pseudo-random number generator

yiangos — Tue, 07 Jul 2009 02:19:27 +0300

I've shown the inner workings of the first essential component for my steganography project in a previous post here. The second essential part is a pseudo-random number generator (PRNG) that's seedable.
I could use the .NET framework built-in PRNG, but since I have no control over it, I can never be certain that Microsoft will always keep the same algorithm for its PRNG. Now, seeing how crucial the PRNG is in the scheme, I believe the way to go is to implement a custom one.

I know that PRNG's are supposed to be split into two categories, the ones that are safe to use in cryptography and the ones that aren't. Also, by searching, I've found that there is a very good PRNG that's safe for cryptography; the Yarrow PRNG. However, I can't really make out the C/C++ implementation. The ISAAC PRNG, which seemed like a nice equivalent, I was also unable to use for some reason. My attempts to use a cryptographically safe PRNG stopped there.

In the end, I wrote down a vb.net implementation of the central PRNG I found here. It is definitely a very "weak" PRNG, in that it is not safe for cryptography: it is a well known algorithhm, that produces a number sequence that's relatively easy to predict. Apparently, I'll factor this out in a separate library, so that if I manage to get a different PRNG, I can simply replace the dll - or have them both working side -by-side and choose which I want to use each time.

The PRNG lies within a class named "Shuffler". This class has two constructors. One that seeds the PRNG with a number generated using the current datetime, and one that takes a seed as argument. The class has only one public method:

Public Function Shuffle(ByVal rangemax As Long, ByVal totalnum As Long) As Long()

This method produces an array with totalnum different integers between zero and rangemax.

The zip contains the full solution for this part of the project.

Towards steganography I: a Brainfuck code generator and interpreter in VB.Net

yiangos — Mon, 06 Jul 2009 14:52:57 +0300

In order to develop the steganography project I described earlier, I'll need a class that can convert any given text to a Brainfuck program, and also to "run" such a program to reproduce the original text. It turns out, this is not that difficult.
The easier part is the interpreter. A Brainfuck program source code can have only 8 different characters, each of which stands for a different command. Also, Brainfuck assumes that there is a memory organized in 1 byte slots, an input stream and an output stream. Finally, there needs to be a command pointer, that points to the command being executed.

The output stream will be replaced by a string.

Protected _outStream As String

I won't deal with the input stream here, as the interpreter I need will only be used on programs that print "hard coded" strings.

The 1-byte memory slots will be simulated by an arraylist of integers. A 64-bit integer variable will play the role of the pointer, and another 64-bit integer will play the role of the command pointer.

 Protected _mem As New ArrayList
 Protected _memptr As Long
 Protected _progptr As Long

The increase and decrease commands amount to acting upon a specific item in the arrayList of integers.

_mem(_memptr) = CLng(_mem(_memptr)) + 1
 _progptr += 1
'...Decrease value
_mem(_memptr) = CLng(_mem(_memptr)) - 1
_progptr += 1

The "move pointer" commands amount to increasing or decreasing the pointer variable.

 _memptr += 1
If _mem.Count = _memptr Then
    _mem.Add(0)
End If
_progptr += 1
'...decrease pointer
_memptr -= 1
_progptr += 1

The print command amounts to adding another character to the end of the string The character will be the one with charcter code equal to the value of the element in the "memory" arraylist pointed by the "pointer" variable.

 
_outStream &= ChrW(_mem(_memptr))
_progptr += 1

The two flow control commands are somewhat trickier. I need to implement a bracket matching subroutine, and I also need code to execute whenever the command pointer hits one of these, as well as keep track of all left brackets I've passed through. So here goes:

The bracket matching subroutine will be run whenever the command pointer hits a left bracket, and its job will be to find the corresponding right bracket. To that end, we need to keep track of opening and closing brackets. So, we need a counter for counting currently open brackets. This will be an integer variable initialized at 1 (we already have an oen bracket, the one that made the original call to the subroutine). The subroutine will then scan the program code, starting at the command pointer position, increase its counter whenever it encounters a left bracket, and decrease its counter whenever it encounters a right bracket. When the counter reaches 0, that's where the initial left bracket has its matching right bracket. The subroutine should return the position of that right bracket.

Protected Function findMatchingBracket(ByVal CodeStr As String, ByVal currentPosition As Long) As Long
    Dim openBrackets = 1
    While openBrackets > 0
        currentPosition += 1
        If CodeStr(currentPosition) = "[" Then
            openBrackets += 1
        ElseIf CodeStr(currentPosition) = "]" Then
            openBrackets -= 1
        End If
    End While
    Return currentPosition
End Function

To keep track of all the left brackets, all I need is a stack.

Protected LoopStack As New Stack(Of Long)

So, when the command pointer encounters a left bracket, the program should first of all, push its position on top of the stack. Then it will check the value at the memory slot pointed by the memory pointer. If zero, call the aforementioned subroutine, otherwise, simply move along.

LoopStack.Push(_progptr)
If _mem(_memptr) <> 0 Then
    _progptr += 1
Else
    _progptr = findMatchingBracket(CodeStr, _progptr)
End If

When the command pointer encounters a right bracket, the program should first pop a value from the stack. Since we're talking about bracket matching, the position popped will undoubtedyt be the position of its matching left bracket. Then check the value at the memory slot pointed by the memory pointer. If nonzero, move the command pointer to the position popped. Otherwise, simply move along.

Dim tempptr As Long = LoopStack.Pop()
If _mem(_memptr) <> 0 Then
    _progptr = tempptr
Else
    _progptr += 1
End If

I include checking for an input command, but this will be a no-op. The interpreter will ignore it and move along.

 'Implement user input
_progptr += 1

Also, if the character encountered is not one of these 8, the interpreter will simply move along without doing anything.

_progptr += 1

Here's the entire interpreter function:

        Public Function EvalBF(ByVal CodeStr As String) As String
            Dim token As Char
            _memptr = 0
            _progptr = 0
            _mem.Add(0)
            _outStream = ""
            While _progptr < CodeStr.Length
                token = CodeStr(_progptr)
                Select Case token
                    Case ">"
                        _memptr += 1
                        If _mem.Count = _memptr Then
                            _mem.Add(0)
                        End If
                        _progptr += 1
                    Case "<"
                        _memptr -= 1
                        _progptr += 1
                    Case "+"
                        _mem(_memptr) = CLng(_mem(_memptr)) + 1
                        _progptr += 1
                    Case "-"
                        _mem(_memptr) = CLng(_mem(_memptr)) - 1
                        _progptr += 1
                    Case "."
                        _outStream &= ChrW(_mem(_memptr))
                        _progptr += 1
                    Case ","
                        'Implement user input
                        _progptr += 1
                    Case "["
                        LoopStack.Push(_progptr)
                        If _mem(_memptr) <> 0 Then
                            _progptr += 1
                        Else
                            _progptr = findMatchingBracket(CodeStr, _progptr)
                        End If
                    Case "]"
                        Dim tempptr As Long = LoopStack.Pop()
                        If _mem(_memptr) <> 0 Then
                            _progptr = tempptr
                        Else
                            _progptr += 1
                        End If
                    Case Else
                        _progptr += 1
                End Select
            End While
            Return _outStream
        End Function

The code generator requires a bit more thought. As there is more than one way to write a program in Brainfuck that prints a string, we need to have a consistent way of finding the shortest (or an adequately short) source code. It seems that one easy way of writing a program like the one we want (that simply prints a hard-coded message) is to prepopulate some slots with some values, and then increase or decrease the slot with value that's closest to the character code we want to print. Then print the character and start looking for the closest slot to the next letter, and so on.

Apparently, the number of prepopulated slots will have a dramatic effect on the length of the code. Oh, what the heck, let's waste some cpu cycles and memory, and generate programs for the same output string, using up to 32 initial slots, and choose the one with the shortest code.

So, first of all, we need a function that outputs the same characted a specified number of times. If you've seen a Brainfuck program, you'll know that there are lots of "+", "-", ">" and "<" sequences, so this helper function will come in quite handy:

Protected Function strTimes(ByVal str As String, ByVal times As Long) As String
    Dim endstr As String = ""
    For i As Integer = 0 To times - 1
        endstr += str
    Next
    Return endstr
End Function

The above function will be used once we know which slot to alter, and how much to alter it. So, we need a function that finds which slot is the closest to the value we need to store:

Protected Function findClosestBin(ByVal val As Integer, ByVal bins() As Integer, ByVal currbin As Integer)
    Dim minBin As Integer = 0
    For b As Integer = 1 To bins.Length - 1
        If Math.Abs(val - bins(b)) < Math.Abs(val - bins(minBin)) Then
            minBin = b
        End If
    Next
    If Math.Abs(val - bins(minBin)) > Math.Abs(val - bins(currbin)) Then
        Return currbin
    End If
    Return minBin
End Function

A few things to note here:

val is the integer value we wish to store.
bins() is the array that holds the slots we're using.
currbin is the slot currently pointed at by the pointer.

So what this function essentially does, is pretty simple: it iterates over all slots (the bins() array) and checks to see which slot is the closest (either higher or lower) to the desired value (val). It then returns that slot's position.

Next thing we need, is a way to know ehether we need to increase or decrease the value at the slot with the closest value to the desired:

Protected Function printDifference(ByVal diff As Integer, ByVal poschar As String, ByVal negchar As String) As String
    Dim str = ""
    Dim b As Integer = 0
    While b < Math.Abs(diff)
        If diff > 0 Then
            str &= poschar
        Else
            str &= negchar
        End If
        b += 1
    End While
    Return str
End Function

Indeed, this function returns the increase operator "+" if the value at the slot is lower than the desired, and the decrease operator "-" if the value at the slot is higher.

Finally, we need a helper function that prepopulates a specified number of slots. What we'll do, is use populate the first of the slots with a high enough value, and then fill the next ones with increasing values. To this end, we'll use a loop on the value of the first slot, and add an increasing amount to each of the other slots, while decreasing the value of the first one. At the end, we restore its original value:

Protected Function writeBins(ByVal numBins As Integer, ByVal diff As Integer) As String
    Dim str = strTimes("+", diff) + "["
    For i As Integer = 1 To numBins - 1
        str &= ">" + strTimes("+", i + 1)
    Next
    str &= strTimes("<", numBins - 1) + "-]"
    str &= strTimes("+", diff)
    Return str
End Function

We now have all we need, except for the optimal number of slots to prepopulate. As I said, we'll find that by brute force.

We start by creating a function that generates the Brainfuck program we need, using a specific number of slots to prepopulate (this number being passed as argument):

Protected Function Dumbtext2BF(ByVal textstr As String, ByVal numBins As Short)
    If numBins <= 0 Then
        Throw New Exception("error: too few bins")
    End If
    Dim bins(numBins - 1) As Integer
    Dim diff As Integer = Math.Floor(127 / numBins)
    For i As Integer = 0 To numBins - 1
        bins(i) = (i + 1) * diff
    Next
    Dim codestr As String = writeBins(numBins, diff)
    Dim counter As Long = 0
    Dim currbin As Integer = 0
    Dim newbin As Integer = 0
    Dim c As Integer
    While (counter < textstr.Length)
        c = AscW(textstr(counter))
        newbin = findClosestBin(c, bins, currbin)
        codestr &= printDifference(newbin - currbin, ">", "<")
        codestr &= printDifference(c - bins(newbin), "+", "-")
        codestr &= "."
        currbin = newbin
        bins(newbin) = c
        counter += 1
    End While
    Return codestr
End Function

Pretty straight forward: after the initial check that the number of slots (numbins) is positive, we prepopulate the slots starting with the integer division of 128 (last character code for ascii) to the number of slots.

We then get the message and assign values one character at a time. Each character we assign successfully, we also print, thus "freeing" the slot it was "occupying".We go on like that until there are no more characters in the message.

We're almost done. In a huge waste of cpu cycles, we use brute force to find the shortest generated code for the same string:

Public Function Text2BF(ByVal textstr As String) As String
    Dim bestbin As Short = 1
    Dim results(32) As Long
    Dim beststr As String = ""
    Dim resultstr As String = ""
    For i As Integer = 1 To 32
        Dim str = Dumbtext2BF(textstr, i)
        results(i - 1) = str.length
        If results(i - 1) < results(bestbin - 1) Then
            beststr = str
            bestbin = i
        End If
        resultstr &= i & ": " & results(i) & "\n"
    Next
    Return beststr
End Function

The zip contains the entire Brainfuck project.

Steganography, Brainfuck and other related issues

yiangos — Mon, 06 Jul 2009 02:47:43 +0300

I've always been fascinated with encryption. And, by always, I mean since the age of 7. That's when I "invented" my first encryption method. Of course, it was neither a new, nor a hard-to-break method (I shifted all vowels by one to the "right" and all consonants by one to the left), but still, it was an encryption method.

Since then, I've regularly tred myself both in inventing encryption methods and in deciphering encrypted messages. I can't say I was very successful. Most of my methods were mere letter shifts - or eventually amounted to such - and also I preserved white space. On the other hand, I usually managed to crack simple emcryption patterns.

Then along came the computer. My first encounter with real encryption was in 2004, when, as part of my job, I ported an ASP site to PHP. That's when I came across the ARCFOUR cipher. I was so excited! It was the first time I ever saw this kind of encryption method. I tried to understand its inner workings, but failed miserably. Eventually, I gave up and simply translated to PHP statement to statement.

However, the dice had been thrown. When I found some spare time, I sat down determined to figure this thing out. After all, it was only a bunch of commands - how hard could this be, really? Well, it was quite hard, if you've never seen tis kind of thing before. But eventually I made it. I even transfered the method to other languages (i.e. my favourite at the time, python). In any case, the ARCFOUR still remains my method of choice when it comes to using quick-and-dirty encryption.

And then, I came across this class. Hiding messages (or even files) in images, in such a way that the resulting image appears relatively untouched, now that was a different ballgame altogether. I tried to work the class, but failed, I never quite got it to function properly.

Time passed, and things got slow in the area. Until one day, when a colleague came with a joke, about a language so difficult that even a simple "Hello world" program would be forbiddingly hard to write. That got us into the fun of esoteric programming languages, most of which were simply made for the fun of it. We really laughed with their names, and of course the one that stood out was Brainfuck. The name alone is enough to cause a chuckle, let alone seeing what the source code for an actual program looks like.

At the time, I dismissed Brainfuck as another funny invention, but nothing more than that. So, the day before yesterday, while searching for something irrelevant, I found this little gem. Interestingly, they have enlisted the Brainfuck interpreter under security. That got me thinking. Although in itself, a brainuck program for printing a hard-coded string is actually quite longer than the string itself, the fact that Brainfuck only uses 8 symbols for any program can make things quite interesting: You only need 3 bits to encode each of the source code's commands. Actually, a program that simply prints a message uses only 7 of the 8 symbols (the eighth is there to allow user input), so one of the eight available slots in the three bits is free to use for other purposes. After quite some thinking, I came up with quite a plan for a steganography program. Here's what you'll need:

a message to encrypt. Of course, noone forbids you to hide an already encrypted message.
a 24-bit (or less) color image to use for medium. Any type (jpg, png, gif...) will do. The resulting image however, will be in png, so size (width x height) matters in two ways: a very small image can't hold a very large message (i.e. whose corresponding Brainfuck source code contains more commands than the number of pixels in the image), and a very large image will be huge when converted to png, and therefore harder to send to the recipient.
A pseudo-random number generator that can be seeded. Usually, these produce floating point numbers from -1 to 1 or from 0 to 1. We'll be assuming that our generator can produce integers from 0 to the number of pixels in the image (exclusive). That's not too hard to achieve using the floating point numbers produced by the generator, the width and the height of the image in pixels.
A table that maps the seven required Brainfuck commands to numbers 0 to 6, and an "End-Of-Message" mark to 7.

And here's how to do it, in human-talk:

Convert the message to a Brainfuck program.
Seed a pseudo-random number generator (PRNG) with a value derived from the image (e.g. width+height).
get a value from the generator. Each value represents a pixel in such a way that if the top-left pixel is pixel 0, then the pixel N is at the [(N-N%width)/width] line and [N%width] column.
Get the pixel pointed by the generator.
Get the least significant bit (LSB) of the value of every color component for that pixel. You now have a 3-bit word.
Check the integer value that corresponds to that 3-bit word and compare it to the 3-bit value of the Brainfuck command (you get that from the mapping table) you want to hide in the pixel. To make things even more obscure, instead of using the actual mapping table value, you can use a pseudo-randomly generated rotation of that table for each Brainfuck command. That's relatively easy to do: use another seeded PRNG, that produces values from 0 to 7, and use the XOR of a generated number and the integers in the mapping table.
Flip the bits you got from the pixel so that they match the value you need to hide.
Repeat this process with the next command, and the next generated number, making sure that there are no repetitions in the generated numbers for the selection of pixels.
When you're done with all the commands, generate another number, and store an "End-of-Message" signal in the LSB's of the corresponding pixel.
Save the image as png. Png is lossless, so all the bit-flipping we did is preserved.

The important thing about this method is that the original image is not needed to decrypt the message. Here's how you decrypt.

Create two PRNG's and seed them both with the (known) value you extract from the image (in our case, width+height). One PRNG will generate values between 0 (inclusive) and the number of pixels in the image (exclusive) while the other will generate numbers between 0 and 7 (both inclusive).
Start generating numbers
For each new (i.e. not seen before) number you get from the "first" PRNG, go to the corresponding pixel
Get the three LSB's from the color components of this pixel
XOR this value with the value you get from the second PRNG. Since (a XOR b) XOR b = a, this makes sure we get the correct final value. Match this value to a Brainfuck command, using the mapping table. Store this command.
Carry on until you hit an "End-of-Message" signal.
Execute the Brainfuck program you got.
The result is the original message.

This scheme could be used e.g. to store a serial number in a background (or logo) image of an application, and thus serve for license validation.

The attachment contains a .NET 3.5 windorms application that does just this.

Button popularity

yiangos — Wed, 27 May 2009 00:55:49 +0300

It seems that my custom server-side button control is gaining momentum in the office. Yay!

Custom button ASP.NET 2.0 server control

yiangos — Sat, 16 May 2009 22:24:05 +0300

At work, I found a frequently occurring scenario: the designers would come up with some button design that's just impossible to represent in an efficient manner with ASP.NET 2.0 controls.
A simple example is as follows:

This is really a background image of an aqua-style button, and a text rendered on top of it.

You'd say that an imageButton control could easily tackle this one, and in general I'd agree. Some markup like the following would be sufficient:

However, what happens if the site is multilingual (something that happens quite a lot)? Then you'd have to resort to a solution, where the ImageUrl for the ImageButton is not set declaratively, but programmatically. So, instead of the above, you'd have

and then in the codebehind page, you'd have to set the image url explicitly, depending on the language:

Dim PageLanguage as String
'Code that sets the PageLanguage variable to the current language
button.ImageUrl="~/PathToImages/ButtonImage" & PageLanguage & "png"

You'd say that this is not really much, but imagine having 3, 4 or more buttons on the same page. Even worse, imagine having buttons in a Repeater (for Item selection) or in a gridView. Things can get pretty messy quite fast.

Then there's another way of doing it. Actually have an imageButton without the text, and a linkbutton with the text, and posittion one on top of the other. This tackles the problem of having to define all the states of the "button" programmatically, but adds extra complexity with the event handlers and such; the two "buttons" must actually use the same method for their click event. Moreover, it won't always be easy to position one on top of the other.

At first, I followed the former solution. But since I kept seeing the same thing happen over and over again, I thought that there must be another way of doing this. After a bit of google digging that resulted next to nothing, and quite a few trial-and-error attempts, I ended up with the following specs for my solution:

It must implement the IButtonControl interface. This goes without saying, as the IButtonControl interface exists purely as a guideline for control developers, as to which methods must be implemented for a control to behave as a button. However, as we'll see, if we stick to that, then we only get a bare-bones implementation of a button functionality.
It must implement the IPostBackEventHandler interface, as this will be a control that posts back and raises events
It must override all the rendering methods, and display the following:
- A table with one row
- Within the row, three cells
- the left cell must only display an image (the left part of the image for the button, up to the text)
- The middle cell must have an image as background and contain the button Text
- the right cell must display only an image (the part of the image that spans from the end of the text to the end of the button
It should be somehow themable, preferably through CSS

So, I ended up building this control from scratch. It's far from complete, but it's a good stating point.

Let's go over the thing. Mind you, the code-highlighter seems to be a bit broken (doesn't render round brackets nice), so I've attached the vb file at the end.

Public Class customButton
        Inherits System.Web.UI.WebControls.WebControl
        Implements IButtonControl
        Implements IPostBackEventHandler

Nothing big here, except for the decision to inherit from WebControl, and not from Control. Since we're talking about ASP.NET, the WebControl base class seemed like a reasonable choice. here. This headermeans that we have some methods to override, namely the following from IButtonControl:

        Public Event Click(ByVal sender As Object, ByVal e As System.EventArgs) Implements System.Web.UI.WebControls.IButtonControl.Click
 
       Public Event Command(ByVal sender As Object, ByVal e As System.Web.UI.WebControls.CommandEventArgs) Implements System.Web.UI.WebControls.IButtonControl.Command
 
         Public Property CausesValidation() As Boolean Implements System.Web.UI.WebControls.IButtonControl.CausesValidation
            Get
 
            End Get
            Set(ByVal value As Boolean)
 
            End Set
        End Property
 
       Public Property CommandArgument() As String Implements System.Web.UI.WebControls.IButtonControl.CommandArgument
            Get
 
            End Get
            Set(ByVal value As String)
 
            End Set
        End Property
 
        Public Property CommandName() As String Implements System.Web.UI.WebControls.IButtonControl.CommandName
            Get
 
            End Get
            Set(ByVal value As String)
 
            End Set
        End Property
 
         Public Property PostBackUrl() As String Implements System.Web.UI.WebControls.IButtonControl.PostBackUrl
            Get
 
            End Get
            Set(ByVal value As String)
 
            End Set
        End Property
 
        Public Property Text() As String Implements System.Web.UI.WebControls.IButtonControl.Text
            Get
 
            End Get
            Set(ByVal value As String)
 
            End Set
        End Property
 
         Public Property ValidationGroup() As String Implements System.Web.UI.WebControls.IButtonControl.ValidationGroup
            Get
 
            End Get
            Set(ByVal value As String)
 
            End Set
        End Property

From the IPostBackEventHandler, interface, we get one method:

        Public Sub RaisePostBackEvent(ByVal eventArgument As String) Implements System.Web.UI.IPostBackEventHandler.RaisePostBackEvent
 
        End Sub

As we'll soon see, these are far from enough to have a control that acts like a button in all situations.

So then. Let's start off by giving all those properties inherited from IButtonControl some body. We follow the same pattern in all of them: define a protected member variable, and use the property as a getter-and-setter method for this variable. For example, we define

        Protected _CausesValidation As Boolean = True

and fill out the equivalent property like so:

        Public Property CausesValidation() As Boolean Implements System.Web.UI.WebControls.IButtonControl.CausesValidation
            Get
                Return _CausesValidation
            End Get
            Set(ByVal value As Boolean)
                _CausesValidation = value
            End Set
        End Property

All the other properties defined in IButtonControl are defined in the same manner.

The RaisePostBackEvent is somewhat trickier. We do not have a single event that we might raise, but two: Click and Command. Let's see how a button behaves:

Apparently, if a CommandName is defined, then the Command event is raised whenever we click on the button, otherwise the default Click event is raised. So, we create the following two helper methods:

        Protected Overridable Sub OnClick(ByVal e As EventArgs)
            RaiseEvent Click(Me, e)
        End Sub
 
        Protected Overridable Sub OnCommand(ByVal e As CommandEventArgs)
            RaiseEvent Command(Me, e)
        End Sub

And use them in the implemented method:

        Public Sub RaisePostBackEvent(ByVal eventArgument As String) Implements System.Web.UI.IPostBackEventHandler.RaisePostBackEvent
            If CommandName <> "" And Not CommandName Is Nothing And CommandName <> String.Empty Then
                Dim e As New CommandEventArgs(CommandName, CommandArgument)
                OnCommand(e)
            Else
                OnClick(New EventArgs())
            End If
        End Sub

What we just did, is we checked for a commandName and if that is present, we chose to raise the Command event (after we created a CommandEventArgs object to pass to the event handler). If no commanName exists, then this is probably not a command button, so we simply raise the click event.

We're missing one major fanctionality of the Button control: the "onClientClick" property. Essentially, this allows the developer to assign arbitrary javascript code to the button click event, that's executed prior to the postback, and may even cancel it, if the last statement of the client-side code is a "return false" statement. Presumably, we'll simply concatenate the contents of this property with whatever javascript is needed for the postback, when we render the control. However, this is where things get a bit tricky; the developer may forget (or intentionally leave out) the trailing semicolon in the client-side code they assign to the control with this property. Therefore, it's up to the control to ensure that there is a semicolon at the end of the client-side code, if that code exists. To that end, we define a member to hold whatever the developer assigns,

        Protected _OnClientClick As String = ""

and create the relevant property:

        Public Property OnClientClick() As String
            Get
                Return _OnClientClick
            End Get
            Set(ByVal value As String)
                Dim val As String = Trim(value)
                If Right(val, 1) <> ";" Then
                    val &= ";"
                End If
                _OnClientClick = val
            End Set
        End Property

What we are doing here, is that we make sure there is always a trailing semicolon, if something is set as client-side script to invoke upon clicking. This property will be used afterwards.

This sums up all the properties and methods that define functionality. We go on to displaying the control. As I initially said, the "button" comprises of a table with one row and three columns. In other words, three cells one next to the other. The middle cell holds whatever text we wish to display on the button. These three cells should be themeable through CSS, therefore each needs a CSS class assigned to it. To that end, we define three plain properties for the CSS class name of each one of the three cells. As an example, here's the definition of the member variable and property for the CSS classname of the left cell:

        Protected _CssClassLeft As String = ""

and

        Public Property CssClassLeft() As String
            Get
                Return _CssClassLeft
            End Get
            Set(ByVal value As String)
                _CssClassLeft = value
            End Set
        End Property

In the same way, we define the CssClassMiddle and CssClassRight member variables and properties. However, since it would be cumbersome to define each one of these whenever the developer needs a button, we've short-circuited the CssClass property inherited from WebControl. In essence, if the CssClass value is not an empty string, we expect to find the following three CSS classes:

CssClass & "Left"
CssClass & "Middle"
CssClass & "Right"

To better show how we are using the CssClass property, we define an "alias" for it, called CssClassFamily:

        Public Property CssClassFamily() As String
            Get
                Return CssClass
            End Get
            Set(ByVal value As String)
                CssClass = value
            End Set
        End Property

Time to focus on the rendering methods inherited from WebControl. We have five of them: RenderBeginTag, RenderContents, RenderEndTag, Render and AddAttributesToRender.

We begin with the AddAttributesToRender. This is a very important method. The basic implementation gathers all attributes created by the .NET framework (such as the id of the control) based on the markup in the page where the control is defined, as well as all the extra attributes defined by the developer (such as extra styling, onmouseover and onmouseout actions, etc), and assigns them to the first tag that we render for the control (after we call this method of course). We need the basic functionality, so the first thing we do in the overriden AddAttributesToRender, is call the base method:

        Protected Overrides Sub AddAttributesToRender(ByVal writer As System.Web.UI.HtmlTextWriter)
            Style.Remove("width")
            MyBase.AddAttributesToRender(writer)
            writer.AddAttribute(HtmlTextWriterAttribute.Cellpadding, "0")
            writer.AddAttribute(HtmlTextWriterAttribute.Cellspacing, "0")
            writer.AddAttribute(HtmlTextWriterAttribute.Border, "0")
            writer.AddStyleAttribute("cursor", "pointer")
            writer.AddAttribute(HtmlTextWriterAttribute.Onclick, Me.OnClientClick & Page.ClientScript.GetPostBackEventReference(_PostBackOptions))
        End Sub

Note the very first line: all these attributes will go to the first tag that we open for rendering the control. That tag is the table tag. However, as we do not know whether the left and the right cell have some custom width defined in their CSS classes, we choose not to give the table a width, and so we remove any reference to width from the style collection of attributes passed to the control at design time. We'll be using the "Width" attribute later on though.

So, after we pass on any attributes from the control design, we go on to define a few more. Cellpadding, cellspacing, and border are pretty much self-explanatory. We also want to let the user (the viewer of the webpage) to know that this is a clickable element, so we turn the mouse into a hand whenever it is over the table.

The last line deserves some extra comments. This is the line that defines what happens when someone clicks anywhere on the area defined by the table. Note that the first thing we put in the value part of the "onclick" property of the rendered table, is just the "OnClientClick" property of the control, which is either the emtpy string, or javascript code ending in a single semicolon. We then add the output of the GetPostBackEventReference method of the ClientScript object of the page. The output of this method, is a string that's the javascript needed to do the postback to the server. Note that we are using a so-far unseen member: _PostBackOptions. This is defined as:

        Protected _PostBackOptions As PostBackOptions

and there is a method that instantiates it:

        Protected Sub CreatePostBackOptions()
            _PostBackOptions = New PostBackOptions(Me, _CommandArgument, _PostBackUrl, False, False, True, True, _CausesValidation, _ValidationGroup)
        End Sub

Apparently, this method must be called before calling the AddAttributesToRender, or we'll be facing a null reference exception.

We are now ready to start rendering:

        Public Overrides Sub RenderBeginTag(ByVal writer As System.Web.UI.HtmlTextWriter)
            CreatePostBackOptions()
            AddAttributesToRender(writer)
            writer.RenderBeginTag(HtmlTextWriterTag.Table) 'Table
 
            writer.RenderBeginTag(HtmlTextWriterTag.Tr) 'tr
            Dim LeftClass As String
            If CssClassLeft <> "" Then
                LeftClass = CssClassLeft
            Else
                LeftClass = CssClassFamily & "Left"
            End If
            writer.AddAttribute(HtmlTextWriterAttribute.Class, LeftClass)
            writer.AddAttribute(HtmlTextWriterAttribute.Id, Me.ClientID & "_td1")
            writer.RenderBeginTag(HtmlTextWriterTag.Td) 'td1
            writer.RenderEndTag() 'td1
            If Me.Width.Value <= 0 Then
                Me.Width = Unit.Pixel(100)
            End If
            Dim MiddleClass As String
            If CssClassMiddle <> "" Then
                MiddleClass = CssClassMiddle
            Else
                MiddleClass = CssClassFamily & "Middle"
            End If
 
            writer.AddAttribute(HtmlTextWriterAttribute.Class, MiddleClass)
            writer.AddAttribute(HtmlTextWriterAttribute.Width, CStr(CInt(Me.Width.Value)) & "px")
            writer.AddAttribute(HtmlTextWriterAttribute.Id, Me.ClientID & "_td2")
            writer.RenderBeginTag(HtmlTextWriterTag.Td) 'td2
        End Sub

Despite its length, this method is pretty straight forward: we instantiate the postbackOptions object, gather all attributes for the table, and then open the table (thereby assigning all the attributes and styles). We go on to open the row, within which we'll place the three cells.

Then, we check which classname we'll use for the left cell. If the developer has defined a custom CSS classname for the left cell, we use that, otherwise we use the generic family name+ "Left". We also apply a unique id to the cell, to facilitate any custom client side code that might affect the styling of this cell (e.g. a mouseover/mouseout function that changes the classname). Finally, we open -and close- the left cell.

Then we do the same things about CSS classes with the middle cell, but we also apply an extra attribute: width (the one we deliberately took out of the attributes for the whole table). The reason we did this, is mainly better manageability: assigning the width to the entire table may cause some unwanted side-effects to the rendering of the three cells (e.g. squeeze them). Assigning the width to the middle cell only, however, is easier to grasp and view in terms of the final rendered page.

The method ends, leaving three tags open: the enclosing table, the row and the middle cell.

Filling up the middle cell is what the RenderContents method does:

        Protected Overrides Sub RenderContents(ByVal output As HtmlTextWriter)
            output.Write(Text)
        End Sub

It simply prints out the Text assigned to the button.

Finally, the RenderEndTag method closes the middle tag, renders the right tag (performing the same checks and assigning the same types of attributes as with the left tag), and then goes on to close the row and the table tag:

        Public Overrides Sub RenderEndTag(ByVal writer As System.Web.UI.HtmlTextWriter)
            writer.RenderEndTag() 'td2
            Dim RightClass As String
            If CssClassRight <> "" Then
                RightClass = CssClassRight
            Else
                RightClass = CssClassFamily & "Right"
            End If
            writer.AddAttribute(HtmlTextWriterAttribute.Class, RightClass)
            writer.AddAttribute(HtmlTextWriterAttribute.Id, Me.ClientID & "_td3")
            writer.RenderBeginTag(HtmlTextWriterTag.Td)
            writer.RenderEndTag() 'td3
            writer.RenderEndTag() 'tr
            writer.RenderEndTag() 'table
        End Sub

Finaly, the Render method does just that: render the control.

        Protected Overrides Sub Render(ByVal writer As System.Web.UI.HtmlTextWriter)
            If Not Page Is Nothing Then
                Page.VerifyRenderingInServerForm(Me)
            End If
            MyBase.Render(writer)
        End Sub

Note that before we render, we check that the button is within a form with a runat="server" attribute. The actual rendering is left to the base class render method.

All in all, the button does its job. It has quite a few things that need imroving though: Here's a few things I can think of off the top of my head:

Allow for individual styling of each of the three cells, not just CSS classes
There is no management for any mouse-over state, except for the mouse turning into a hand. It would be nice if the button handled the mouseover and mouseout events intrinsically by changing its style (i.e. change CSS class names). Something along the line of this:
http://www.aspfree.com/c/a/ASP.NET/ASPNET-Custom-Server-Controls-Cute-Image-Hover-Button/