DevaDraco's Rambling about Tech Stuff

Do dereferencing null or uninitialized pointers in Objective C cause runtime errors?

2011-02-07T03:34:00.027+08:00

I recently a interesting "discussion" with a Objective C developer about what happens when we dereference null or uninitialized pointers in Objective C?

First a little recap: A pointer references a location in memory, and obtaining the value at the location a pointer refers to is known as dereferencing the pointer. A null pointer is a variable that makes reference to something that is not initialized. Uninitialized pointer is pointing to some memory location but the pointer value is not assigned.

From my experience in C programming, dereferencing these types of pointers will almost certainly cause a runtime error resulting in a segmentation fault when the compiled program is executed. I'm pretty certain that this applies to Objective C too as the fundamentals are the same. However, my opponent insists that the Objective C language takes care of null and uninitialized pointers by making them point to Nil by default.

To proof that dereferencing null or uninitialized pointers in Objective C will cause runtime errors, I found a simple Objective C sample file online and modified it to compile with gcc in Mac OS X. Attached below are 3 files that are identical except for 1 line of code with the following differences:

hello.m: with normal initialized pointer
hello-null.m: with pointer pointing to NULL
hello-uninit.m: with uninitialized pointer

The screenshot below shows the programs compiled from hello-null.m and hello-uninit.m causing segfaults.

The test environment is a default install Mac OS X 10.6.6 Snow Leopard and the gcc compiler is from Xcode 3.2.5 and iOS SDK 4.2.

There you have to it: Dereferencing null or uninitialized pointers in Objective C will cause runtime errors resulting in segmentation faults.

// hello.m

#import <Foundation/Foundation.h>
#import <stdio.h>

@interface Number: NSObject
{
        @public
        int number;
}
- (void)printNum;
@end

@implementation Number: NSObject
- (void)printNum
{
        printf("%d\n", number);
}
@end

int main(void)
{
        Number *myNumber = [Number new]; // equal to [[Number alloc] init]

        myNumber->number = 6;

        [myNumber printNum];

        return 0;
}

// hello-null.m

#import <Foundation/Foundation.h>
#import <stdio.h>

@interface Number: NSObject
{
        @public
        int number;
}
- (void)printNum;
@end

@implementation Number: NSObject
- (void)printNum
{
        printf("%d\n", number);
}
@end

int main(void)
{
        Number *myNumber = NULL;

        myNumber->number = 6;

        [myNumber printNum];

        return 0;
}

// hello-uninit.m

#import <Foundation/Foundation.h>
#import <stdio.h>

@interface Number: NSObject
{
        @public
        int number;
}
- (void)printNum;
@end

@implementation Number: NSObject
- (void)printNum
{
        printf("%d\n", number);
}
@end

int main(void)
{
        Number *myNumber; // uninitialized

        myNumber->number = 6;

        [myNumber printNum];

        return 0;
}

--- Update ---

It occurred to me that other people might think that my examples were biased towards the segfault results as they write to null and uninitialized pointers, instead of just dereferencing the pointers. So I retested by modifying the examples to only dereference the null and uninitialized pointers, and I get the same results: segmentation faults.

Attached below is a modified version of hello-uninit.m that do not write to the dereferenced pointer. The hello-null.m file is modified accordingly.

// hello-uninit2.m

#import <Foundation/Foundation.h>
#import <stdio.h>

@interface Number: NSObject
{
        @public
        int number;
}
- (void)printNum;
@end

@implementation Number: NSObject
- (void)printNum
{
        printf("%d\n", number);
}
@end

int main(void)
{
        Number *myNumber; // uninitialized

         // myNumber->number = 6;
  
        if( myNumber->number ) {
                [myNumber printNum];
        }
 
        return 0;
}

--- The End ---

Testing for TLS1/SSLv3 Renegotiation Vulnerability

2010-01-09T13:22:00.024+08:00

I noticed that eEye's Retina Network Scanner and Tenable's Nessus added the check for TLS1/SSLv3 Renegotiation Vulnerability in December. During my research, I came across the excellent whitepaper by Thierry Zoller from G-SEC titled "TLS/SSLv3 renegotiation vulnerability explained":

http://www.g-sec.lu/practicaltls.pdf

To help sysadmins who needs to find out if their own webservers are vulnerable, I'm going to demonstrate how to test for the vulnerability using the OpenSSL toolkit (http://www.openssl.org). I'm not going to discuss the details of the vulnerabilty as that can be found in the Zollor whitepaper. If your target is Internet-accessible, Nasko provided a great online "TLS Renegotiation Test" at:

http://netsekure.org/tag/tls1-2/

In a nutshell, we can test the issue by running the following command:

$ openssl s_client -connect targetserver:443

then adding:

GET / HTTP/1.0
R
<CRLF>

* Please note that <CRLF> means hitting the Enter/Return key.

If the target is vulnerable, the server will return a renegotiation message. After receiving the renegotiation message, the server will return the content of the page if another <CRLF> is sent.

Since a picture paints a thousand words, the following two examples illustrates the SSL transactions of a non-vulnerable and a vulnerable server using OpenSSL.

OpenSSL transaction of a non-vulnerable server:

$ openssl s_client -connect good-server.org:443
CONNECTED(00000003)
depth=0 /OU=SAMPLE ONLY/O=<DELETED>
A 1024 Server Certificate/C=CA
verify error:num=20:unable to get local issuer certificate
verify return:1
<DELETED>
---
Certificate chain
0 s:/OU=SAMPLE ONLY/O=<DELETED>
---
Server certificate
-----BEGIN CERTIFICATE-----
<DELETED>
-----END CERTIFICATE-----
subject=/OU=SAMPLE ONLY/O=<DELETED>
---
No client certificate CA names sent
---
SSL handshake has read 1421 bytes and written 316 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: D37DC0B86A49D57900149FF75419F31221E862FFB18A38CA9ABDE165D6DC3A32

    Session-ID-ctx:
    Master-Key: 801C70181E7597FB2355FC842D35ED741236E148E17002498C1CA85D287FF64B
5AB2FC0C9653977C7B6621DCF249C325
    Key-Arg   : None
    Start Time: 1263012957
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---
GET / HTTP/1.0
R
<CRLF>
RENEGOTIATING
5648:error:140940F5:SSL routines:SSL3_READ_BYTES:unexpected record:s3_pkt.c:1210:
$

OpenSSL transaction of a vulnerable server:

$ openssl s_client -connect bad-server.org:443
CONNECTED(00000003)
depth=0 /CN=<DELETED>
verify error:num=20:unable to get local issuer certificate
<DELETED>
---
Certificate chain
 0 s:/CN=<DELETED>
---
Server certificate
-----BEGIN CERTIFICATE-----
<DELETED>
-----END CERTIFICATE-----
subject=/CN=<DELETED>
---
No client certificate CA names sent
---
SSL handshake has read 1620 bytes and written 316 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 100B637C67A441127FEE9836EDB8364D7F3D78280D1C991AF59AF7D6F09960A6

    Session-ID-ctx:
    Master-Key: 86E28EB111FDF81ED9970D05769582ED2AE217E1C992DDA3CB36DD2F5AA2570B
258F5C44C2CBAB95D3145C124AC3B7F7
    Key-Arg   : None
    Start Time: 1263013004
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---
GET / HTTP/1.0
R
<CRLF>
RENEGOTIATING
 depth=0 /CN=bad-server.org
 verify error:num=20:unable to get local issuer certificate
 verify return:1
 depth=0 /CN=bad-server.org
 verify error:num=27:certificate not trusted
 verify return:1
 depth=0 /CN=bad-server.org
 verify error:num=21:unable to verify the first certificate
 verify return:1
<CRLF>
HTTP/1.1 200 OK
 Date: Sat, 09 Jan 2010 04:56:52 GMT
 Server: Apache
 Last-Modified: Mon, 13 Apr 2009 06:12:41 GMT
 ETag: "758012-fe3-467699a12e840"
 Accept-Ranges: bytes
 Content-Length: 4067
 Connection: close
 Content-Type: text/html; charset=UTF-8
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 
 <HTML>
 
 <HEAD>
 <DELETED>
</HTML> 
closed

$

For this vulnerablity, there's no known generic fix yet. Let's hope something comes along soon.

Where is the ASP.NET Web Service template in Visual Studio 2005

2009-10-31T22:43:00.009+08:00

I recently needed to create a Web Service (WS) application fast, and since I know nothing about web services, I thought that the best way would be to try out some sample WS apps first. I found that most of the online sample WS app were introduced using Visual Studio .NET.

Since I have a newer Visual Studio 2005 Professional Edition, I thought that there will be no problem for me to follow the online exercises. Boy was I wrong!!!

The first problem I encountered was just to create a Visual C# Web Service project. According to the instructions: from Visual Studio, select File -> New -> Project.... Then select the ASP.NET Web Service template...

Wait a minute!!! There's no ASP.NET Web Service template!!!

The only one I found was by selecting File -> New -> Web Site....

After a lot of googling and countless failed attempts to load the ASP.NET Web Service template, I found out that all I had to do was to install the Service Pack 1 for Visual Studio.

Unbelievable right?

Publishing Web Service in IIS 6 from Visual Studio 2005

2009-10-31T21:48:00.029+08:00

I was recently tasked with creating a simple Web Service (WS) application to serve as a training tool, and the problems that I encountered can be considered cruel and unusual for any pentester. The most idiotic issue came from using Visual Studio 2005 to publish the WS in IIS 6. When I used the debugger in Visual Studio (VS) to run the WS app, the app worked fine. But when I tried to publish the WS app in the wwwroot of IIS, the stupid ASP keeps throwing me errors.

I believe that no one should be made to suffer through this again, so I'm going to summarize what I did for *posterity*.

Before I can start, we're going to need a baseline. I was using a default installation of Windows 2003 Server R2 Standard Edition with IIS 6, and a default installation of Visual Studio 2005 Professional Edition without SP1. The baseline WS app will be the default "Hello World" Web Service Web Site from Visual Studio.

1. To create the Web Site in Visual Studio, go to File -> New -> Web Site. Choose ASP.NET Web Service in the dialog box.

I'm going to name and save the project as per the following for brevity in this post:

C:\Documents and Settings\Administrator\My Documents\Visual Studio 2005\WebSites\Sample1

You may notice that the Web.config file is missing from VS's Solution Explorer (right windows), but it'll be created when you start debugging.

2. Then in VS, select Debug -> Start Debugging. and choose Add a new Web.config file with debugging enabled. in the next dialog box. A new browser is started showing the Web Service directory and you can start playing with the Web Service without any problem.

Notice the port number in the URL, this is not the default IIS 6 web server.

3. Now we will try to publish the WS. In VS, select Build -> Build Web Site. You should get the Build succeeded status. Then select Build -> Publish Web Site. I'm going to publish the WS app in the root directory of IIS: C:\Inetpub\wwwroot\Sample1.

You should get the Publish succeeded status. Here comes the nightmare!!!

4. On the local machine, open the WS's URL in a new browser: http://localhost/Sample1/Service.asmx

You will get the following error:

Server Error in '/' Application.

Parser Error
Description: An error occurred during the parsing of a resource required to service this request. Please review the following specific parse error details and modify your source file appropriately.

Parser Error Message: Could not create type 'Service'.

Source Error:

Line 1: <%@ WebService Language="C#" CodeBehind="~/App_Code/Service.cs" Class="Service" %>

Source File: c:\inetpub\wwwroot\Sample1\Service.asmx Line: 1

Version Information: Microsoft .NET Framework Version:1.1.4322.2300; ASP.NET Version:1.1.4322.2300

5. You need to make 2 changes to solve this error. The first step is to copy the bin directory from your project directory into IIS's web root. Look at your IIS's wwwroot directory structure:

C:\
+- Inetpub
   +- AdminScripts
   +- wwwroot
      +- aspnet_client
      +- Sample1
         +- bin
         +- App_Code.compiled
         +- App_Code.dll

You need to put all your "App_Code" and "bin" directories into the wwwroot directory instead of the published project directory (sub-directory where the asmx file resides). For some unknown reasons, Visual Studio 2005 do not move or copy them from the project directory for you automatically.

Your new IIS wwwroot directory structure should look like this:

C:\
+- Inetpub
   +- AdminScripts
   +- wwwroot
      +- aspnet_client
      +- bin
         +- App_Code.compiled
         +- App_Code.dll
      +- Sample1
         +- bin
            +- App_Code.compiled
            +- App_Code.dll

You should still get the same error if you reload the browser.

5. The second step is changing the .NET version in IIS 6. IIS 6 is trying to run code compiled in .NET 2 with .NET 1. In Windows, go to Administrative Tools -> Internet Information Services (IIS) Manager. In IIS Manager, expand LOCALSERVER(local computer) -> Web Sites -> Default Web Site.

Right-click Default Web Site and select Properties.In the dialog box, select the ASP.NET tab. Change the ASP.NET version from 1.1.4322 to 2.0.50727 and click OK.

6. Reload the local browser. You should see the following error:

Server Error in '/' Application.

Configuration Error
Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately.

Parser Error Message: It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused by a virtual directory not being configured as an application in IIS.

Source Error:

Line 24:             ASP.NET to identify an incoming user.
Line 25:         -->
Line 26:
Line 27:         <!--
Line 28:             The section enables configuration

Source File: c:\inetpub\wwwroot\sample1\web.config    Line: 26

Version Information: Microsoft .NET Framework Version:2.0.50727.42; ASP.NET Version:2.0.50727.42

On a remote browser, you should see the following error when you open the WS's URL (assuming 192.168.1.185 is the WS server's IP): http://192.168.1.185/Sample1/Service.asmx

Server Error in '/' Application.

Runtime Error
Description: An application error occurred on the server. The current custom error settings for this application prevent the details of the application error from being viewed remotely (for security reasons). It could, however, be viewed by browsers running on the local server machine.

Details: To enable the details of this specific error message to be viewable on remote machines, please create a <customErrors> tag within a "web.config" configuration file located in the root directory of the current web application. This <customErrors> tag should then have its "mode" attribute set to "Off".



<configuration>
    <system.web>
        <customErrors mode="Off"/>
    </system.web>
</configuration>

Notes: The current error page you are seeing can be replaced by a custom error page by modifying the "defaultRedirect" attribute of the application's <customErrors> configuration tag to point to a custom error page URL.



<configuration>
    <system.web>
        <customErrors mode="RemoteOnly" defaultRedirect="mycustompage.htm"/>
    </system.web>
</configuration>

7. You need to create an application in IIS 6 with the same name as the virtual directory. From IIS Manager, expand LOCALSERVER(local computer) -> Web Sites -> Default Web Site -> Sample1.

Right-click Sample1 and select Properties.In the dialog box, select the Directory tab. Click on the Create button and click OK.

8. You should find that the WS app is working normally on the local machine.

9. On a remote machine, it looks like the WS is working.

But you will see the following error message when you select the HelloWorld WS:

The test form is only available for requests from the local machine.

10. Since .NET Framework 1.1, HTTP GET and HTTP POST are both disabled by default. You need to enable them in the Web.config file. From VS, insert the following code into Web.config and re-publish the Web Site as shown in step 3:

<webServices>
    <protocols>
        <add name="HttpGet"/>
        <add name="HttpPost"/>
    </protocols>
</webServices>

Note that the code must be inserted inside the <system.web> tags like so:

<configuration>
    <system.web>
    <webServices>
        <protocols>
            <add name="HttpGet"/>
            <add name="HttpPost"/>
        </protocols>
    </webServices>
    </system.web>
</configuration>

11. You should find that the WS app is working normally on the remote machine now.

12. If you're going to release this WS app into the production environment, you probably should disable Debugging for your app. From VS, find the following line in Web.config:

<compilation debug="true"/>

Set debug to false and re-publish the Web Site as shown in step 3:

<compilation debug="false"/>

--- The End ---

Guide to Cracking EnableDebugger2 Password in SWF/Flash

2009-06-22T00:11:00.002+08:00

Caveat Emptor!!! Let me first state that I am not an ActionScript programmer. The reason I wrote this article was because I needed to crack an EnableDebugger2 password in a Flash file, but could not find any DIY guide to do it. From the references I found from Google, the details of the hashing scheme used were very sketchy and threw me off the correct trail for hours. This article represents hours of research, experimentation and source code review, and I’ve provided all the technical details that I feel is important for my peers reading this article.

The article presumes an intermediate level of technical competency.

You can access the PDF version from here.

Windows Update IE Frame Recursion/Loop Problem when Selecting "Optional" Updates

2009-06-10T13:14:00.013+08:00

I've been having problems performing the "Windows Update" with the Internet Explorer on one of my Windows Server 2003 system, which is used as a software testing workstation.

From IE6 to IE8, the whole "Windows Update" process goes on normally until I try to select the "Software, Optional" option on the side frame. IE just loads another "Windows Update" process in the center frame.

Prior to IE8, the recursive process just cascades deeper and deeper, with more frames within frame. But since IE8, the process is now a loop. When I try to continue the "Windows Update" process in the sub-frame window, the sub-frame just goes back to the original "High Priority" option sub-frame.

The funny thing is that it only happens to one of my machines. Usually, I just use CTupdate to update this machine and forget about it; but I thought I'll fix it since I have some free time now.

After a little googling, I found a link to this page:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.windowsupdate&mid=bcd4ec08-55d3-4ee5-8daa-56dcd25f5311
The forum poster found out that it was the "BitComet Helper" add-on from his BitComet 0.84 that was affecting his Windows XP system.

I checked and I found that I have an old BitComet 0.7 in my system that I have totally forgotten about, so I went on to disable the add-on.

In IE8, I went to "Tools -> Manage Add-ons", and disabled the "BitComet Helper" add-on.

Problem solved and my "Windows Update" is now working fine.

Bluetooth Audio Streaming from Windows Server 2003 to LG FB163

2009-06-09T13:40:00.015+08:00

I've recent got a sexy little LG FB-163 Micro HIFI System that comes with Bluetooth. Unfortunately, the Bluetooth is only used to stream audio, and not for file transfer or sharing as I had originally hoped for.

After a lot of procrastination, I finally got around to try out the Bluetooth function. After a lot of experimentation, I got it working with the following configuration:
OS: Windows Server 2003
BT Stack: BlueSoleil version 6.2.227.11 (Demo)
BT Dongle: D-Link DBT-120 rev B4

At first, I was using a hacked Windows XP Bluetooth stack with a D-Link DBT-120 rev B4 dongle as Windows 2003 do not come with a Bluetooth stack, but I couldn't get my PC to pair with the FB-163.

As the FB-163 uses the newer A2DP Bluetooth profile, I went out and bought a newer dongle (unbranded model ES-389), thinking that it is a hardware problem. The ES-389 was detected as a "Silicon Wave" bluetooth device by Windows, but couldn't pair with the FB-163 either.

So I thought, maybe I need a newer Bluetooth stack. Thus I installed BlueSoleil version 6.2.227.11 as I had downloaded the demo version previously. Unfortunately, when I tried to pair ES-389 with the FB-163, it couldn't even get FB-163's device name. The error message was "Refreshing device name is not successful".

After a lot of troubleshooting, I replaced the ES-389 with my older DBT-120 as I remembered that the D-Link dongle could at least get the device name from FB-163.

The short version is that it worked, and here are the steps I took:

In the start screen, the FB-163 is identified by a "Headset" icon with its MAC address.
When I right-clicked the "Headset" icon and chose "Get Device Name", it worked and got the "LG_AUDIO" device name.
I right-clicked the Headset icon and chose "Pair". The passkey dialog box appeared and I entered the default PIN "0000" (Why do everyone seem to use the same PIN?).
The DBT-120 and FB-163 are now paired.
Finally, I right-clicked the Headset icon and chose "Connect Bluetooth Advance Audio". The DBT-120 and FB-163 are now connected.

I fired up my music player and the music streaming worked perfectly.

Installing Windows Live Messenger 2009 on Windows Server 2003

2009-03-22T17:54:00.014+08:00

When I tried to install the new Windows Live Messenger 2009 on my Windows Server 2003 machine, I got the "Couldn't install programs" error message, and the detail is "os_check: 0x8028004".

Apparently, Windows 2003/2008 and 64bit XP systems are not supported by the new Live Messenger.

Thank goodness I came across the following site:
http://www.gtalkme.com/development/install-windows-live-wave3-on-windows2003-or-2008.html
It's about "Windows Live Wave 3" and it's in Chinese, but the hack is identical.

Download the messenger wlsetup-custom.exe.
Open it with Resource Hacker.
Open the resource tree to "CONFIG -> CONFIG0 -> 0".
Find the XML tag: <os productType="workstation" />
Change "workstation" to "server" and recompile the script in the Resource Hacker.
Remember to save the modified installer file.

The installer should work properly on the Win2003 system now.

Cyberarmor viexpf2k.sys conflicts with MS's Driver Verifier

2008-12-24T13:04:00.007+08:00

I had a BSOD (Blue Screen of Death) on my Windows XP laptop today. It freaked me out as I don't remember changing any system configurations previously, so I thought that it might be a virus. I've extracted the juicy part from the BSOD messages below:

--------------------------------------------------------------------
Technical information:

*** STOP: 0x000000c9 (0x00000007, 0xA8655492, 0x8ADACF68, 0x00000000)

*** viexpf2k.sys - Address A8655492 base at A8655000, DateStamp 4372d07b

Beginning dump of physical memory
--------------------------------------------------------------------

A little googling shows that "viexpf2k.sys" is either a malware, or a driver from CyberArmor. I have the Cyberarmor firewall (Corporate version) installed, so I investigated from this angle. But just in case, I also ran CureIt AntiVirus from DrWeb.

At first, I couldn't get into Safe Mode as it gets stuck during the driver loading phase. But CHKDSK pops up after a few hard reboots, and Safe Mode boots fine after the disk check.

For some reason, my laptop didn't generate any dump file (company policy, no direct control), so I could not confirm my suspicion with WinDbg. I had to do it the "hacker" way: I renamed "viexpf2k.sys" to "~viexpf2k.sys" in both the "C:\Program Files\CyberArmor" and "C:\WINDOWS\system32\drivers", and then my XP managed to boot normally, but without CyberArmor.

So it's confirmed that CyberArmor is the problem, but why? More googling shows stop code C9 to be DRIVER_VERIFIER_IOMANAGER_VIOLATION, and it hit me! I must have turned on Microsoft's Driver Verifier by mistake yesterday when I was researching on kernel dump debugging.

So I restored "viexpf2k.sys" and ran:

C:> verifier /reset

Voila! Every thing's back to normal after a reboot.

Performance tuning for Samba on Fedora 9

2008-12-16T00:21:00.003+08:00

When I first set up Samba on my Fedora 9 server, the access speed was not very impressive to say the least.

So I googled a little, and I found out that I can get some speedups if my disk do not record the file access time as my application reads and writes to files very often. I added the noatime option to the entry for my share partition in "/etc/fstab" like:
UUID=????? /data ext3 defaults,noatime 1 1

I did get some speed increase after this, but it is still slower than a native Windows Share.

So I googled some more, and I found:
http://oreilly.com/catalog/samba/chapter/book/appb_02.html

I added the following options to "/etc/samba/smb.conf":

socket options = TCP_NODELAY IPTOS_LOWDELAY
dead time = 15

The speed increase is quite dramatic, but it is still slower than a native Windows Share. Still not sure if the "dead time" option helps, but I just don't have to time to test it out.

Symbol Server for WinDbg

2008-12-15T23:58:00.006+08:00

Today, I used Microsoft's WinDbg debugger to check out a kernel memory dump to see if I can determine which is the last program in memory before my Windows 2003 server (Mystic Hare) crashed. I guessed that it may give me a clue about which is the offending program that is crashing the server.

I haven't used WinDbg in years, and I didn't have the symbol package for Windows 2003 with me. Downloading it is out of the question as my internet connection speed is slow and the package is a few hundred megabytes.

Lucky for me, WinDbg can now download symbols as needed if internet access is available, from what I read in http://www.microsoft.com/whdc/devtools/debugging/debugstart.mspx

I created the "c:\websymbols" directory to download the symbols to.

1. Start a debugging session.

2. Set the debugger symbol path as:
SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

Now, I can start the debugging process.

Unfortunately, the debugging didn't go far as the symbols for an external program's .sys file is not available, but it's another story.

Editing fstab from "Repair Filesystem" prompt in Fedora 9

2008-12-11T11:28:00.002+08:00

My Fedora 9 server is a laptop with a non-standard harddisk setup. In a mis-guided attempt to reduce the heat produced by the laptop, I removed the internal SATA II harddisk and put the Fedora's / root partition on a external SATA II harddisk connected by a SATA ExpressCard. As my laptop do not detect the main harddisk connected by the SATA ExpressCard, I created the /boot partition on a 1GB USB disk.

Here comes the problem, the USB disk is detected as either "/dev/sda1" or "/dev/sdb1" at different boot times. Thus I have the problem of deciding what to put in the fstab. You may ask when don't I use the UUID since these devices are controlled by udev anyway. It's because sometimes the UUID used to identify the USB disk do not work during boot up and Fedora drops me into the "Repair Filesystem" prompt.

Usually, I'll insert the Fedora DVD, boot into "Rescue" mode, chroot /mnt/sysimage/ and edit the fstab file. But when I rebooted and encountered the same problem last night, I got fed up of getting the DVD again.

I found the following forum while googling and the answer provided is exactly what I need:
http://www.linuxquestions.org/questions/linux-software-2/how-modify-fstab-when-its-ro-in-repair-filesystem-mode-562021/

In the "Repair Filesystem" prompt, login and remount the filesystem with:
> mount -o remount,rw /

I can modify the fstab file now.

Also, I found out that the system can boot up perfectly fine without mounting the /boot partition when I removed the entry from fstab. But I put the /boot entry back in case I forget to remount /boot when I upgrade the kernel in the future.

VBScript to backup Windows System, Application and Security event logs

2008-12-01T18:26:00.008+08:00

To diagnose my crashing Windows 2003 server (Mystic Hare) mentioned previously, I needed to backup the server's System, Application and Security event logs every half hour. At first, I thought of just copying the *.evt files to another location, using the Windows Scheduler. But this might not be the best idea as the latest entries might not be in the event logs. So I clobbered together a VBScript from the following links:
http://msdn.microsoft.com/en-us/library/aa394593.aspx
http://www.microsoft.com/technet/scriptcenter/guide/sas_log_pcna.mspx?mfr=true
http://www.informit.com/content/images/9780672329470/downloads/SPSiteBackup.wsf.txt

The script will backup the event logs using standard WMI methods to "C:\scripts\" and append the current date and time to the saved event log files.

'*******************************************************************
'********************** Begin Script *******************************
'*******************************************************************

dtmThisSecond = PadDigits(Second(Now), 2)
dtmThisMinute = PadDigits(Minute(Now), 2)
dtmThisHour = PadDigits(Hour(Now), 2)
dtmThisDay = PadDigits(Day(Now), 2)
dtmThisMonth = PadDigits(Month(Now), 2)
dtmThisYear = Year(Now)

strBackupName = dtmThisYear & "-" & dtmThisMonth _
& "-" & dtmThisDay & "_" & dtmThisHour & "-" & dtmThisMinute & "-" & dtmThisSecond
strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Backup, Security)}!\\" & _
strComputer & "\root\cimv2")

Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile " _
& "Where LogFileName='Application'")
For Each objLogfile in colLogFiles
objLogFile.BackupEventLog("c:\scripts\" _
& strBackupName & _
"_application.evt")
' WScript.Echo "File saved: " & strBackupName & _
' "_application.evt"
Next

Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile " _
& "Where LogFileName='System'")
For Each objLogfile in colLogFiles
objLogFile.BackupEventLog("c:\scripts\" _
& strBackupName & _
"_system.evt")
Next

Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile " _
& "Where LogFileName='Security'")
For Each objLogfile in colLogFiles
objLogFile.BackupEventLog("c:\scripts\" _
& strBackupName & _
"_security.evt")
Next

'===================================================================
' Functions
'===================================================================
' This function is used to pad date variables that contain only on digit.
Function PadDigits(n, totalDigits)
If totalDigits > len(n) then
PadDigits = String(totalDigits-len(n),"0") & n
Else
PadDigits = n
End If
End Function

'*******************************************************************
'************************ End Script *******************************
'*******************************************************************

PS: The script was only tested on a Windows XP system.

Dummy write to Windows' System event log

2008-12-01T16:17:00.006+08:00

I have a Windows 2003 server, let's call it Mystic Hare, which keeps crashing intermittently. The problem I have in diagnosing the problem, is that the last 3 hours of the Windows System logs are always empty.

So either:
1. The last 3 hours of the System log are wiped out during the crash; or
2. There is no event written to the System log during those times.

So I decided to write to the System event log with dummy entries as an experiment.

Googling brings up a lot of VBScripts, JavaScripts, C#, WSH scripts, etc. But I needed a simple app that I can just set in the Windows scheduler. Thank goodness I found what I need at:
http://www.winserverkb.com/Uwe/Forum.aspx/windows-server-scripting/8696/Write-To-System-Log-On-A-Specified-Server-When

The command I'm using is:
> eventcreate /L System /T Information /id 1 /d "For testing only"

This is what I see for the dummy System log entry in the Event Viewer"

New "e1000" network adapter for Fedora 9 guest in VMWare Server 2

2008-11-29T18:48:00.000+08:00

I read somewhat that in VMWare Server 2, I can get better network performance if I use the new Intel "e1000" network adapter instead of the default AMD one. So here's the process of replacing the adapter.

For each guest, add the following line to each VMX file:
ethernet0.virtualDev = "e1000"

For Windows 2003 guests, the new hardware will be automatically recognized and a new "Local Area Network 2" connection will be created.

For Fedora 9 guests, eth0 will fail to work during boot time as the new hardware is recognized as eth1. Modifying the network config files under "/etc/sysconfig/networking" do not help because in Fedora 9, udev controls the hardware. The following file needs to be modified:

/etc/udev/rules.d/70-persistent-net.rules

Remove or comment out the original line for the AMD network adapter.
# Advanced Micro Devices [AMD] 79c970 [PCnet32 LANCE] (rule written by anaconda)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="00:0c:29:9b:f4:58", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"

The new e1000 adapter should be in the file as:
# PCI device 0x8086:0x100f (e1000)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="00:0c:29:d2:28:34", ATTR{type}=="1", KERNEL=="eth*", NAME="eth1"

change NAME="eth1" to "eth0" so we get:

# PCI device 0x8086:0x100f (e1000)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="00:0c:29:d2:28:34", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"

Reboot and the network service should start fine at boot time.

My first attempt at blogging!

2008-11-28T21:23:00.000+08:00

Wow! I still can't believe that I've finally became a blogger. I used to tell myself never to become one, but guess what? Thanks to a friend, I found out that the blog is actually a great place to put all the technical information that I learnt; instead of just creating lots of little text files in my systems (that I can't seem to find the time to organize).