[ Code Explored ]

We’ve all heard of one-way Hash Functions sometime or the other.
Most of us have heard about them from books.
An Algorithm’s explanation is usually followed by its applications and most books mention only one major application (in security) ie. implementing password checks.

I used to wonder:”That’s it? One Application in Security?”, and searching on the internet (and some more books) didn’t help either.

Luckily, I’ve finally found my answers. Now, I’m able to appreciate one-way Hash functions a lot more because I’ve seen it in action. If I had read this application in a book I’m sure that I wouldn’t have realized its importance.

A few days ago, Nokia Corporation issued a notice to all customers that some of its BL-5C Model Batteries had some manufacturing defects which could cause it to explode. It asked customers to check if their batteries were manufactured between December 2005 and November 2006 and if so, get the battery replaced for free.

Nokia also allowed its customers to type in their 26 Character Battery Code on their website (www.nokia.com/batteryreplacement) to see if their battery was faulty or not.

I decided to check the script which finds out when the battery was manufactured. I thought that by looking at the source code, I could figure out exactly which batteries were faulty.

This is what the script looks like:

function rcrcheck_serial() {
var isgood=false;
var serial=document.enterserial.serial.value;
var a=”;
var b=”;
var c=”;
if(serial.length<26) {
alert(”The identification number is incorrect. Please check that you have entered the full 26 characters of the battery identification number.”);
return false;
}
if(serial.length>26) {
alert(”The identification number is incorrect. Please check that you have entered the full 26 characters of the battery identification number.”);
return false;
}
a=md5(serial.substr(7,6));
b=md5(serial.substr(13,1));
c=md5(serial.substr(14,3));
//###
if(a!=”ea4a302b5cbd017871ec94fd6ae189b5″ //###
&&amp;amp;amp;amp; a!=”1f098214896cc40cfabc3b2403a65b75″ //###
&& a!=”fd06cd296b4bf634d85e26884565aa6c”) { //###
window.location=”rcrb2.html”;
return false;
}if(b==”8d9c307cb7f3c4a32822a51922d1ceaa” b==”7b8b965ad4bca0e41ab51de7b31363a1″) { //###
if(c==”84eb13cfed01764d9c401219faa56d53″){return true;} //###
if(c==”d2490f048dc3b77a457e3e450ab4eb38″){return true;} //###
if(c==”441954d29ad2a375cef8ea524a2c7e73″){return true;} //###
if(c==”0e51011a4c4891e5c01c12d85c4dcaa7″){return true;} //###
if(c==”af032fbcb07ffc7bd2569d86ae4ce1f5″){return true;} //###
if(c==”73f7634ab3f381fb40995f93740b3f8a”){return true;} //###
if(c==”738cccd4fda172441f216712a488dca6″){return true;} //###
if(c==”f803dfeb3583d5099a58a7478f28bd75″){return true;} //###
if(c==”7f5144f962efde75e0f7661e032166db”){return true;} //###
if(c==”8fc4c7ab4453d247e011738197b6136c”){return true;} //###

/* Some more Comparisons */

if(c==”defd40204344c9659a0a3eb4ebc125f6″){return true;} //###
if(c==”c4de9fe96832a877668d0dced80657b8″){return true;} //###
if(c==”2c62105ee18ecd5f0ee37bc8c35718eb”){return true;} //###
if(c==”3994f23bfb2b89994bd6e828977b42ae”){return true;} //###
if(c==”28fd0fbd334515deb8a8291b71941c9e”){return true;} //###
if(c==”9ac05befca7d6499e3abec9bdfef2b68″){return true;} //###
if(c==”1732cb437260c60a0744aea8aedfa331″){return true;} //###
if(c==”e1eee5e2b42d45443cdc82db1a3bc465″){return true;} //###
if(c==”7d06a9cf10f2e9e47e77d6c6cfaa7f54″){return true;} //###
if(c==”2618045a3a5fc883e65b6bec2fcac3c8″){return true;} //###
if(c==”2421fcb1263b9530df88f7f002e78ea5″){return true;} //###
if(c==”fccb60fb512d13df5083790d64c4d5dd”){return true;} //###
if(c==”15d4e891d784977cacbfcbb00c48f133″){return true;} //###
if(c==”c203d8a151612acf12457e4d67635a95″){return true;} //###
if(c==”13f3cf8c531952d72e5847c4183e6910″){return true;} //###
if(c==”550a141f12de6341fba65b0ad0433500″){return true;} //###
if(c==”67f7fb873eaf29526a11a9b7ac33bfac”){return true;} //###
if(c==”1a5b1e4daae265b790965a275b53ae50″){return true;} //###
if(c==”9a96876e2f8f3dc4f3cf45f02c61c0c1″){return true;} //###
if(c==”941e1aaaba585b952b62c14a3a175a61″){return true;} //###
if(c==”9431c87f273e507e6040fcb07dcb4509″){return true;} //###
if(c==”49ae49a23f67c759bf4fc791ba842aa2″){return true;} //###
if(c==”e44fea3bec53bcea3b7513ccef5857ac”){return true;} //###
if(c==”821fa74b50ba3f7cba1e6c53e8fa6845″){return true;} //###
if(c==”250cf8b51c773f3f8dc8b4be867a9a02″){return true;} //###
if(c==”42998cf32d552343bc8e460416382dca”){return true;} //###
if(c==”0353ab4cbed5beae847a7ff6e220b5cf”){return true;} //###
if(c==”51d92be1c60d1db1d2e5e7a07da55b26″){return true;} //###
if(c==”428fca9bc1921c25c5121f9da7815cde”){return true;} //###
if(c==”f1b6f2857fb6d44dd73c7041e0aa0f19″){return true;} //###
if(c==”68ce199ec2c5517597ce0a4d89620f55″){return true;} //###
if(c==”e836d813fd184325132fca8edcdfb40e”){return true;} //###
if(c==”ab817c9349cf9c4f6877e1894a1faa00″){return true;} //###
if(c==”8e6b42f1644ecb1327dc03ab345e618b”){return true;} //###
if(c==”ef575e8837d065a1683c022d2077d342″){return true;} //###
if(c==”2050e03ca119580f74cca14cc6e97462″){return true;} //###
if(c==”25ddc0f8c9d3e22e03d3076f98d83cb2″){return true;} //###
if(c==”5ef0b4eba35ab2d6180b0bca7e46b6f9″){return true;} //###
if(c==”598b3e71ec378bd83e0a727608b5db01″){return true;} //###
if(c==”74071a673307ca7459bcf75fbd024e09″){return true;} //###
}if(b==”69691c7bdcc3ce6d5d8a1361f22d04ac” b==”6f8f57715090da2632453988d9a1501b”) { //###
if(c==”2bb232c0b13c774965ef8558f0fbd615″) {return true;} //###
if(c==”ba2fd310dcaa8781a9a652a31baf3c68″) {return true;} //###
if(c==”69421f032498c97020180038fddb8e24″) {return true;} //###
if(c==”85422afb467e9456013a2a51d4dff702″) {return true;} //###
if(c==”13f320e7b5ead1024ac95c3b208610db”) {return true;} //###
}
window.location=”rcrb2.html”;
return false;
}

This code is awesome because, even after reading the source code, nobody can figure out which models are faulty. At the most what we can understand is that Battery Information (Date of Manufacture, Location of Manufacture) is present between the 8th and 17th characters. The characters between 18 and 26th positions could hold the amount of batteries manufactured by the factory before the current unit. We also know that the battery is faulty for some 334 combinations of characters between the 14th and 17th positions. But having this knowledge is futile.

Hence by using a one-way Hash Algorithm (MD5 in this case), we can hide such information (factory codes of factories which manufactured the faulty batteries) even in the source code. This way we can protect such vital information from being stolen by anyone even if he has access to the complete source code, and this according to me is one of the most brilliant applications of One-way Hash functions.

i{content: normal !important}

#include <stdio.h>

void copy(char [],char []);

void main()
{
char s1[10],s2[10];
printf(”Enter String 1:”);
gets(s1);
copy(s1,s2);
printf(”\nThe copied string is: “);
puts(s2);
}

void copy(char x[],char y[])
{
int i=0;
while(x[i])
{
y[i]=x[i];
i++;
}
}

Can you notice that something is missing in the copy() function? Yes, the null termination character ” was not appended at the end of the new string. Luckily, another student in my class pointed out this error to everyone. But then, the rest of the students asked that if their code was wrong, then how come it works for most of the strings?

To this he had no answer. And I had better things to do (such as sleep) than to explain these guys why it happens.

Now (since I’m awake) I’ll put forth a fitting explanation.

Observe the declaration of this character array:

char name[10]=”Sanchit”;

Internally, this String is stored like this:

S,a,n,c,h,i,t,0,0,0

Yes, if the string initial declaration is less than the size provided in the square brackets, the rest of the elements are filled with zeros. This is applicable for arrays of any data type.

Since the ASCII Value of ” is 0, I can represent my array like this again,

S,a,n,c,h,i,t,,,

Doesn’t this give you a hint?

If you create another array of the same size (here: 10) and copy this string to it using the code given above, the rest of the elements after the String are already ”. So there is no need to append the ” character as C would know where the string terminates.

But what if the String is larger? Assuming “Sanchit Karve” is stored in the same Array, it will look like this:

S,a,n,c,h,i,t,’ ‘,K,a,r,v,e, <garbage> , <garbage> , …

If you notice, that inspite of the string being larger than the array size, it is stored completely after occupying the space after the array. Since, now the space outside the array has been accessed, the data out there is not zero. Instead they contain garbage values. So, for such situations, we need to append the ” character at the end of the string, so that C can figure out where the string ends. Otherwise, C will output all bytes till a zero is encountered.

So, appending the ” character is not required in theory, because we assume that the string length is lesser than the array size. We should also ensure that we declare enough space before accepting such input. But still, we must do this (append ) as a precaution because of the following reasons:

1. Unlike other Languages C/C++ do not provide Array Bound Checking features.
2. Hackers make the most of such types of errors, known as Buffer Overflow Errors, and launch Buffer Overflow Attacks where the string is inserted with shellcode (yes, in hex), and the return address of the function is overwritten to the address of the string. This results in the processor passing control to the shellcode and executing it after the function returns.

Why is it like this? If C/C++ compilers can figure out the size of a 1D array then why not for 2D?

This is because 2D Array elements are stored consecutively as two 1D Arrays.

Consider this code.

#include <stdio.h>

int main()
{
int x[][2]={1,2,3,4,5,6,7,8,9,10};
int *p,*q;
int i;
p=&x[0][0];
for(i=0;i<10;i++)
printf(”%d “,*(p+i));

printf(”\n\n Now using pointer q:\n”);

q=&x[1][0];
for(i=0;i<10;i++)
printf(”%d “,*(q+i));

return 0;
}

Run the Program. You’ll get this as the output.
1 2 3 4 5 6 7 8 9 10

Now using pointer q:
3 4 5 6 7 8 9 10 0 4239532

Run the code and observe the output:
1 2 3 4 5 6 7 8 9 10

Now using pointer q:
6 7 8 9 10 0 4239532 0 4235541 1

As you can see, the output using the pointer p remains unchanged because we’re setting it to the first element of the array itself, so it iterates to every element after it.

But q is set to the first element of the 2nd row.
Now which one is the First element of the second row?
It is 6. How do we know it?
It’s because we’ve placed 5 in the column bracket to specify the bounds of each column.

So if we don’t place any value, the compiler gets confused as to how many numbers can be grouped into one column.
And whenever such confusion occurs, the compiler generates the error Size of the int[] is unknown or zero

I hope you’ve realised why the column parameter is required.

And now it’s time to tell you guys why I posted this today.
We were given an assignment to pass a 2D Matrix to a function and find the sum.
Nobody got the solution and I had to write the solution on the blackboard and let the rest of the class take it down.
And I used this function declaration:

void add_mat(int [][],int [][],int [][]);

No student realised my mistake, neither did the professor ( and neither did I )

I realised what I had done after I was taking the train back home and was just thinking about how my day had passed.
Now everyone has copied down wrong code into their notebooks.
I’ve gotta tell them to correct the code tomorrow.

The numbers change because of the complement notation that the computer uses to store negative numbers.

And it’s not the compiler’s fault but the processor’s limitation.
This code will give negative numbers on 32-bit,16-bit and 8bit Microprocessors as each register can hold 32/16/8 bits respectively.
You won’t encounter this problem on 64-bit processors as each register can hold a maximum of 64-bits. (Actually, you will encounter the same problem since the value of INT_MAX will be a 64-bit number for a 64 bit processor….but It’ll work fine with 32-bit numbers)

Adding a Number to a maximum value set in these registers creates the problem.
Have a look at this.

Since INT_MAX is the largest 32-bit number that
Here’s the code it generates for this C++ code:
I’ve typecasted it just so that my compiler compiles it.

printf(”%d = %x\n%d = %x”,INT_MAX,INT_MAX,(unsigned long)INT_MAX+1,(unsigned long)INT_MAX+1);

…
…
aDXDX  db ‘%d = %x’,0Ah
db ‘%d = %x’,0

Now, the values in the first 2 push Instructions is the Binary Representation of INT_MAX (2147483647 on my PC).
Note that it is all ONE’s.

When 1 is added to INT_MAX, look what happens to the next two push instructions.
This number is 2147483648 but in unsigned notation…but in signed notation it’s -2147483648 since the Most Significant Bit decides the Sign of a Number.

And since by default the compiler assumes that a variable is signed, you get the negative value.

Try the same C code after replacing %d with the %u format specifier.
You’ll notice that 2147483648 will be the output.

Remember, there’s nothing like postive or negative numbers…It’s all about interpretation. 111 (for a 3 bit architecture) could mean 7(without using MSB for sign-convention…ie. unsigned) as well as -1 (using MSB for sign ie. signed).

You might wonder why I’ve blamed the Processor and not the compiler inspite of the fact that the Compiler has precalculated the result of addition and passed it to printf.

I was just in the process of continuing my VB Disassembling Tutorial, when I was analyzing how a simple Library Function works.
The function I was analyzing was the Len() Function.

Contrary to our belief that this function, counts the number of characters in a string and returns it, this one does something totally different.

Here’s how it works.

When any string is stored in VB, it is automatically stored in this format (in unicode):

Suppose the String is “ABC”:

06 00 00 00 41 00 42 00 43 00

The 41 to 43 part is a typical unicode style of storing strings, but 2 unicode characters before that, the number of bytes occupied by the string (including zeros) is stored.
So 06 stands for 6 bytes occupied by “ABC” (since its stored as A,0,B,0,C,0)

So all that the Len Function does is read 4 bytes before the beginning of the string and return that value itself.

This is real good. There are many more functions which are far more interesting and worth mentioning.

(

“Ain’t this freakin’ kewl?”

)

;

return

0

;

}

The Prof came over, saw my code and commented:
“If you don’t want to write the programs I ask you to do, that’s fine with me but at least don’t write something that won’t even work…”

I smiled and said that the code would work. I compiled the code and showed it to the Prof.
And guess what he says:”Must be something wrong with the Compiler”

Our Prof. is such a dweeb…If only he knew what tokens are and how compilers process them for lexical analysis.
If you provide more than one Space, it is considered as 1 (and the rest are ignored).

Everyone seems to be using void main() instead of int while writing C/C++ programs, inspite of void not being accepted as a return type for main in the C/C++ standard.

I too used to do the same until some programmers on a Programming Forum told me a few years ago about the C++ Standard on the return type of main().

But what does void do anyway? Is it different from return 0?
This doubt can be easily clarified by disassembling any C/C++ program and reading the code that is executed after main().
On Windows, a start() function calls the main() function. But what about the return value? Is it read after main() quits?

Let’s see…

It doesn’t matter what data type you return from main(). Whether its int or void it doesn’t make any difference.
Here’s what actually happens.
In an executable file, the start() function which calls the main() function, expects a return value of data type integer so that it may decide what argument is passed to the exit() function which is called after main().
If void is chosen as the return type for main, the EAX register is passed as an argument to the exit function.
Since the EAX register almost always contains the return value of any function, so if we say return 0, EAX would be set to zero, that’s all.
Generally whenever void is used, EAX is set to zero at the end of main() , so it is exactly the same as passing return 0.
But this is actually compiler dependant, so this cannot always be assumed.

Ever wondered what happens to the return value after main() quits?
Take a look at this disassembled listing of any C/C++ program.

call dword ptr [esi+18h]

add esp, 0Ch
; (4 x 3) 12 bytes are cleared from the stack to clear space
; occupied by main()’s three arguments.
push eax ; status for exit. Return value of main() is pushed
call _exit

So no matter what you do, even if you ignore the return value type, the compiler will still pass the contents of the EAX Register into the exit function. This could lead to some unwanted results, and hence it is better to return 0 (ie. EXIT_SUCCESS) or 1(EXIT_FAILURE) depending on when and why you have designed the program to end.

So even though, it is almost always the same, there is a reason why the standard recommends using int. Simply for the following reasons:

1. returning 0 by default is COMPILER DEPENDENT.
2. No Guarantee about the content of the EAX Register after main() exits.
3. Will not be portable to all Operating Systems.
4. May cause incorrect termination of main()

So even though void main and return 0 are almost alike, we should try to avoid it’s use.

A lot of people still are confused about how characters can be compared to numbers.
They believe that the characters are automatically converted into integers and then compared.

Actually, there’s no need for a character to be converted in the first place as you shall see below.

Have a look at this snippet.

char x;
scanf(”%c”,&x);
if( x>= 65 && x <= 90) printf(”Hello”);

A question raised by a student was that how can a character be compared to a number? (which is a pretty acceptable query since that guy was new to the world of programming)

But here’s what our professor replied:
C automatically typecasts the character into an integer and then performs comparision.

Characters are stored in memory as Numbers. So Suppose an ‘A’ is entered, it’s stored in a memory(a single byte) as (0×41 or 65) in binary. Just because you specify the %c specifier in printf, it assumes the value to be an ASCII value of a character. No typecasting involved at all. Characters are treated as single-byte numbers.

So Basically, there is nothing like a character in reality…everything is internally represented as a number…certain numbers correspond to a unique character according to ASCII Code and when the %s or %c format specifier is used, it requests the function that the argument that is being passed is to be displayed as the corresponding character of the actual number, instead of displaying the actual number itself.

Luckily, people started to believe me after I showed them disassembled listings of programs.

- Sanchit Karve
[ b o r n 2 c 0 d e ]
printf(”I’m a %XR”,195936478);

[EOF]