Déc 282016
 

DNSPING uses windows dnsquery function to measure the time it takes for a nameserver to process and reply to your dns query.

This can be useful to monitor and/or troubleshoot DNS performance issues.

Result can easily be piped into a text file and later processed by excel or libreoffice calc (fixed space delimiter).


dnsping 192.168.1.250 www.google.fr 5
timestamp query result ttl duration
00:59:11 www.google.fr [216.58.210.227] TTL:219 time:47
00:59:16 www.google.fr [216.58.210.227] TTL:214 time:0
00:59:21 www.google.fr [216.58.210.227] TTL:209 time:0
00:59:26 www.google.fr [216.58.210.227] TTL:204 time:15

Tool can be downloaded here.

Erwan

Déc 282016
 

Been a while since last article.

A quick one to post a tool I have been using lately to quickly convert VMDK to raw disks.
Indeed it is sometimes easier/quicker to install an operating system in a virtual environement but afterwards you may want to convert the vmware disk (vmdk) to a raw disk so that you can write it to another physical media (usb, hard drive, etc).

Thanks to libvmdk, a library written by Joachim Metz, it is easy to write a quick graphical frontend that will read a vmdk and write it back to a raw image.

VMDK2RAW can be downloaded here.

Erwan

 Posted by at 0 h 42 min  Tagged with:
Jan 032016
 

In a previous article, we had managed to snif & record RF signals, decode it and reproduce it with an arduino.

Thus, even if you can visualize the wav form in Audacity (or any other sound editor), it is not easy to « read » the signal.

The attached software (source code provided) will not only display the wave form, but also shape it as a « square » form and eventually provide a textual reading (high for xx ms, low for xx ms, …).

This makes it easier to reproduce (from an arduino) or eventually make a better guess at what the signal (or part of it) actually is.

Below :

1-the original wave form

2-the square form

3-a textual reading of the worm

Hope this helps others 🙂

 Posted by at 17 h 17 min
Déc 132015
 

Last ESP8266 example for the day (credit goes here) : a web server turning a lef off and on.


#include 
 
const char* ssid = "livebox0";
const char* password = "password";
 
int ledPin = 2; // GPIO2
WiFiServer server(80);
 
void setup() {
  Serial.begin(115200);
  delay(10);
 
  pinMode(ledPin, OUTPUT);
  digitalWrite(ledPin, LOW);
 
  // Connect to WiFi network
  Serial.println();
  Serial.println();
  Serial.print("Connecting to ");
  Serial.println(ssid);
 
  WiFi.begin(ssid, password);
 
  while (WiFi.status() != WL_CONNECTED) {
    delay(500);
    Serial.print(".");
  }
  Serial.println("");
  Serial.println("WiFi connected");
 
  // Start the server
  server.begin();
  Serial.println("Server started");
 
  // Print the IP address
  Serial.print("Use this URL to connect: ");
  Serial.print("http://");
  Serial.print(WiFi.localIP());
  Serial.println("/");
 
}
 
void loop() {
  // Check if a client has connected
  WiFiClient client = server.available();
  if (!client) {
    return;
  }
 
  // Wait until the client sends some data
  Serial.println("new client");
  while(!client.available()){
    delay(1);
  }
 
  // Read the first line of the request
  String request = client.readStringUntil('\r');
  Serial.println(request);
  client.flush();
 
  // Match the request
 
  int value = LOW;
  if (request.indexOf("/LED=ON") != -1)  {
    digitalWrite(ledPin, HIGH);
    value = HIGH;
  }
  if (request.indexOf("/LED=OFF") != -1)  {
    digitalWrite(ledPin, LOW);
    value = LOW;
  }
 
// Set ledPin according to the request
//digitalWrite(ledPin, value);
 
  // Return the response
  client.println("HTTP/1.1 200 OK");
  client.println("Content-Type: text/html");
  client.println(""); //  do not forget this one
  client.println("");
  client.println("");
 
  client.print("Led pin is now: ");
 
  if(value == HIGH) {
    client.print("On");
  } else {
    client.print("Off");
  }
  client.println("

"); client.println("Click here turn the LED on pin 2 ON
"); client.println("Click here turn the LED on pin 2 OFF
"); client.println(""); delay(1); Serial.println("Client disonnected"); Serial.println(""); }
Déc 132015
 

In previous article, we have seen how to talk to a 8266 thru serial.

We could do the same from an arduino and therefore use this module as a slave.
But why introduce a second MCU when the ESP8266 itself is a MCU?

Our arduino IDE can actually program such a MCU (next to the atmega series).
For this you will need latest arduino ide (version 1.6.4 and up).
You will also need to add support for the ESP8266 : see here how to do this.

Once done you are ready to program your MCU.
Dont forget to pull GPIO0 down but also to reset your MCU when entering the flash phase (or else you’ll get « error: espcomm_open failed »).
Once flashed, set GPIO0 free.

See below our arduino ide flashing the blink demo.

Déc 132015
 

In a previous article, we saw how I flashed my new ESP8266.

Now lets see how to « talk » with this module.

First wiring : chpd high, 3v3+gnd, tx to rx / rx to tx.

Lets launch putty,
select serial,
enter the right com port (com7 for me, using my usb to serial adapter),
select 9600 bauds (if it does not work, try 57600 or 115200).

Lets try the below command (ctrl/m + ctrl/j to enter):
-AT should respond OK
-AT+GMR should to get the firmware revision
-AT+CWMODE=3 to select AP & STA mode
-AT+CWLAP to list access points
-AT+CWJAP=“SSID”,“password” to connect to an AP
-AT+CIFSR to retrieve the ip (at this point you should be able to ping the module on your home wifi network)

Déc 122015
 

Playing with registry api’s, I coded this small proggie.

Will save an online registry hive to an offline hive file.
Will restore an offline hive file to an online hive (a backup will be made next to the source hive file).

Needs admin rights – Works on windows 2000 and up.

Discuss it here.

dumpreg

 Posted by at 16 h 12 min
Déc 122015
 

Just received my esp2866.
Read more about it here.
In short it is a wireless soc which you can control from a MCU (like Arduino) thru serial OR use directly as MCU (from Arduino IDE).

ESP8266

First things first : lets flash it with the latest firmware.

1-get the firmware here.
2-get the flasher here.
3-wire 3v3 and ground.
4-wire tx to rx, and rx to tx (I use a usb to serial ftdi adapter)
5-set gpio0 to low (ground)
6-reboot (power off/on will do)
7-flash
8-set gpio0 free
9-reboot and enjoy

Déc 122015
 

Latest changes :

fixed : will use libewf_handle_read_buffer_at_offset or libewf_handle_read_random (x32)
fixed : extend/shrink function (x32)
added : backup_ewf function (x32)
added : backup_devio function (x32)
added : restore_devio function (x32)
added : restore_ewf function (x32)
added : options grayed out in backup/restore window (x32)
added : disk image conversion (x32)
modified : not fliping code for disk s/n (x32)
added : create iso disk image (x32)

 Posted by at 14 h 24 min
Août 232015
 

A new version is out.
Manu additions and bug fixes.


changed : use IOCTL_DISK_GET_PARTITION_INFO_EX to retrieve part size when backuping/restoring/cloning
changed : common code for prep source and prep dest when backuping/restoring
added : vdh informations
modified : copyfile uses xcopy only if psexec not in the folder
added : get boot sector work with \\.\PhysicalDrivex syntax
added : reach boot sector from partition table
modified : get_bs and set_bs now get an offset optional parameter (to possibly skip asking the user)
modified : can create more than one gpt partition
added : can modify a gpt partition type
added : can modify a gpt partition attributes
added : can create a virtual disk (raw) in mb/kb/byes
fixed : taborder in mbr and bs form
fixed : config called later in formcreate
added: enable_advanced=1 option in config
fixed : _restore_bs to work with \\.\PhysicalDrivex syntax
added : lock & dismount volume(s) when writing BS to physicaldrive
todo : prep drive before cloning
modified : getdrive works will all medias
modified : _get_infos will not crash on GetDriveLayoutEX (x32)
modified : increased getdrivelayoutex buffer size (x32)
added : extra partition types in part editor (x32)
modified : grayed out menus based on gpt/mbr in part editor (x32)
modified : check on total size in wipe (x32)
modified : change backup_drive signature (mode parameter removed) (x32)
modified : backup_drive signature now accepts offset parameter (x32)
modified : restore_drive signature now accepts size & offset parameters (x32)
added : can backup/restore from part editor (x32)
added : disks in gray in main window (x32)
modified : disks and parts are displayed by default (x32)

 Posted by at 15 h 02 min