Hypn.za.net | @hypn

Thoughts on Diablo 3 (beta) classes

These are some of my thoughts on the difference Diablo 3 classes. I’m not a serious gamer, and this isn’t an attempt at theory crafting or suggesting that any of the classes are imbalanced. Item drops are random, and can make a huge difference to the damage your character does as well as it’s survivability – in my playing I used what items dropped (that I could equip), so these comparisons aren’t entirely “fair” in that regard, but I still think my points are valid. It’s also worth mentioning that I didn’t try leveling up my characters as much as possible in each area, nor did I loot every chest I found etc, so my characters were (all) weaker and less equipped than I’d imagine most players to be… so do keep this in mind when reading my thoughts below, I just wanted to make sure my characters had to work for their kills, and see what the experience would be like.

1. Demon Hunter:
• best (least annoying) male voice so far, looks pretty cool, and who doesn’t like the idea of dual-wielding crossbows
• felt a bit weak at the start of the game, got a lot stronger/easier as the game progressed and I leveled up
• personally not fond of having to keep running away from enemies (so they can’t hit me) while shooting them
• Rapid Fire works best if you hold down the key/mouse-button to use it, rather than single casting it (silly me) – does a fairly good job of taking down big mobs or groups of them
• Skeleton King battle felt relatively easy – the Chakram took care of the skeletons he summoned, and being ranged kept me out of (most of) his attacks

Diablo Lore + Diablo 2 Postmortem

Diablo 3 is due out this year, possibly even next month, and I for one am looking forward to it! I play a lot of World of Warcraft, mainly working the Auction House and making gold, and Diablo 3 is going to have a “real money” Auction House. It probably wont make me rich, but it’s always nice if your hobby generates some income ;)

Back on topic, there’s a great Gamasutra article titled “Postmortem: Blizzard’s Diablo II” which gives you an inside look in to the development that went in to Diablo 2 and lessons learned from Diablo 1, etc – some interesting stuff.

Next up are three great YouTube videos by “Force Strategy Gaming“, covering the Diablo Lore leading up to Diablo 3, a great way to catchup before the releases:

Part 1 – Pre-Diablo:

Twitter Avatar Image Hackery

Twitter does something I consider to be poor security-wise… not renaming, or removing EXIF information from, uploaded avatar images. There are a few potential security issues around this, all of which I’ve personally come across:

1. The image might be named with the person’s first and last name – potentially disclosing more information than they intended to in their Twitter profile
2. Many people download their Facebook Profile picture to use on Twitter  – Facebook renames uploaded files to include the Facebook user ID, allowing you to easily find their Facebook profile (as opposed to trying to search on their first and last name)
3. If the original filename is unique enough you can often find other related pictures just by Goolging
4. You can use something like Jeffrey’s Exif viewer to extract EXIF information from the image – often telling you what type of camera/phone the user has

Sure, they’re small things, but for anyone wanting to Social Engineer the target it could certainly help. The frustrating part: it would take only few lines of code for Twitter to prevent this, and it really is (in my opinion) a “best practice” they’re simply not bothering to follow.

SQLite mischief (password stealing) via custom DLL

There’s a (Windows) program I use that stores it’s data in SQLite files… password protected SQLite files… and I’d really like to take a look inside of them. I’ve tried looking for the password as an embedded text string, I’ve tried decompiling the .Net code (with Reflector – but it’s obfuscated), and I’ve tried attaching a debugger and stepping through tons of ASM code, but still haven’t been able to find the password.

During a mild case of insomnia I had another thought on cracking/bypassing SQLite password protection: what if (in the case where the app uses a .dll file, rather than statically linking the library) I just downloaded the SQLite source code, added “logging” of sorts to each of the main functions (“login”, executing queries, etc), compiled it, and replaced the application’s version with mine – the DLL would basically just output the database’s password for me, in plain text, perfect for opening it with something like SQLiteSpy :D

SanDisk 2-in-1 memory card and USB

I might be a bit late to the party, but I’ve just found out about SanDisk’s “2-in1″ memory cards, which I think are awesome. They look and work just like a regular SD card (think digital cameras, etc) but fold half of it down and it reveals a USB adapter, ready to be plugged straight in to your computer:

What’s so great about this, you ask? Well, I’d imagine it’s far easier to keep one of these in your wallet than to carry a flash drive around with you everywhere (and I prefer to keep my keyring as small as possible so I’m not fond of attaching a flash drive to it). It also has a hardware “read only” lock (at least judging by the pictures), so no more “autorun” viruses when plugging in to infected machines, and you could boot an OS off of it and not worry about becoming infected or backdoor’ed (at least not past a reboot) when visting places like Defcon ;)

Selling for $13 from Amazon (for the 2GB), I definitely think I’m going to get myself one!

Scrooge McDuck Did Inception First

There’s an interesting article over at Cracked.com about “5 Amazing Things Invented by Donald Duck“… like how they already did “Inception”, in a comic book.

Check it out: http://www.cracked.com/article_19021_5-amazing-things-invented-by-donald-duck-seriously.html#Title_box

Samsung R590 Hackingtosh + DSDT file

I’m trying to get Mac OS X to run on my Samsung R590 and I’m not having much luck… I can installed 10.6.3 from my retail disk, using iBoot, and it’s usable – though the ethernet or wireless LAN adapters don’t work, and I have to reboot with iBoot every time.

Although I have no clue what I’m doing, I read that I may need a “DSDT” file – and I couldn’t find one for my laptop – so I set about extracting it and fixing it (well, trying to anyway – I did seem to get rid of the errors and warnings). I tried using it with MultiBeast but it didn’t help or fix anything, but maybe it’s of some use to someone else: SamsungR590.zip.

UPDATE: It seems things work fairly well (after updating to 10.6.6) with my DSDT file and the MultiBeast (3.20) settings below:

(The “System Definitions” is set to “Mac Pro” otherwise the nVidia drivers wont install)

Chameleon boots (so you don’t need the “iBoot” disk) and the keyboard and trackpad works (though the trackpad’s detected as a mouse, not a trackpad, so swiping doesn’t work). LAN and Wireless still don’t work, despite having tried multiple kext files and adding a “IONameMatch” to “AppleAirPortBrcm4311.kext/Contents/Info.plist” (see http://www.insanelymac.com/forum/index.php?showtopic=223182 for more info – my R590 has a “pci14e4,4727″ wireless adapter).

You can get sound working by using “VoodooHDA” (here’s the exact version I used: VoodooHDA.kext.zip) – I had to “sudo rm -rf /System/Library/Extensions/AppleHDA.kext” though – and “VoodooBattery” (version I used: VoodooBattery.kext.zip) will show your battery status etc.

Update: It might also be worth keeping an eye on http://wiki.osx86project.org/wiki/index.php/HCL_10.6.6/Portables#R590 – in case anyone else adds to it :/

String to Hex / Hex to String – in Ruby :D

I’m busy converting a project of mine from PHP in to Ruby, and one of the things it needs to be able to do is convert a bunch of hex characters into a string (and vice versa)… which I wasn’t sure how to do, so I hit Google. As it turns out there seem to be several other people who’ve needed to do the same thing, without finding the answer they were looking for, so I got to trying to code my own functions and managed to come up with this:

# hex_to_string("486578546f537472") returns "HexToStr"
def hex_to_string(str)
  returned = ''
  for i in (0..str.length).step(2)
    unless str[i].nil?
      hex_chr = str[i].chr + str[i+1].chr
      returned += hex_chr.hex.chr
    end
  end
  returned
end

# string_to_hex("StrToHex") returns "537472546f486578"
def string_to_hex(str)
  returned = ''
  for i in (0..str.length)
    unless str[i].nil?
      returned += str[i].to_s(16)
    end
  end
  returned
end

I’m still new to Ruby, and don’t really know what I’m doing, so please feel free to make any improvements or suggestions. You can find the latest versions of these functions on github: https://github.com/hypn/HexToString

When I hate being a coder… #2

I just found this gem, in some of our billing code:

$ci = $this->paymentMethod;

$cc['CC_CardType'] = $ci['CC_CardType'];
$cc['CC_Number'] = $ci['CC_Number'];
$cc['CC_ExpMonth'] = $ci['CC_ExpMonth'];
$cc['CC_ExpYear'] = $ci['CC_ExpYear'];
$cc['CC_Name'] = $ci['CC_Name'];
$cc['CC_Street'] = $ci['CC_Street'];
$cc['CC_City'] = $ci['CC_City'];
$cc['CC_State'] = $ci['CC_State'];
$cc['CC_Country'] = $ci['CC_Country'];
$cc['CC_Zip'] = $ci['CC_Zip'];

$p->loadCreditCardPayment($cc, $total, 0);

First it copies A ($this->paymentMethod) to B ($ci), then copies each value of B in to C ($cc), and then passes C to the function. That’s right, 3 copies of the same data, and 14 lines of code. One could also have just passed A to the function, as so:

$p->loadCreditCardPayment($this->paymentMethod, $total, 0);

It’s kinda like pouring a drink that’s already in glass in to another glass, then using a spoon to move the liquid in to a different glass, then drinking from that last glass… why not just drink from the glass it was originally in? o_O

When I hate being a coder…

This is how NOT to comment your code:

#addCreditCard
function addCreditCard(){
… code removed …
//————————————————————————-
#addBankAccount
function addBankAccount(){
… code removed …
//———————————————————–
#deleteCreditCard()
function deleteCreditCard(){
… code removed …
//—————————————————————–
#deleteBankAccount()
function deleteBankAccount(){
… code removed …

Now I totally understand that for doc-generating programs, and certain IDEs, you’re meant to put comments above your functions describing them and the parameters use… but who does this (above)? Are you really so stupid that you need to put the function’s name in a comment above… the function’s name?

You, sir, should not be coding.