Mailbag

Deividson Luiz Okopnik and Howard Dyckoff · also

  double classes_ocurrences[M]; //M = Number of ambiguity classes
  double classes_pair_ocurrences[M][M];
  double tags_estimate[N]; //N = Number of tags (states)
  double tags_pair_estimate[N][N];

  vector <double> classes_ocurrences(M); //M = Number of ambiguity classes
  vector <vector <double> > classes_pair_ocurrences(M, vector<double>(M));
  vector <double> tags_estimate(N); //N = Number of tags (states)
  vector <vector <double> > tags_pair_estimate(N, vector<double>(N));

#include <vector>
#include <iostream>

using namespace std;

int main ()
{
        int N = 2;
        int a[N][N];
        vector < vector <int> > b (N, vector<int>(N));

        a[0][0] = 1;
        a[0][1] = 2;
        a[1][0] = 3;
        a[1][1] = 4;

        b[0][0] = 1;
        b[0][1] = 2;
        b[1][0] = 3;
        b[1][1] = 4;

        cout << "a: " << a[0][0] << " b: " << b[0][0] << endl;
        cout << "a: " << a[0][1] << " b: " << b[0][1] << endl;
        cout << "a: " << a[1][0] << " b: " << b[1][0] << endl;
        cout << "a: " << a[1][1] << " b: " << b[1][1] << endl;

        return 0;
}

a: 1 b: 1
a: 2 b: 2
a: 3 b: 3
a: 4 b: 4

  Just so we're really clear about this, and review:  I'm a system
  administrator who brought to your attention in ticket #28621 an episode
  of 419 fraud mail from your IP, 64.6.241.11, possibly through exploit of
  a buggy PHP page.  Ticket #28621 was immediately closed without any
  indication of resolution, and then (briefly) reopened when I asked what
  the resolution was. 

  One day later, I find that my ticketing system login no longer has
  access to that ticket.  I ask what's going on, resulting in this ticket
  (#28748) -- which ticket I find has now also been closed without
  comment.  

  So, I will now be setting all systems I administer to 550-reject mail
  from your company's IPs.  Have a nice eternity.

-- 
Britto

> The following message to <dirtur@academ01.zac.itesm.mx> was undeliverable.
> The reason for the problem:
> 5.1.2 - Bad destination host 'DNS Hard Error looking up academ01.zac.itesm.mx (MX):  NXDomain'

   Tiscali S.p.A. (Borsa Italiana, Milan: TIS) is one of the leading 
   alternative telecommunications operators in Europe. With one of 
   the broadest and most interconnected IP technology-based networks 
   worldwide, Tiscali supplies a wide range of services to its customers, 
   both private individuals and companies, namely: Internet access through 
   dial-up and ADSL as well as voice, VoIP, media, added-value services 
   and other technologically advanced products.

From: Francis Tyers <ftyers@prompsit.com>
Date: 2008/8/1
Subject: [Apertium-stuff] Par iaith newydd: apertium-cy-en / New

To: apertium-stuff@lists.sourceforge.net
Cc: Dafydd Jones <dafyddj@gmail.com>, "John D. Phillips"

From: Keith Owens <kaos@ocs.com.au>
To: luv-main@luv.asn.au
Date: Fri, 25 Jul 2008 12:10:40 +1000
Subject: Re: DNS Exploit: Fix for older Fedora machines?? 

> I have a couple of older FC2 machines running bind DNS. Is there an rpm
>available with the fix for the recent DNS exploit? Or am I stuck with
>the choice of compiling from source or upgrading the OS?

From: Keith Owens <kaos@ocs.com.au>
To: James Harper <james.harper@bendigoit.com.au>

Date: Fri, 25 Jul 2008 11:24:36 +1000
Subject: Re: DNS exploit: watch out for NAT boxes 

From: Keith Owens <kaos@ocs.com.au>
To: Brian May <brian@microcomaustralia.com.au>

Date: Fri, 25 Jul 2008 10:08:09 +1000
Subject: Re: DNS exploit: watch out for NAT boxes 

>Brian May (on Fri, 25 Jul 2008 09:17:56 +1000) wrote:
>>Keith Owens wrote:
>>> Bottom line: check if your DNS server is behind a NAT box that does
>>> sequential port mapping.  The 'Check My DNS' widget at
>>> http://www.doxpara.com will tell you if the outside world is seeing
>>> sequential ports or not.
>>>   
>>How does Linux NAT assign port numbers?
>
>2.6.26 should do random port mapping.  It starts off by trying to
>preserve the original (hopefully random) source port number.  If the
>original source port number is already in use by another NAT entry then
>it should generate a random source port number.  I say "should" because
>the code tests for flag IP_NAT_RANGE_PROTO_RANDOM and a quick check of
>the source did not find anywhere where that flag was set, I'm still
>looking.

Date: Fri, 25 Jul 2008 10:15:02 +1000
From: hannah commodore <hannah@tinfoilhat.net>
To: luv-main@luv.asn.au
Subject: Re: DNS exploit: watch out for NAT boxes

>test masquerading DNS queries to a small range of source port numbers
>and it went sequential .
>  
>Recent kernels should do random mapping but they do not. 

Date: Wed, 6 Aug 2008 16:52:29 -0700
From: Rick Moen <rick@linuxmafia.com>
To: conspire@linuxmafia.com
Subject: [conspire] Kaminsky presentation slides

0.  Bad guy induces a nameserver to issue queries for 1.foo.com,
    2.foo.com,... and floods it with forged responses delegating the
    query to claimed nameserver (or CNAME alias) "www.foo.com", and 
    trying to race that info back before the genuine response does.  
    Any response that succeeds and gets cached also carries the 
    (unrequested) "ADDITIONAL INFORMATION" datum that the forward-lookup 
    IP of www.foo.com is $EVIL_IP.  That unrequested info then gets 
    cached for a long time-to-live (TTL).  Voila!  Cache poisoning.
    Notice that the forged, malign data is in-bailiwick for foo.com.
1.  There are a huge number of ways to induce "safe" machines behind
    firewalls to ask about hostnames of an attacker's choosing:
    o  Web hyperlinks, with or without Typhoid Marys Javascript, Flash, 
       Java, etc. (though an attack can use those Typhoid Marys to 
       induce severe mischief by inducing reverse-DNS lookups).
    o  Practically any part of an attempted SMTP mail delivery.
    o  Logfiles that do reverse-DNS lookup (e.g., Web servers).
    o  "Web bugs" in documents.
    o  IDS paranoia that makes them do reverse-DNS lookups.
    (Kaminsky talks at length about ways to make this scale, practical,
    and more revealing of details of company-internal networks.)
2.  Making sure UDP source ports are random is a stopgap, as DNS's
    protocol design leaves it pretty unreliable.  (Duh.)
3.  DNS clients (resolver libs) are a little vulnerable if you
    can flood them with fake responses -- but at least don't cache.[1]
4.  Web (etc.) SSL certs don't necesssarily paper over the problem,
    because of dependency on DNS.  (For example:  Did you make your
    browser trust my Thawte cert for example.com?  Cool!
    That means it'll typically also accept my cert for paypal.com
    that has the same signature.  Or, hey, if I can convincingly forge
    paypal.com's DNS, I can register a Thawte certificate for paypal.com
    myself, because I can make the confirmation mails come to me.
    Ditto, almost everyone's "I forgot my password" link trusts DNS
    to some extent.)
5.  Risks also affect some internal networks, for several reasons including
    active internal code and routing that rely on DNS.  (Duh.)
6.  NAT is a sore point.

Choice quotation from the first slide:

    "-- I found a really bad bug a while ago.
        o   You might have heard of it...."

Date: Wed, 23 Jul 2008 22:37:55 -0700
To: conspire@linuxmafia.com

From: Eric De MUND <ead-conspire@ixian.com>
Reply-To: Eric De MUND <ead@ixian.com>
Subject: Re: [conspire] DNS vulnerability details

    DNS Resolver(s) Tested:

    1. 68.87.76.179 (sjos-cns01.sanjose.ca.sanfran.comcast.net)
       appears to have POOR source port randomness and GREAT transaction
       ID randomness.

    2. 68.87.76.181 (sjos-cns03.sanjose.ca.sanfran.comcast.net)
       appears to have POOR source port randomness and GREAT transaction
       ID randomness.

    3. 68.87.78.131 (utah-cns01.saltlakecity.ut.utah.comcast.net)
       appears to have GOOD source port randomness and GREAT transaction
       ID randomness.

-- 
Eric De MUND   | Ixian Systems           | Jab: eadixian@jabber.org/main
ead@ixian.com  | 650 Castro St, #120-210 | Y!M: ead0002
ixian.com/ead/ | Mountain View, CA 94041 | ICQ: 811788

Date: Thu, 24 Jul 2008 09:20:00 -0700
From: Rick Moen <rick@linuxmafia.com>
To: conspire@linuxmafia.com
Subject: Re: [conspire] DNS vulnerability details

> Ok, in repeated tests, I'm getting 2/3 POORs and 1/3 GOODs for source
> port randomness, and all GREATs for transaction IDs. This is Comcast.
> 
>     DNS Resolver(s) Tested:

iptables -t nat -A POSTROUTING -o ! lo -p udp --dport 53 \
    -j MASQUERADE --to-ports 1024-65535 --random

iptables -t nat -A POSTROUTING -o ! lo -p tcp --dport 53 \
    -j MASQUERADE --to-ports 1024-65535 --random

From: alMubarmij <almubarmij@gmail.com>
Date: 2008/8/12
Subject: Building a simple del.icio.us clone .. Files ?
To: joregan@gmail.com

> On Friday 25 July 2008 21:02:51 Ben Okopnik wrote:
> > On Fri, Jul 25, 2008 at 11:35:02AM -0700, Greg Metcalfe wrote:
> > > Regarding "2-cent tip: Removing the comments out of a configuration
> > > file":
> > >
> > > I don't like to invoke Yet Another Interpreter (Perl, Python, etc.) for
> > > simple problems, when I've already got a perfectly good one (the bash
> > > shell) running, and all those wonderful GNU programs.
> >
> > You know, I'm often puzzled when people say that. Whether you have Bash
> > running or not, your script launches another instance of it - *as an
> > interpreter.* The memory footprint of bash plus grep is not going to be
> > much smaller than that of Perl, either. You also lose the capability of
> > (easily) writing the result back to the original file. In what way is
> > this better?
> >
> The bit about launching another interpreter is forehead-slappingly correct, of 
> course. I have systems where bash is the only interpreter present. Sendmail's 
> restricted shell is disabled, etc. I wonder if I'm not subconciously making 
> peace with that situation, rather than growling about it.

> My 'dense' actually does other things via switches, such as reporting on local 
> modifications to config files via a mandated '# LOCALMOD date name reason' 
> standard, etc.
> 
> But it just growed, and most of it is far too nasty (non-standard switches, 
> etc.) to ever be seen by the public. I just grabbed the two most relevant 
> lines, and pasted. You'll have seen my shebang typo, for instance. 
> The 'dense' that's really in use does have the advantage of actually being 
> runable...

	cd
    svn co https://tools.assembla.com/svn/chdk/trunk 

   1) cd ~/chdk_cross_compiler/binutils-2.17
   2) ./configure --srcdir=../binutils-2.17 --target=arm-elf --prefix=${HOME}/arm-elf
   3) make
   4) make install

   export PATH=${HOME}/arm-elf/bin:$PATH

   cd ~/chdk_cross_compiler/gcc-3.4.6

   patch -p0 < ~/chdk/trunk/tools/patches/gcc-3.4-arm.diff

   cd /home/sujith/chdk_cross_compiler/gcc-3.4.6-arm-elf
   ../gcc-3.4.6/configure --srcdir=../gcc-3.4.6 --target=arm-elf \
     --enable-multilib --enable-languages=c --enable-clocale=gnu \
     --disable-libm --disable-libc --disable-threads \
     --disable-nls --disable-libssp --disable-intl --disable-libiberty \
     --with-cpu=arm9 --with-newlib --prefix=${HOME}/arm-elf
   unset LIBRARY_PATH 
   unset CFLAGS
   make
   make install

   cd ~/chdk/trunk

   PLATFORM=a720
   PLATFORMSUB=100c

   make fir

   mkdosfs -F 16

umount /dev/sda1
hexedit /dev/sda1

   @title Hello World
   print "Hello World" 

   for n=1 to 5
     print "Led blink ",n
     gosub "ledblink"
   next n

   :ledblink
     set_led 7 1 60
     sleep 1000
     set_led 7 0
     set_led 8 1 60
     sleep 1000
     set_led 8 0
     return 

     for n=1 to 6
         sleep 5000
         print "shoot ",n, "of ",6
         shoot
     next n

     set_raw 1
     sleep 1000
     shoot
     sleep 1000
     set_raw 0

     for n=1 to 10
         a=get_vbatt
         print "The V is ",a/1000, "V"
         print "The V is ",a, "mV"
         sleep 9000
         a=0
     next n

BTB.RVW 20080831
================
%A   Hal Abelson, Ken Ledeen, Harry Lewis
%C   Boston, MA
%D   2008
%G   ISBN-10: 0-13-713559-9
%G   ISBN-13: 978-0-13-713559-2
%I   Pearson Education, Inc.
%O   http://bitsbook.com
%P   366 pages
%T   "Blown to Bits: your life, liberty, and happiness after the digital explosion"

iwlist wlan0 scan

ifconfig wlan0 up

# This line enables the use of wpa_cli which is used by rc.wireless
# if possible (to check for successful association)
ctrl_interface=/var/run/wpa_supplicant
# By default, only root (group 0) may use wpa_cli
ctrl_interface_group=0
eapol_version=1
ap_scan=1
fast_reauth=1

network={
  scan_ssid=1
  mode=0
  ssid="SSID_To_Connect_To"
  proto=WPA
  key_mgmt=WPA-EAP
  pairwise=TKIP
  group=TKIP
  eap=LEAP
  priority=2
  auth_alg=LEAP
  eapol_flags=0
  identity="Your_User_Name"
  password="Your_Password"
}

#!/bin/bash

ifconfig wlan0 down
iwconfig wlan0 essid "XXXXXXXXXX"
ifconfig wlan0 up
wpa_supplicant -iwlan0 -c /etc/wpa_supplicant.conf -Dwext -dd

 cc src/uvhd.c -o bin/uvhd

 uvhd bin/uvhd r256s3  <-- execute uvhd to display bin/uvhd with options r256s3
 ====================    - r256 Record-size (256 is the default if omitted)
                         - s3 Spaces between scale and 3 line groups
                10        20        30        40        50        60
 r#  1 0123456789012345678901234567890123456789012345678901234567890123
     0 .ELF..............>.......@.....@.......H[..........@.8...@..... <-chars
       744400000000000000300000B040000040000000450000000000403000401010 <-zones
       F5C621100000000020E010000D000000000000008B100000000000808000D0A0 <-digits
    64 ........@.......@.@.....@.@.....................................
       00000000400000004040000040400000C0000000C00000000000000000000000
       6000500000000000000000000000000001000000010000008000000030004000
   128 ..........@.......@.............................................
       0000000000400000004000001000000010000000000000000000000000000000
       020000000200000002000000C0000000C0000000100000001000500000000000
   192 ..@.......@......9.......9........ ..............@.......@a.....
       0040000000400000E3000000E300000000200000000000000400000004600000
       0000000000000000491000004910000000000000100060000010000000100000

 uvhd bin/uvhd r256    <-- execute uvhd with option 'r' recsize=256
 ==================        (r256 is the default if no options specified)

 ---> s 'version'      <-- 's'earch for 'version' anywhere in program
      ===========
                      10        20        30        40        50        60
 r#      276 0123456789012345678901234567890123456789012345678901234567890123
       70400 useful,.but WITHOUT ANY WARRANTY; without even the implied warra
             7766762067725454455244525455445532767667726766276626676666276776
             53565CC025407948F5401E9071221E49B07948F540565E048509D0C954071221
          64 nty of..MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.....
             6772660044544445444445526724454455244524254554454452555545420000
             E490F600D52381E4129C9490F20694E53306F20100124935C1200520F35E0000
         128 See the full description of the GNU General Public License at:.h
             5662766267662667676776662662766244524666766257666624666676267306
             3550485065CC0453329049FE0F6048507E5075E521C0052C930C935E35014A08
         192 ttp://www.gnu.org/licenses......uvhd version 20080807 - Copyrigh
             7773227772667267626666676720000077662767766623333333322246777666
             440AFF777E7E5EF27FC935E353E000005684065239FE0200808070D03F092978
                                                  *******
 found--> s 'version' <--at byte# 229 of record# 276
 rec#=276 rcount=406 rsize=256 fsize=104126 bin/uvhd

 ---> ss     <-- may enter 'ss' to repeat the last 's' search
      ===      - will find 'version' in 2 other records (not shown here)

 ---> 1      <-- could then reset to record# 1 and repeat 'ss' to find again
      ===

 uvhd /var/log/wtmp r384   <-- investigate wtmp (recsize=384)
 =======================
 uvhd filename=/var/log/wtmp
 options=r384 lastmod=2008081704 today=20080817143240 print=p1
 rec#=1 rcount=1343 filesize=515712 recsize=384 fsize%rsize(remainder)=0
                      10        20        30        40        50        60
 r#        1 0123456789012345678901234567890123456789012345678901234567890123
           0 ....05..~...............................~~..runlevel............
             0000330070000000000000000000000000000000770077666766000000000000
             10000500E0000000000000000000000000000000EE0025EC565C000000000000
          64 ............2.6.18-92.1.6.el5xen................................
             0000000000003232332332323266376600000000000000000000000000000000
             0000000000002E6E18D92E1E6E5C585E00000000000000000000000000000000
         128 ................................................................
             0000000000000000000000000000000000000000000000000000000000000000
             0000000000000000000000000000000000000000000000000000000000000000
         192 ................................................................
             0000000000000000000000000000000000000000000000000000000000000000
             0000000000000000000000000000000000000000000000000000000000000000
         256 ................................................................
             0000000000000000000000000000000000000000000000000000000000000000
             0000000000000000000000000000000000000000000000000000000000000000
         320 .......................H<.......................................
             000000000000000000008A843900000000000000000000000000000000000000
             00000000000000000000B928C0B0000000000000000000000000000000000000

 uvhd /var/log/wtmp r384   <-- startup uvhd for /var/log/wtmp (recsize 384)
 =======================     - will display 1st record (same as above)
                             - not shown here to save space
 --> s 44(5),'uvadm'     <-- search for records with userid 'uvadm'
                           - displays 1st record found as follows:
 r#       74 0123456789012345678901234567890123456789012345678901234567890123
       28032 ........tty2............................2...uvadm...............
             0000800077730000000000000000000000000000300077666000000000000000
             70006F004492000000000000000000000000000020005614D000000000000000
          64 ................................................................
             0000000000000000000000000000000000000000000000000000000000000000
             0000000000000000000000000000000000000000000000000000000000000000
         128 ................................................................
             0000000000000000000000000000000000000000000000000000000000000000
             0000000000000000000000000000000000000000000000000000000000000000
         192 ................................................................
             0000000000000000000000000000000000000000000000000000000000000000
             0000000000000000000000000000000000000000000000000000000000000000
         256 ................................................................
             0000000000000000000000000000000000000000000000000000000000000000
             0000000000000000000000000000000000000000000000000000000000000000
         320 ....................A..H9.......................................
             000000000000000080004C843E00000000000000000000000000000000000000
             00000000000000006F0019489640000000000000000000000000000000000000

 --> w9999 44(5),'uvadm'    <-- Write all records with 'uvadm' in bytes 44-48
     ===================        to a tmp/file
                      10        20        30        40        50        60
 r#     1340 0123456789012345678901234567890123456789012345678901234567890123
      514176 ........tty2............................2...uvadm...............
             0000800077730000000000000000000000000000300077666000000000000000
             70005F004492000000000000000000000000000020005614D000000000000000
                      ----- bytes 64-319 omitted to save space -----
         320 .......................H.8......................................
             0000000000000000000011A4E300000000000000000000000000000000000000
             0000000000000000000050888890000000000000000000000000000000000000

 uvhd tmp/wtmp_080817_153211W r384  <-- examine selected records (user 'uvadm')
 =================================
 uvhd filename=/home/uvadm/tmp/wtmp_080817_153211W
 options=r384 lastmod=2008081715 today=20080817153306 print=p1
 rec#=1 rcount=30 filesize=11520 recsize=384 fsize%rsize(remainder)=0
                      10        20        30        40        50        60
 r#        1 0123456789012345678901234567890123456789012345678901234567890123
           0 ........tty2............................2...uvadm...............
             0000800077730000000000000000000000000000300077666000000000000000
             70006F004492000000000000000000000000000020005614D000000000000000
                      ----- bytes 64-319 omitted to save space -----
         320 ....................A..H9.......................................
             000000000000000080004C843E00000000000000000000000000000000000000
             00000000000000006F0019489640000000000000000000000000000000000000

 utmpdump tmp/wtmp_080817_153211W
 ================================
 [7] [03974] [2   ] [uvadm   ] [tty2   [Mon Jul 21 10:37:05 2008 PDT]
 [7] [03936] [2   ] [uvadm   ] [tty2   [Tue Jul 22 07:39:50 2008 PDT]
 [7] [03974] [2   ] [uvadm   ] [tty2   [Wed Jul 23 10:07:30 2008 PDT]
         - - - - - 24 records omitted to save space - - - - -
 [7] [03971] [2   ] [uvadm   ] [tty2   [Fri Aug 15 06:32:59 2008 PDT]
 [7] [03973] [2   ] [uvadm   ] [tty2   [Sat Aug 16 08:06:10 2008 PDT]
 [7] [03973] [2   ] [uvadm   ] [tty2   [Sun Aug 17 04:48:37 2008 PDT]
      000-005 - cust#
      010-034 - customer name
      035-059 - address
      060-075 - address
      077-078 - province
      080-089 - postal code
      090-101 - telephone#
      102-119 - contact name
      120-179 - this year monthly sales 12 * 5 byte packed decimal
      180-239 - last year monthly sales 12 * 5 byte packed decimal
      240-256 - unused

 uvhd data/custmas1 r256u  <-- execute uvhd on custmas1 with options r256u
 ========================    - option 'u' is required to allow Updates
                             - uvhd displays 1st record and prompts for commands
                      10        20        30        40        50        60
 r#        1 0123456789012345678901234567890123456789012345678901234567890123
           0 130140    EVERGREEN MOTORS LTD.    1815 BOWEN ROAD          NANA
             3333332222454545444244545524542222233332445442544422222222224444
             130140000056527255E0DF4F230C44E0000181502F75E02F140000000000E1E1
          64 IMO          BC V9S1H1    250-754-5531 LARRY WRENCH     ..4V|...
             4442222222222442535343222233323332333324455525544442222201357000
             9DF00000000002306931810000250D754D55310C12290725E38000000246C000
         128 .........W0....`........)X}..f3.....\.................4V}...f...
             0000000005300016000000002570063100095000000000000000013570016000
             0C0000C0270D0540C0000C0098D0263C0444C0000C0000C0000C0246D0056C00
         192 .E|...V}.......................f.....<........f.C 19950531
             0470005700000000880000000018000680001300000000694233333333222222
             35C0046D0000C0023C0000C0083C0056D0012C0000C0016D3019950531000000

 --> s 77(2),'AL'     <-- Search for record with 'AL' in bytes 77-78
     ============       - will display found record and prompt for commands
                      10        20        30        40        50        60
 r#       13 0123456789012345678901234567890123456789012345678901234567890123
        3072 201120    ALLTYPE RENTAL LTD.      BOX 1819                 DRAY
             3333332222444555425445442454222222244523333222222222222222224545
             20112000001CC4905025E41C0C44E0000002F801819000000000000000004219
 'AL'-->  64 TON VALLEY   AL T0E0M0    403-246-5274LARRY ZOLF        ........
             5442544445222442534343222233323332333344555254442222222200000000
             4FE061CC590001C04050D00000403D246D5274C12290AFC6000000000000C000
         128 ..........Fl...Il......................................vl..9q...
             0000000000460014600000000000000000000000000008900000000760037100
             0C0000C0086C0039C0000C0000C0000C0000C0000C0003C0000C0066C0091C00
         192 .4..................%.L.............I...........A 20010731
             1390000000000000000020400810000000004000000000004233333333222222
             24C0000C0000C0000C0054C0095C0000C0039C0000C0000C1020010731000000
      found--> s 77(2),'AL' <--at byte# 77 of record# 13
 rec#=13 rcount=32 rsize=256 fsize=8192 dat1/custmas1
 null=next,r#=rec,s=search,u=update,x=rollback,p=print,i=iprint,w=write,e=count
 ,g=genseq#,c=chkseq#,t=translate(ta=Asc,te=Ebc,tu=Upr,tl=Lwr,tc=Chars,tp=Pers)
 ,R#=Recsize,h1=char,h2=hex,q=quit,?=help -->

 --> u 77(2),'AB'    <-- Update bytes 77-78 with 'AB'
     ============      - re-displays record to confirm Update to 'AB'
                       - Updated record not shown here to save space

 --> ss              <-- repeat previous Search (double letters repeat commands)
     ===               - next AL record not shown here to save space

 --> uu              <-- repeat previous Update
     ===               - Updated AB record not shown here to save space

 uvhd data/custmas1 r256u    <-- re-execute uvhd on restored custmas1
 ========================      - displays 1st record and prompts for command
                               - 1st record not shown here to save space

 --> u999 77(2),'AB',,'AL'   <-- Update 77-78 to 'AB', IF existing 'AL'
     =====================     - displays last record updated as follows:
                      10        20        30        40        50        60
 r#       27 0123456789012345678901234567890123456789012345678901234567890123
        6656 318833    TOP NOTCH CONSTRUCTION   BOX 308, STN J           CALG
             3333332222545244544244455554544422244523332255424222222222224444
             31883300004F00EF43803FE3425349FE0002F80308C034E0A0000000000031C7
          64 ARY          AB T2A4X6    403-385-2965HARRY SMIRNOFF    ..85\...
             4552222222222442534353222233323332333344555254454444222200335000
             12900000000001204214860000403D385D29658122903D92EF6600000085C000
         128 ................................................................
             0000000000000000000000000000000000000001100000000000000000000000
             0C0000C0000C0000C0000C0000C0000C0000C0007C0000C0000C0000C0000C00
         192 .....................p...............<..%P......C 20021130
             0000000000000000000017800000000000008300258000004233333333222222
             00C0000C0000C0000C0000C0000C0000C0027C0050C0000C3020021130000000
         EOF, 32 records read, 11 updated u999 77(2),'AB',,'AL'
 rec#=27 rcount=32 rsize=256 fsize=8192 tmp/custmas1
 null=next,r#=rec,s=search,u=update,x=rollback,p=print,i=iprint,w=write,e=count
 ,g=genseq#,c=chkseq#,t=translate(ta=Asc,te=Ebc,tu=Upr,tl=Lwr,tc=Chars,tp=Pers)
 ,R#=Recsize,h1=char,h2=hex,q=quit,?=help --> ** quit request - program ended **

 --> u999 77(2),'AB',,'AL'  <-- Update 77-78 to 'AB', IF existing 'AL'
     =====================    - displays last record updated (as shown above)

Owen Townsend, UV Software Inc, 4667 Hoskins Rd
North Vancouver BC, V7K2R3 Canada
owen@uvsoftware.ca www.uvsoftware.ca
Tel: 604-980-5434 Fax: 604-980-5404

B1.	Tutorial #2 - investigate /var/log/wtmp log file
	- logs events such as reboot, shutdown, logins(userids)
	- select records for specified userid, write separate file

C1.	Tutorial #3 - investigate a typical mainframe file migrated to Unix/Linux
	- customer master file with Name,Address, and 24 packed decimal monthly sales
	- search and update 1 record at a time interactively
	- or 1 command to search all records replacing 1 pattern with a 2nd pattern

A1.	Tutorial #1 - investigate an executable binary program
	- search the uvhd program itself (for 'version')

September 2008 (#154):

Mailbag

This month's answers created by:

Our Mailbag

Vectors vs. dynamic arrays

Followup: [Apertium-stuff] Google patent

One moment in TAG mail administration

Virtualization

Followup: Apertium in 'The Guardian'

Eml to tiff converter

doubt in accessing serial port

learning linux

Delivery Status Notification (Failure)

Followup: [Apertium-stuff] Par iaith newydd: apertium-cy-en / New language pair: apertium-cy-en

Mailbag 2

This month's answers created by:

Editor's Note

DNS Exploit: Fix for older Fedora machines??

DNS exploit: watch out for NAT boxes

[conspire] Kaminsky presentation slides

[conspire] DNS vulnerability details

DNS source port randomisation

Talkback

Talkback:126/howell.html

Talkback:152/okopnik.html

Talkback:110/oregan1.html

Talkback:152/lg_tips.html

2-Cent Tips

Two-cent tip: Starting XWindow at certain virtual terminal

News Bytes

Contents:

News in General

Court upholds FOSS licences and community copyrights

Intel details Core i7 Architectures, Multi-core "Larrabee"

AMD: Ready to Compete

Progress on DNS Vulnerabilities, IANA test tool shows gaps

Mozilla's Firefox Wins the "Who's the Next Open Source Idol" Crown at LinuxWorld

Conferences and Events

Distro News

Debian "Lenny" Dev Tree Frozen

Freespire will go back to Debian

Scientific Linux Live CD/DVD 5.2 released for i386 and x86_64

gOS 3 Gadgets announced

Software and Product News

Sun Launches openSSO Express

Sun Unveils AMP Stack for Solaris and Linux

New Javascript Interpreter to be Launched with Firefox 3.1

Hacking a Canon A720IS digital camera with CHDK on GNU/Linux

Installation procedure

Scripting

Reference

Book Review: Blown to Bits

WPA Supplicant LEAP

System

See What Wireless LANs Are Out There

Scripts

WPA Supplicant Configuration

Connection Script

Software Review: uvhd - file investigation utility

Download and Compile

uvhd Tutorials

A1. Tutorial #1 - search executable file

A2. Search command

B1. Tutorial #2 - /var/log/wtmp search/select

B2. Search /var/log/wtmp for userid uvadm

B3. Select all records for userid 'uvadm'

B4. Examine records selected by Write

C1. Tutorial #3 - Customer Master with packed decimal fields

C2. custmas1 - Search/Update

C3. custmas1 - Multi-Record Search/Update

Notes about Multi-Record Search/Update

Conclusions

References

HelpDex

Ecol

XKCD

The Linux Launderette

Debian package management Sudoku