
<rss version='2.0'><channel><item><title></title><description><![CDATA[]]></description><link>http://bowo.web.id/bowo_view_content.php?id=273</link></item><item><title>Kenapa Kalo Ngantuk mood nya Ngambek</title><description><![CDATA[Kenapa ya kalo ngantuk bawaannya pengen marah-marah aja? Wah kalo
pengalaman gw sendiri sih kalo dah keasyikan kerja sampe lupa tidur
atau sampe kekurangan tidur berhari-hari pasti ada suatu hari yang
bawaannya pengen marah-marah, semua hal bikin ngeselin, pengennya
marah-marahin orang, semua nya Enggak BANGETT.... Kalo udah gak kontrol
gitu mendingan cari makan terus makan yang kenyang udah gitu tidur ..
dijamin pasti ntar bangun tidur bawaannya tenang bangedddd.. hehe.. 

Hari ini kacau banget jadi nya mood nya, semua jadi bahan makian, wah
kaco setelah diselidiki gw kurang tidur selama 5 hari ini.. What the
hell..

Sekarang jadi pertanyaan kenapa bisa begitu ya..?
]]></description><link>http://bowo.web.id/bowo_view_content.php?id=242</link></item><item><title>Menguasai Informasi Berarti Menguasai Dunia(1)</title><description><![CDATA[Siapa ya yang bilang pernyataan tersebut, Lupa saya. Tapi emang bener
ko sekarang terbukti jika anda menguasai informasi berarti anda
menguasai dunia.Dan anda akan terkalahkan oleh orang yang lebih
menguasai informasi dari pada anda. Pada Kesempatan Kali ini saya ingin
memberikan sedikit
tulisan tentang mengambil informasi-informasi uptodate yang anda
butuhkan di Internet. Banyak cara untuk mendapatkan informasi di
internet. Mulai dari Browsing ke situs-situs Favorit, RSS
Feed,Berlangganan Newsletter, Mengikuti Forum Diskusi&amp;nbsp; hingga
Milis(Mailing List). Media yang akan saya bahas kali ini adalah Milis.

Mailing List atau biasa disebut milis merupakan media yg juga
berperanan sangat penting bagi kita dalam mendapatkan
informasi.

Berjuta-juta mungkin bermilyar-milyar mailing list tersebar di
Internet. Salah satu yang sangat populer adalah Yahoogroups dari Yahoo!!
. Anda dapat memulai mengikuti mailing list sesuai dengan minat anda.
Misalkan anda seorang pengusaha atau pebisnis anda bisa mengikuti
milis-milis yang berhubungan denga bidang usaha anda. Dari A-Z beserta
tips &amp;amp; trik minat anda ada disana. Mungkin anda bisa juga
mengikuti
milis-milis yang berhubungan dengan Hoby,Komunitas dan lain sebagainya.


Awal-awal saat saya mengetahui tentang mailing list ini saya disibukkan
dengan mailbox saya yang penuh, ketika itu saya masih menggunakan
webmail untuk membaca dan menulis email. Sehingga akhir nya pusing
sendiri dengan keberadaan email-email pada Inbox saya. Buat saya
membaca email-email dari mailing list melalui webmail merupakan
perkerjaan yang membosankan. Hingga saya waktu itu mengerti tentang
menggunakan fasilitas pop3. Sekarang membaca email tidak lagi menjadi
pekerjaan yang menjemukan. Menerima Ribuan email setiap hari bukan lah
menajadi suatau masalah. Ditambah lagi dengan kemajuan teknologi SPAM
Filter, Anti Virus dan masih banyak yang lainnya turut membantu kita
untuk ber mailing list

Sedikit Tips dari saya mungkin berguna bagi anda :
 Apabila anda mengikuti mailing list
yang traffic email nya sangat
tinggi maka disarankan menggunakan email service yang berkapasitas
besar sehingga tidak memenuhi Inbox anda. Google Mail (Gmail)
menyediakan lebih dari 1GB untuk email-email anda. Gmail juga
menyediakan service untuk pop3. Fasilitas tersebut semua nya
Gratis. Selalu Update Antivirus anda bagi anda yang menggunakan Operating System Microsoft Windows karena banyak
sekali virus yang menyerang
operasi ini melalui email. Jika anda menggunakan OS lain seperti Linux atau yang
lainnya Virus bukanlah menjadi suatu masalah sepertinya
Aktifkan SPAM Filter anda, untuk menangkis para spammer di
internet. Pisahkan email bisnis dengan email
mailing list anda. 


Sekarang saya merupakan anggota pasif(nyedot email aja) dari berbagai mailing list. Dari mulai
milis computer,technology sampai Bisnis saya ikuti. Kurang lebih
100
email account yang saya kelola untuk menampung kurang lebih 200 milis yang saya ikuti. Dengan Bantuan Mozilla
Thunderbird untuk menampung email email bukan lah suatu masalah lagi.



Nantikan artikel selanjutnya
mengkonfigurasi Email Client anda Untuk menyedot Berbagai Informasi
dari Internet dengan Flexible dan Portable
]]></description><link>http://bowo.web.id/bowo_view_content.php?id=213</link></item><item><title>PROXXY</title><description><![CDATA[http://freshproxy.com/
http://proxy.org/cgi_proxies.shtml

www.proxy4free.com
http://anonycat.com/webproxylist.htm

Free Proxy Lists Links


Here is a list of some third-party sites where you can find free proxy server lists.


http://www.proxy4free.com


http://www.publicproxyservers.com


http://www.anonymitychecker.com


http://www.proxz.com


http://www.digitalcybersoft.com/ProxyList/


http://www.checker.freeproxy.ru


http://tools.rosinstrument.com/proxy/


http://www.samair.ru/proxy/


http://www.multiproxy.org/anon_proxy.htm
]]></description><link>http://bowo.web.id/bowo_view_content.php?id=161</link></item><item><title> Beware of hacker attacks at public Hotspots   </title><description><![CDATA[Going
online these days exposes your PC to all kinds of cyber-nasties such as
viruses and spyware. To combat them, we use anti-virus and anti-spyware
software. You also can subject yourself to a wide variety of hacker
attacks that try to access your computer. These kinds of attacks try to
steal your passwords, credit card numbers, banking information and any
other kind of sensitive information you may have stored on your
computer's hard drive. For those problems, we install firewalls that
hopefully let only the good data come in.That's all well and
good when you're using your computer at home or at the office. But what
about when you take your portable computer to a Hotspot?

Hotspots
are venues that offer wireless access to the Internet. Typical public
Hotspots include libraries, airports and other commercial locations
such as restaurants and coffee houses such as Starbucks. It turns out
that when you go wireless, accessing the data to and from your computer
is even easier to get than it is when you are directly wired to a
network. After all, it's being transmitted out over the open air so
it's readily accessible to anyone who knows how to reach out and grab
it.One example of how hackers get your wireless data is via an
''Evil Twin.'' Say you're about to log onto your local Starbucks'
T-Mobile connection to gain access to the Internet. Nearby, an attacker
with an ordinary laptop running special software can interfere with the
Hotspot's legitimate network connection by sending a stronger signal
from a base station positioned close to the wireless client (Starbucks)
thus turning the fake access point into a so-called Evil Twin. You see
a Web site that looks identical to the legitimate T-Mobile logon screen
you normally see, asking for your user name, password or a credit card
number. But in fact, you are really logged onto the Evil Twin Web site.
So when you enter in your account information, everything is being
captured by the bad guys.Some of the more simplistic Evil Twin
sites will just say that the service is temporarily down and to try
again later. You leave never suspecting that your sensitive information
has already been captured and stolen. More sophisticated Evil Twin
sites may actually supply you with Internet access so that wherever you
go, everything you type and receive is also being intercepted and
stolen. And you may never be the wiser until it's too late. So what do
you do?On Computer America, I recently interviewed Richa rd
Rushing, the chief security officer for AirDefense. The company makes
AirDefense Personal, an end-user software agent that protects users of
Hotspots and other networks from wireless risks that could expose
private data and transactions. His advice is to never give out
proprietary information while using a Hotspot. Just surf the Net for
casual purposes. Never use anything that requires a password or access
anything that you wouldn't want anyone else to know. The other thing
you can do is use AirDefense Personal. The software is specially
designed to first help reconfigure your computer's operating system so
that is less susceptible to hacker attacks. For example, it disables
Bluetooth, and turns off bridging and ad hoc modes.AirDefense
Personal checks for a variety of suspicious behaviors such as an
unusually high amount of wireless data transmitted compared to what you
ordinarily transmit. And best of all, AirDefense Personal is free. The
company bills it as their lite version but according to Rushing, the
only other thing added to their full version is useful only to
enterprise environments. So for the single average user, the lite
version is all you'll need. Currently in its version 2.0 release,
AirDefense Personal can be downloaded from the company's Web site at http://www.airdefense.net . So
go ahead and enjoy the convenience of being able to wirelessly access
the Internet. Just make sure that you use some common sense, a dash of
caution and AirDefense Personal. With these precautions in mind, you'll
be more inclined to stay cool at your Hotspot. 
================================================
source: http://www.mcall.com
================================================

]]></description><link>http://bowo.web.id/bowo_view_content.php?id=155</link></item><item><title>email icon generator</title><description><![CDATA[email icon generator
http://services.nexodyne.com/email/index.php
]]></description><link>http://bowo.web.id/bowo_view_content.php?id=148</link></item><item><title>Nokia 6600</title><description><![CDATA[
This is a copy paste from All About Symbian
Forums
(http://www.allaboutsymbian.com/forum/showthread.php?t=23770&amp;amp;page=1&amp;amp;pp=15)
but it was good reading so I am putting it here 




First i will start by listing the 2 limitations of the 6600, voice recorder and video recodring.





Unlimited sound recorder - Dictaphone


Unlimited Video recorder - Eti Camcorder pro 2004





You must turn sound off to use etic pro with Nokia 6600





MP3 PLAYERS





I have used all the mp3 players out and i mean all of them. The best mp3 player is;





Mp3 Player. This is the best out of all of them, it scans your phone
for the mp3 so it can play from any location on your phone. It has the
smallest footprint, no other mp3 player has a smaller installation
size. It will play all of the mp3's in the list when one has finished
it will play the next. It has equilizer settings, it supports bluetooth
headset, apparently its the only player to support STEREO sound.





Most important feature, it uses the least amount of phone RAM, so you can play your mp3 and even play goboy with no probs.










Ebook reader with Mp3 support - This player has the best quality as
far as Im aware, however it has a huge installation size and can only
play one song at a time this is done by opening the file.








Getting Small MP3's on your phone around 1mb per song instead of 3mb





And to who asked in the froum - YOU CANT COMPRESS MP3'S THEY ARE ALREADY COMPRESSED.





Download WHITE TIGER STUDIO for pc, im using version 3 (or is it 4 i dont know) because I think the current version 5 sucks.








Now uncompress your mp3 to a wav file then compress the wav file back to mp3 format with the follwing settings.





Ok you need to be looking at the khz value not the bitrate.




for loudspeaker use 22,000khz (40kbit lowest bit rate on 22k) and
mono since you only have one speaker so stereo is pointless. You will
get typically 1mb files. I see no point using anything higher because
the loudpseaker is bad quality so having a good quality mp3 will only
waste space.




for headphone use - use 44,000khz and the lowest bit rate for
44khz, you cant really tell that much between the highest and lowest
bitrates on a cell phone (id


imagine) if your using a BT headset then use mono (coz you have only thing in your ear) and use stereo if your using headphones!








EMULATORS








GOBOY - gbc emulator, very good apparently supports zipped files.





Gamephone Advance - just like goboy but better for phone reason see below




Picodrive - AHA!!! A megadrive emulator this is freeware as far as
I know, it is still in early development but it runs games very smooth
actually smoother then my PC. Currently has no sound support and the
changing the keys is weird, delete the ini file in its root folder if
you screw em up. - This is proof that nokia 6600 can run SNES games!!!
Ur megadrive is a 16bit machine so it should be able to run snes too,
take that GBA







Gamephone advance has sound, although not great it has sound none
the less, goboy+ which i have installed still has no sound on the 6600,
it might just be me, but i reckon that the loud speaker isnt supported
as a speaker, but like i said it might just be me. NOTE: Gamephone
advance doesnt play gameboy advance game is a marketting trick with the
emu even though it has a gba icon.














IMAGINING APPS







FlexiCam - offers 25x zoom which looks rubbish when you are taking
the picture but once you take it it come out looking really nice. Also
supports night mode with zoom on, similar products support 25x zoom but
not night mode too. Also has a small window that displays the full un
zoomed picture which is useful when at high zoooms as you can tell what
you're pointing ur camera at.




Photofusion - Allows you to take unlimited panaroma shots vertical
and horizontal, you need to have a good hand to do this and use alot of
light, since it takes the image and superimposes the last part for you
to find where to stitch the next image too.




Photoactue - Allows you to take 1MP resolution pics with your
phone. It works by taking 4 images at once and then doing something
interesting to them. Each unproccesed image uses 500kb to store, whilst
processing the image you need to have around 4mbs of phone space, i
think it took 5mins to process the image.




Facewrapper - great for taking the pi$$ out of your mates, you take
a pic and it detects their face automaticlly and then morphs it into
very funny things.. USAGE. pick your victim take a pic and then show
everyone else but not him and your victim will be wondering whats so
funny.








SYSTEM TOOLS




Fxplorer - freeware. this is better then seleq as seleq has no copy
functions. Fxplorer allows you to see the file structure of your phone.
Be careful what you do you can really screw your phone up with this.
MUST HAVE




Stacker- this is another must have program. It compresses installed
programs and decompresses them automaticly on use. dont try and
compress ngage games you'll regret it. Also has the ability to shut
down a hung program.. all those dodgy java games




Doris Browser - Has a scarey name but is better then opera. Opera
doesnt allow you to enter text into text fields so google is useless to
you. This is the fastest browser of the two I think.




Total IR - Allows you to use your phone as a remote control for tvs
dvds vcrs yes it works i had alot of fun pi$$in about with my mates
tv.. doesnt work on all tv types.




erecorder - another dictaphone program looks quite nice but never
use it since i use dictaphone which can be hidden and then recording
starts when a hotkey is pressed.





RS60 (remote s60 i think) This sends the display on your phone to your PC, whatever is seen on your phone is sent to your PC





Softcam - This usess whatever within the box on ur PC's screen as a cam, seems to work on msn messenger and not yahoo.




You can use the above to software to use ur phone as a webcam. I
suggest you use torch to leave the light on and prevent the screensaver
coming on. USAGE start remote S60 on your pc then on your phone, as the
pc listens for the phone, then place softcams box over the screen for
remote s60







PCftp Bridge - The greatest program ever made for your phone. When
you use your phone with PC suite using BT or IR (make a serial
connection) it allows you to access your phone through FTP! You can
access everything (cept trial version dont allow system access) just
like normal window files. THIS IS GOING TO GIVE NOKIA THE BIGGEST
HEADAHCE see ngage section.




Zipman - Allows you to open zip files and add contents to a zip
file. It DOES NOT allow you to extract the files. Id imagine this was
released by wildpalm to get back the development costs for zip support
for goboy+. Zipman also supports upto V3.0 rar files and tar files with
an addon.




Launcher - Apparently this increases the amount of phone memory by
using the phones memroy as ram, my phone has ~6mb of mem and this
reports it to be around 9mb!??? also used as a themes programs which i
detest greatly




Where AM I - like minigps but allows for more functions havent used
it yet but sounds pretty nice. I have though it would be cool to turn
my phone to silent when i walk into a classroom. For those that dont
know, this program does something that you have told it to when you
move into a prestored gsm cell. So you store cell 2 as home and then
you move into cell2 it will do the thing you told it too.





NON NGAGE GAMES







GAYA - An arcade shooter in space, the gfx are rubbish they have
been very badly done. But its a good game very addictive but allows you
to save your position after each boss.




SkyForce - A VERY well done game you will not be dissappointed with
this game. It is a top to bottom scroller plane shooting arcade. Top
down prespective





Animal Farm - Bomberman Clone.





Nightmare - Similar to Diablo okish. Isometric Prespective




Metal Bluster - Walk around in a Mech and kill people good game but
the controls are hard to use on the 6600. Isometric Prespective





Intersteller flames - 3D gfx no real control over the craft you just tell it where to move 3rd person prespective.





Rally Pro Contest - 3D gfx running on the MOPHUN engine very well done, multiplayer support included.





Dead Or Alive Xtreme Volley Ball- Nice splash screens VERY ANNOYING XTREME sound plays like rubbish I think.




Prince of Persia Harlem Adventures - Works on the 6600 dont care
much for it, just happy it works unlike the first one. Works fine.




Mosqitos - The first game to use the camera to move your aiming -
can cheat by moving your hand behind it. THE BEST OT ALL OF CAM GAMES.





Killer Virus - Very large installation size - absolute rubbish




Moorhun Camera X - rubbish Camera game, doesnt use the camera view
as a background, its only saved by the fact that you can use the keys
to move the crosshair if you prefer instead of the camera.




Talon - Hated it at first but very good when given a chance when i
found out how to use the controls. took me 10mins to figure out how to
move, you cant move and aim the gun. its a flaying game that needs alot
of thought has you have to avoid traps everywhere.


Ok this is my guide on the Nokia 6600 because i think i know almost everything.




TerraForce - A 3D tank game, you move around a maze and kill other
tanks, supports BT multiplayer. Sort of difficult controls on 6600.





NOKIA USAGE TIPS





Prob - When I get a text Message it doesnt show up on screen and plays no sound.





Answer - You have been messeing around with the file system. You HAVE to format the MMC to fix this problem.







This problem is caused by moving a file from the system/mail
folders. so now the phone thinks it has a message but it has no message
because you have moved or deleted it. Note the inbox is a pointer to a
file in the mail folder so it is now pointing to something that is no
longer there.




When you send a file to your phone and you wish to move it
somewhere else, COPY IT!!! DONT CUT IT! that way the file is still
there for you to delete through your inbox.







MMC 128+ recommendation - i have heard that PQI cars are the best,
I cannot verify this I havent used one, just thought Id let you know.





BEST MMC READER




PQI - I have ordered one off the net, it was around 9 quid inc VAT
P&amp;amp;P, it is the only MMC reader that has built in Flash Memroy. The
drivers are sroted on the flash memroy so you dont need to install
drivers for it. This is brilliant for places that restrict access to
mass storage devices. I havent tested it yet as I havent been home to
get it. Id imagine it would work just like an Pen drive. Also include a
long 1M usb cable.








BLUETOOTH HEADEST




I have been trying to find a new headset for ages, and although
they are apparently comftable the jabra FREESPEAK 250 has very bad
static problems. Apparently because the FREESPEAK 250 uses a type 3
transistor that has a 1.5m range whilst the BT 250 uses a type 2
tranistor that has a 10m range. Hence why they were able to double the
battery life of the 250. Many sites label the FREESPEAK 250 as a BT250
they have got the name wrong thats all.




I have now put off getting a BT headset until the jabra T-800 comes
out, it has digital signal processing for something or other, anyhow i
suggest that one when it comes out. for those who cant wait, the G2
seems to be the best.




Even though I have never bought a headset I have done alot of
research and you need to ask the questions underneath before you buy a
headset








Headset Buyers Guide





RANGE OF BLUETOOTH


STATIC PROBLEMS


DISTANCE BETWEEN DEVICES BEFORE STATIC KICKS IN


NOISE REDUCTION FACILITIES


COMFORT OF FIT


SENSITIVITY OF MIC


DOES THE FIRMWARE PREVENT PC ACCESS


TALK TIME


STANDBY TIME


PRICE


HOW SECURE IS THE FIT


CAN THE DEVICE FIT AROUND PEOPLE WITH BIG EARS


HOW MANY DEVICES CAN BE PAIRED


IS NOKIA VOICE DIALLING SUPPORTED


DOES IT FIT IN THE EAR OR OVER THE EAR


IS THERE A HISS FOR THE PERSON LISTENING TO YOU


CAN YOU PUT THE PHONE IN YOUR TROUSER POCKET WITHOUT CAUSING STATIC


CAN YOU WEAR GLASSES WITH THE HEADSET


DOES THE HEADSET SUPPORT VOiP


CHARGE TIME


MICROPHONE ANGLE




ok the microphone angle if pointing upwards will be subject to the
wind as with the jabras. If the device doesnt allow pc access to it
then you cant use voip (i believe) VOiP allows you to route your PC's
mic and speakers to ur headset. Should save all of phone bills if your
gf has one of these and ADSL.





INCREASE BATTERY LIFE




I have heard reports that repeaditly dropping your phone onto
concrete surfaces from very far up manages to INCREASE! battery
performace by upto 75%! note that this DOESNT work on carpet and will
do nothing but damage your phone!











I hope you find this useful if it did find it helpful please post as im the curious type.

I have included only the best apps for 6600 which I use on my
phone. Everyting within this post has been tested for 6600 and I
gurantee that it works. Anything else you want to know ask, and i il
tell you about it.











MOST USELESS PROGRAM EVER SEEN!!




on handigo (whatever that site is called) they are offering
software that says you can use your phone as a survelliance camera for
your home!. OK PLEASE TELL ME WHAT RET@RD IS GONNA STICK THERE 6600 OFF
THEIR WALL. I mean the theif will be like tar very much nice security
cam you got their thanks very much!! 








NOKIA 6600 PROCESSOR runs at 104mhz and has 379.5kb of RAM (dirve D)
and a 22mb ROM drive (drive Z) yes your phone has alot more then 6mb
but you cant use the ROM drive!]]></description><link>http://bowo.web.id/bowo_view_content.php?id=143</link></item><item><title>Tracing a Hacker</title><description><![CDATA[
Sometimes, it's just not enough to simply know that there's a Trojan or
Virus onboard. Sometimes you need to know exactly why that file is
onboard, how it got there - but most importantly, who put it there.


By enumerating the attacker in the same way that they have
enumerated the victim, you will be able to see the bigger picture and
establish what you're up against. But how can you do this? Read on...



## Connections make the world go round ##


The computer world, at any rate. Every single time you open up a
website, send an email or upload your webpages into cyberspace, you are
connecting to another machine in order to get the job done. This, of
course, presents a major problem, because this simple act is what
allows malicious users to target a machine in the first place.



# How do these people find their victim?


Well, first of all, they need to get hold of the victim's IP
Address. Your IP (Internet Protocol) address reveals your point of
entry to the Internet and can be used in many ways to cause your online
activities many, many problems. It may not reveal you by name, but it
may be uniquely identifiable and it represents your digital ID while
you are online (especially so if you're on a fixed IP / DSL etc).


With an IP address, a Hacker can find out all sorts of weird and
wonderful things about their victim (as well as causing all kinds of
other trouble, the biggest two being Portnukes/Trojans and the dreaded
DoS ((Denial of Service)) attack). Some Hackers like to collect IP
Addresses like badges, and like to go back to old targets, messing them
around every so often. An IP address is incredibly easy to obtain -
until recently, many realtime chat applications (such as MSN) were
goldmines of information. Your IP Address is contained as part of the
Header Code on all emails that you send and webpages that you visit can
store all kinds of information about you. A common trick is for the
Hacker to go into a Chatroom, paste his supposed website address all
over the place, and when the unsuspecting victim visits, everything
about your computer from the operating system to the screen resolution
can be logged...and, of course, the all important IP address. In
addition, a simple network-wide port scan will reveal vulnerable target
machines, and a war-dialler will scan thousands of lines for exposed modems that the hacker can exploit.



So now that you know some of the basic dangers, you're probably wondering how these people connect to a victim's machine?



## Virtual and Physical Ports ##



Everything that you recieve over the Internet comes as a result of
other machines connecting to your computer's ports. You have two types;
Physical are the holes in the back of your machine, but the important
ones are Virtual. These allow transfer of data between your computer
and the outside world, some with allocated functions, some without, but
knowing how these work is the first step to discovering who is
attacking you; you simply MUST have a basic knowledge of this, or you
won't get much further.



# What the phrases TCP/UDP actually mean


TCP/IP stands for Transmission Control Protocol and Internet
Protocol, a TCP/IP packet is a block of data which is compressed, then
a header is put on it and it is sent to another computer (UDP stands
for User Datagram Protocol). This is how ALL internet transfers occur,
by sending packets. The header in a packet contains the IP address of
the one who originally sent you it. Now, your computer comes with an
excellent (and free) tool that allows you to see anything that is
connected (or is attempting to connect) to you, although bear in mind
that it offers no blocking protection; it simply tells you what is
going on, and that tool is NETSTAT.



## Netstat: Your first line of defence ##


Netstat is a very fast and reliable method of seeing exactly who or
what is connected (or connecting) to your computer. Open up DOS
(Start/Programs/MS-DOS Prompt on most systems), and in the MSDOS
Prompt, type:



netstat -a



(make sure you include the space inbetween the &quot;t&quot; and the &quot;a&quot;).



If you're connected to the Internet when you do this, you should see something like:





Active Connections



Proto Local Address Foreign Address State

TCP macintosh: 20034 modem-123.tun.dialup.co.uk: 50505 ESTABLISHED

TCP macintosh: 80 proxy.webcache.eng.sq: 30101 TIME_WAIT

TCP macintosh MACINTOSH: 0 LISTENING

TCP macintosh MACINTOSH: 0 LISTENING

TCP macintosh MACINTOSH: 0 LISTENING




Now, &quot;Proto(col)&quot; simply means what kind of data transmission is
taking place (TCP or UDP), &quot;Local address&quot; is your computer (and the
number next to it tells you what port you're connected on), &quot;Foreign
Address&quot; is the machine that is connected to you (and what port they're
using), and finally &quot;State&quot; is simply whether or not a connection is
actually established, or whether the machine in question is waiting for
a transmission, or timing out etc.



Now, you need to know all of Netstat's various commands, so type:



netstat ?



You will get something like this:





Displays protocol statistics and current TCP/IP network connections.



NETSTAT [-a] [-e] [-n] [-s] [-p proto] [-r] [interval]



-a Displays all connections and listening ports.

-e Displays Ethernet statistics. This may be combined with the -s option.

-n Displays addresses and port numbers in numerical form.
-p proto Shows connections for the protocol specified by proto;
proto may be TCP or UDP. If used with the -s option to display
per-protocol statistics, proto may be TCP, UDP, or IP.

-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are
shown for TCP, UDP and IP; the -p option may be used to specify a
subset of the default.




Have a play around with the various options, but the most important
use of these methods is when you combine them. The best command to use
is



netstat -an


because this will list all connections in Numerical Form, which
makes it a lot easier to trace malicious users....Hostnames can be a
little confusing if you don't know what you're doing (although they're
easily understandable, as we shall see later). Also, by doing this, you
can also find out what your own IP address is, which is always useful.



Also,



netstat -b



will tell you what ports are open and what programs are connecting to the internet.



## Types of Port ##


It would be impossible to find out who was attacking you if
computers could just access any old port to perform an important
function; how could you tell a mail transfer from a Trojan Attack?
Well, good news, because your regular, normal connections are assigned
to low, commonly used ports, and in general, the higher the number
used, the more you should be suspicious. Here are the three main types
of port:


# Well Known Ports These run from 0 to 1023, and are bound to the
common services that run on them (for example, mail runs on channel 25
tcp/udp, which is smtp (Simple Mail Transfer Protocol) so if you find
one of these ports open (and you usually will), it's usually because of
an essential function.


# Registered Ports These run on 1024 to 49151. Although not bound
to a particular service, these are normally used by networking
utilities like FTP software, Email client and so on, and they do this
by opening on a random port within this range before communicating with
the remote server, so don't panic (just be wary, perhaps) if you see
any of these open, because they usually close automatically when the
system that's running on them terminates (for example, type in a common
website name in your browser with netstat open, and watch as it opens
up a port at random to act as a buffer for the remote servers).
Services like MSN Messenger and ICQ usually run on these Ports.


# Dynamic/Private Ports Ranging from 49152 to 65535, these things
are rarely used except with certain programs, and even then not very
often. This is indeed the usual range of the Trojan, so if you find any
of these open, be very suspicious. So, just to recap:





Well Known Ports 0 to 1023 Commonly used, little danger.

Registered Ports 1024 to 49151 Not as common, just be careful.

Dynamic/Private Ports 49152 to 65535 Be extremely suspicious.





## The hunt is on ##


Now, it is essential that you know what you're looking for, and the
most common way someone will attack your machine is with a Trojan. This
is a program that is sent to you in an email, or attempts to bind
itself to one of your ports, and when activated, it can give the user
your passwords, access to your hard drive...they can even make your CD
Tray pop open and shut. At the end of this Document, you will find a
list of the most commonly used Trojans and the ports they operate on.
For now, let's take another look at that first example of Netstat....







Active Connections



Proto Local Address Foreign Address State

TCP macintosh: 27374 modem-123.tun.dialup.co.uk: 50505 ESTABLISHED

TCP macintosh: 80 proxy.webcache.eng.sq: 30101 TIME_WAIT

TCP macintosh MACINTOSH: 0 LISTENING

TCP macintosh MACINTOSH: 0 LISTENING

TCP macintosh MACINTOSH: 0 LISTENING




Now, straight away, this should make more sense to you. Your
computer is connected on two ports, 80 and 27374. Port 80 is used for
http/www transmissions (ie for all intents and purposes, its how you
connect to the net, although of course it's a lot more complicated than
that). Port 27374, however, is distinctly suspicious; first of all, it
is in the registered port range, and although other services (like MSN)
use these, let's assume that you have nothing at all running like
instant messengers, webpages etc....you're simply connected to the net
through proxy. So, now this connection is looking even more
troublesome, and when you realise that 27374 is a common port for
Netbus (a potentially destructive Trojan), you can see that something
is untoward here. So, what you would do is:





1) run Netstat , and use:



Netstat -a



then



Netstat -an



So you have both Hostnames AND IP addresses.





## Tracerouting ##


Having the attacker's IP is all well and good, but what can you do
with it? The answer is, a lot more! It's not enough to have the
address, you also need to know where the attacker's connections are
coming from. You may have used automated tracerouting tools before, but
do you jknow how they work?



Go back to MSDOS and type





tracert *type IP address/Hostname here*




Now, what happens is, the Traceroute will show you all the
computers inbetween you and the target machine, including blockages,
firewalls etc. More often than not, the hostname address listed before
the final one will belong to the Hacker's ISP Company. It'll either say
who the ISP is somewhere in there, or else you run a second trace on
the new IP/hostname address to see who the ISP Company in question is.
If the Hostname that you get back doesn't actually seem to mention an
actual geographical location within its text, you may think all is
lost. But fear not! Suppose you get a hostname such as



http://www.haha.com


Well, that tells us nothing, right? Wrong....simply enter the
hostname in your browser, and though many times you will get nothing
back, sometimes it will resolve to an ISP, and from there you can
easily find out its location and in what areas they operate. This at
least gives you a firm geographical location to carry out your
investigations in.


If you STILL have nothing, as a last resort you COULD try
connecting to your target's ISP's port 13 by Telnet, which will tell
you how many hours ahead or behind this ISP is of GMT, thus giving you
a geographical trace based on the time mentioned (although bear in
mind, the ISP may be doing something stupid like not having their
clocks set correctly, giving you a misleading trace. Similarly, a
common tactic of Hackers is to deliberately have their computer's clock
set to a totally wrong time, so as to throw you off the scent). Also,
unless you know what you're doing, I wouldn't advise using Telnet
(which is outside the parameters of this tutorial).



## Reverse DNS Query ##


This is probably the most effective way of running a trace on
somebody. If ever you're in a chatroom and you see someone saying that
they've &quot;hacked into a satellite orbiting the Earth, and are taking
pictures of your house right now&quot;, ignore them because that's just bad
movie nonsense. THIS method is the way to go, with regard to finding
out what country (even maybe what State/City etc) someone resides,
although it's actually almost impossible to find an EXACT geographical
location without actually breaking into your ISP's Head Office and
running off with the safe.



To run an rDNS query, simply go back to MS-DOS and type



netstat



and hit return. Any active connections will resolve to hostnames rather than a numerical format.



# DNS


DNS stands for Domain Name Server. These are machines connected to
the Internet whose job it is to keep track of the IP Addresses and
Domain Names of other machines. When called upon, they take the ASCII
Domain Name and convert it to the relevant numeric IP Address. A DNS
search translates a hostname into an IP address....which is why we can
enter &quot;www.Hotmail.com&quot; and get the website to come up, instead of
having to actually remember Hotmail's IP address and enter that
instead. Well, Reverse DNS, of course, translates the IP Address into a
Hostname (ie - in letters and words instead of numbers, because
sometimes the Hacker will employ various methods to stop Netstat from
picking up a correct Hostname).



So, for example,



298.12.87.32 is NOT a Hostname.

mail6.bol.net.au IS a Hostname.


Anyway, see the section at the end? (au) means the target lives in
Australia. Most (if not all) hostnames end in a specific Country Code,
thus narrowing down your search even further. If you know your target's
Email Address (ie they foolishly sent you a hate mail, but were silly
enough to use a valid email address) but nothing else, then you can use
the Country codes to deduce where they're from as well. You can also
deduce the IP address of the sender by looking at the emails header (a
&quot;hidden&quot; line of code which contains information on the sender)...on
Hotmail for example, go to Preferences, and select the &quot;Full Header's
Visible&quot; option. Alternatively, you can run a &quot;Finger&quot; Trace on the
email address, at:



www.samspade.org


Plus, some ISP's include their name in your Email Address with them
too (ie Wanadoo, Supanet etc), and your Hacker may be using an email
account that's been provided by a Website hosting company, meaning this
would probably have the website host's name in the email address (ie
Webspawners). So, you could use the information gleaned to maybe even
hunt down their website (then you could run a website check as
mentioned previously) or report abuse of that Website Provider's Email
account (and thus, the Website that it goes with) to



abuse@companynamegoeshere.com



If your Hacker happens to reside in the USA, go to:



www.usps.gov/ncsc/lookups/abbr_state.txt



for a complete list of US State abbreviatons.



## List of Ports commonly used by Trojans ##


Please note that this isn't a complete list by any means, but it
will give you an idea of what to look out for in Netstat. Be aware that
some of the lower Ports may well be running valid services.



UDP: 1349 Back Ofrice DLL

31337 BackOfrice 1.20

31338 DeepBO

54321 BackOfrice 2000





TCP: 21 Blade Runner, Doly Trojan, Fore, Invisible FTP, WebEx, WinCrash

23 Tiny Telnet Server

25 Antigen, Email Password Sender, Haebu Coceda, Shtrilitz Stealth, Terminator, WinPC, WinSpy, Kuang2 0.17A-0.30

31 Hackers Paradise

80 Executor

456 Hackers Paradise

555 Ini-Killer, Phase Zero, Stealth Spy

666 Satanz Backdoor

1001 Silencer, WebEx

1011 Doly Trojan

1170 Psyber Stream Server, Voice

1234 Ultors Trojan

1243 SubSeven 1.0 - 1.8

1245 VooDoo Doll

1492 FTP99CMP

1600 Shivka-Burka

1807 SpySender

1981 Shockrave

1999 BackDoor 1.00-1.03

2001 Trojan Cow

2023 Ripper

2115 Bugs

2140 Deep Throat, The Invasor

2801 Phineas Phucker

3024 WinCrash

3129 Masters Paradise

3150 Deep Throat, The Invasor

3700 Portal of Doom

4092 WinCrash

4567 File Nail 1

4590 ICQTrojan

5000 Bubbel

5000 Sockets de Troie

5001 Sockets de Troie

5321 Firehotcker

5400 Blade Runner 0.80 Alpha

5401 Blade Runner 0.80 Alpha

5402 Blade Runner 0.80 Alpha

5400 Blade Runner

5401 Blade Runner

5402 Blade Runner

5569 Robo-Hack

5742 WinCrash

6670 DeepThroat

6771 DeepThroat

6969 GateCrasher, Priority

7000 Remote Grab

7300 NetMonitor

7301 NetMonitor

7306 NetMonitor

7307 NetMonitor

7308 NetMonitor

7789 ICKiller

8787 BackOfrice 2000

9872 Portal of Doom

9873 Portal of Doom

9874 Portal of Doom

9875 Portal of Doom

9989 iNi-Killer

10067 Portal of Doom

10167 Portal of Doom

10607 Coma 1.0.9

11000 Senna Spy

11223 Progenic trojan

12223 Hack&acute;99 KeyLogger

12345 GabanBus, NetBus

12346 GabanBus, NetBus

12361 Whack-a-mole

12362 Whack-a-mole

16969 Priority

20001 Millennium

20034 NetBus 2.0, Beta-NetBus 2.01

21544 GirlFriend 1.0, Beta-1.35

22222 Prosiak

23456 Evil FTP, Ugly FTP

26274 Delta

30100 NetSphere 1.27a

30101 NetSphere 1.27a

30102 NetSphere 1.27a

31337 Back Orifice

31338 Back Orifice, DeepBO

31339 NetSpy DK

31666 BOWhack

33333 Prosiak

34324 BigGluck, TN

40412 The Spy

40421 Masters Paradise

40422 Masters Paradise

40423 Masters Paradise

40426 Masters Paradise

47262 Delta

50505 Sockets de Troie

50766 Fore

53001 Remote Windows Shutdown

54321 SchoolBus .69-1.11

61466 Telecommando

65000 Devil





## Summary ##


I hope this tutorial is useful in showing you both how to secure
yourself against unwanted connections, and also how to determine an
attacker's identity. The Internet is by no means as anonymous as some
people think it is, and although this is to the detriment of people's
security online, this also works both ways....it IS possible to find
and stop even the most determined of attackers, you just have to be
patient and keep hunting for clues which will help you put an end to
their exploits.


]]></description><link>http://bowo.web.id/bowo_view_content.php?id=141</link></item><item><title>DVD Recordable Formats (Guide) </title><description><![CDATA[C/P

Buying or bought a new DVD Burner and now you see DVD+R, DVD-R, DVD+RW,
DVD-RW, DVD-RAM?, DVD+R DL? What are all these? AHH Im confuzled? Well
I will tell you what this is about and other junks too



DVD-R
DVD-R is the most compatible of the formats. This format will play
in about 90% of DVD Players, DVD-Roms etc. It was the first recordable
format out. This format supports up to 4.37GB of data on a disk. You
can also get this disc double sided* and expand its space to 8.75GB of
data. This disc can be written on once and only once. Basically if it
screws up, you get a nice, shiny coaster.



DVD-RW
This format is the same as DVD-R but can be rewritten several
times. This format is compatible with about 80% of DVD Players, drives,
etc.



DVD+R
DVD+R is very simlar to DVD-R but supports a few more features,
thus sacrificing compatiblity. It supports lossless linking and both
CAV and CLV writing. Newbies dont worry about these features . This
format is compatible on about 80% of DVD Players, drives, etc. This
disc can be written on once and only once. Basically if it screws up,
you get a nice, shiny coaster. Supports the same amount of data DVD-R
does. 4.37GB and 8.75 GB Double Sided



DVD+RW
DVD+RW is the same as DVD+R but can be written on more several
times. It is compatible with about 70% of DVD Players, drives, etc.



DVD+R Dual-Layer
DVD+R is the same as DVD+R but supports 7.95GB on one disc. This
disc achieves this by having two seperate recordable layers. This disc
is the most expesive of the formats. This disc is also available in
double sided* format supporting up to 15.9GB of data. It is compatible
in about 75% of DVD Players, drives, etc.



DVD-RAM
DVD-RAM is the least supported format. many DVD Burners do not
support this. DVD-RAM usually comes in a catridge and will not fit in
most DVD-ROM drive, Player, etc. It is compatible with about 20% of DVD
Players. To my knowlage, no DVD-ROM drives support this format. Think
of this format as a slow harddrive. This format is not recommended.



Which is Right for Me?
Okay so now you know about all the formats but which is right for
you? Well that is up to your DVD-Player. It is best to buy 1 or 2 of
each format and try them out. Sometimes a DVD-Player will read DVD+R
but not DVD-R. Same goes for other formats. Some DVD-Players will not
read any recordable format and that just is no fun now is it.



Speeds

There are several speeds for discs. 2.4x, 4x, 8x, 16x. What do I get?
Well you should get the same speed as your DVD Burner supports. If
you get slower than what it supports do note try to burn with a higher
speed than what the disc says on it or you will probably end up with a
coaster. EG: burner a 2.4x Disc at 4x. Same goes for burning a 4x disc
at 2.4x. That stragely could still cause you to get a coaster.



Cheap Media
When CD-Writers came out blank discs were about $5 each. But then
cheap $2 blanks came out and people decided to save money and buy
those. Big mistake, back then. Those people ended up with alot of
coasters and ended up losing money. Now times have changed, you can buy
any brand blank CD discs and you will probably get a quality burn. Well
that old expensive versus cheap media has started all over again, this
time for Recordable DVD media. Do not buy cheap no name DVD Recordable
discs. Stick with known brands. I recommend:



-- TDK

-- Kodak

-- Verbatim

-- Ritek



Definitions

Double Sided: Both sides of the disc have a recordable surface.

Coaster: An object you use to place cups on or beverages on to.

Dual-Layer: A disc with two recordable layers. Almost doubling the discs capacity.

Sizes: The disc size may say 4.7GB on the Label but infact is 4.37GB.





=================


Also I suggest you avoid Ebay and be VERY careful of other online
suppliers. Always use suppliers that guarantee their sales, because
what many people don't know is that there are many levels of quality
main ones being A grade B grade and C grade.


Manufacturers create a batch of DVD blanks which are tested as part
of the process, this is where the grading happens (A B or C or reject).

(Most big name brands will not suffer this problem as they will settle for not less than A grade)



A grade is the best quality that is used by most people and commercial producers


B grade is medium quality that is good for general use but you will
get a few fualty DVD's in a batch. Mainly used for temporary storage
(magazine covers etc)


C grade is not really used by anyone knowingly but unknowingly I
think most of us have. This really is the lowest level before total
reject. The emulsion used for the DVD is usually organic and will
deteriorate over time (good quality A grade organic is OK). Ever
noticed a DVD you have burned worked ok initially but after a couple of
months it started to stop playback?


Unfortunatly SOME Wholesalers and mail order suppliers will buy a
bulk batch of A B and C grade media mix them up and flog them off as A
grade &amp;gt;&amp;gt;Not Good&amp;lt;&amp;lt;

Ebay is the worst place for this.


example would be Princo. Their A grade is excellent but the packs
you get on Ebay are littered with the false A grade. Also some Ritek
DVDs are sold this way on EBAY.



Please note that it is a few amongst the many that do this.



My advice is:

1. Buy from a well known &quot;Ebay store&quot; who guarantees their quality or avoid ebay and buy from a local supplier

2. Always seek out &quot;guaranteed&quot; A grade media.

3. Most media with &quot;A grade&quot; imprinted on the media itself is ok
4. (general burning advice) If you are doing many DVDs, pause after
each one or do a few and wait 5 minutes. All burners get hot, they are
lasers after all and non stop continued use will effect the burn
quality eventually.



Finally Always check the manufacturers web site for a compatability list and keep your firmware up to date.


If you want to try out a brand of disk buy 1 - 5 and test them out
yourself. Most incompatible media types will play up on first few
burns. As norseman said AVOID cheap no name disks BUT if you are
careful there are excellent cheap alternatives out there.





A lot of good information on:

http://www.cdr-zone.com/

http://www.cdfreaks.com/





Do not forget to look at DVD Media Reviews:

http://www.cdr-zone.com/reviews/dvd_media_reviews/
]]></description><link>http://bowo.web.id/bowo_view_content.php?id=140</link></item><item><title> How does Windows Product Activation(WPA)scheme work?</title><description><![CDATA[Inside Windows Product Activation





                        A Fully Licensed Paper





                              


   Fully Licensed GmbH, Rudower Chaussee 29, 12489 Berlin, Germany





                      http://www.licenturion.com








&amp;gt;&amp;gt; INTRODUCTION





The current public discussion of Windows Product Activation (WPA) is


characterized by uncertainty and speculation. In this paper we supply


the technical details of WPA - as implemented in Windows XP - that


Microsoft should have published long ago.





While we strongly believe that every software vendor has the right to


enforce the licensing terms governing the use of a piece of licensed


software by technical means, we also do believe that each individual


has the right to detailed knowledge about the full implications of the


employed means and possible limitations imposed by it on software


usage.





In this paper we answer what we think are currently the two most


important open questions related to Windows Product Activation.





  * Exactly what information is transmitted during activation?





  * How do hardware modifications affect an already activated


    installation of Windows XP?





Our answers to these questions are based on Windows XP Release


Candidate 1 (build 2505). Later builds as well as the final version of


Windows XP might differ from build 2505, e.g. in the employed


cryptographic keys or the layout of some of the data


structures.





However, beyond such minor modifications we expect Microsoft to cling


to the general architecture of their activation mechanism. Thus, we


are convinced that the answers provided by this paper will still be


useful when the final version of Windows XP ships.





This paper supplies in-depth technical information about the inner


workings of WPA. Still, the discussion is a little vague at some


points in order not to facilitate the task of an attacker attempting


to circumvent the license enforcement supplied by the activation


mechanism.





XPDec, a command line utility suitable for verifying the presented


information, can be obtained from http://www.licenturion.com/xp/. It


implements the algorithms presented in this paper. Reading its source


code, which is available from the same location, is highly


recommended.





We have removed an important cryptographic key from the XPDec source


code. Recompiling the source code will thus fail to produce a working


executable. The XPDec executable on our website, however, contains


this key and is fully functional.





So, download the source code to learn about the inner workings of WPA,


but obtain the executable to experiment with your installation of


Windows XP.





We expect the reader to be familiar with the general procedure of


Windows Product Activation.





&amp;gt;&amp;gt; INSIDE THE INSTALLATION ID





We focused our research on product activation via telephone. We did


so, because we expected this variant of activation to be the most


straight-forward to analyze.





The first step in activating Windows XP via telephone is supplying the


call-center agent with the Installation ID displayed by msoobe.exe,


the application that guides a user through the activation process. The


Installation ID is a number consisting of 50 decimal digits that are


divided into groups of six digits each, as in





      002666-077894-484890-114573-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XX





In this authentic Installation ID we have substituted digits that we


prefer not to disclose by 'X' characters.





If msoobe.exe is invoked more than once, it provides a different


Installation ID each time.





In return, the call-center agent provides a Confirmation ID matching


the given Installation ID. Entering the Confirmation ID completes the


activation process.





Since the Installation ID is the only piece of information revealed


during activation, the above question concerning the information


transmitted during the activation process is equivalent to the


question





               'How is the Installation ID generated?'





To find an answer to this question, we trace back each digit of the


Installation ID to its origins.





&amp;gt;&amp;gt;&amp;gt; Check digits





The rightmost digit in each of the groups is a check digit to guard


against simple errors such as the call center agent's mistyping of one


of the digits read to him or her. The value of the check digit is


calculated by adding the other five digits in the group, adding the


digits at even positions a second time, and dividing the sum by


seven. The remainder of the division is the value of the check


digit. In the above example the check digit for the first group (6) is


calculated as follows.





         1 | 2 | 3 | 4 | 5  &amp;lt;- position


        ---+---+---+---+---


         0 | 0 | 2 | 6 | 6  &amp;lt;- digits





         0 + 0 + 2 + 6 + 6 = 14       (step 1: add all digits)


             0     + 6     + 14 = 20  (step 2: add even digits again)





     step 3: division


             20 / 7 = 2, remainder is 20 - (2 * 7) = 6





             =&amp;gt; check digit is 6





Adding the even digits twice is probably intended to guard against the


relatively frequent error of accidentally swapping two digits while


typing, as in 00626 vs. 00266, which yield different check digits.





&amp;gt;&amp;gt;&amp;gt; Decoding





Removing the check digits results in a 41-digit decimal number. A


decimal number of this length roughly corresponds to a 136-bit binary


number. In fact, the 41-digit number is just the decimal encoding of


such a 136-bit multi-precision integer, which is stored in little


endian byte order as a byte array. Hence, the above Installation ID


can also be represented as a sequence of 17 bytes as in





               0xXX 0xXX 0xXX 0xXX 0xXX 0xXX 0xXX 0xXX


               0x94 0xAA 0x46 0xD6 0x0F 0xBD 0x2C 0xC8


               0x00





In this representation of the above Installation ID 'X' characters


again substitute the digits that we prefer not to disclose. The '0x'


prefix denotes hex notation throughout this paper.





&amp;gt;&amp;gt;&amp;gt; Decryption





When decoding arbitrary Installation IDs it can be noticed that the


most significant byte always seems to be 0x00 or 0x01, whereas the


other bytes look random. The reason for this is that the lower 16


bytes of the Installation ID are encrypted, whereas the most


significant byte is kept in plaintext.





The cryptographic algorithm employed to encrypt the Installation ID is


a proprietary four-round Feistel cipher. Since the block of input


bytes passed to a Feistel cipher is divided into two blocks of equal


size, this class of ciphers is typically applied to input blocks


consisting of an even number of bytes - in this case the lower 16 of


the 17 input bytes. The round function of the cipher is the SHA-1


message digest algorithm keyed with a four-byte sequence.





Let + denote the concatenation of two byte sequences, ^ the XOR


operation, L and R the left and right eight-byte input half for one


round, L' and R' the output halves of said round, and First-8() a


function that returns the first eight bytes of an SHA-1 message


digest. Then one round of decryption looks as follows.





          L' = R ^ First-8(SHA-1(L + Key))


          R' = L





The result of the decryption is 16 bytes of plaintext, which are -


together with the 17th unencrypted byte - from now on interpreted as


four double words in little endian byte order followed by a single


byte as in





                     name | size        | offset


                     -----+-------------+-------


                      H1  | double word |      0


                      H2  | double word |      4


                      P1  | double word |      8


                      P2  | double word |     12


                      P3  | byte        |     16





H1 and H2 specify the hardware configuration that the Installation ID


is linked to. P1 and P2 as well as the remaining byte P3 contain the


Product ID associated with the Installation ID.





&amp;gt;&amp;gt;&amp;gt; Product ID





The Product ID consists of five groups of decimal digits, as in





                       AAAAA-BBB-CCCCCCC-DDEEE





If you search your registry for a value named 'ProductID', you will


discover the ID that applies to your installation. The 'About' window


of Internet Explorer should also yield your Product ID.





&amp;gt;&amp;gt;&amp;gt;&amp;gt; Decoding





The mapping between the Product ID in decimal representation and its


binary encoding in the double words P1 and P2 and the byte P3 is


summarized in the following table.





       digits |  length | encoding


      --------+---------+---------------------------------------


        AAAAA | 17 bits | bit  0 to bit 16 of P1


          BBB | 10 bits | bit 17 to bit 26 of P1


      CCCCCCC | 28 bits | bit 27 to bit 31 of P1 (lower  5 bits)


              |         | bit  0 to bit 22 of P2 (upper 23 bits)


        DDEEE | 17 bits | bit 23 to bit 31 of P2 (lower  9 bits)


              |         | bit  0 to bit  7 of P3 (upper  8 bits)





The meaning of each of the five groups of digits is documented in the


next table.





       digits | meaning


      --------+-------------------------------------------------


        AAAAA | apparently always 55034 (in Windows XP RC1)


          BBB | most significant three digits of Raw Product Key


              | (see below)


      CCCCCCC | least significant six digits of Raw Product Key


              | plus check digit (see below)


           DD | index of the public key used to verify the


              | Product Key (see below)


          EEE | random value





As can be seen, the (Raw) Product Key plays an important role in


generating the Product ID.





&amp;gt;&amp;gt;&amp;gt;&amp;gt; Product Key





The Raw Product Key is buried inside the Product Key that is printed


on the sticker distributed with each Windows XP CD. It consists of


five alphanumeric strings separated by '-' characters, where each


string is composed of five characters, as in





                    FFFFF-GGGGG-HHHHH-JJJJJ-KKKKK





Each character is one of the following 24 letters and digits:





           B C D F G H J K M P Q R T V W X Y 2 3 4 6 7 8 9





Very similar to the decimal encoding of the Installation ID the 25


characters of the Product Key form a base-24 encoding of the binary


representation of the Product Key. Decoding the Product Key yields a


multi-precision integer of roughly 115 bits, which is stored - again


in little endian byte order - in an array of 15 bytes. Decoding the


above Product Key results in the following byte sequence.





               0x6F 0xFA 0x95 0x45 0xFC 0x75 0xB5 0x52


               0xBB 0xEF 0xB1 0x17 0xDA 0xCD 0x00





Of these 15 bytes the least significant four bytes contain the Raw


Product Key in little endian byte order. The least significant bit is


removed by shifting this 32-bit value (0x4595FA6F - remember the


little endian byte order) to the left by one bit position, resulting


in a Raw Product Key of 0x22CAFD37, or





                              583728439





in decimal notation.





The eleven remaining bytes form a digital signature, allowing


verification of the authenticity of the Product Key by means of a


hard-coded public key.





&amp;gt;&amp;gt;&amp;gt;&amp;gt; Product Key -&amp;gt; Product ID





The three most significant digits, i.e. 583, of the Raw Product Key's


nine-digit decimal representation directly map to the BBB component of


the Product ID described above.





To obtain the CCCCCCC component, a check digit is appended to the


remaining six digits 728439. The check digit is chosen such that the


sum of all digits - including the check digit - is divisible by


seven. In the given case, the sum of the six digits is





               7 + 2 + 8 + 4 + 3 + 9     = 33





which results in a check digit of 2, since





               7 + 2 + 8 + 4 + 3 + 9 + 2 = 33 + 2 = 35





which is divisible by seven. The CCCCCCC component of the Product ID


is therefore 7284392.





For verifying a Product Key, more than one public key is available. If


verification with the first public key fails, the second is tried,


etc. The DD component of the Product ID specifies which of the public


keys in this sequence was successfully used to verify the Product Key.





This mechanism might be intended to support several different parties


generating valid Product Keys with different individual private keys.





However, the different private keys might also represent different


versions of a product. A Product Key for the 'professional' release


could then be signed with a different key than a Product Key for the


'server' release. The DD component would then represent the product


version.





Finally, a valid Product ID derived from our example Product Key might


be





                       55034-583-7284392-00123





which indicates that the first public key (DD = index = 0) matched and


123 was chosen as the random number EEE.





The randomly selected EEE component is the reason for msoobe.exe


presenting a different Installation ID at each invocation. Because of


the applied encryption this small change results in a completely


different Installation ID.





So, the Product ID transmitted during activation will most probably


differ in the last three digits from your Product ID as displayed by


Internet Explorer or as stored in the registry.





&amp;gt;&amp;gt;&amp;gt; Hardware Information





As discussed above, the hardware configuration linked to the


Installation ID is represented by the two double words H1 and H2.





&amp;gt;&amp;gt;&amp;gt;&amp;gt; Bit-fields





For this purpose, the double words are divided into twelve


bit-fields. The relationship between the computer hardware and the


bit-fields is given in the following table.





    double word | offset | length | bit-field value based on


    ------------+--------+--------+----------------------------


         H1     |      0 |     10 | volume serial number string


                |        |        | of system volume


         H1     |     10 |     10 | network adapter MAC address


                |        |        | string


         H1     |     20 |      7 | CD-ROM drive hardware


                |        |        | identification string


         H1     |     27 |      5 | graphics adapter hardware


                |        |        | identification string


         H2     |      0 |      3 | unused, set to 001


         H2     |      3 |      6 | CPU serial number string


         H2     |      9 |      7 | harddrive hardware


                |        |        | identification string


         H2     |     16 |      5 | SCSI host adapter hardware


                |        |        | identification string


         H2     |     21 |      4 | IDE controller hardware


                |        |        | identification string


         H2     |     25 |      3 | processor model string


         H2     |     28 |      3 | RAM size


         H2     |     31 |      1 | 1 = dockable


                |        |        | 0 = not dockable





Bit 31 of H2 specifies, whether the bit-fields represent a notebook


computer that supports a docking station. If docking is possible, the


activation mechanism will be more tolerant with respect to future


hardware modifications. Here, the idea is that plugging a notebook


into its docking station possibly results in changes to its hardware


configuration, e.g. a SCSI host adapter built into the docking station


may become available.





Bits 2 through 0 of H2 are unused and always set to 001.





If the hardware component corresponding to one of the remaining ten


bit-fields is present, the respective bit-field contains a non-zero


value describing the component. A value of zero marks the hardware


component as not present.





All hardware components are identified by a hardware identification


string obtained from the registry. Hashing this string provides the


value for the corresponding bit-field.





&amp;gt;&amp;gt;&amp;gt;&amp;gt; Hashing





The hash result is obtained by feeding the hardware identification


string into the MD5 message digest algorithm and picking the number of


bits required for a bit-field from predetermined locations in the


resulting message digest. Different predetermined locations are used


for different bit-fields. In addition, a hash result of zero is


avoided by calculating





                   Hash = (Hash % BitFieldMax) + 1





where BitFieldMax is the maximal value that may be stored in the


bit-field in question, e.g. 1023 for a 10-bit bit-field, and 'x % y'


denotes the remainder of the division of x by y. This results in


values between 1 and BitFieldMax. The obtained value is then stored in


the respective bit-field.





&amp;gt;&amp;gt;&amp;gt;&amp;gt; RAM bit-field





The bit-field related to the amount of RAM available to the operating


system is calculated differently. The seven valid values specify the


approximate amount of available RAM as documented in the following


table.





                  value | amount of RAM available


                  ------+---------------------------


                      0 | (bit-field unused)


                      1 | below    32 MB


                      2 | between  32 MB and   63 MB


                      3 | between  64 MB and  127 MB


                      4 | between 128 MB and  255 MB


                      5 | between 256 MB and  511 MB


                      6 | between 512 MB and 1023 MB


                      7 | above              1023 MB





It is important to note that the amount of RAM is retrieved by calling


the GlobalMemoryStatus() function, which reports a few hundred


kilobytes less than the amount of RAM physically installed. So, 128 MB


of RAM would typically be classified as &quot;between 64 MB and 127 MB&quot;.





&amp;gt;&amp;gt;&amp;gt;&amp;gt; Real-world example





Let us have a look at a real-world example. On one of our test systems


the hardware information consists of the following eight bytes.





               0xC5 0x95 0x12 0xAC 0x01 0x6E 0x2C 0x32





Converting the bytes into H1 and H2, we obtain





                 H1 = 0xAC1295C5 and H2 = 0x322C6E01





Splitting H1 and H2 yields the next table in which we give the value


of each of the bit-fields and the information from which each value is


derived.





   dw &amp;amp;  |       |


  offset | value | derived from


  -------+-------+-----------------------------------------------


   H1  0 | 0x1C5 | '1234-ABCD'


   H1 10 | 0x0A5 | '00C0DF089E44'


   H1 20 |  0x37 | 'SCSI\CDROMPLEXTOR_CD-ROM_PX-32TS__1.01'


   H1 27 |  0x15 | 'PCI\VEN_102B&amp;amp;DEV_0519&amp;amp;SUBSYS_00000000&amp;amp;REV_01'


   H2  0 |   0x1 | (unused, always 0x1)


   H2  3 |  0x00 | (CPU serial number not present)


   H2  9 |  0x37 | 'SCSI\DISKIBM_____DCAS-34330______S65A'


   H2 16 |  0x0C | 'PCI\VEN_9004&amp;amp;DEV_7178&amp;amp;SUBSYS_00000000&amp;amp;REV_03'


   H2 21 |   0x1 | 'PCI\VEN_8086&amp;amp;DEV_7111&amp;amp;SUBSYS_00000000&amp;amp;REV_01'


   H2 25 |   0x1 | 'GenuineIntel Family 6 Model 3'


   H2 28 |   0x3 | (system has 128 MB of RAM)


   H2 31 |   0x0 | (system is not dockable)





&amp;gt;&amp;gt;&amp;gt; Using XPDec





XPDec is a utility to be run from the command prompt. It may be


invoked with one of four command line options to carry out one of four


tasks.





&amp;gt;&amp;gt;&amp;gt;&amp;gt; XPDec -i





This option enables you to access the information hidden in an


Installation ID. It decodes the Installation ID, decrypts it, and


displays the values of the hardware bit-fields as well as the Product


ID of your product. Keep in mind that the last three digits of the


Product ID contained in the Installation ID are randomly selected and


differ from the Product ID displayed by Internet Explorer.





The only argument needed for the '-i' option is the Installation ID,


as in





 XPDec -i 002666-077894-484890-114573-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XX





&amp;gt;&amp;gt;&amp;gt;&amp;gt; XPDec -p





To help you trace the origin of your Product ID, this option decodes a


Product Key and displays the Raw Product Key as it would be used in a


Product ID.





The only argument needed for the '-p' option is the Product Key, as in





                XPDec -p FFFFF-GGGGG-HHHHH-JJJJJ-KKKKK





Note that this option does not verify the digital signature of the


Product Key.





&amp;gt;&amp;gt;&amp;gt;&amp;gt; XPDec -v





This option calculates the hash of a given volume serial number. It


was implemented to illustrate our description of string hashing. First


use '-i' to display the hardware bit-fields. Then use this option to


verify our claims concerning the volume serial number hash.





The only argument needed for the '-v' option is the volume serial


number of your system volume, as in





                          XPDec -v 1234-ABCD





(The volume serial number is part of the 'dir' command's output.)





&amp;gt;&amp;gt;&amp;gt;&amp;gt; XPDec -m





This option calculates the network adapter bit-field value


corresponding to the given MAC address. Similar to '-v' this option


was implemented as a proof of concept.





The only argument needed for the '-m' option is the MAC address of


your network adapter, as in





                      XPDec -m 00-C0-DF-08-9E-44





(Use the 'route print' command to obtain the MAC address of your


network adapter.)





&amp;gt;&amp;gt; HARDWARE MODIFICATIONS





When looking at the effects of hardware modifications on an already


activated installation of Windows XP, the file 'wpa.dbl' in the


'system32' directory plays a central role. It is a simple


RC4-encrypted database that stores, among other things like expiration


information and the Confirmation ID of an activated installation,





  a) the bit-field values representing the current hardware


     configuration,





  and





  b) the bit-field values representing the hardware configuration


     at the time of product activation.





While a) is automatically updated each time the hardware configuration


is modified in order to reflect the changes, b) remains fixed. Hence,


b) can be thought of as a snapshot of the hardware configuration at


the time of product activation.





This snapshot does not exist in the database before product activation


and if we compare the size of 'wpa.dbl' before and after activation,


we will notice an increased file size. This is because the snapshot is


added to the database.





When judging whether re-activation is necessary, the bit-field values


of a) are compared to the bit-field values of b), i.e. the current


hardware configuration is compared to the hardware configuration at


the time of activation.





&amp;gt;&amp;gt;&amp;gt; Non-dockable computer





Typically all bit-fields with the exception of the unused field and


the 'dockable' field are compared. If more than three of these ten


bit-fields have changed in a) since product activation, re-activation


is required.





This means, for example, that in our above real-world example, we


could replace the harddrive and the CD-ROM drive and substantially


upgrade our RAM without having to re-activate our Windows XP


installation.





However, if we completely re-installed Windows XP, the information in


b) would be lost and we would have to re-activate our installation,


even if we had not changed our hardware.





&amp;gt;&amp;gt;&amp;gt; Dockable computer





If bit 31 of H2 indicates that our computer supports a docking


station, however, only seven of the ten bit-fields mentioned above are


compared. The bit-fields corresponding to the SCSI host adapter, the


IDE controller, and the graphics board are omitted. But again, of


these remaining seven bit-fields, only up to three may change without


requiring re-activation.





&amp;gt;&amp;gt; CONCLUSIONS





In this paper we have given a technical overview of Windows Product


Activation as implemented in Windows XP. We have shown what


information the data transmitted during product activation is derived


from and how hardware upgrades affect an already activated


installation.





Looking at the technical details of WPA, we do not think that it is as


problematic as many people have expected. We think so, because WPA is


tolerant with respect to hardware modifications. In addition, it is


likely that more than one hardware component map to a certain value


for a given bit-field. From the above real-world example we know that


the PX-32TS maps to the value 0x37 = 55. But there are probably many


other CD-ROM drives that map to the same value. Hence, it is


impossible to tell from the bit-field value whether it is a PX-32TS


that we are using or one of the other drives that map to the same


value.





In contrast to many critics of Windows Product Activation, we think


that WPA does not prevent typical hardware modifications and,


moreover, respects the user's right to privacy.





&amp;gt;&amp;gt; ABOUT THE AUTHORS





Fully Licensed GmbH is a start-up company focusing on novel approaches


to online software licensing and distribution. Have a look at their


website at





                      http://www.licenturion.com





for more information.





Their research branch every now and then analyzes licensing solutions


implemented by other companies.





&amp;gt;&amp;gt; COPYRIGHT





Copyright (C) 2001 Fully Licensed GmbH (www.licenturion.com)


All rights reserved.
]]></description><link>http://bowo.web.id/bowo_view_content.php?id=132</link></item></channel></rss>
