广域网中实现远程唤醒，被控计算机端要增加一个能获取公网IP地址、能设置端口映射的设备(如路由器、防火墙)。
1、在路由器中设置允许“Subnet Directed Broadcasts(子网定向广播)”，并且设置端口映射，将路由器的某一端口映射到被控计算机的任意端口 。
2、只要路由器通电，主控计算机就能通过互联网向路由器发送Magic Packet，而路由器与被控计算机之间是通过网线连通的，所以可以很顺利地将Magic Packet发送到被控计算机的网卡。路由器实际上起到中间桥梁的作用。
附上能发送Magic Packet的网页Wake On Lan over the Internet
http://www.depicus.com/wake-on-lan/woli.aspx
Netmask是一个比较值得注意的地方，填错了的话，目标IP地址就会出错。
下面通过一个例子简单讲述一下广域网远程唤醒的过程
假设主控计算机为A机，被控计算机为B机
B机的所在局域网环境如下：一条ADSL接在4口路由器R1上，R1的4 个口分别连接着S1,S2,S3,S4四台交换机。B机接在S3交换机的其中一个口。
R1拨号后自动获取到的IP为12.34.56.78，B机在局域网中的IP为192.168.1.167，MAC地址为BB:BB:BB:BB:BB:BB。
在R1设置端口映射条目如下：12.34.56.78:9——>192.168.1.255:168
这里192.168.1.255为192.168.1.167所在网络的定向广播地址。
为什么不直接映射到192.168.1.167呢?因为当B机关机后，192.168.1.167这个IP不再与R1通信，R1中关于192.168.1.167的ARP条目也会很快就消失，所有与192.168.1.167这个IP通信的数据包都会被丢弃。
1.A机向12.34.56.78(255.255.255.251)这个目标IP的9号端口发送一个包含FFFFFFFFFFFF和连续重复16次BBBBBBBBBBBB（为B的MAC地址）的Magic Packet的单播包，中间经过了N个路由，该单播包顺利进入R1;
2.当R1检测到该数据包端口号为9，根据端口映射条目将该数据包的目标IP及端口号修改为192.168.1.255:168，此时该包被R1识别成定向广播包，因为R1已设置成允许Subnet Directed Broadcasts，所以该包并没有被丢弃;
3.R1将这个广播包向4个口广播，S1,S2,S3,S4所连的所有端口都收到这个广播包，即便B机处于关机状态也会收到该广播包;
B机的网卡检测到广播包中含自己MAC地址信息的Magic Packet，就会被唤醒，而其它机收到之后只会将该数据包丢弃。
4.实际应用中不建议主控计算机通过IP地址去跟路由器通讯，因为一旦路由器重新获取IP地址，远程唤醒就会失效。只要路由器支持动态域名解析(DDNS)功能，可将路由设置成IP地址变更时自动向DDNS提供商重新注册IP地址，DDNS提供商将根据你的帐号对你申请的域名进行域名解析。设置成功后就可以通过固定的域名去与路由器通讯，唤醒与该路由器直连的计算机。
2010年10月7日星期四
Quake-III代码里神奇的浮点开方函数
Quake-III Arena (雷神之锤3)是90年代的经典游戏之一。该系列的游戏不但画面和内容不错，而且即使计算机配置低，也能极其流畅地运行。这要归功于它3D引擎的开发者约翰-卡马克（John Carmack）。事实上早在90年代初DOS时代，只要能在PC上搞个小动画都能让人惊叹一番的时候，John Carmack就推出了石破天惊的Castle Wolfstein, 然后再接再励，doom, doomII, Quake...每次都把3-D技术推到极致。他的3D引擎代码资极度高效，几乎是在压榨PC机的每条运算指令。当初MS的Direct3D也得听取他的意见，修改了不少API。
最近，QUAKE的开发商ID SOFTWARE 遵守GPL协议，公开了QUAKE-III的原代码，让世人有幸目睹Carmack传奇的3D引擎的原码。
这是QUAKE-III原代码的下载地址：
http://www.fileshack.com/file.x?fid=7547
(下面是官方的下载网址，搜索 “quake3-1.32b-source.zip” 可以找到一大堆中文网页的
ftp://ftp.idsoftware.com/idstuff/source/quake3-1.32b-source.zip)
我们知道，越底层的函数，调用越频繁。3D引擎归根到底还是数学运算。那么找到最底层的数学运算函数（在game/code/q_math.c）， 必然是精心编写的。里面有很多有趣的函数，很多都令人惊奇，估计我们几年时间都学不完。
在game/code/q_math.c里发现了这样一段代码。它的作用是将一个数开平方并取倒，经测试这段代码比(float)(1.0/sqrt(x))快4倍：
float Q_rsqrt( float number )
{
long i;
float x2, y;
const float threehalfs = 1.5F;
x2 = number * 0.5F;
y = number;
i = * ( long * ) &y; // evil floating point bit level hacking
i = 0x5f3759df - ( i >> 1 ); // what the fuck?
y = * ( float * ) &i;
y = y * ( threehalfs - ( x2 * y * y ) ); // 1st iteration
// y = y * ( threehalfs - ( x2 * y * y ) ); // 2nd iteration, this can be removed
#ifndef Q3_VM
#ifdef __linux__
assert( !isnan(y) ); // bk010122 - FPE?
#endif
#endif
return y;
}
函数返回1/sqrt(x)，这个函数在图像处理中比sqrt(x)更有用。
注意到这个函数只用了一次叠代！（其实就是根本没用叠代，直接运算）。编译，实验，这个函数不仅工作的很好，而且比标准的sqrt()函数快4倍！要知道，编译器自带的函数，可是经过严格仔细的汇编优化的啊！
这个简洁的函数，最核心，也是最让人费解的，就是标注了“what the fuck?”的一句
i = 0x5f3759df - ( i >> 1 );
再加上y = y * ( threehalfs - ( x2 * y * y ) );
两句话就完成了开方运算！而且注意到，核心那句是定点移位运算，速度极快！特别在很多没有乘法指令的RISC结构CPU上，这样做是极其高效的。
算法的原理其实不复杂,就是牛顿迭代法,用x-f(x)/f'(x)来不断的逼近f(x)=a的根。
简单来说比如求平方根,f(x)=x^2=a ,f'(x)= 2*x,f(x)/f'(x)=x/2,把f(x)代入
x-f(x)/f'(x)后有(x+a/x)/2，现在我们选a=5,选一个猜测值比如2，
那么我们可以这么算
5/2 = 2.5; (2.5+2)/2 = 2.25; 5/2.25 = xxx; (2.25+xxx)/2 = xxxx ...
这样反复迭代下去，结果必定收敛于sqrt(5)，没错，一般的求平方根都是这么算的
但是卡马克(quake3作者)真正牛B的地方是他选择了一个神秘的常数0x5f3759df 来计算那个猜测值
就是我们加注释的那一行,那一行算出的值非常接近1/sqrt(n),这样我们只需要2次牛 顿迭代就可以达到我们所需要的精度.
好吧 如果这个还不算NB,接着看:
普渡大学的数学家Chris Lomont看了以后觉得有趣，决定要研究一下卡马克弄出来的
这个猜测值有什么奥秘。Lomont也是个牛人，在精心研究之后从理论上也推导出一个
最佳猜测值，和卡马克的数字非常接近, 0x5f37642f。卡马克真牛，他是外星人吗？
传奇并没有在这里结束。Lomont计算出结果以后非常满意，于是拿自己计算出的起始
值和卡马克的神秘数字做比赛，看看谁的数字能够更快更精确的求得平方根。结果是
卡马克赢了... 谁也不知道卡马克是怎么找到这个数字的。
最后Lomont怒了，采用暴力方法一个数字一个数字试过来，终于找到一个比卡马克数
字要好上那么一丁点的数字，虽然实际上这两个数字所产生的结果非常近似，这个暴
力得出的数字是0x5f375a86。
Lomont为此写下一篇论文，"Fast Inverse Square Root"。
论文下载地址：
http://www.math.purdue.edu/~clomont/Math/Papers/2003/InvSqrt.pdf
http://www.matrix67.com/data/InvSqrt.pdf
参考：<IEEE Standard 754 for Binary Floating-Point Arithmetic><FAST INVERSE SQUARE ROOT>
最后，给出最精简的1/sqrt()函数：
float InvSqrt(float x)
{
float xhalf = 0.5f*x;
int i = *(int*)&x; // get bits for floating VALUE
i = 0x5f375a86- (i>>1); // gives initial guess y0
x = *(float*)&i; // convert bits BACK to float
x = x*(1.5f-xhalf*x*x); // Newton step, repeating increases accuracy
return x;
}
大家可以尝试在PC机、51、AVR、430、ARM、上面编译并实验，惊讶一下它的工作效率。
前兩天有一則新聞，大意是說 Ryszard Sommefeldt 很久以前看到這麼樣的一段 code (可能出自 Quake III 的 source code)：
float InvSqrt (float x) {
float xhalf = 0.5f*x;
int i = *(int*)&x;
i = 0x5f3759df - (i>>1);
x = *(float*)&i;
x = x*(1.5f - xhalf*x*x);
return x;
}
他一看之下驚為天人，想要拜見這位前輩高人，但是一路追尋下去卻一直找不到人；同時間也有其他人在找，雖然也沒找到出處，但是 Chris Lomont 寫了一篇論文 (in PDF) 解析這段 code 的演算法 (用的是 Newton’s Method，牛頓法；比較重要的是後半段講到怎麼找出神奇的 0x5f3759df 的)。
PS. 這個 function 之所以重要，是因為求 開根號倒數 這個動作在 3D 運算 (向量運算的部份) 裡面常常會用到，如果你用最原始的 sqrt() 然後再倒數的話，速度比上面的這個版本大概慢了四倍吧… XD
PS2. 在他們追尋的過程中，有人提到一份叫做 MIT HACKMEM 的文件，這是 1970 年代的 MIT 強者們做的一些筆記 (hack memo)，大部份是 algorithm，有些 code 是 PDP-10 asm 寫的，另外有少數是 C code (有人整理了一份列表)。
附：牛顿迭代法快速寻找平方根
下面这种方法可以很有效地求出根号a的近似值：首先随便猜一个近似值x，然后不断令x等于x和a/x的平均数，迭代个六七次后x的值就已经相当精确了。
例如，我想求根号2等于多少。假如我猜测的结果为4，虽然错的离谱，但你可以看到使用牛顿迭代法后这个值很快就趋近于根号2了：
( 4 + 2/ 4 ) / 2 = 2.25
( 2.25 + 2/ 2.25 ) / 2 = 1.56944..
( 1.56944..+ 2/1.56944..) / 2 = 1.42189..
( 1.42189..+ 2/1.42189..) / 2 = 1.41423..
....
这种算法的原理很简单，我们仅仅是不断用(x,f(x))的切线来逼近方程x^2-a=0的根。根号a实际上就是x^2-a=0的一个正实根，这个函数的导数是2x。也就是说，函数上任一点(x,f(x))处的切线斜率是2x。那么，x-f(x)/(2x)就是一个比x更接近的近似值。代入 f(x)=x^2-a得到x-(x^2-a)/(2x)，也就是(x+a/x)/2。
2010年10月2日星期六
中秋節完整版
名词解释：
钟秋洁：中秋节
郭晴婕：国庆节
韩佳：寒假
方淑佳：放暑假
步尚雪：不上学
尚瓣：上班
步尚瓣：不上班
郑大钱：挣打钱
推秀：退休
钟大讲：中大奖
任敏碧：人民币
梅静：美金
尹邦：英镑
欧原：欧元
百日萌：白日梦
尚雪：上学
谢作叶：写作业
梅钱：没钱
方佳：放假
度贾、杜佳：度假
燕玉：艳遇
方韩佳：放寒假
隋澜姣：睡懒觉
车吉巴丹：扯鸡巴蛋
正文：
唉～我和钟秋洁分手了，
现在在等郭晴婕，
但实际上我特喜欢方韩佳，好想方韩佳。。。
不过她姐姐方淑佳更美，我更喜欢。。。
但我内心一直最爱步尚雪，
我多么想永远和她在一起～
方韩佳和方淑佳已经和我绝交了。。。。。步尚学确实和我在一起，但是丈母娘尚瓣也过来一起住了。。。。我很郁闷。。。。。
我最喜欢的就是步尚瓣和郑大钱这两个妹子，可惜，他们只能是我的女神啊
我爱游仁阳。希望早日遇到他，要不就早日遇到推秀或钟大讲。
任敏碧这个大众情人，我多想勾搭上啊，有机会如果还能勾搭上梅静，尹邦，欧原那就此生无憾了！可惜我现在身边只有一个百日萌，悲催！
最讨厌尚雪了，每天还有谢作叶同居，悲催生活啊！
我讨厌偶尔要碰见梅钱,每次都得请建行叔帮忙把他支走…情何以堪啊
我深爱的是方佳她哥，度贾。为了他我心都碎了…
郭晴婕后天来看望大家，我想跟她说，让郑大钱做我丈人，杜佳做我丈母娘，那样的我就可以日死步尚瓣这个小骚货了，然后找燕玉做小三，哥的一生也就完满了~
方韩佳和方淑佳已经在我尘封的记忆中了，虽然我跟尚瓣在一起，但心中深深地爱着隋澜姣，唉…….强烈的郁闷啊
你们说的那些我都没福气，每天赖在我身边的只有一位，貌似还是个少数民族女子，她的名字叫——
车吉巴丹
2010年9月25日星期六
UltraDefrag 4.4.0
UltraDefrag is a powerful disk defragmentation tool for Windows. It is the first open source defragmenter with full support of system locked files defragmentation. Actually all files including registry hives and paging file can be processed by UltraDefrag during the Windows boot process.
Virtual Router – 用无线网卡虚拟出 WiFi 热点
可以将无线网卡虚拟成 WiFi 热点的工具，满足没有无线路由器时移动设备的需要。是的，出门可以不用带无线路由器了，支持 Windows 7 / 2008 R2。
Virtual Router 将一切都简化了，下载安装后，只需要 设置热点名称 > 设置热点密码 > 选择要共享的网络 > 启动虚拟路由器。
密码需要需8位以上，WPA2 加密，如果仅有一个无线网卡设备，是不需要选择共享网络的。很快，就可以在移动设备中找到热点了，当然不止支持移动设备，有无线网卡的设备都可以，比如笔记本电脑。
videocacheview
VideoCacheView - 网络视频暴力下载工具，对于浏览器所播放的视频而言，也是凡走过必留下痕迹，只要网络视频流的提供者所采用的是快取技术，那么当你关闭Firefox或IE时，视频便会保存在浏览器临时文件夹中，而这个小工具可以打开曾经播放过的视频（支持MP4，WMV，FLV等格式），或者另存为文件。
用法：用Firefox或IE打开你的视频网址→等它缓存完毕→关闭浏览器→打开VideoCacheView→右键你要的视频→另存到
用法：用Firefox或IE打开你的视频网址→等它缓存完毕→关闭浏览器→打开VideoCacheView→右键你要的视频→另存到
2010年9月15日星期三
ATA security
The below Princeton “Lest we Remember: Cold Boot Attacks on Encryption Keys” article sparked a debate on the minasi forum (Which most people know I participate actively in)
The user Douggg suggested the use of a to mostly unknown security feature of modern ATA drives, which enables a user to password protect the drive it self.
So I decided to do some research into it.
The Security Mode feature set was initially created for 2½” disks (laptop disks) in about 1996.
——————————————————————————–
The optional Security Mode feature set is a password system that restricts access to user data stored on a
device. The system has two passwords, User and Master and two security levels, High and Maximum. The
security system is enabled by sending a user password to the device with the SECURITY SET PASSWORD
command. When the security system is enabled, access to user data on the device is denied after a power
cycle until the User password is sent to the device with the SECURITY UNLOCK command.
A Master password may be set in a addition to the User password. The purpose of the Master password is to
allow an administrator to establish a password that is kept secret from the user, and which may be used to
unlock the device if the User password is lost. Setting the Master password does not enable the password
system.
The security level is set to High or Maximum with the SECURITY SET PASSWORD command. The security
level determines device behavior when the Master password is used to unlock the device. When the security
level is set to High the device requires the SECURITY UNLOCK command and the Master password to
unlock. When the security level is set to Maximum the device requires a SECURITY ERASE PREPARE
command and a SECURITY ERASE UNIT command with the master password to unlock. Execution of the
SECURITY ERASE UNIT command erases all user data on the device.
The SECURITY FREEZE LOCK command prevents changes to passwords until a following power cycle. The
purpose of the SECURITY FREEZE LOCK command is to prevent password setting attacks on the security
system.
——————————————————————————–
What this seems mean is that you can set two security modes on the drives High & Maximum
In High security mode both the “user” and the “master” password is able to unlock the drive.
In Maximum only the “user” password will unlock the drive, the “master” password needs to be sent with a delete all command, that overwrites the entire disk with 0′s and then allows access to the disk.
IBM started making this widely available in their 3½” disks in 1998 as well, Microsoft later asked Seagate to build the security into their 3½ drives for the Xbox to protect them, later WD followed suit.
This means that practically all disks today have the “security features” available.
As a security precaution the devices have a function called “SECURITY FREEZE LOCK”, when this command is sent to the device it will not accept any changes to the password until next boot. The problem is that most PC manufacturers have not added this feature to the BIOS of PC’s meaning that it is theoretically possible to set the password when the PC is running, rendering the disk unreadable at next boot.
Luckily for us the windows API that sends “ATA” commands does not support the commands:
——————————————————————————–
SECURITY SET PASSWORD
-
SECURITY UNLOCK
-
SECURITY ERASE PREPARE
-
SECURITY ERASE UNIT
-
SECURITY FREEZE LOCK
-
SECURITY DISABLE PASSWORD
——————————————————————————–
So in order for someone to abuse it, that person would have to gain admin access to the PC, install a kernel mode driver that can communicate directly with the disk, and the BIOS should not have sent the “SECURITY FREEZE LOCK” command.
On the security topic Heise.de tested it, and found that it was not enough to remove the circuit board and replace it with a board from an unlocked drive. So password data is stored on the drive platters as well.
They sent the drive to IBAS (Norwegian data recovery company) who were able to recover the key.. (They call it a trade secret)
As with most closed systems it is not known is there is a master master password, though vendors claim there isn’t.
So if you want to add another security hurdle besides encryption, you find a PC with a BIOS that supports the security features, set security the maximum, encrypt the disk with your favorite encryption software. This should scare off most except the mosts adamant hackers or big brother.
There is a tool called WinAAM (German) which is used to manipulate drives acoustics, it will also tell you the current security setting of the drive (You can use it to see if your BIOS sets the SECURITY FREEZE LOCK on the drive) If it doesn’t you might consider to check for a BIOS update, and you might be lucky that the new BIOS sets it.
From what I have read I am convinced that the ATA security standard is not unbreakable, with the right experience/equipment it is still possible to bypass the ATA password, and it does not mitigate the initial problem of the possibility to extract encryption keys from RAM. But it is definitely an extra layer of security.
The user Douggg suggested the use of a to mostly unknown security feature of modern ATA drives, which enables a user to password protect the drive it self.
So I decided to do some research into it.
The Security Mode feature set was initially created for 2½” disks (laptop disks) in about 1996.
——————————————————————————–
The optional Security Mode feature set is a password system that restricts access to user data stored on a
device. The system has two passwords, User and Master and two security levels, High and Maximum. The
security system is enabled by sending a user password to the device with the SECURITY SET PASSWORD
command. When the security system is enabled, access to user data on the device is denied after a power
cycle until the User password is sent to the device with the SECURITY UNLOCK command.
A Master password may be set in a addition to the User password. The purpose of the Master password is to
allow an administrator to establish a password that is kept secret from the user, and which may be used to
unlock the device if the User password is lost. Setting the Master password does not enable the password
system.
The security level is set to High or Maximum with the SECURITY SET PASSWORD command. The security
level determines device behavior when the Master password is used to unlock the device. When the security
level is set to High the device requires the SECURITY UNLOCK command and the Master password to
unlock. When the security level is set to Maximum the device requires a SECURITY ERASE PREPARE
command and a SECURITY ERASE UNIT command with the master password to unlock. Execution of the
SECURITY ERASE UNIT command erases all user data on the device.
The SECURITY FREEZE LOCK command prevents changes to passwords until a following power cycle. The
purpose of the SECURITY FREEZE LOCK command is to prevent password setting attacks on the security
system.
——————————————————————————–
What this seems mean is that you can set two security modes on the drives High & Maximum
In High security mode both the “user” and the “master” password is able to unlock the drive.
In Maximum only the “user” password will unlock the drive, the “master” password needs to be sent with a delete all command, that overwrites the entire disk with 0′s and then allows access to the disk.
IBM started making this widely available in their 3½” disks in 1998 as well, Microsoft later asked Seagate to build the security into their 3½ drives for the Xbox to protect them, later WD followed suit.
This means that practically all disks today have the “security features” available.
As a security precaution the devices have a function called “SECURITY FREEZE LOCK”, when this command is sent to the device it will not accept any changes to the password until next boot. The problem is that most PC manufacturers have not added this feature to the BIOS of PC’s meaning that it is theoretically possible to set the password when the PC is running, rendering the disk unreadable at next boot.
Luckily for us the windows API that sends “ATA” commands does not support the commands:
——————————————————————————–
SECURITY SET PASSWORD
-
SECURITY UNLOCK
-
SECURITY ERASE PREPARE
-
SECURITY ERASE UNIT
-
SECURITY FREEZE LOCK
-
SECURITY DISABLE PASSWORD
——————————————————————————–
So in order for someone to abuse it, that person would have to gain admin access to the PC, install a kernel mode driver that can communicate directly with the disk, and the BIOS should not have sent the “SECURITY FREEZE LOCK” command.
On the security topic Heise.de tested it, and found that it was not enough to remove the circuit board and replace it with a board from an unlocked drive. So password data is stored on the drive platters as well.
They sent the drive to IBAS (Norwegian data recovery company) who were able to recover the key.. (They call it a trade secret)
As with most closed systems it is not known is there is a master master password, though vendors claim there isn’t.
So if you want to add another security hurdle besides encryption, you find a PC with a BIOS that supports the security features, set security the maximum, encrypt the disk with your favorite encryption software. This should scare off most except the mosts adamant hackers or big brother.
There is a tool called WinAAM (German) which is used to manipulate drives acoustics, it will also tell you the current security setting of the drive (You can use it to see if your BIOS sets the SECURITY FREEZE LOCK on the drive) If it doesn’t you might consider to check for a BIOS update, and you might be lucky that the new BIOS sets it.
From what I have read I am convinced that the ATA security standard is not unbreakable, with the right experience/equipment it is still possible to bypass the ATA password, and it does not mitigate the initial problem of the possibility to extract encryption keys from RAM. But it is definitely an extra layer of security.
订阅：
博文 (Atom)