The Mystery of the Encrypted Gauss Payload

Posted by jasper22 at 19:09 | Friday, August 17, 2012

There are many remaining mysteries in the Gauss and Flame stories. For instance, how do people get infected with the malware? Or, what is the purpose of the uniquely named “Palida Narrow” font that Gauss installs?

Perhaps the most interesting mystery is Gauss’ encrypted warhead. Gauss contains a module named “Godel” that features an encrypted payload. The malware tries to decrypt this payload using several strings from the system and, upon success, executes it. Despite our best efforts, we were unable to break the encryption. So today we are presenting all the available information about the payload in the hope that someone can find a solution and unlock its secrets. We are asking anyone interested in cryptology and mathematics to join us in solving the mystery and extracting the hidden payload.

The containers

Infected USB sticks have two files that contain several encrypted sections. Named “System32.dat” and “System32.bin”, they are 32-bit and 64-bit versions of the same code. These files are loaded from infected drives using the well-known LNK exploit introduced by Stuxnet. Their primary goal is to extract a lot of information about the victim system and write it back to a file on the drive named “.thumbs.db”. Several known versions of the files contain three encrypted sections (one code section, two data sections).

The decryption key for these sections is generated dynamically and depends on the features of the victim system, preventing anyone except the designated target(s) from extracting the contents of the sections.

By the way, the 64-bit version of the module has some debug information left in it. The module contains debug assertion strings and names of the modules:

.\loader.cpp

NULL != encSection

Path

NULL != pathVar && curPos < pathVarSize

NULL != progFilesDirs && curPos < progFilesDirsSize

NULL != isExpected

NULL != key

(NULL != result) && (NULL !=str1) && (NULL != str2)

.\encryption_funcs.cpp

It's RX v2 Baby! Reactive Extensions v2.0 RTW, with details, download and the SDK too!

Posted by jasper22 at 01:47 |

Today, we’re extremely pleased to announce the availability of Reactive Extensions for .NET (Rx) v2.0 RTM, aligned with the availability of Visual Studio 2012 RTM and Windows 8 RTM for MSDN subscribers. This is a major milestone for the Rx project and we hope you’ll love what you see!

In this post, we’ll focus on how to download and install the bits for use in various application frameworks. Unlike previous posts about the v2.0 pre-releases, we’ll defer further technical details to a series of follow-up posts. Nonetheless, we’ll give a brief introduction into the use of Portable Library with Rx v2.0 RTM.

Note: We’ve written this post in the typical font used for big announcements nowadays – Comic Sans – in honor of the Higgs boson discovery. In case you don’t want to partake in this celebration for the remainder of the post, click here to switch fonts.

Before we get started, make a note of the supported platforms for this release:

.NET Framework 4

.NET Framework 4.5

.NET Framework 4.5 for Windows Store apps

Silverlight 5

Windows Phone 7.5

Although this post was authored on Windows 8 using Visual Studio 2012 for screenshots, Rx can be used with Visual Studio 2010, and/or on older versions of the operating system as well. (For example, at the time of writing this post, Windows Phone development wasn’t yet publicly available in Visual Studio 2012, so that’d be a case where you have to use Visual Studio 2010 for the time being.)

Reactive Extensions for JavaScript (RxJS) users can expect the v2.0 release – including support for WinJS used in Windows Store apps – to hit the web very soon. Watch this blog for the announcement

Posted via email from Jasper-net

Task Parallel Library: 1 of n

Posted by jasper22 at 15:44 | Wednesday, August 15, 2012

Introduction

I recall the first time I created a UI in .NET that had to go and get some data from a database, and the amount of data that I fetched was way larger in production that my code assumed it would be in my dumbed down test setup. Guess what happened... my UI froze as soon as it used real data. The reason for this is that the UI thread (i.e., the only thread in my naive UI) was being used to carry out this fetching of data from the backend database. Yikes! Surely there is a better way.

As it turned out, there was. .NET offered (and still does) a wide variety of Threading classes to help with just this sort of situation, such as Thread, BackgroundWorker, ThreadPool etc.

So I got to know and love some of these classes in the System.Threading namespace, and they did make a massive difference to the responsiveness of my application, all cool.

Thing is, some of the code one has to write when doing some of this threading stuff using the System.Threading namespace (from here on in "classic threading") took a lot of work in some cases, and just was not that intuitive at times. Classic threading is well known as the domain of experts; after messing with its quirks for long enough, one can begin to see why... You are like frack, where did that Exception come from, ahhhh I am using a shared data object with multiple threads, aha! This has by the main stay been a mixture of intuition/luck/skill... and not necessarily in equal parts.

Luckily, help is at hand. With .NET 4.0, there is a new kid in town. It is called a Task, which some of you may know is part of the Task Parallel Library (TPL), which is a new collection of very, very useful (and I feel highly intuitive) classes aimed at not only making your parallel programming easier to read, but also offers lighter weight objects when compared to the classic threading alternatives. For example, when a new Thread is started in .NET, there is a whole process that goes with that, such as creating queues, thread local storage, managing the Thread's lifecycle etc. This takes time. OK, so you could use the classic threading ThreadPool, which does allow you to queue up work item delegates directly to the ThreadPool, which means you are not impacted by the overhead of creating a new Thread yourself, as the ThreadPool will manage all new Thread creation etc.

However, even using the classic threading ThreadPool, there were problems in that you could not cancel a work item once it has been queued with the ThreadPool, or get a return result that easily. It just doesn't read that well either. There is an excellent article here on CodeProject that tackles some of these issues: Smart ThreadPool, which is pretty excellent actually. However, the new TPL infrastructure has got all these problems covered, and many many more useful features in my opinion.

A TPL Task actually uses the ThreadPool internally, if you use the default scheduler, which you more than likely will most of the time. The scheduler can be swapped out, and that is something I will be showing in a subsequent article. For the time being, if we assume we are using the default scheduler, Tasks will be allocated threads by the the use of a ThreadPool, which handles the creation of Threads to carry out Tasks, so a lot of the heavy lifting (so to speak) is done behind the scenes for us by TPL.

Arduino Installer For Atmel Studio 6

Posted by jasper22 at 13:52 |

Project Description

Install binaries with core library and Arduino libraries in Atmel Studio 6. Creates two project templates, one for sketches and another one for Arduino libraries. All you need to do is download, configure the installation script (arduino port, speed, chip, etc) and run install.bat.

Is Stack Overflow “secure”? Kind of…

Posted by jasper22 at 15:22 | Tuesday, August 7, 2012

I had an interesting question pop up on my “SSL is not about encryption” blog post this weekend:

I have a question about logging to site like StackOverflow which doesn't use SSL at all.

If I am login to SO via Google. Is this secure in this case?

This is actually a very good question for a number of reasons so I thought it deserved a little more attention than just the short response I gave on the blog. The question implies there is some sort of absolute state to security (probably unintentionally) where a site such as Stack Overflow is deemed to be either “secure” or “insecure” (hence the quotes in the title).

The reality is that there are a few more twists to it than that and Stack Overflow in particular is an interesting case study due to their use of a third party authentication provider. What this blog post will show you is that in this particular case, we’re really looking at two different security domains with different levels of protection and in the case of Stack Overflow, yes, it’s kind of secure – but then it’s also kind of insecure too…

Stack Overflow and the role of OpenID

I’ve followed the evolution of Stack Overflow from the very early days and one thing that Jeff Atwood was always adamant about was the role of OpenID. Jeff has many, many good points and probably the most significant one from a security perspective is that it makes the job of keeping credentials safe the responsibility of someone else. This is a good thing, particularly when you consider the work organisations like Google they’ve done around two factor authentication. Now of course there are other OpenID providers who are not quite as well equipped, but certainly they still do a very good job of implementing secure authentication mechanisms.

There are opponents of OpenID, but the arguments are more about the logistics of implementing it and dealing with customers having accounts with all sorts of different providers. These are perfectly valid concerns, but they’re not about security; all the OpenID implementations I’ve seen adhere to all the sorts of good account management practices I regularly talk about such as no restrictions on password length or structure, well implemented password reset processes and of course everything is done over HTTPS.

But what we need to remember is that OpenID is being used by Stack Overflow solely for the purpose of authenticating the users. What happens after this is a whole new ballgame.

Stack Overflow and HTTPS

Here’s what you currently see on Stack Overflow today:

This is really what Marek was referring to in the initial question which sparked this blog post and as he has rightly observed, there is no use of HTTPS. But is this a problem? I mean I’ve already logged on via OpenID so my credentials have been sent securely already, what’s the risk?

To answer that question, let’s start by taking a look at the cookies set by the site. Why? Because cookies are how our logged in state is persisted across multiple requests over HTTP which is a stateless protocol, that is each request is made over a new connection totally independent to the other requests. In other words, HTTP itself doesn’t know we’re logged in, it needs help from cookies.

How Apple and Amazon Security Flaws Led to My Epic Hacking

Posted by jasper22 at 14:35 |

In the space of one hour, my entire digital life was destroyed. First my Google account was taken over, then deleted. Next my Twitter account was compromised, and used as a platform to broadcast racist and homophobic messages. And worst of all, my AppleID account was broken into, and my hackers used it to remotely erase all of the data on my iPhone, iPad, and MacBook.

In many ways, this was all my fault. My accounts were daisy-chained together. Getting into Amazon let my hackers get into my Apple ID account, which helped them get into Gmail, which gave them access to Twitter. Had I used two-factor authentication for my Google account, it’s possible that none of this would have happened, because their ultimate goal was always to take over my Twitter account and wreak havoc. Lulz.

Had I been regularly backing up the data on my MacBook, I wouldn’t have had to worry about losing more than a year’s worth of photos, covering the entire lifespan of my daughter, or documents and e-mails that I had stored in no other location.

Those security lapses are my fault, and I deeply, deeply regret them.

But what happened to me exposes vital security flaws in several customer service systems, most notably Apple’s and Amazon’s. Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information. In short, the very four digits that Amazon considers unimportant enough to display in the clear on the web are precisely the same ones that Apple considers secure enough to perform identity verification. The disconnect exposes flaws in data management policies endemic to the entire technology industry, and points to a looming nightmare as we enter the era of cloud computing and connected devices.

This isn’t just my problem. Since Friday, Aug. 3, when hackers broke into my accounts, I’ve heard from other users who were compromised in the same way, at least one of whom was targeted by the same group.

Microsoft .NET Framework Undersized Glyph Buffer Remote Code Execution Vulnerability

Posted by jasper22 at 11:42 |

CVE ID

CVE-2012-0162

CVSS Score

7.5, (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Affected Vendors

Microsoft

Affected Products

.NET

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the .NET Framework. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within Microsoft .NET handling of XAML Browser Applications (XBAP) graphics components. It is possible to cause an undersized allocation for a buffer which is populated with user-supplied glyph data, resulting in memory corruption which can be leveraged to remotely execute code.

Vendor Response

Microsoft has issued an update to correct this vulnerability. More details can be found at:

http://technet.microsoft.com/en-us/security/bulletin/ms12-034

Disclosure Timeline

2011-12-07 - Vulnerability reported to vendor

2012-08-03 - Coordinated public release of advisory

DaRT 8 Tutorial Videos

Posted by jasper22 at 11:16 | Monday, August 6, 2012

The Microsoft Diagnostics and Recovery Toolset (DaRT) is a powerful set of tools that can help you diagnose and troubleshoot computers. This video introduces the features available in version

DaRT 8 Overview - Diagnose, Troubleshoot PC Issues TechNet

Create Boot Meda with DaRT 8

Start a Computer with DaRT 8

Reset Passwords with DaRT 8

Analyze Crash Dumps with DaRT 8

Disable Device Drivers with DaRT 8

Recover Files with DaRT 8

Repair Disks Using DaRT 8

Explore the PC Using DaRT 8

Repair System Files with DaRT 8

Scan for Malware with DaRT 8

Remove Hotfixes with DaRT 8

Wipe Disks with DaRT 8

Native shell

Posted by jasper22 at 09:39 |

Native shell — программа, написанная мной для экспериментов в Native-режиме Windows семейства NT (NT/2000/XP/2003/Vista/7). Этот тот режим, в котором запускается утилита chkdsk, когда ей надо проверить и исправить ошибки в системном разделе. Сам режим (его ещё называют загрузочным режимом) представляет собой синий экран (в Windows XP синий, в других версиях другого цвета), который появляется до появления окна логина в систему. Выглядит этот режим так (нажмите картинку, чтобы увеличить):

Программа распространяется на условиях лицензии GNU General Public License, часть исходников по GNU Lesser General Public License. Упоминания о других авторах исходного кода смотрите в исходных текстах программы. Исходные коды доступны по адресу

...

Список консольных команд

Постепенно будут добавляться команды, которые будут реализовывать те или иные функции, которые я хотел бы опробовать в Native-режиме. Если аргумент команды содержит пробел, его надо брать в кавычки (кроме команды cd, она понимает пути без кавычек).

если команда не совпадает с одной из описанных ниже, считается, что это имя исполняемого файла для запуска (чтобы программа запустилась, имя исполняемого файла нужно указывать обязательно вместе с расширением)

cd X - сменить каталог на X

md X - создать каталог X

copy X Y - копировать файл X в Y

move X Y - перенести или переименовать файл X в Y

poweroff - выключить ПК

shutdown - выключить ПК

dir - показать содержимое каталога

pwd - напечатать название текущего каталога

del X - удалить файл X

reboot - перезагрузить ПК

devtree - вывести дерево процессов

exit - выход в Windows

sysinfo - показать информацию о системе

lm - показать исполняемые модули в памяти

vid - проверка вывода символов на экран

lp - вывод запущенных процессов

Делаем свою Time Machine для Линукса

Posted by jasper22 at 09:33 |

После интенсивного пользования time machine на маках и пару ситуаций когда она реально пригодилась (были варианты когда пришлось поставить систему из бэкапов и варант когда пришлось откатывать назад после проблем), возникла мысль а собственно почему такой удобной системы нет на линуксе. После исследования вопроса и опроса знакомых линуксоидов оказалось что:

1. сделать такую систему можно просто за пару минут на коленках

2. странно, но как-то никто собственно не в курсе что это можно поднять настолько быстро.

3. наша time machine для линукса будет с маджонгом и гейшами.

Как раз был ненужный appletv первого поколения из которого было решено сделать небольшой сервер на hardeded linux для сбора логов и всяких вспомогательных целей. После установки hardened gentoo как раз и возник вопрос как его бы бэкапить чтобы весь и сразу диск - чтобы можно было при полном отказе накатить бэкап на новый диск или на полностью новый appletv (хм, если потом такой найду конечно), или выборочно востанавливать удалённые или потерянные файлы просто ссылаясь на опеределенную дату.

Как работает time machine? Довольно просто, первый слепок системы просто копируется как файлы со всеми атрибутами в Backups.backupdb/hostname/YYYY-MM-dd-hhmmss, +делается симлинк Latest указывающий на последний слепок. А уже при втором слепке происходит следующее: сравниваются даты файлов и если файл не поменялся то вместо новой копии файла делается hardlink на файл из предыдущего слепка. Тогда если нет изменений файлов то весь новый слепок будет полностью ссылаться на предыдущий. Слепки будут отличатся только новыми/модифицированными/удалёнными файлами. В результате можно просто удалить любой слепок (каталог типа YYYY-MM-dd-hhmmss) и ничего не поламается. Самая ближайшая ассоциация - умный указатель в c++ например: когда пропадает последняя ссылка на файл (из всех слепков) он и удалится с дисков.

Очень удобная система с точки зрения просмотра предыдущих файлов, их востановления, удаления старых бэкапов итд. Вплоть до восстановления всей системы из слепка.

После исследования всех известных мне систем бэкапа под линукс, они были отброшены как немного не то что нужно. Зато нашлось простейшее решение с rsync в одну строчку.

rsync имеет чудесную опцию --link-dest которая как раз и делает всю выше описанную логику по сравнению с предыдущими слепками и создания hardlink-ов. Опция -x исключит все примонтированные файловые системы как /proc /sys /dev итд. --delete будет удалять файлы которые пропадут.

Вся time machine будет одним скриптом как:

#!/bin/sh

date=`date "+%Y-%m-%d-%H%M%S"`

SRC=/

DST=/mnt/backup-hdd/Backups.backupdb/atv

rsync -ax \

--delete \

--link-dest=../Latest \

$SRC $DST/Processing-$date \

&& cd $DST \

&& mv Processing-$date $date \

&& rm -f Latest \

&& ln -s $date Latest

Копируем скрипт в /etc/cron.hourly и вуаля у нас бэкапы как в time machine.

Если наша система слетела, мы можем загрузтся со флешки, отформатировать раздел, и запустить тот же rsync в обратную сторону, потом перегрузится или сделать chroot и система опять рабочая.

Using Custom Markup Extensions in Silverlight 5

Posted by jasper22 at 16:18 | Sunday, August 5, 2012

The first beta of Silverlight 5 was announced at MIX this week and is available for downloading. As such, I’ll be blogging about the new features in weeks to come. I’ll also be delivering sessions on Silverlight 5 at several upcoming conferences, including Microsoft TechDays in Belgium, Microsoft DevDays in the Netherlands, Devscovery in Redmond, WA, and Microsoft TechEd in Atlanta. If you plan to attend any of those conferences, I’d love to see you in my sessions!

One of the most exciting features that Silverlight 5 introduces – and one that has been a long time in coming to the platform – is custom markup extensions. My fellow coconspirator and Silverlight MVP Jeremy Likness presented a custom markup extension that uses MEF to satisfy imports on object instances declared in XAML. I’d like to present a custom markup extension of my own – one that retrieves RESX localization resources and simplifies the task of adding localization support to Silverlight applications.

In the past, RESX-based localization was usually performed in Silverlight XAML with the help of the built-in {Binding} markup extension. To demonstrate, the following example declares an instance of the ResourceManager wrapper class named Resources (which is generated by Visual Studio from Resources.resx), assigns the Resources instance to the DataContext property of a TextBlock, and uses a data-binding expression to set the TextBlock’s Text property equal to the Greeting property of the Resources instance:

<Grid>

<Grid.Resources>

<local:Resources x:Key="Localize" />

</Grid.Resources>

</Grid>

It works, but it makes you wonder why you have to resort to data binding to make localization work when localization is such a common task in Silverlight applications.

You can make this work a little more cleanly by writing a custom markup extension. Such an extension might be applied this way:

<Grid>

<TextBlock

Text="{local:Resx ResxKey=Greeting, ResxType=Resources, Default=Welcome}" />

</Grid>

In this example, Resx is the custom markup extension, ResxKey identifies the localization resource to be loaded, ResxType identifies the ResourceManager wrapper class that provides access to that resource, and Default is an optional default value that’s used if the specified localization resource doesn’t exist or can’t be retrieved. Better, is it not? And it’s just one of a million different applications for custom markup extensions.

Silverlight (and WPF): How to make items stretch horizontally in a ListBox

Posted by jasper22 at 16:08 |

Sometimes we need to use controls like TextBox, TextBlock etc (that set their width automatically depending on content) in a ListBox’s ItemTemplate. If we need to draw Borders or assign Background colors to each such controls then we may end up having non-equal rows. Here’s a sample markup:

<ListBox.ItemTemplate>

</DataTemplate>

</ListBox.ItemTemplate>

</ListBox>

Here’s the output for the above XAML:

A quick thought would be to assign HorizontalContentAlignment property to Stretch for the TextBox but this wont work. We need to specify this property for the ListBoxItem that encapsulates our DataTemplate. Here’s a quick syntax for doing this using a style:

Six years of WPF; what's changed?

Posted by jasper22 at 15:43 |

Prior to working full time on Octopus Deploy, I spent a year building a risk system using WPF, for traders at an investment bank. Before that I worked as a consultant and trainer, mostly with a focus on WPF. I've lived and breathed the technology for the last six years, and in this post I'm going to share some thoughts about the past and future of WPF and the XAML-ites.

Six years ago, I wrote an article about validation in WPF on Code Project. I also wrote a custom error provider that supported IDataErrorInfo, since, would you believe, WPF in version 3.0 didn't support IDataErrorInfo. Later, I worked on a bunch of open source projects around WPF like Bindable LINQ (the original Reactive Programming for WPF, back before Rx was invented) and Magellan (ASP.NET-style MVC for WPF). I was even in the MVVM-hyping, Code Project-link sharing club known as the WPF Disciples for a while.

As I look back at WPF, I see a technology that had some good fundamentals, but has been really let down by poor implementation and, more importantly, by a lack of investment. I'm glad those days are behind me.

Back in 2006, here's what the markup for a pretty basic Window looked like (taken from an app I worked on in 2006):

<Window x:Class="PaulStovell.TrialBalance.UserInterface.MainWindow"

xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"

xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"

xmlns:tb="clr-namespace:PaulStovell.TrialBalance.UserInterface"

xmlns:tbp="clr-namespace:PaulStovell.TrialBalance.UserInterface.Providers"

xmlns:system="clr-namespace:System;assembly=mscorlib"

Title="TrialBalance"

WindowState="Maximized"

Width="1000"

Height="700"

Icon="{StaticResource Image_ApplicationIcon}"

Background="{StaticResource Brush_DefaultWindowBackground}"

x:Name="_this"

I mean, look at all that ceremony! x:Class! XML namespace imports! Why couldn't any of that stuff be declared in one place, or inferred by convention?

Fortunately, it's now 2012, and things have come a long way. Here's what that code would look like if I did it today:

<Window x:Class="PaulStovell.TrialBalance.UserInterface.MainWindow"

xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"

xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"

xmlns:tb="clr-namespace:PaulStovell.TrialBalance.UserInterface"

xmlns:tbp="clr-namespace:PaulStovell.TrialBalance.UserInterface.Providers"

xmlns:system="clr-namespace:System;assembly=mscorlib"

Title="TrialBalance"

WindowState="Maximized"

Width="1000"

Height="700"

Icon="{StaticResource Image_ApplicationIcon}"

Background="{StaticResource Brush_DefaultWindowBackground}"

x:Name="_this"

Spot the difference? Of course not, it was a trick question, nothing has changed since 2006 that would have made that less verbose.

C# Heap(ing) Vs Stack(ing) in .NET: Part IV

Posted by jasper22 at 10:28 |

Even though with the .NET framework we don't have to actively worry about memory management and garbage collection (GC), we still have to keep memory management and GC in mind in order to optimize the performance of our applications. Also, having a basic understanding of how memory management works will help explain the behavior of the variables we work with in every program we write. In this article we'll look into Garbage Collection (GC) and some ways to keep our applications running efficiently.

Graphing

Let's look at this from the GC's point of view. If we are responsible for "taking out the trash" we need a plan to do this effectively. Obviously, we need to determine what is garbage and what is not (this might be a bit painful for the pack-rats out there).

In order to determine what needs to be kept, we'll first make the assumption that everything not being used is trash (those piles of old papers in the corner, the box of junk in the attic, everything in the closets, etc.) Imagine we live with our two good friends: Joseph Ivan Thomas (JIT) and Cindy Lorraine Richmond (CLR). Joe and Cindy keep track of what they are using and give us a list of things they need to keep. We'll call the initial list our "root" list because we are using it as a starting point. We'll be keeping a master list to graph where everything is in the house that we want to keep. Anything that is needed to make things on our list work will be added to the graph (if we're keeping the TV we don't throw out the remote control for the TV, so it will be added to the list. If we're keeping the computer the keyboard and monitor will be added to the "keep" list).

This is how the GC determines what to keep as well. It receives a list of "root" object references to keep from just-in-time (JIT) compiler and common language runtime (CLR) (Remember Joe and Claire?) and then recursively searches object references to build a graph of what should be kept.

Roots consist of:

Global/Static pointers. One way to make sure our objects are not garbage collected by keeping a reference to them in a static variable.
Pointers on the stack. We don't want to throw away what our application's threads still need in order to execute.
CPU register pointers. Anything in the managed heap that is pointed to by a memory address in the CPU should be preserved (don't throw it out).

In the above diagram, objects 1, 3, and 5 in our managed heap are referenced from a root 1 and 5 are directly referenced and 3 is found during the recursive search. If we go back to our analogy and object 1 is our television, object 3 could be our remote control. After all objects are graphed we are ready to move on to the next step, compacting.

Compacting

Now that we have graphed what objects we will keep, we can just move the "keeper objects" around to pack things up.

THE open source WinForm & WPF docking library gets overhauled and a new version two, AvalonDock v2's!

Posted by jasper22 at 10:02 |

Welcome to the first release of AvalonDock 2.0

Finally I can upload the new release of AvalonDock. This new release is stable and includes many new features if compared to 1.3:

AvalonDock 2.0 has been completely rewritten to take full advantage of the MVVM design.

The layout model is now completely separated from the view controls; integration with frameworks like PRISM is easier and faster.

I worked a lot to get the best performance especially when user move panes in floating window or set them as auto hidden.

Floating windows can now be arranged together as it's possible in VS2010.

The library itself is lighter because use only standard controls restyled like the TabControl or the Grid panel.

Since first beta I fixed a lot of bugs; this version should be stable enough for most of the projects.

Comes with two additional themes: VS2010 and Aero theme.

Create your own IaaS platform with open source CloudStack

Posted by jasper22 at 11:09 | Thursday, August 2, 2012

Takeaway: Ian Hardenburgh offers an overview of the open source CloudStack solution that allows you to build and manage a highly available and scalable cloud computing platform, now licensed under ASL 2.0.

If you’re not one for waiting around until the ongoing debate concerning which cloud strategy (public, private or hybrid approach) is settled, and just want to take your chances and delve right into creating your very own IaaS (Infrastructure as a Service), CloudStack could be an open source solution for you.� Acquired back in July of 2011 by Citrix, it looks as if its overseers are moving its code base to the Apache Software Foundation — a move that will certainly garner it even more community support than it already has. However, don’t feel as if you have to wait until the software gets pushed through the Apache Incubator in order to take immediate advantage of the project, as it is already licensed under ASL 2.0 and available for full download from SourceForge.

CloudStack allows you to build, manage, and deploy multi-tenant compute environments by way of a web-based interface, command line, or even through its RESTful API, both in public and private data center type settings. To oversimplify, CloudStack is a software tool for assembling a cloud computing service similar to Amazon EC2, to scale. In fact, depending on your users’ workload requirements, you can deploy any number of hypervisors that you feel are best suited for such scalability. Some of the more well-known hypervisors available for deployment include Citrix XenServer, KVM, vSphere and/or Oracle VM. However, for your CloudStack users, any stack you look to provide is obscured into an on-demand and easy-to-use portal.

There are four primary components to CloudStack: the CloudStack management server, virtualized hosts, primary storage facet (what might be more universally known as the virtual machine disk files), and the secondary storage — essentially the volume where you keep your ISO template images and VM snapshots. Hardware-wise, in order to run the management service and virtualized hosts, you’ll need at least a combined 6GB of memory, 110GB of disk storage split between two separate 64-bit x86 CPU machines running a predetermined set of operating systems, namely RHEL/CentOS, Fedora 14, Ubuntu LTS and Citrix XenServer. An NFS storage appliance or Linux NFS server of no less than 100 GB is also needed to handle secondary storage.

SQL Server Scheduling Flowchart

Posted by jasper22 at 10:59 |

C#/.NET Little Wonders: The Nullable struct

Posted by jasper22 at 10:55 |

Once again, in this series of posts I look at the parts of the .NET Framework that may seem trivial, but can help improve your code by making it easier to write and maintain. The index of all my past little wonders posts can be found here.

There are many times in .NET where we have an instance of a value type that we need to treat as optional. That is, we may want to consider its value as being supplied or missing.

The System.Nullable<T> structure in the .NET Framework can be used to represent these situations in a consistent and meaningful way.

Why Do We Use Nullable<T>?

With instances of reference types, you can easily denote an optional item by simply leaving the reference as null, but this isn’t really possible with a value type (that is, not directly), because the instance of a value type always has a value.

For example, if you had an Person class with some basic data:

1: public class Person

2: {

3: public string FirstName { get; set; }

4: public string LastName { get; set; }

5: public int YearsRetired { get; set; }

7: // ...

8: }

We could have a person with no first name (Sting, Madonna, etc… or is that no last name?), simply by setting the string property FirstName to null:

1: aPerson.FirstName = null;

But in the case of YearsRetired, if the person hasn’t retired yet, we can’t set a simple int to null, because an int is a value type, which must always have a value (strictly speaking):

1: // compiler error

2: aPerson.YearsRetired = null;

That said, we could use a sentinel value (-1), or have a separate bool field (IsRetired) to say whether we should use this field or not, but these get messy and harder to maintain. Consider that if you use a sentinel value, everyone who uses this field must know what that value would be and to test for it.

Alternatively, if you use a bool field to tell you if the value field is usable, they aren’t encapsulated, so again there could be usage issues or consistency issues in naming, etc.

This is why Nullable<T> exists, to allow you to easily mark value type instances as optional (“nullable”) by providing a mechanism that gives values types something like null semantics in an encapsulated and uniform way.

In this way, anyone who looks at your interface and sees Nullable<int> (can also be abbreviated int?) will know how to test whether it has a valid value or not.

How the Nullable<T> struct Works

When you have a Nullable<T> wrapped type in the .NET Framework, it doesn’t give you a reference which you can make null. It actually is a simple struct (value type) that wraps your value type. This is an important distinction because it clears up some common misconceptions on what the Nullable<T> type does and does not do.

For example, let’s say you have:

1: // or int? for short…

2: Nullable<int> yearsRetired = null;

What really is yearsRetired? Is it a reference that points to nothing? No, it’s actually an instance of a value type with two fields: HasValue, and Value. Note: for you C++ boost library users out there, this is much like how boost::optional<T> works.

Why do some font names begin with an at-sign?

Posted by jasper22 at 10:52 |

It was a simple question.

For some reason, my font selection dialog (CFontDialog) shows a bunch of font names beginning with the at-sign (@). These fonts don't work correctly if I use them. Any idea what they are? (I tried searching the Internet, but search engines don't seem to let you search for @ so it's hard to make much headway.)

(And that's why I wrote "at-sign" in the subject instead of using the @ character.)

Fonts which begin with an @-sign are vertically-oriented fonts. They are used in languages like Chinese, Japanese, and (less often) Korean. The idea is that if you want to generate vertical text, you start with the horizontal version of the font and compose your document, then switch to the vertical version for printing.

I wasn't able to detect that your browser supports the @SimSun font, so I'll give an example with fake Chinese characters. Pretend that the shapes and Latin letters are actually Chinese characters. First, you compose your document with the horizontal font:

▴❤❦Quo123▴‌̥

When it's time to print, switch to the vertical version of the font.

◀❥❧℺ᴝᴑ123◀°

Hm, it looks like the Chinese characters got rotated 90° to the left, so they're all lying on their side. The result is not really all that readable, but wait, here's the trick: After the paper comes out of the printer, rotate the paper right 90°:

Entity Framework and Open Source

Posted by jasper22 at 10:11 |

The Entity Framework has advanced significantly over the last few years. A little over a year ago we released EF 4.1, which introduced the new DbContext API and EF “Code First” support. Earlier this year we delivered EF 4.3, which provides Code First Migration support that enables developers to easily evolve database schema in a code optimized way. And we are now in the final stages of wrapping up the EF 5 release, which adds enum support, spatial data types, table-valued function support and some significant performance and Visual Studio Tooling improvements.

One of the things the team has done throughout the EF4 and EF5 development cycles has been to involve the community early as we make design decisions and solicit as much feedback as possible. Going forward with EF 6 we are looking to take this to the next level by moving to an open development model.

The Entity Framework source code is today being released under an open source license (Apache 2.0), and the code repository is now hosted on CodePlex (using Git) to further increase development transparency. This will enable everyone in the community to be able to engage and provide feedback on code checkins, bug fixes, new feature development and build and test the product on a daily basis using the most up to date version of the source code and tests. Community contributions will also be welcomed, so you can help shape and build Entity Framework into an even better product. You can find all the details on the Entity Framework CodePlex Site.

Last December the Windows Azure SDKs adopted this open development model, and in March of this year I blogged about how ASP.NET MVC, ASP.NET Web API and ASP.NET Razor were also adopting this approach. These products have all found the open development approach to be a great way to build a tighter feedback loop with the community, and at the end of the day deliver even better products.

Jasper22.NET