In der dynamischen Landschaft der Cybersicherheit hat der Schutz von Softwarecode vor neugierigen Blicken höchste Priorität. Die C++ Verschleierung tritt als raffinierte Technik auf, die von Entwicklern verwendet wird, um ihren Quellcode zu verschleiern und es Hackern sowie Reverse-Engineering-Spezialisten zu erschweren, diesen zu verstehen und zu manipulieren. Dieser kryptografische Ansatz verwandelt den herkömmlichen C++-Code in ein undurchsichtiges Labyrinth und erhöht so die Gesamtsicherheit von Anwendungen.

Die C++ Verschleierung beinhaltet die gezielte Einführung von Komplexitäten und Redundanzen in den Quellcode, ohne dabei dessen Funktionalität zu beeinträchtigen. Dieser Ansatz zielt darauf ab, Reverse-Engineering-Versuche zu vereiteln und es unbefugten Entitäten außerordentlich schwer zu machen, die ursprüngliche Logik zu entschlüsseln. Verschleierter Code kann verworrene Kontrollstrukturen und die strategische Einfügung irreführender Code-Konstrukte enthalten, wodurch ein komplexes Labyrinth für jeden entsteht, der versucht, die Software zu analysieren.

Eines der Hauptmotive für die C++ Verschleierung besteht darin, geistiges Eigentum und proprietäre Algorithmen zu schützen. Unternehmen, die erhebliche Ressourcen in die Entwicklung innovativer Lösungen investieren, suchen oft nach Möglichkeiten, zu verhindern, dass Konkurrenten oder bösartige Akteure ihren Code leicht verstehen und replizieren können. Die Verschleierung bietet eine zusätzliche Schutzschicht, indem sie den Code für selbst erfahrene Reverse-Engineering-Experten undurchschaubar macht.

Darüber hinaus kann verschleierter Code nicht autorisierte Änderungen abschrecken und vor Schwachstellen schützen, die von Angreifern ausgenutzt werden könnten. Durch die Einführung der Verschleierung können Entwickler das Risiko von Code-Manipulationen verringern, sicherstellen, dass die Software wie beabsichtigt funktioniert, und die Wahrscheinlichkeit von Sicherheitsverstößen reduzieren.

Trotz ihrer Vorteile ist die C++ Verschleierung nicht ohne Herausforderungen. Das Debuggen von verschleiertem Code wird für Entwickler zu einer komplexeren Aufgabe, da herkömmliche Tools Schwierigkeiten bei der Analyse der verworrenen Struktur haben können. Darüber hinaus kann die Leistungseinbuße, die durch verschleierten Code entsteht, ein zu berücksichtigender Faktor sein, obwohl Fortschritte in den Verschleierungstechniken darauf abzielen, diese Auswirkungen zu minimieren. Zusammenfassend steht die C++ Verschleierung als mächtiger Verbündeter im fortlaufenden Kampf um die Sicherheit von Software. Während Entwickler bestrebt sind, ihren Code vor Reverse Engineering und unbefugtem Zugriff zu schützen, bietet die Kunst der Verschleierung ein effektives Mittel, um die Integrität und Vertraulichkeit von proprietärer Software zu gewährleisten. In der sich ständig weiterentwickelnden Welt der Cybersicherheit erweist sich die C++ Verschleierung als kryptischer Schild, der wertvollen Code in einem Schleier aus Komplexität und Widerstandsfähigkeit verbirgt.

The post Die Entwirrung der Kunst der C++ Verschleierung: Code-Sicherung in einem kryptischen Web appeared first on Rene Windegger.

During the last years I was working on different projects, most of them involving non disclosure agreements.

That’s why it took some time for me to reappear. During that time I did some side development that got obsoleted by the European parliament when accepting the Directive on Copyright in the Digital Single Market.

When looking over the accumulated repositories a small little class caught my attention. It was not much but a neat little thing.

I started to ask around if it’s ok to LGPL the code. The feedback was good. So I started to extract the code into a fresh repository. The GitHub repository was born.

Starting an Open Source project

Starting an open source project is very straight forward. GitHub offers great support to get you started. And even offers you help to select the right license for your requirements.

The next thing after setting up the repository is getting a build setup. One of the easier ways to get going for your .Net project is using a service like appveyor.com. Setting up the build is very straight forward and happens in a nice integrate user interface. You select a repository from your linked GitHub account adjust some settings and the build is working.

After being able to build you need to be able to deploy the library. When using the .Net ecosystem there is only one good solution for dependency management and publishing.

Let me introduce nuget. Just create an account and you’re good to go. For the integration with appveyor add an API Key on nuget.org and use it during your build. After a short validation your new package will show up in the package feed.

Great it’s there let’s use it

After all that setup is done you figure out that you need to setup some documentation. GitHub even offers a quick solution for that. Activating GitHub pages on the repository will create a public facing website using Jekyll. There is a set of ready to use themes defined. And your README.md file will be automatically available.

So with the documentation in place let’s take a look at how to a reference can be added to RabbitExpress now. Using Visual Studio you can just use the Manage NuGet Packages menu entry. Searching for RabbitExpress will yield the result on the right.

When you use the Visual Studio window simply add the reference to RabbitExpress.JsonSerializer to your project. This will take care of all the dependencies required by RabbitExpress and allows you to use the QueueClient in your project.

Using RabbitExpress to talk with RabbitMQ

Integration is very easy. The Examples offer a great start for your use. All you need is an instance of RabbitMQ ready.

Using the RabbitExpress publisher

The Publisher just makes use of the Publish method.

View the code on Gist.

As you can see the code is pretty straight forward. Observe the call to Publish in Line 60. The object that is passed is just a plain object. The queue name is specified using the Queues enumeration and prevents typos.

Implementing a worker using RabbitExpress

A worker is a simple program that only has one concrete task. In our example the task of the worker is to output messages that it receives from the queue. The example randomly fails and adds the message back into the queue, so another worker can try to process the message or after some time the error is recovered and the current worker receives the message again. When the worker receives an empty message it just rejects the message without adding it to the queue again. Let’s take a look at the example.

View the code on Gist.

This example requires a little more knowledge. It is using the Methods of the QueuedMessage to signal failure or success. And when it receives the exit message, the loop will end.

You can see the different forms of rejection used in Line 63 and Line 82. In Line 73 you can see the call to Acknowledge.

What is next

The next thing to do is adding more serializers to the project. Serializers allow to pass data around in messages. At the moment you will only find a JSON serializer.

Implementing your own serializer is very easy. Just implement the IExpressSerializer interface. Only two methods need your attention to implement the interface.

View the code on Gist.

Over the next couple of weeks there will show up different serializers. A Protobuf serializer is already in development and development on a msgpack serializer will begin shortly. Do you have other ideas, let me know in the comments below. When multiple serializers are available adoption rate increases and with higher adoption rate new ideas spring up on it’s own.

Conclusion

Starting an open source project is quite easy. There is a lot of infrastructure already in place and starting the usage is free of charge. After the initial setup there are multiple channels your open source project gets listed. nuget became the predominant channel for package distribution in .Net. No the library is out in the wild. I’m looking forward to feedback. The project the class was extracted from is already using the new NuGet package. When you use the library and end up here drop a line in the comments.  When encounter an issues, make sure to create an issue on GitHub, also when you think you can contribute. Feel free to create Pull Requests on GitHub.

With all that said. I hope you enjoyed the post. Maybe I have another post sooner than the last time.

The post Release RabbitExpress appeared first on Rene Windegger.

What are barcodes?

When you like to transfer information in an analogue fashion you have to deal with encoding and decoding the information in an efficient manner. Optical Character Recognition (OCR) could be an efficient way to process human readable data, on the other hand it is very prone to error. Transporting information in a nonhuman readable way is more efficient than dealing with OCR. Barcodes use lines to represent information. The representation of a datum is called encoding. There are many different encodings on the market. Lately QR code became public. QR code is a different form of barcode. The EAN-13 barcode is classified as 1D barcode. That means that only one dimension of the analogue label contains information. QR code is a encoding that is called 2D barcode. 2D barcodes contain information on both dimensions on the label.

Why ECMA Script and SVG?

Scalable Vector Graphics in short SVG is a XML dialect that is able to describe graphics. Those graphics can be scaled to any size and thus are perfect to create printable labels. Every printed barcode needs to be crisp clear otherwise the reader can’t process the information. Some encodings are capable of error correction but still having the option to scale it up as large as you like makes SVG a great tool for creating a barcode.

Creating the generator in JavaScript ensured that the process is not relaying on server side infrastructure. On the other hand you can integrate it into a server side solution as well using node.js. It might even become possible to integrate it directly into different desktop publishing software.

The post Generateing EAN-13 barcodes with Javascript and SVG appeared first on Rene Windegger.

I totally agree with him about the open floor office. It’s horrible, you can’t focus on your work and get a flow going. It’s important to get in the state of mind where you can let the creativity flow, imaging software development as writing book, without the right state of mind you won’t be productive.

When it comes to office designs, distractions are a big nuisance when trying to get into the flow. When you get interrupted during the flow, it takes some minutes to get back into the flow again. Open offices tend to create interruptions.

I was once working in a small scale open floor office. It was a pain to teach the sales force to not simply come into the room and interrupt everyone. Sales persons tend to need input and they need their input now. Teaching them to prepare their questions in an ordered way and inviting the technician to a meeting does wonders in that regard.

That behavior is understand able, but could break a good flow of code. Joel notes that developers get 2 hours of uninterrupted coding time. During that time, I think the team I’m working with didn’t get that time at all.

How can you help your developers?

It should be easy to get your developers the uninterrupted daily flow time. The first step is to plan your office time well. Introduce a stand up meeting and enforce the a time constrain. Next start to use your meeting planing tools, block a fixed time slot every day. Figure out the most productive time for every of your developers and let them block that time in their calendar.

So when you see some issues in your current workforce, look at the environment they are working in. It might actually be that your workforce simply needs some flow time to get back on track. When you think your team lacks other issues as well feel free to contact me. It might be easy to get you back on track and make your team deliver great software in time. When you currently not able to answer 12 of 12 questions of the Joel Test with yes, contact me as well and we will figure out how to proceed.

The post GeekWire Interview with Joel Spolsky appeared first on Rene Windegger.

You’re here to find the answer.

The Scenario

You have a long running console application and want to create an UI for it. You don’t have the oppurtunity to integrate the console application as a library so you’re bound to run the executeable. You want to be able to spawn multiple processes at the same time and be able to limit the concurrent execution of the processes. You need to be able to set EnvironmentVariables for the process environment. You need to be able to respond to new lines on the StandardError and StandardInput. You might need to respond to the console application with input.

The Basics

The .Net Framework offers a handy class that allows most of the requirements the scenario holds. The class is called System.Diagnostics.Process. After I’m finished you will have a nice wrapper around the Process class that can be used in many different scenarios. How is the process class helping us? It’s pretty simple, the Process class is used to start a new process. You need to specify some information in the form of a ProcessStartInfo object and call the Start method on the Process.

Why do we need a wraper?

Since .Net Framework 4.5 we can use the TAP (Task-based Asynchronous Pattern) and that’s what I’m gonna faciliate to get a class that can be inherited for your own needs and allows you to run multiple instances of the application.

Getting Started

First we need the LimitedConcurrencyTaskScheduler I’ve provided in an earlier post. If you didn’t read that post yet go there now and atleast get the code set up in your project. While you do so leave a comment about your expirience.

Since we need a clean way to interact with the process we define an interface. This interface defines a set of properties that allow you to react to updates from the application. It also defines a set of methods that are used to generate the input for the application.

View the code on Gist.

Now that we have sepcified our Environment Builder Interface we are ready to implement our BaseProcess class.

The BaseProcess Class

The BaseProcess class specifies some static properties and a set of static methods. Since it is an abstract generic class those static properties and methods will be initialized per implementation. The static members are used for parallelization, we define our LimitedConcurrencyTaskScheduler used for scheduling our child processes and a LinkedList that will hold our processes. The static Start methods provide a way to enqueue a new process to the queue. The argument for that methods will be our environment builders. Our class defines two properties, the command line of the process to run and the environment that will be used during execution. The two fields are used to generate the console output, one for locking the StringBuilder and one to generate the output. The constructor of the class sets the command line so make sure to specify it in your implementation class. The protected Execute method does the actual work of spawning the new child process. The private methods are handlers for some of the events triggered by the System.Diagnostics.Process class. Those memebers will call the abstract members defined in the class.

View the code on Gist.

So Now that we have the Base Process class ready we can start to make use of it in one of our projects.

The post Capture command line output in C# appeared first on Rene Windegger.

In the next few step I guide you through the creation of a TaskScheduler that will enable you exactly that.

The Scenario

You need to limit parallel execution of tasks that are started. You need to be able to limit the execution only for certain tasks.

The Basics

The .Net Framework offers a technology called Task-based Asynchronous Pattern. This pattern allows you to parallelize operations in a very simple way and automatically deals with the different schedulers that are used during runtime. For example it’s possible to use the await keyword to launch a long running operation from the main UI thread. And wait for the task and continue with your code scheduled back to the main UI thread.

In the back the TAP makes use of different TaskSchedulers but for our example we’re going to implement our own to limit parallel execution of the different queued Tasks.

The Code

So here is the code. Feel free to use it in your projects, just drop a comment.

View the code on Gist.

What’s it all about?

It’s pretty simple we have multiple methods we override, a property that handles the currently alowed degree of parallelism and Some fields that hold the current state of the scheduler. The code is pretty much self explainatory.

The ThreadStatic at the top is a marker if the current ThreadPool thread is processing items. The Tasks get queued into a LinkList called m_Tasks. And there is a counter for how many delegates are there. The constructor takes one argument and sets the degreee of parallelism.

The linked list is also used as a lock for the synchronization of the work balancing.

Why limit parallel execution of Tasks?

In my next Post I’m going to show you a useful example that needs limit parallel execution.

The post Limit parallel execution in TAP appeared first on Rene Windegger.

The solution and its friendly assemblies

We start with a Blank Solution and describe everything as detailed as possible.

To create a Blank Solution start your Visual Studio 2012 and wait until it is loaded. When Visual Studio is ready press [CTRL] + [SHIFT] + [n]. The New Project Dialog will open. Adjust your selection according to the next screenshot and give your Solution a name.

Click the OK button to create your Blank Solution. Now we need some Projects in our Solution to demonstrate the behavior we’ll need at least 3 Solutions. One Console Application and two ClassLibraries. We select File – Add – New Project in Visual Studio and create Projects with the following names. Just make your selection according to the following screenshots.

• at.automism.FriendlyAssemblies.Consumer
• at.automism.FriendlyAssemblies.Secret
• at.automism.FriendlyAssemblies.Public

Now we have the project structure for our little demo application.

Setup the Solution to use Strong-Name Signing

Its time to sign our assemblies to be able to identify the friendly assemblies.
Start the „Developer Command Prompt for VS2012“ enter your Solution directory and execute the following steps.

In our example we will generate only one KeyPair that will be used to sign all Assemblies.

View the code on Gist.

When everything worked out you will see something similar to the following screenshot.

Now we configure Signing for our Projects, repeat this steps for all Projects in the Solution.

1. Click the Project in the Solution Explorer.
2. Press [ALT] + [Enter] to open the Properties Window.
3. Click on Signing on the left side.
4. Check Sign the assembly.
5. Select „<Browse…>“ in the now enabled Drop Down box.
6. Select the generated .snk file in the opened File Open Dialog box.
7. Click Open.
8. Press [CTRL] + [s] to save the changes.

Press [CTRL] + [b] to start a build and make sure everything is still working.

Put some spread on the bread

Now that the Solution is set up, we add some Code to our projects.

Start with the „at.automism.FriendlyAssemblies.Secret“ Project. Visual Studio already generated a class for us, we’re going to change it to fit our needs.

View the code on Gist.

There is nothing spectacular about our Greeter Class. It just defines two Methods and sets the access modifier of one of the methods to internal.

Now we add the „at.automism.FriendlyAssemblies.Consumer“ as friendly assembly. Open the AssemblyInfo.cs file located in the Properties folder of the Project „at.automism.FriendlyAssemblies.Secret“.

At the end of the file add the InternalsVisibleToAttribute like in the following example.

View the code on Gist.

The Parameter for the Attribute is defined as „<name of the friendly assembly>, PublicKey=<key found in the at.automism.FriendlyAssemblies.txt file>“. Make sure to remove all line breaks from the public key.

Now we add a reference to our „at.automism.FriendlyAssemblies.Secret“ in the other two Projects.

1. Right click the References Folder of the Project.
2. Select „Add Reference…“.
3. On the left side of the opened window select Solution – Projects.
4. Check the box right in front of the desired Project.
5. Click OK when finished.

When you have added the references hit [CTRL] + [b] and make sure the build works as expected.

Now we modify the code in the „at.automism.FriendlyAssemblies.Public“ Project. Just modify the already existing class to look like the snippet below.

View the code on Gist.

You probably have noticed that you can’t access the WhisperHello Method from that file. That happens because the the method is only visible to friendly assemblies.

We add a reference to „at.automism.FriendlyAssemblies.Public“ to the „at.automism.FriendlyAssemblies.Consumer“ Project. Just follow the steps done earlier.

Adjust the Program.cs file to look like the following snippet.

View the code on Gist.

Have you noticed how WisperHello was available in Intellisense when making the adjustments?

When everything went OK you can hit F5 and will be presented with something similar to the screenshot below.

Reference

InternalsVisibleTo

The post Know your enemies with Friendly Assemblies appeared first on Rene Windegger.