$amount = 0x1FFFF;
$start = microtime(true);

while ($amount--)
	$throwAway = "this is a test at the $amount point!"; //$throwAway = "this is a test at the ". $amount ." point!";

	echo "Time: ". (microtime(true) - $start);

Exactly as expected, leaving it up to in-string parsing of variables ended up with a bench mark time of 0.1574 and manually concatenating in the variable was 0.1384, which is not a huge difference, but I wanted to see how this would scale when doing multiple concatenations. The string was changed to $throwAway = "this is ". $amount ." a test ". $amount ." at the ". $amount ." point!"; and it's respective in-string.

What I found is that it actually scales to in-string far better! In-string averaged to 0.3235 and manual to 0.3597. After some research it turns out this is because it does a single large concatenation while manually doing it could perform the operation 3 separate times.

Index Checking

The functional difference between array_key_exists($key, $array) and isset($array[$key]) is that isset returns false when the key exists but contains null. Functionality aside, there is a demonstrable performance difference.

$dataSet = array();
$size = 0x1FFFF;

$i = $size;
while ($i--)
	$dataSet[$i] = $i+1;

$start = microtime(true);

$i = $size;
while ($i--)
	array_key_exists($i, $dataSet); //isset($dataSet[$i]);

echo "Time: ". (microtime(true) - $start);

Sure enough, after averaging a few benchmarks together the outcome was clear.

isset

0.0248870849609

array_key_exists

0.604112148285

When performance is important target isset() when applicable. It's even possible to use a fall through to increase performance, here's an example from my Options class: if (!isset($this->_options[$resolvedName]) && !array_key_exists($resolvedName, $this->_options))

In the following test case there was no performance difference between usage of append or directly addressing an index.

$dataSet = array();
$size = 0x1FFFF;
$i = $size;

$start = microtime(true);

while ($i--)
	$dataSet[] = $i+1; //$dataSet[$i] = $i+1;

echo "Time: ". (microtime(true) - $start);

I have designed a pattern that allows an object to accept and address public level optional named arguments without the problems that could be associated with the compact()/extract() pattern. This pattern does require at least PHP 5.3 (uses late static binding) and overloads __get/__set preventing the child class from doing so.

Possible optional keys are defined as class constants, if one is addressed or set that is undefined an exception will be thrown. Instead of using extract(), the inherited SetOptionalProperties($array) method should be called to set the values. The value's can be addressed by it's constants name like it's a property, like $instance->ConstantName. Default values can be given by overloading the protected static $_defaultOptions member. The example shows this in with more detail:

class MyClass extends Options {
	public $Property;

	const MyOption = "MyOption";
	const AnotherOption = "AnotherOption";

	protected static $_defaultOptions = array(self::AnotherOption = "default value!");

	public function __construct($property, $options = array()) {
		$this->Property = $property;
		$this->SetOptionalProperties($options); // this allows Options to access the optional values.
	}
}

$instance = new MyClass("property's value", array(MyClass::MyOption = "my option value!"));
echo "MyOption: '{$instance->MyOption}', AnotherOption: '{$instance->AnotherOption}', Property: '{$instance->Property}'";

MyOption: 'my option value!', AnotherOption: 'default value!', Property: 'property's value'

abstract class Options {
	/// The array which stores the optional values
	private $_options = array();

	/// This array should be overloaded by child classes if default values are going to be used.
	protected static $_defaultOptions = array();

	/// Use Options::$AllowUndefinedProperties = true; to prevent exceptions from being thrown when an undefined
	/// property is set or fetched.
	public static $AllowUndefinedProperties = false;

	public function &__get($name) {
		$resolvedName = $this->ResolveOptionName($name);

		// Do we have a value? Use the isset/array_key_exists fall through to speed up access to existing non-null entries.
		if (!isset($this->_options[$resolvedName]) && !array_key_exists($resolvedName, $this->_options)) {
			// Do we have a default value?
			if (array_key_exists($resolvedName, static::$_defaultOptions))
				$this->_options[$resolvedName] = static::$_defaultOptions[$resolvedName];
			else
				$this->_options[$resolvedName] = null;
		}

		return $this->_options[$resolvedName];
	}

	public function __set($name, $value) {
		$resolvedName = $this->ResolveOptionName($name);

		return $this->_options[$resolvedName] = $value;
	}

	public function __isset($name) {
		$resolvedName = $this->ResolveOptionName($name);

		return isset($this->_options[$resolvedName]);
	}

	public function __unset($name) {
		$resolvedName = $this->ResolveOptionName($name);

		unset($this->_options[$resolvedName]);
	}

	/**
	 * Set the optional properties for the class.
	 * @param $options A [ClassConstant] = Value indexed array of optional properties.
	 */
	protected function SetOptionalProperties(array $options) {
		$this->_options = $options;
	}

	/// Resolve any aliases name to the proper name.
	private function ResolveOptionName($name) {
		$constant = "static::". $name;

		if (defined($constant))
			return constant($constant);
		else if (!self::$AllowUndefinedProperties)
			throw new Exception("Undefined property or option '$name' being set in ". get_called_class());

	}
}

SELECT Foods.Description, concat( NutrientValue, Units ) AS Value
FROM Foods
JOIN NutrientDefinitions ON ( NutrientName = 'Protein' )
JOIN NutrientData
USING ( NutrientID, FoodID )
ORDER BY NutrientValue DESC
LIMIT 150

SELECT Foods.Description, concat( NutrientValue, Units ) AS Value
FROM FoodGroups
JOIN Foods
USING ( CategoryID )
JOIN NutrientDefinitions ON ( NutrientName = 'Protein' )
JOIN NutrientData
USING ( NutrientID, FoodID )
WHERE FoodGroups.Description like '%LEGUME%'
ORDER BY NutrientValue DESC
LIMIT 100

SELECT Foods.Description, concat( NutrientValue, Units ) AS Value
FROM Foods
JOIN NutrientDefinitions ON ( NutrientName like '%Iron%' )
JOIN NutrientData
USING ( NutrientID, FoodID )
ORDER BY NutrientValue DESC
LIMIT 150

GraphicsPath Front is vector drawing software based upon the GraphicsPath .net class.

Download (source and binaries) — Execute \bin\debug\GraphicsPathFront.exe or compile from source.

Some of the notable features include:

• Save/load vectorized graphics, or save in numerous rasterized formats.
• Configurable and snap-to'able grid.
• Live preview of what's being drawn, including rendering in real-time.
• The ability to render as mouse input. (Need to see the videos to understand!)
  • Rendering an elaborate font as mouse input to Microsoft Paint.
  • Rendering a vectorized playing card as mouse input to Microsoft Paint.

There are several limitations in this program due to the limits of the underlying GraphicsPath class. Though the code is in place to do so, nodes can not be directly edited once created, for example. Nor can different paths be drawn using different pens.

Below are some samples of the code from the project. Note that some of the limitations of the code highlighting plugin are apparent in generics being passed as generic types, and with XML comments.

The class which manages the drawing of and mouse handling for the grid.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Drawing;
using System.Drawing.Drawing2D;

namespace CrayonAutomaton {
    ///

    /// Create a GraphicsPath based grid in memory.
    /// 

    class DrawingGrid {
        ///
An event that is triggered when ever the grid is regenerated and needs to be redisplayed.

        public event Action GridUpdated;

        ///
Gets or Sets the total area of the grid.

        public Size GridSize {
            get { return _gridSize; }
            set {
                _gridSize = value;
                makeGrid();
            }
        }
        ///
Gets or Sets the size of each grid cell.

        public Size CellSize {
            get { return _cellSize; }
            set {
                _cellSize = value;
                makeGrid();
            }
        }
        ///
Gets or Sets the color of the drawn grid.

        public Color GridColor {
            get { return _gridColor; }
            set {
                _gridColor = value;
                makeGrid();
            }
        }
        ///
Gets the grid vector

        public GraphicsPath Grid { get { return path; } }
        ///
Gets or Sets if 'GridPositionFromPoint()' snaps passed Point to the grid.

        public bool SnapPointsToGrid { get; set; }
        ///
Gets or Sets if grid is drawn when asked to

        public bool Visible {
            get { return _visible; }
            set {
                _visible = value;
                if (GridUpdated != null)
                    GridUpdated();
            }
        }

        private Size _gridSize;
        private Size _cellSize;
        private Color _gridColor;
        private bool _visible;
        private bool noRendering = false;
        private GraphicsPath path = new GraphicsPath();

        public DrawingGrid(Size gridSize) : this(gridSize, new Size(20, 20), Color.LightGray, true) { }
        public DrawingGrid(Size gridSize, Size cellSize) : this(gridSize, cellSize, Color.LightGray, true) { }
        public DrawingGrid(Size gridSize, Size cellSize, Color gridColor) : this(gridSize, cellSize, gridColor, true) { }
        ///
Creates an instance of a class for drawing a grid on an image

        ///
Total area of grid to draw
        ///
Size of each cell to draw
        ///
Color to draw the grid
        ///
Determins if 'GridPositionFromPoint()' snaps passed Point to the grid.
        public DrawingGrid(Size gridSize, Size cellSize, Color gridColor, bool snapPointsToGrid) {
            BeginUpdate();
            GridSize = gridSize;
            CellSize = cellSize;
            GridColor = gridColor;
            SnapPointsToGrid = snapPointsToGrid;
            Visible = true;
            EndUpdate();
        }

        ///
'Snaps' the passed point to grid, returns as-is if snapping to grid is disabled.

        public Point GridPositionFromPoint(Point point) {
            if (!SnapPointsToGrid)
                return point;
            Point gridPoint = new Point();
            gridPoint.X = (int)Math.Floor((decimal)(point.X / CellSize.Width)) * CellSize.Width;
            gridPoint.Y = (int)Math.Floor((decimal)(point.Y / CellSize.Height)) * CellSize.Height;
            if (point.X % CellSize.Width > CellSize.Width / 2)
                gridPoint.X += CellSize.Width;
            if (point.Y % CellSize.Height > CellSize.Height / 2)
                gridPoint.Y += CellSize.Height;
            return gridPoint;
        }
        ///
Draws grid to Graphic 'g' if Visible, regenerates grid if 'size' is different

        public void DrawToGraphic(Graphics g, Size size) {
            if (Visible) {
                if (size != GridSize)
                    GridSize = size;
                g.DrawPath(new Pen(GridColor), Grid);
            }
        }
        ///
Draws grid to Graphic 'g' if Visible

        public void DrawToGraphic(Graphics g) {
            if (Visible)
                g.DrawPath(new Pen(GridColor), Grid);
        }
        ///
Prevents (costly) regeneration of grid during property changes.

        public void BeginUpdate() { noRendering = true; }
        ///
Allows grid to be regenerated by property changes again, also regenerates grid.

        public void EndUpdate() {
            noRendering = false;
            makeGrid();
        }

        ///
(Re)render the grid to the 'path' variable.

        private void makeGrid() {
            /* Do not render if durring an 'update' */
            if (noRendering)
                return;

            int cellX = CellSize.Width;
            int cellY = CellSize.Height;

            /* Clear old grid */
            path.Reset();

            /* Add vertical lines (columes) */
            do {
                path.StartFigure();
                path.AddLine(cellX, 0, cellX, GridSize.Height);
            } while ((cellX += CellSize.Width) < GridSize.Width);

            /* Add horizontal lines (rows) */
            do {
                path.StartFigure();
                path.AddLine(0, cellY, GridSize.Width, cellY);
            } while ((cellY += CellSize.Height) < GridSize.Height);

            /* Call all grid updated events */
            if (GridUpdated != null)
                GridUpdated();
        }
    }
}

A collection of drawing tools and an abstract class and event driven drawing tool system.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Drawing;
using System.Drawing.Drawing2D;
using System.Windows.Forms;

namespace CrayonAutomaton {
    ///
A collection of DrawingTool

    class DrawingTools {
        ///
Event for when an update is required.

        public event Action PreviewUpdate;

        ///
Gets or Sets the currently in-use drawing tool.

        public DrawingTool Tool { get; set; }
        ///
A collection of DrawingTools

        public List Tools { get; set; }
        ///
Functions which are called on the mouse input before the mouse data is used.

        public IEnumerable> MouseInputFilters {
            get { return _mouseInputFilters; }
            set {
                performToAllTools(delegate(DrawingTool tool) { tool.MouseInputFilters = value; });
                _mouseInputFilters = value;
            }
        }
        public GraphicsPath Path {
            get { return _path; }
            set {
                performToAllTools(delegate(DrawingTool tool) { tool.Path = value; });
                _path = value;
            }
        }

        private GraphicsPath _path;
        private IEnumerable> _mouseInputFilters;

        public DrawingTools(GraphicsPath path, Func mouseInputFilter/*, Control hookToSurface*/)
            : this(path, new[] { mouseInputFilter }) { }
        ///
Instances a usable collection of DrawingTool's

        ///
Path for the tools to draw to
        public DrawingTools(GraphicsPath path, IEnumerable> mouseInputFilters/*, Control hookToSurface*/) {
            /* Instance all locally coded drawing tools */
            Tools = new List(new DrawingTool[] {
                new NullDrawingTool(),
                new LineDrawingTool(),
                new RectangleDrawingTool(),
                new EllipseDrawingTool(),
                new FreeDrawDrawingTool(),
                new TextDrawingTool()
            });

            /* Set-up all required members */
            performToAllTools(delegate(DrawingTool tool) { tool.ParentCollection = this; });
            Path = path;
            MouseInputFilters = mouseInputFilters;

            SetTool("");
        }

        public void Preview() {
            if (PreviewUpdate != null)
                PreviewUpdate();
        }
        public void HookToolsToSurface(Control surface) {

        }

        public bool SetTool(DrawingTool tool) { return SetTool(tool.Name); }
        ///
Changes the in-use tool based upon 'name'

        /// Returns 'true' if a tool is found and set, 'false' otherwise.
        public bool SetTool(string name) {
            foreach (DrawingTool curTool in Tools)
                if (curTool.Name == name) {
                    Tool = curTool;
                    return true;
                }
            return false;
        }

        private void performToAllTools(Action delegateFunction) {
            foreach (DrawingTool curTool in Tools)
                delegateFunction(curTool);
        }
    }

    abstract class DrawingTool : IEquatable {
        ///
Get the tools name

        public string Name { get { return _name; } }
        ///
A value indicating if the mouse is presently inside the drawing area

        public bool IsMouseInside { get; set; }
        public GraphicsPath Path { get; set; }
        public IEnumerable> MouseInputFilters { get; set; }
        public MouseButtons MouseButtonState { get; set; }
        public DrawingTools ParentCollection { get; set; }

        private string _name;

        protected Point mouseDownLocation;

        ///
Abstract class for drawing tools

        ///
Name of the drawing tool, must be unique
        protected DrawingTool(string name) {
            _name = name;
            IsMouseInside = false;
        }

        ///
Call to pass the mouse down event to the in-use tool.

        public void MouseDown(Point point) {
            point = filterMouseInput(point);
            mouseDownLocation = point;
            mouseDown(point);
        }
        ///
Call to pass the mouse move event to the in-use tool.

        public void MouseMove(Point point) {
            point = filterMouseInput(point);
            mouseMove(point);
        }
        ///
Call to pass the mouse up event to the in-use tool.

        public void MouseUp(Point point) {
            point = filterMouseInput(point);
            mouseUp(point);
        }
        public void MouseLeave() {
            IsMouseInside = false;
            mouseLeave();
        }
        public void MouseEnter() {
            IsMouseInside = true;
            mouseEnter();
        }
        public void Render(Point currentMouseLocation) { Render(Path, currentMouseLocation); }
        public void Render(GraphicsPath path, Point currentMouseLocation) {
            render(path, filterMouseInput(currentMouseLocation));
        }

        protected virtual void mouseMove(Point point) {}
        protected virtual void mouseUp(Point point) { }

        ///
This function should be override if it's possible to render with mouseDownLocation and the currentMouseLocation.
        /// If this function is not overloaded, drawing is still possible, but preview rendering is not.

        protected virtual void render(GraphicsPath path, Point currentMouseLocation) { }
        ///
Override if mouse down detection is needed

        protected virtual void mouseDown(Point point) { }
        ///
Override if mouse enter detection is needed

        protected virtual void mouseEnter() { }
        ///
Override if mouse up detection is needed

        protected virtual void mouseLeave() { }

        ///
Returns passed point as processed by the list of provided filters in MouseFilterList

        protected Point filterMouseInput(Point point) {
            foreach (Func curFilter in MouseInputFilters)
                point = curFilter(point);
            return point;
        }
        ///
Reorders the passed points so that point1 is to the upper left of point2

        /// Returns the distance between refactored point1 and point2
        protected Size orderPoints(ref Point point1, ref Point point2) {
            point1.X = Math.Min(point1.X, point2.X);
            point1.Y = Math.Min(point1.Y, point2.Y);
            point2.X = Math.Max(point1.X, point2.X);
            point2.Y = Math.Max(point1.Y, point2.Y);
            return new Size(point2.X - point1.X, point2.Y - point1.Y);
        }
        ///
Returns a rectangle from where MouseDown and mouseUpPoint occured

        protected Rectangle mouseDragRectangle(Point mouseUpPoint) {
            return new Rectangle(mouseDownLocation, orderPoints(ref mouseDownLocation, ref mouseUpPoint));
        }

        public override string ToString() { return Name; }
        public bool Equals(DrawingTool obj) { return obj.GetHashCode() == GetHashCode(); }
        public override int GetHashCode() { return Name.GetHashCode(); }
    }

    ///
A base level null drawing tool for default tool selection

    class NullDrawingTool : DrawingTool {
        public NullDrawingTool()
            : base(string.Empty) { }
    }

    ///
A DrawingTool for drawing single lines

    class LineDrawingTool : DrawingTool {
        public LineDrawingTool()
            : base("Line") { }

        protected override void render(GraphicsPath path, Point currentMouseLocation) {
            path.AddLine(mouseDownLocation, currentMouseLocation);
        }

        protected override void mouseUp(Point point) {
            Render(point);
        }
    }

    ///
A DrawingTool for drawing single rectangles

    class RectangleDrawingTool : DrawingTool {
        public RectangleDrawingTool()
            : base("Rectangle") { }

        protected override void render(GraphicsPath path, Point currentMouseLocation) {
            path.AddRectangle(mouseDragRectangle(currentMouseLocation));
        }

        protected override void mouseUp(Point point) {
            Render(point);
        }
    }

    ///
A DrawingTool for drawing single ellipses

    class EllipseDrawingTool : DrawingTool {
        public EllipseDrawingTool()
            : base("Ellipse") { }

        protected override void render(GraphicsPath path, Point currentMouseLocation) {
            path.AddEllipse(mouseDragRectangle(currentMouseLocation));
        }

        protected override void mouseUp(Point point) {
            Render(point);
        }
    }

    ///
A DrawingTool for 'free hand' drawing

    class FreeDrawDrawingTool : DrawingTool {
        Point lastPoint;

        public FreeDrawDrawingTool()
            : base("Free Draw") { }
        protected override void mouseDown(Point point) {
            lastPoint = point;
        }
        protected override void mouseMove(Point point) {
            if (MouseButtonState == MouseButtons.Left) {
                drawLine(point);
                lastPoint = point;
            }
        }
        protected override void mouseUp(Point point) {
            drawLine(point);
        }

        private void drawLine(Point point) {
            Path.AddLine(lastPoint, point);
        }
    }

    class TextDrawingTool : DrawingTool {
        public TextDrawingTool()
            : base("Text") { }

        enterTextDialog textDialog;

        protected override void mouseUp(Point point) {
            textDialog = new enterTextDialog(ParentCollection.Preview);
            if (textDialog.ShowDialog() == DialogResult.OK)
                render(Path, point);
        }

        void textDialog_PreviewUpdateEvent() {
        }

        protected override void render(GraphicsPath path, Point currentMouseLocation) {
            path.AddString(textDialog.EnteredText,
                textDialog.SelectedFont.FontFamily,
                (int)textDialog.SelectedFont.Style,
                textDialog.SelectedFont.Size,
                mouseDownLocation,
                StringFormat.GenericDefault);
        }
    }
}

Boggle.exe is a computerized version of the Hasbro dice game. It's intended to be played by multiple people infront of the computer using pens and paper, no internet play is supported as it's ridiculously easy to cheat. The main neat feature of Boggle.exe over it's physical counterpart is a board solver. Once the game is over, all of the valid words inside of the board are shown and can be highlighted (see picture).

Download (source and executable) — Extract to it's own directory and run \bin\debug\Boggle.exe. words.txt must be in the same directory as the executable.

First on a different system you should remove all existing partitions and create new ones (optional), then set the partition as active, give it a boot loader, then give it the installation files.

First execute diskpart.exe from inside of a console. You'll need to determine which drive is the hard drive you intend to do this to. Type in list disk. From now on, the drive number will be referred to as n.

select disk n
clean
create partition primary
select partition 1
active
format fs=NTFS quick
assign
exit

clean will remove all existing partitions, then the partition is made and selected, active will mark is at an active partition which signals a bootloader to use this partition, the partition is then formatted, and mounted. Determine the drive letter assigned to the partition, this will be referred to as m.

Using the bootsect.exe executable found in the \boot\ directory of your Vista or Windows 7 DVD, install Windows Boot Manager (BOOTMGR) onto the drive using bootsect.exe /nt60 m: . I can confirm that using a 32 bit executable to make a 64 bit installer does work, and vice versa.

That's it! You're all done! Boot from the drive and the installer will run.

Check out the source code that went into making this video! It uses AviSynth scripting to speed up small sections.
video = DirectShowSource("MVI_0480.AVI")

return video.Trim(0,2300) ++ \
video.Trim(2300,3250).AssumeFPS(fps*speedfactor).ChangeFPS(fps) ++ \
video.Trim(3251,5999) ++ \
video.Trim(6000, 6300).AssumeFPS(fps*speedfactor).ChangeFPS(fps) ++ \
video.Trim(6301,9599) ++ \
video.Trim(9600, 11300).AssumeFPS(fps*speedfactor).ChangeFPS(fps) ++ \
video.Trim(11301,0)

Don't feel like doing this yourself? No need!

When running PowerCalcPowertoySetup.exe, it complained that I'm not on Windows XP. Fair enough, but is that really important?

The exe installer dumped the MSI file at C:\Windows\Downloaded Installations\Calculator Powertoy for Windows XP.msi which I ran MsiDiff on to dump the MSI script. This gave me Calculator Powertoy for Windows XP.msi.MmDumpTxt which I searched for the above error in.

<$Row
	Condition="VersionNT = 501"
	Description="The powertoys require Windows XP or a service pack. They will not function on a version of Windows earlier or later than Windows XP."
>

Perfect. 501 is the Windows XP kernel version. Lets change that to the Vista kernal version in the MSI...

Sweet! It worked!

Running PowerCalc.exe causes it to exit before ever giving us a GUI. Lets do a trace in OllyDbg and see what we can figure out.

01018405	Main	JE SHORT PowerCal.0101840C
0101840C	Main	TEST BYTE PTR SS:[EBP-30],1
01018410	Main	JE SHORT PowerCal.01018423
01018412	Main	MOVZX ECX,WORD PTR SS:[EBP-2C]	ECX=0000000A
01018416	Main	JMP SHORT PowerCal.01018426
01018426	Main	PUSH ECX	Arg4 = 0000000A
01018427	Main	PUSH EAX	Arg3 = 001E1F33
01018428	Main	PUSH EBX	Arg2 = 00000000
01018429	Main	PUSH PowerCal.01000000	Arg1 = 01000000
0101842E	Main	CALL PowerCal.01001FD3	EAX=00000000, ECX=D73F2C3E, EDX=7F68081A
01018433	Main	MOV ESI,EAX
01018435	Main	MOV DWORD PTR SS:[EBP-7C],ESI
01018438	Main	CMP DWORD PTR SS:[EBP-60],EBX
0101843B	Main	JNZ SHORT PowerCal.01018444
0101843D	Main	PUSH ESI	status = 0
0101843E	Main	CALL DWORD PTR DS:[<&msvcrt.exit>]	ECX=0006FE28, EDX=00000000, EBP=0006FE84, ESI=00000001, EDI=00831BF0
    Process terminated, exit code 0

The bottom of the trace-over isn't telling us much. Lets check out some of these offsets in IDA Pro and see what we can come up with.

All the stuff around 0101843B seems to exit the program, and none of these other offsets get us anywhere... lets run a trace-into and see what we get.

Aside from a 75mb text file, we get: (search from the bottom up for our programs address space! There's a lot of external code in there!).

010180E3	Main	RETN
01001FD1	Main	LEAVE	EBP=0006FEE4
01001FD2	Main	RETN
01001FDF	Main	TEST EAX,EAX
01001FE1	Main	JE PowerCal.010020A0
010020A0	Main	XOR EAX,EAX
010020A2	Main	POP ESI
010020A3	Main	LEAVE	EBP=0006FF88
010020A4	Main	RETN 10
01018433	Main	MOV ESI,EAX
01018435	Main	MOV DWORD PTR SS:[EBP-7C],ESI
01018438	Main	CMP DWORD PTR SS:[EBP-60],EBX
0101843B	Main	JNZ SHORT PowerCal.01018444
0101843D	Main	PUSH ESI	status = 0
0101843E	Main	CALL DWORD PTR DS:[<&msvcrt.exit>]
exit	Main	MOV EDI,EDI

Now we're talking! It looks like a function returns and then the program exits. Lets check out the call to that function.

One path goes to the exit, the other... doesn't! Lets check out sub_1001F60 to see what it does...


It's our evil Windows Version Checking function!

In OllyDbg lets goto the jz loc_10020A0 after the function call, right click, and goto "nop" and press run. This causes the program to always follow the non-exiting code path.

Success!

Lets hex edit that into the executable so it's like this all the time.

We can now use our calculator!

Oh, that makes sense. So lets uninstall the old version.

Can't install the new, can't uninstall the old. Time for some hackery!

First lets find out the name of the culprit installer with Process Explorer's find tool, then in Process Monitor lets setup a filter to this executable.

Re-running the installer lets us see what it's accessing. Using that we can find out what makes it think it's installed so we can trick it into thinking it's doing a fresh install. Once the error screen comes up, unattach the event monitor in Process Monitor (control+e).

This looks interesting. It's the registry key used by Window's Add/Remove Programs.

Lets rename it to prevent the installer from seeing it then re-run the installer. Hmm... Semi-success. The installer now gives us the same error, but in a different place, so lets re-Process Monitor the installer.

Well! This looks very interesting! Lets rename this one as well...

Hey! It's installing!

Finally, time to get back to work.

Crap!

A DLL did not get replaced during the installation and a version mis-match is causing problems (why put the version number in the filename and not update it?). After a harddrive-wide search, I found sigc-2.0.dll in C:\Program Files\VMware\VMware Workstation. Good news is the installer has all of the installation files out in the open, so no need to dump cabs or hack the msi. I replaced copy in the Program Files directory with the one from the installer's directory and...

Success!

I thought an interesting implementation would be a completely client side one written in Javascript using Google's search API. To spoil the ending, after creating this I discovered the API only allows 8 results per page and 8 pages, making this useless if the site is beyond the 64th result, but the API is interesting and powerful regardless.

The finished version can be found at pagerank.red-stars.net with the complete Javascript.

The WebSearch() object is relatively simple, once instanced, all it needs is a call back to be setup before it can be used.

var webSearch = new google.search.WebSearch();
webSearch.setSearchCompleteCallback(this, searchComplete, null);
webSearch.execute("cookies");

The function searchComplete() will be called when the search for "cookies" completes. It's important that our instance of WebSearch named webSearch is inside of a scope which is viewable from searchComplete() because the callback is argumentless.

function searchComplete() {
	// Make sure that there are results.
	if (webSearch.results && webSearch.results.length > 0) {
		var results = webSearch.results;
		// Go through every result.
		for (var resultIndex = 0; resultIndex < results.length; resultIndex++) {
			var result = results[resultIndex];
			// Show a messagebox with the results information.
			alert(result.html.innerHTML);
		}
	}
}

We used the .html property from the result which gives us a Google-looking result. Now what if we wanted more than just the first page?

var currentPageIndex = 0;
function searchComplete() {
	// Make sure that there are results.
	if (webSearch.results && webSearch.results.length > 0) {
		currentPageIndex++;
		var results = webSearch.results;
		// Go through every result.
		for (var resultIndex = 0; resultIndex < results.length; resultIndex++) {
			var result = results[resultIndex];
			// Show a messagebox with the results information.
			alert(result.html.innerHTML);
		}

		// Check if another page exists, if so, perform the request.
		if (currentPageIndex < webSearch.cursor.pages.length)
			webSearch.gotoPage(currentPageIndex);
	}
}

The cursor object contains an array called pages who's length is used to determine the number of pages available. This will go through all available search results. When gotoPage is called, our call back function is once again executed when the search is finished.

A complete reference to the WebSearch and associate classes is available on code.google.com. The API is decent and flexible, if not limited in functionality.

Inside of GraphicsPath is a byte array called PathTypes that contains PathPointType and a PointF array called PathPoints (the same data is also stored in GraphicsPath.PathData.Points and GraphicsPath.PathData.Types). They relate to each other by index, so PathTypes[n] is the PathPointTypes for PathPoints[n].

The reason PathTypes is stored as bytes and not PathPointType is because multiple values will be contained per byte. To separate the two, you must use a bitwise AND operation of your value against the bit mask PathPointType.PathTypeMask. The resulting value is either Start, Line or Bezier (Bezier3 is equal to Bezier).

You can NOT modify these collections directly. Instead, you must make a new instance of GraphicsPaths and pass modified collections to them via the (PointF[], byte[]) constructor.

Below is code which parses the PathTypes and PathPoints and causes actions in a class which renders the GraphicsPath as mouse output where the mouse is down when the pen should be down, and the mouse moves to the location the pen should be, etc. Please note this code renders Bezier curves as lines.

int index=0;
PointF firstPoint = new PointF(); // Used to store the starting position so closed paths can reposition here.
// Loop through all path data
foreach (PointF point in Path.PathPoints) {
	byte curType = Path.PathTypes[index];
				// Extract the item type by the bit mask
	byte itemType = (byte)(curType & (byte)PathPointType.PathTypeMask);

	// Draw the different object types
	if (itemType == (byte)PathPointType.Start) {
		firstPoint = point;
		input.MousePos(point);
		input.LeftButtonDown();
	} else if ((itemType == (byte)PathPointType.Line) || (itemType == (byte)PathPointType.Bezier) || (itemType == (byte)PathPointType.Bezier3))
		input.MousePos(point);

	// Handle all additional flags
	if (isType(curType, PathPointType.PathMarker)) {
		bool wasMouseDown = false;
		if (input.IsMouseDown) {
			wasMouseDown = true;
			input.LeftButtonUp();
		}
		input.MousePos(point);
		if (wasMouseDown)
			input.LeftButtonDown();
	}

	if (isType(curType, PathPointType.CloseSubpath)) {
		input.MousePos(firstPoint);
		input.LeftButtonUp();
	}
	index++;
}
input.LeftButtonUp();

private bool isType(byte type, PathPointType isType) {
	return (type & (byte)isType) != 0;
 }

The local machine is a Windows Vista workstation and the remote is a webserver running LAMP.

The security of the locally backup database file is only as secure as the machine it-self. If you're not sure what this means, do not backup sensitive data using this method.

mysqldump is a program which can dump the contents of a MySQL database. It should be used with a MySQL user which has read access to all of the databases on your server that you wish to backup.

mysqldump will be executed by PHP on the remote server and the output will be passed back over standard http.

Update the variables in the above script and save as index.php. Upload this file to it's own directory on your server, for example /www/sqlbackup/.

/www/sqlbackup/ should be configured as a password protected directory to prevent access by anyone to it.

Download wget into your %windir. This is a command line utility that can be used to download remote files and pages from http and ftp servers.

Optionally, install WinRAR to add compression.

wget --http-user=... --http-password=... --output-document=C:\Users\Joe\Documents\Scripts\sqlbackup\backup.txt http://www.yourserver.com/sqlbackup/
"C:\program files\winrar\rar.exe" u -dw -y -p... backup.rar backup.txt

The first line uses wget to download the output from our remote script to backup.txt. The user, password, remote, and local locations all need to be changed to suite your configuration. This should be saved into script.bat in it's own directory on your local workstation, example C:\Users\Joe\Documents\Scripts\sqlbackup\.

The second line compresses the downloaded file into backup.rar and sets the password of the rar to whatever follows the -p argument. Note that the rar password ads very minimal security due to the script, which contains the password, being in the same directory. This line is optional and can be omitted.

Run backup.bat to make sure that everything is working fine.

In a command window, enter at 13:00 /EVERY:M,T,W,Th,F,S,Su C:\Users\Joe\Documents\Scripts\sqlbackup\backup.bat

This will cause the above local script to execute everyday at 1:00PM everyday of the week.

There's nothing else to it! Keep in mind, once again, that this will make any of the dumped MySQL contents as insecure as your computer is!