Coding Stuffs

Fobber Code Decryption

Mon, 10 Aug 2015 09:00:12 +0000

After reading the Malwarebytes blog post describing Fobber, a new variant of Tinba, I wanted to have a look at it myself (MD5 691ce6807925fed03cb61f4add0e5ffd).

Instead of unpacking all the code at once in memory, Fobber uses a cleverer way to make the analysis much more difficult. Before any code can be executed, Fobber performs the following:

Decrypt the function to be executed
Execute it
Re-encrypt the function

In this post, let’s have a look on how the decryption routine works. On the screenshot below we see OllyDbg stopped before the decryption function at 0x009E2592 is getting called.

The decryption function will use specific bytes preceding this call to perform the decryption. Let’s describe them:

Position	Description
`- 0xB`	Mutex: either `0x21` (free) or `0xC1` (occupied)
`- 0xA..0x9`	Code length
`- 0x8`	XOR key
`- 0x7`	Either 1 (decrypted) or 0 (encrypted)
`- 0x6`	Not used
`- 0x5..0x1`	Call to decrypt function
`0x0`	First byte of encrypted code

If we want to match these field to the above code we obtain:

Mutex: 0x21
Key: 0x37
Size 0x9c bytes
Encrypted: 0x0

The size is not directly used but it is first XORed with the constant 0x0E489, so 0xE415 ^ 0x0E489 = 0x9C

The mutex is 0x21 meaning that no other thread is decrypting it.

Now let’s have a look at the decryption function in IDA:

In loc_2597 the decrypt function waits until the mutex is free (value 0x21), then it adds 1 to the -7th byte and checks that the the previous value was 0x0 (encrypted), if so, it continues by pushing the XOR key and the computed size to the stack.

Function xor_code performs the actual decryption. This function loops from 0 to size and for each byte code performs the following:

XOR the current code byte with the XOR key
Compute a new XOR key for the next step by rotating the bits of the XOR key 3 position to the right (ROR) Once finished it foes back

To simplify this process I wrote a small python script performing the steps described above. You can either use it directly on a dump of the injected memory or adapt it to be loaded in IDA debugger. The script uses pwntools library to dump assembly code to the console.

import re
import struct
from pwnlib.asm import disasm
from pwnlib.context import context

context(arch='i386', os='windows', endian='big', word_size=32)

# Injected memory dump file
f = open("./data/dump_009E0000.mem", "rb")
d = bytearray(f.read())


def decrypt_section(key, size, data, start, end):
    ror = lambda val, r_bits, max_bits: \
        ((val & (2 ** max_bits - 1)) >> r_bits % max_bits) | \
        (val << (max_bits - (r_bits % max_bits)) & (2 ** max_bits - 1))

    tmpkey = key
    for i in range(start, end):
        b = data[i]
        b = ((b ^ tmpkey) & 0xFF)
        tmpkey = ror(tmpkey, 0x3, 8)
        tmpkey += 0x53
        tmpkey &= 0xFF
        data[i] = b

    # Write ASM code to the console
    print disasm(data)


total_length = len(d)
print "Total length %s bytes" % hex(total_length)
count = 0

# Match where encrypted functions begins using this regex
for m in re.finditer('\x21[\x00-\xFF]{5}\xe8[\x00-\xFF]{4}', d):
    print "Encrypted code section found at %s" % hex(m.start())
    size = struct.unpack('<H', d[m.start() + 1:m.start() + 3])[0]
    size ^= 0x0e489
    if size > total_length:
        print "Wrong match, size bigger then binary data"
        continue
    key = struct.unpack('B', d[m.start() + 3:m.start() + 4])[0]
    encrypted = struct.unpack('B', d[m.start() + 4:m.start() + 5])[0]
    if encrypted > 0:
        print "Wrong match, encrypted flag must be zero"
        continue

    print "Key: %s" % hex(key)
    print "Size: %s bytes" % hex(size)
    print "Encrypted: %s" % hex(encrypted)

    decrypt_section(key, size, d, m.end(), m.end() + size)
    count += 1

print "-" * 30
print "Found %d references!" % count
# Save the decrypted code to a file
wf = file("./data/decrypted.bin", "wb")
wf.write(d)
print "Written %d bytes to %s" % (len(d), wf.name)

Blog migrated to Github Pages

Sat, 08 Aug 2015 19:01:52 +0000

This blog continues the one I started a long time ago on Blogger. Thanks to jekyll-import I could migrate all posts from Blogger with ease.

Have fun!

Modify intercepted Windows API functions parameters with WinAppDbg

Mon, 06 Jul 2015 10:58:00 +0000

If you are a malware analyst, you probably already came across WinAppDbg.
This module allows you to quickly script instrumentation code in python under Windows.

One of its (many) powerful features is the ability to quickly intercept Windows API calls.
Let's have a look at a small example showing how to intercept Sleep calls.


class MyEventHandler(EventHandler):
    apiHooks = {
        'kernel32.dll': [
            ("Sleep", 1)
        ]
    }

# Intercept the API before the actual call is being made to Sleep ('pre' callback)
def pre_Sleep(self, event, retval, dwMilliseconds):
    thread = event.get_thread()
    process = event.get_process()

    print "Intercepted Sleep call of %d milliseconds"

Many malware use the Sleep function to delay an operation on the infected machine (e.g. to timeout dynamic analysis or to interval home-beaconing).
With WinAppDbg we can modify the function parameter (dwMilliseconds) before the actual call is being made to Sleep().
To do so we simply access the stack frame and write a new DWORD with value 0x00 to EBP+4


# Access first parameter on the stack: EBP + 4
stack_offset = thread.get_sp() + 4
# Write the new value at that address (e.g. 0 milliseconds)
process.write_dword(stack_offset, 0x00)

Weekend project: Xamarin.Forms app in 20 hours

Sun, 05 Jul 2015 17:38:00 +0000

Some weekends ago I wanted to test how fast can you develop and deploy an application with Xamarin.Forms.

After around 20 hours of work the Android version landed on the Google Play store. I was very impressed on how fast and clean I had developed the UI in XAML and how all the bindings just worked.

The more interesting part was the development of the platform-dependent services for the app to access native audio API and the Ads rendering (using AdMob component).

Fortunately some good guy already deployed a NuGet library called Lamp to access camera flash across multiple platforms. I just had to pull the library source code to fix a bug within the Android implementation that prevented the flash to turn off.

The Audio service is used to play different sound effects simultaneously which were synchronize against the thunder effects generated by the camera flash. I simply used MediaPlayer for Android and AvAudioPlayer for iOS.

The challenging part was showing the interstitial Ad to the user before a sequence is started.

I could not find ready to use library which supported Interstitial Ad from AdMob, nevertheless the AdsPCLXamarin put me on the right track on how to develop a custom renderer for each platform for this purpose. It took sometime to get everything working in iOS once it was okay for Android, mostly because I had to migrate the project to unified API and fix some library compatibility issue.

But, summing up, 20 hours later I have a ad-supported app on both Google with a sleek UI and which, hopefully, is also useful!

Now, enough about the pro, here some cons I experienced:

Don't expect that working code on Android behave exactly the same on iOS
Label color on iOS was not working (TextColor property)
Debugging via a separate Mac with the Xamarin.iOS Build Host is a pain in the ass, Visual Studio was laggy and crashed many times (FYI: I have a dedicated LAN cable to the Mac)

I would like to thank all the community which is bringing day after day more and more ready to use libraries to Xamarin.Forms.

Google Play URL: https://play.google.com/store/apps/details?id=com.geeksonsoftware.android.thunderlight

AppStore URL: coming at somepoint

Xamarin Stability - Graphical overview of Bugzilla Issues

Fri, 30 Jan 2015 07:29:00 +0000

Hi all,

I'm a fellow subscriber of Bugzilla and I have reported some issues for Xamarin.Forms myself.
What I wanted is a better way to understand bugs reporting vs fixing, so I came up with a graphical solution: http://xamarinstability.azurewebsites.net/

The chart above shows an example of the bugs count in Xamarin.Forms by status. Data are taken from the Xamarin Bugzilla website via the CSV feed.

Its interesting to see how Xamarin.Forms "hype" is growing and more time and resources are invested to make it stable.

The charts are updated once a day with the latest information. The webapp is deployed on Azure Websites and uses node.js & express, Google Charts and bootstrap for its purpose.

The charts are generated for Xamarin.Forms, Xamarin.Android and Xamarin.iOS products.

If you are interested in more products/platforms, just PM me.

Xamarin Studio - Dark color scheme

Mon, 11 Aug 2014 13:27:00 +0000

I'm a big fan of Visual Studio and I use it almost everyday, lately also for Xamarin development. I recently came across this Xamarin Contest and decided to give Xamarin Studio a try. Xamarin Studio loaded the solution blazing fast compared to Visual Studio (maybe because of the absence of R# and Visual Assist?).

My first customization was to change the default color scheme for the editor windows of the Xamarin Studio. I'm more a night-scheme guy, so I checked just the dark theme for this purpose.

Currently there are 4 dark color scheme supported:

Monokai
Nightshade
Oblivion
Solarized Dark

I decided to go with Monokai as it seemed to me the easiest to perceive (clear, good contrast, not too dark). This, together with the Floating Window feature and the amazing f.lux create a perfect multiple-monitors development environment.

You can change the color scheme in the Options dialog under the Text Editor - Syntax Highlighting section.

In the future, I would like to see a complete dark user-interface theme, like the one provided by Visual Studio.

Relax Cube - Arduino ADK Mega

Sat, 04 May 2013 09:57:00 +0000

Relax Cube is a weekend project spent trying to port Relax Lamp to the physical world using an Arduino Mega ADK and some leds.

Check it out on Bitbucket!

Wicket 1.5–Custom Exception Page

Wed, 21 Dec 2011 23:02:00 +0000

I’m building a web application using Wicket for the first time (which is really cool by the way). I’d like that all uncaught RuntimeExceptions are displayed in a custom exception page which permit the user to submit the error report to myself.

I had no luck searching for a simple example that explains how to redirect a user to a custom page when an exception happens. (at least not for Wicket v1.5).

Following the description in the Wicket Migration Guide I came out with my own own code.

1) You have to add an AbstractRequestCycleListener to your WebApplication constructor and override the onException method.

public class TestApplication extends WebApplication {

  /**
   * Constructor
   */
  public TestApplication() {
	  
	  // In case of unhandled exception redirect it to a custom page
	  this.getRequestCycleListeners().add(new AbstractRequestCycleListener() {
		  @Override
	      public IRequestHandler onException(RequestCycle cycle, Exception e) {
			  return new RenderPageRequestHandler(new PageProvider(new ExceptionPage(e)));
		  }
	  });
  }

  public Class<HomePage> getHomePage() {
    return HomePage.class;
  }

}

2) Prepare the exception page, in my case I would like to fill out a form automatically with all exception information's (like full stacktrace) and let the user submit it.

My ExceptionPage.java looks like this:

public class ExceptionPage extends WebPage {

	private static final long serialVersionUID = 593717625018028083L;

	// My model for the form data
	FormExceptionProvider formProvider;
	
	// Mapped wicket:id 
	private static final String wicketIdformSendException="formSendException";
	private static final String wicketIdformTarget="formTarget";
	private static final String wicketIdformComments="formComments";
	private static final String wicketIdmessageDetails="messageDetails";
	private static final String wicketIdsubmitForm="submitForm";

	public ExceptionPage(Exception e) {
		formProvider = new FormExceptionProvider();
		formProvider.setTarget("Administrator");
		formProvider.setComments("Please provide here any useful information...");
		StringBuilder sb = new StringBuilder();
		sb.append(e.getClass().toString()+"\n");
		// Get the full stacktrace from exception and append to the string
		// Thanks to ripper234 (ref: http://stackoverflow.com/questions/1292858/getting-full-string-stack-trace-including-inner-exception)
		sb.append(joinStackTrace(e));
		// Add fullstacktrace as a form's field (readonly)
		formProvider.setAdditional(sb.toString());
		add(makeExceptionForm());
	}

	private Form<?> makeExceptionForm() {

		Form<?> form = new Form<Void>(wicketIdformSendException);

		FormComponent<?> tfTarget = new TextField<String>(
				wicketIdformTarget, new PropertyModel<String>(
						formProvider, "target"));
		form.add(tfTarget);
	
		FormComponent<?> taComments = new TextArea<String>(wicketIdformComments, new PropertyModel<String>(formProvider, "comments"));
		form.add(taComments);

		FormComponent<?> taAdditional = new TextArea<String>(wicketIdmessageDetails, new PropertyModel<String>(formProvider, "additional"));
		form.add(taAdditional);

		form.add(new Button(wicketIdsubmitForm) {
			private static final long serialVersionUID = -3553700128326728526L;

			@Override
			public void onSubmit() {
				/* 
				 * Do your stuff here (i.e. Send Email)
				 */
			}
		});
		return form;
	}
	
	public static String joinStackTrace(Throwable e) {
	    StringWriter writer = null;
	    try {
	        writer = new StringWriter();
	        joinStackTrace(e, writer);
	        return writer.toString();
	    }
	    finally {
	        if (writer != null)
	            try {
	                writer.close();
	            } catch (IOException e1) {
	                // ignore
	            }
	    }
	}

	public static void joinStackTrace(Throwable e, StringWriter writer) {
	    PrintWriter printer = null;
	    try {
	        printer = new PrintWriter(writer);

	        while (e != null) {

	            printer.println(e);
	            StackTraceElement[] trace = e.getStackTrace();
	            for (int i = 0; i < trace.length; i++)
	                printer.println("\tat " + trace[i]);

	            e = e.getCause();
	            if (e != null)
	                printer.println("Caused by:\r\n");
	        }
	    }
	    finally {
	        if (printer != null)
	            printer.close();
	    }
	}
}

And the related HTML code:

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Exception Page</title>
</head>
<body>
<form wicket:id="formSendException">
	<table>
	  <tr>
	    <td width="100" align="right" >Target</td>
	    <td><input wicket:id="formTarget" type="text" size="20" value="admin@unizh.ch"  readonly="readonly"/></td>
	  </tr>
	  <tr>
	   <td width="100" align="right" >Comments:</td>
	    <td><textarea wicket:id="formComments" rows="10" cols="50"></textarea></td>
	  </tr>
	  <tr>
	   <td width="100" align="right" >Additional:</td>
	   <td><textarea wicket:id="messageDetails" rows="20" cols="100" readonly="readonly"></textarea></td>
	   </tr>
	  <tr>
	    <td>&nbsp;</td>
	    <td align="left"><button wicket:id="submitForm" type="submit">Submit Report</button></td>
	    <td>&nbsp;</td>
	  </tr>
	</table>
</form>
</body>
</html>

I didn’t cared much (yet) about the UI, I was just looking to build something quick and useful for submitting error reports. An example of the resulting page is shown here:

Hope it helps!

Having Fun with IR Consumer Remotes

Mon, 13 Jun 2011 16:02:00 +0000

I took a couple of evening to look how TV remotes works and how can we simply interface them with our PC (with minimal hw requirements) and I’d like to share the results with you.

First of all we will need a way to capture those infrared signal coming from our remotes, the easiest way (and cheapest) is to build a small receiver with a photo-diode. (on the sides you see the electric diagram and my test bench)

Now that we built our receiver we can test if it’s working like it should. I used Audacity (a Linux audio multifunctional tool) to analyze the signal coming from the photodiode. The results:

Now we have a signal composed by some waves, great, let’s try to explain how CIR (Consumer infrared) works.
First of all, quite each brand has his own solution, so we can’t really generalize the discussion. Anyway the most used is the RC5 from Philips. As you can remember, the lesser the frequency the the fair signal can get. The modulation (how you encode your data on the wave) used by fast every brand is called Amplitude-Shift Keying (ASK).

RC5 Structure:
Each frame is composed by:

2 start bits which are used by the AGC (Automatic Gain Controller) from the receiver (TV)
1 toggle bit which varies every time a button is pressed
5 bits which represents the device address
6 bits with the command

Bits are encoded with Manchester format, for this reason a logical zero is in practice a 1-0 and a logical one (1) is a 0-1, you can probably better understand this by the following schema:

Now that we have a minimal understanding of the ground let’s try code something with this. First of all we have to access our audio mic line (where we connected our fancy IR receiver) and prepare a buffer that our system will fill up with sampled data. Fortunately Linux provide a simple way to capture data from your soundcard.

   1: void init_audio(void)   2: {   3:     int rc;   4:     int val, dir;   5:     6:     // Open PCM device for capture    7:     rc = snd_pcm_open(&handle, "default",  SND_PCM_STREAM_CAPTURE, 0);   8:     if (rc < 0) {   9:         fprintf(stderr,  10:                 "Unable to open pcm device: %s\n",  11:                 snd_strerror(rc));  12:         exit(1);  13:     }  14:       15:     // Setting default samples   16:     snd_pcm_hw_params_alloca(&params);  17:     snd_pcm_hw_params_any(handle, params);  18:     snd_pcm_hw_params_set_access(handle, params, SND_PCM_ACCESS_RW_INTERLEAVED);  19:       20:     // 8bits Signed samples   21:     snd_pcm_hw_params_set_format(handle, params, SND_PCM_FORMAT_S8);  22:       23:     // Single channel (mono)   24:     snd_pcm_hw_params_set_channels(handle, params, 1);  25:       26:     // Setting sampling rate   27:     val = SAMPLERATE;  28:     snd_pcm_hw_params_set_rate_near(handle, params,  29:                                     &val, &dir);  30:       31:     // Set period size to 300 frames.   32:     frames = 300;  33:     snd_pcm_hw_params_set_period_size_near(handle,   params, &frames, &dir);  34:       35:     // Write the parameters to the driver   36:     rc = snd_pcm_hw_params(handle, params);  37:    38:     if (rc < 0) {  39:         fprintf(stderr,  40:                 "Unable to set hw parameters: %s\n",  41:                 snd_strerror(rc));  42:         exit(1);  43:     }  44:       45:     // Use a buffer large enough to hold one period   46:     snd_pcm_hw_params_get_period_size(params,  &frames, &dir);  47:     size = frames * 1; // 1 bytes/sample, 1 channels   48:    49:     buffer = (char *) malloc(size);  50:       51:     // We want to loop for 2 seconds   52:     snd_pcm_hw_params_get_period_time(params,  53:                                       &val, &dir);      54:       55:     printf("Audio initialized!\n");  56: }  57:    58: // listen function used as a dedicated thread (pthread_create())  59: void *listen_function(void)  60: {  61:     int rc;  62:     int j;  63:       64:     while (!QUIT) {  65:         // variable has been initialized in init_audio function  66:         rc = snd_pcm_readi(handle, buffer, frames); // read "frames" from soundcard  67:    68:         if (rc == -EPIPE) {  69:             // EPIPE means overrun   70:             fprintf(stderr, "overrun occurred\n");  71:             snd_pcm_prepare(handle);  72:               73:         } else if (rc < 0) {  74:             fprintf(stderr,    "error from read: %s\n", snd_strerror(rc));  75:         }  76:    77:         // draw signal to stdout  78:         //graph(buffer, rc);  79:    80:         if(DEBUG)  81:         {  82:             for(j=0; j<rc;j++){  83:                 fprintf(fp, "%.1f\t%d\n", (double)(delta*1000.0*(double)counter), buffer[j]);  84:                 counter++;  85:             }  86:         }  87:         // elaborate buffer  88:         computeDelta(buffer,rc);  89:     }  90:     printf("ListenThread terminated!\n");  91:     closeAudio();  92:     pthread_exit(NULL);  93: }

Next we need a simple algorithm to discriminate the length of the peaks we read from the photodiode:

   1: #define SAMPLERATE 44100   2: #define DELTATHRESHOLD 0.5   3: #define TRUE 1   4: #define FALSE 0   5: #define THRESOLDLIMIT 6 // Under this no calculation is made [range 1-127]   6: #define DEBUG 0  // If true: verbose output + sampled data written to logfile.txt   7:     8: char OVERTH=FALSE; // FLAG used to know if signal is below or above threshold   9: char PEAK = FALSE; // FLAG used to let know when a peak occurred  10:    11: /* delta is time (in milliseconds) between each sample */  12: double delta=(1.0/(double)SAMPLERATE*1000);  13:    14: void computeDelta(char *buffer, int length)  15: {  16:     int k,j;  17:     int maxgraph= -100;  18:     int threshold;  19:     int temp;  20:    21:     int countstep=0;  22:     double dpeak; // delta peak  23:       24:     // Find max value in sampled buffer  25:     for(j=0; j<length;j++)  26:     {  27:         if(buffer[j]>maxgraph)  28:             maxgraph=buffer[j];  29:     }  30:       31:     // Compute threshold against max value  32:     threshold = (int)((double)maxgraph*(double)DELTATHRESHOLD);  33:       34:     // Check if signal rise above threshold  35:     if(threshold > THRESOLDLIMIT)  36:     {  37:         if(DEBUG) printf("Threshold: %d [MAX: %d]\n", threshold, maxgraph);  38:         for(k=0;k<length;k++)  39:         {  40:             // peak length  41:             dpeak = ((double)(delta)*(double)countstep);  42:               43:             // signal low (below 0)   44:             if(buffer[k]>threshold && OVERTH == FALSE){  45:                     if(DEBUG) printf("Low Peak length: %8.3f ms [Steps: %d][Value: %4d]\n", dpeak,countstep, buffer[k]);      46:                     // peak triggered when delta peak is longer than 0.4 ms                      47:                     if(dpeak>0.4)  48:                         PEAK=TRUE;  49:                     // reset counterstep for next peak  50:                     countstep=0;  51:                     countstep++;  52:                     OVERTH = TRUE;  53:             }  54:             // signal high (above 0)  55:             else if(buffer[k]<threshold && OVERTH==TRUE){  56:                     if(DEBUG) printf("High Peak length: %8.3lf ms [Steps: %d][Value: %4d]\n", dpeak,countstep, buffer[k]);  57:                     // peak triggered when delta peak is longer than 0.4 ms  58:                     if(dpeak>0.4)  59:                         PEAK=TRUE;  60:                     // reset counterstep for next peak  61:                     countstep=0;  62:                     countstep++;  63:                     OVERTH=FALSE;  64:             }  65:             // Peak detected  66:             if(PEAK==TRUE)  67:             {  68:                 // I know the peak length should be within 800 us - 1.8 ms  69:                 if(dpeak<2.0)  70:                 {  71:                     temp=(int)dpeak;  72:                     // temp is one if peak is longer than 1 ms or zero if shorter  73:                     cmd = (cmd<<1) | temp;  74:                 }  75:                 else  76:                 {  77:                     // command ready  78:                     if(cmd > 0)  79:                     {  80:                         printf("CMD: %3d\n", cmd);  81:                         cmd=0;  82:                     }  83:                 }  84:                 PEAK = FALSE;  85:             }  86:             countstep++;  87:         }  88:     }  89: }    

The results are shown in the picture. Each peak is measured to see how long is it and was that the shortest peaks (shrinked) have a length of around 900 us and the long peak a length of about 1.8 ms.
A simple proof of this values is done by comparing the graph (gnuplot) generated on the raw sampled data and the program result. If we compare the peak type (long/short) and the peak length we will see a “perfect” match.

Now we have do identify and differentiate the remote’s command (which button pressed).
A simple way to do this is using some bitwise operator. Let’s say that if the peak is longer than 1 ms we insert a one (bit) into our command (8 bit uchar), if shorter we insert a zero (bit).

If you take a look in the code above you will see that there is no length check when shifting and inserting new bit into command. therefore the algorithm will take only the last 8 peaks into the command (the other will be “overwritten”).

Trying the program will results in a series of command number that are associated to remote buttons. In the screenshot is shown the result of pressing two different buttons: channel – (CMD: 194), and volume + (CMD: 57) from a Philips remote.
The algorithm needs of course some more improvements since as you see the commands some time are wrong (0, 98, 25).

Now that we have a list of commands associated with buttons we could move the mouse respectfully with the remote you’re using:

   1: if(cmd==62 || cmd==254)   2: {   3:     printf("Move 10 px left\n");   4:     mouse_move(-10,0);   5: }   6: if(cmd==57 || cmd==249)   7: {   8:     printf("Move 10 px right\n");   9:     mouse_move(10,0);  10: }  11: if(cmd==194)  12: {  13:     printf("Move 10 px down\n");  14:     mouse_move(0,10);  15: }  16: if(cmd==192)  17: {  18:     printf("Move 10 px up\n");  19:     mouse_move(0,-10);  20: }  21:    22: // Move mouse   23: // Current Position + x / y  24: void mouse_move(int x, int y)  25: {  26:         Display *displayMain = XOpenDisplay(NULL);  27:    28:         if(displayMain == NULL)  29:         {  30:                 fprintf(stderr, "Error Opening Display!\n");  31:                 exit(EXIT_FAILURE);  32:         }  33:    34:         XWarpPointer(displayMain, None, None, 0, 0, 0, 0, x, y);  35:    36:         XCloseDisplay(displayMain);  37: }

Maybe it comes handy sometime to draw the signal direct into the console output, for this reason I’ve created a simple ascii graph function to display my buffer (sampled data) content.

   1: // Simple ascii graph function   2: // Draw char buffer to stdout using printf   3: void graph(char *buffer, int length)   4: {   5:        6:     int iy;   7:     char mingraph=126, maxgraph=-126;       8:     int temp;   9:     unsigned int val;  10:     int i,j,k;  11:       12:     // Find max / min  13:     for(j=0; j<length;j++)  14:     {  15:         if(buffer[j]>maxgraph)  16:             maxgraph=buffer[j];  17:         if(buffer[j]<mingraph)  18:             mingraph=buffer[j];  19:     }  20:       21:     for(k=0;k<length;k++)  22:     {  23:         val=buffer[k];  24:         if(mingraph<0)   25:             val-=mingraph;  26:           27:         iy=(val*maxgraph)/(maxgraph-mingraph);  28:         printf("%4d ", val);  29:         for(i=0;i<iy;i++)   30:             printf(" ");           31:         printf("*\n");   32:     }  33: }

That’s it.

Automating an Astronomical Observatory

Tue, 07 Dec 2010 22:04:00 +0000

First tryouts with the Siemens S7-200 (and Lego)

My Summer, this year, was kind of an hard one. I was indeed occupied by my bachelor thesis which consisted in the automation of an astronomical observatory in the Southern Switzerland. The observatory is owned by an association of amateur astronomers called "LePleiadi". The biggest challenge of this project is tied to the observatory location (at 1600 meters, quite unreachable during winter) therefore the observatory has to take care of himself alone, especially in the winter season.

You can learn more about the observatory here

I've spent about 30 nights on the top of a mountain (can't count the ones in 'lowland') working on this project, it was really fun and exciting. My work mostly consisted in taking care of all security aspects (to avoid damages) with a (limited) Siemens PLC S7-200 which I'm now sure that was a too lower series for this kind of purpose. (unfortunately discovered too late)

One important feature of this solution is that every possible alarms that happens are signaled by the PLC via email (and maybe later by SMS). For most common alarms (like sky becoming cloudy) the PLC take care of it by himself. There is anyway some situation where the human action (remote or in extreme case in place) is needed.

Inside view of the observatory

The electronics of the observatory has been completely reviewed and a lot of sensors were added.
To stay safe the observatory has to know every possible threats to him. (weather, snow, sky clouds, telescope dangerous positions, ....).
A radio bridge grants the Internet connectivity to the observatory. All the astronomical software has been deployed on a brand new x3550 IBM server and a 8kVA UPS has been installed to permit emergency operations (PLC operations) in case of power failure.

Observatory Web Interface (ACP)

All astronomical components (like CCD, Focuser, Telescope, Observatory roof...) are centrally managed (or better 'orchestrated') by a commercial software called ACP. This software use ASCOM specifically written (in C#) driver to open/close the roof (via the PLC) or to move the Telescope (via LX200 protocol aka Vertigo).

A better (but probably confusing for this post purpose) overview of the various components (software and hardware) is shown in the diagram below.

Any comments would be appreciated

Interactions diagram