Re: DES Crypto help - C# Discussion Boards

13-May-04 3:19

Be patient. I already answered your post you made just a short while ago.

Microsoft MVP, Visual C#
My Articles

DES Crypto help

yyzzababa13-May-04 2:43

yyzzababa

13-May-04 2:43

Hello!

I need some help here. I have this appliaction where i can load textfiles and decrypt/encrypt with DES cryptation. The problem is how i should know what files are already encrypted at load? if they are, you should be prompted for a password to unlock it, else it should just load the file.. both ways works if i know before i load the file if it's encrypted or not (i can set wich loadfunction to be used programmaticlly then). I need to be able to choose another loadfunction if the file is encrypted. So, how do i check if the file is encrypted or not? I had an idea to check for chars not in the asciitable.. but it doesnt seem to work.. anyone with some good ideas?

thanks!

gek_at13-May-04 2:50

13-May-04 2:50

It's not possible to detect if it has been encrypted. The ASCII-table method does not work if someone wants to encrypt a binary file for example.

Your best bet will be to change the file extension on encryption and detect encrypted files according to the extension. Say you have a file "secrect.doc". On encryption, your application could rename it to "secret.doc.enc". When the user wants to decrypt files, he can be displayed only those files that have the extension .enc.

HTH. Greets,
Daniel

---
SharpPrivacy - A free OpenPGP Implementation in c#
http://sharpprivacy.sf.net

Heath Stewart13-May-04 3:23

13-May-04 3:23

Good idea (and typical, which I'm sure you already know since you seem to be involved with PGP - cool!), except he did state he is encrypting text files (or "textfiles" as he said). In such a case, you could read the few bytes (since the first 2 bytes could be a byte order mark, or BOM) or take a random sampling (several characters from different locations) and see how many are in the printable ASCII range. For Unicode files, you'd have to take this a step further and use the StringInfo class to get text elements, if possible.

Microsoft MVP, Visual C#
My Articles

gek_at13-May-04 3:50

13-May-04 3:50

Uuups, I overread the text file part. Anyway, I still think that the file extension way is the most practical. He could also use statistical analysis (simply count the number of occurances per byte. the resulting graph will be almost equally spread for encrypted files and will have peaks for other files [will work with most binary filetypes too, but not with compressed files]).

Greets,
Daniel

---
SharpPrivacy - A free OpenPGP Implementation in c#
http://sharpprivacy.sf.net

Heath Stewart13-May-04 3:56

13-May-04 3:56

Oh, don't get me wrong, I completely agree with you about using different extensions. Smile | :)

I use PGP* and X.509 certs a lot myself so I'm definitely stranger to it. I was just offering a slightly different alternative.

* Is your OpenPGP implementation derivative of the crypto classes in System.Security.Cryptography? I really don't have the time to check it out right now, so I was just wondering.

Microsoft MVP, Visual C#
My Articles

gek_at13-May-04 4:53

13-May-04 4:53

Did not get you wrong Smile | :)

. No offence taken, none intended Smile | :)

Ad *:

No it's not. OpenPGP uses a /really/ strange cipher mode for symmetrical ciphers that is not supported by SSC. I took the (open source) implementation from the Mono project and modified it accordingly. The asymmentrical ciphers are also from Mono, for coherancy (spelling?) reasons.

Greets,
Daniel

---
SharpPrivacy - A free OpenPGP Implementation in c#
http://sharpprivacy.sf.net

Heath Stewart13-May-04 3:26

Inter Process Communication

13-May-04 3:26

While I agree with gek_at (and this is a common approach), another way depends on how you save the encrypted file. Using different extensions is still better, but you could stream the cipher text through a ToBase64Transform and enclose the base64 text in something like what PGP does:

----- BEGIN ENCRYPTED TEXT -----
base64 encoded cipher text
----- END ENCRYPTED TEXT -----

Then you could check that the first and last lines contain this text. Of course, someone could spoof it or mistakenly include those in their file (but what are the chances of that?), but even PGP would complain about such an error. Also, PGP can also parse an entire text file and treat anything not in between these lines (and it can handle multiple blocks of encased cipher text like this) as unencrypted text.

Microsoft MVP, Visual C#
My Articles

gek_at13-May-04 2:31

Re: Inter Process Communication

13-May-04 2:31

Hi!

I have a question concerning inter process communication. My application is written in c# and runs as a windows service. It should be able to provide its services to applications written in many different programming languages (c++, java, ...). Currently it uses .NET remoting, but as I understand it, only .NET applications can use that. What would be a more generic approach? Sockets would probably be the most compatible way, but they are also not very comfortable to use. So is there something in between remoting and sockets for inter process communication?

Thanks in advance,
Daniel

---
SharpPrivacy - A free OpenPGP Implementation in c#
http://sharpprivacy.sf.net

Heath Stewart13-May-04 3:45

Re: Inter Process Communication

13-May-04 3:45

.NET Remoting can be made to work in other languages, but it's a real b*tch. Since the messages are SOAP (assuming you use a SoapFormatter for the serialization sink), you can always tranform them.

There are many other options available, though. While you may not be comfortable with sockets, it's always good to learn new things! Smile | :)

You could define a simple protocol using commands like SMTP, HTTP, and countless others. This would definitely be the most open approach.

Another way would be to host the ASP.NET runtime in your service (a little resource intensive, but not too bad) and host an XML Web Service. The SOAP bindings for these are industry standard, and Java and C++ (with, for example, the SOAP toolkit for C++ from Microsoft) should have no problems handling this.

It's really not that difficult hosting ASP.NET, either. ASP.NET Web Matrix (a free ASP.NET designer from Microsofties at http://www.asp.net[^]) does it, and VS.NET 2005 will do it for ASP.NET Web Application projects as well (so no more dependency on IIS! Smile | :)

). See the documentation for System.Web.Hosting.ApplicationHost in the .NET Framework SDK for more information. This would be just about as open as using a TCP protocol, except that it requires the client understand SOAP (and most languages do through extensions/mods, like Java, C++, Perl, etc.). IMO, it would even be a better approach since it allows you to develop a transport capable of more easily transporting complex objects, rather than having to serialize them to a byte[] array to send over a NetworkStream.

Microsoft MVP, Visual C#
My Articles

gek_at13-May-04 8:18

how do I marshal lpvoid pointer in a funcion?

13-May-04 8:18

Thanks for the input! I think I'll settle for sockets that send and receive XML formated commands. As the server sends the return as XML even now with remoting, I guess that should be the easiest. Hosting a Webservice is a bit of an overkill IMHO Big Grin | :-D

. Especially as the service should require as few resources as possible (.NET is such a resource killer anyway Frown | :(

.

Thanks again!

Greets,
Daniel

---
SharpPrivacy - A free OpenPGP Implementation in c#
http://sharpprivacy.sf.net

Paolo Ponzano13-May-04 2:24

13-May-04 2:24

hi,
I've two questions how do I mashal

BOOL WINAPI Toolhelp32ReadProcessMemory(
DWORD th32ProcessID,
LPCVOID lpBaseAddress,
LPVOID lpBuffer,
DWORD cbRead,
LPDWORD lpNumberOfBytesRead
);

using dll import so that I can use it with a buffer? I think I should use IntPtr, cut when I declare the buffer how should it be declared? need to use unsafe? I'm trying to use it on a PocketPc, so MarshalAs class is not implemented ( as I've read), need I to make an array of bytes or what else?
thanks
Paolo

Heath Stewart13-May-04 3:29

13-May-04 3:29

Yes, you do use an IntPtr, and no you don't need an unsafe context. I do a heck of a lot of P/Invoke (it's my forte', some might say) and have never once had to use an unsafe context.

To alloc the buffer (if you need to - in this case you don't since it's an output parameter), you can use several methods on the Marshal class in System.Runtime.InteropServices.

Since this is an output parameter, you can use Marshal.Copy(IntPtr, byte[], int, int) to copy the data to a byte[] array. The latter method is supported by the .NET CF.

Microsoft MVP, Visual C#
My Articles

Paolo Ponzano13-May-04 4:40

13-May-04 4:40

how can I use the Marshal.Copy if the buffer I need to write into is accessed by the funcion Toolhelp32ReadProcessMemory? I declared a byte array as you told but I receive
D:\projects\PPC\.cs(28): Argument '3': cannot convert from 'byte[]' to 'System.IntPtr'

I did

<br />
byte[] databuffer= new byte[4096];<br />
uint byteread=0;<br />
Toolhelp32ReadProcessMemory(p.Handle,p.BaseAddress,databuffer,100,(uint)byteread);<br />

thanks again, you always answer me clearly and focusing the point!
Paolo

Heath Stewart13-May-04 5:04

13-May-04 5:04

You can't just cast a byte[] to IntPtr. You have to allocate the memory to pass to Toolhelp32ReadProcessMemory. Since Marshal.AllocHGlobal isn't available on the .NET CF, you have to do it like so:

// No need to allocate more bytes than you plan on reading
byte[] databuffer = new byte[100];
// Pin the object in memory so the GC doesn't move it
GCHandle handle = GCHandle.Alloc(databuffer);
// Get the pointer
IntPtr ptr = handle.AddrOfPinnedObject();
// Call your method
uint bytesread; // defaults to 0, and no need to cast like you did
Toolhelp32ReadProcessMemory(p.Handle, b.BaseAddress, ptr, 100, bytesread);
// Free the GCHandle and your databuffer now contains the data.
handle.Free();

Microsoft MVP, Visual C#
My Articles

Paolo Ponzano13-May-04 5:27

13-May-04 5:27

I've done as you've told, but at this point

<br />
IntPtr ptr = handle.AddrOfPinnedObject();<br />

it's raised an ArgumentException, on MSDN it's written "An instance with nonprimitive (non-blittible) members cannot be pinned."

I think that it's due to the fact that .NET CF doesn't support byte[] as blittable element,any suggestion?
thanks again
Paolo

Heath Stewart13-May-04 6:21

13-May-04 6:21

Yeah, I made a mistake there. You don't want to pin it because a byte is blittable, so just cast the GCHandle to an IntPtr:

IntPtr ptr = (IntPtr)handle;

Sorry about that. I'm used to pinning non-blittable types. Blush | :O

Microsoft MVP, Visual C#
My Articles

Paolo Ponzano13-May-04 7:20

13-May-04 7:20

I've fixed it but the function ToolHelp32ReadMemory fails, I don't know why but I'll check later, here's my source if anyone of you see an error, please tell me

<br />
	[DllImport("toolhelp.dll")]<br />
		private static extern bool Toolhelp32ReadProcessMemory( <br />
											  IntPtr th32ProcessID,<br />
											  int lpBaseAddress, <br />
											  IntPtr lpBuffer,<br />
											  uint cbRead, <br />
											  IntPtr lpNumberOfBytesRead <br />
											  );<br />
		public static void DoDump(Process p)<br />
		{<br />
			<br />
			try<br />
			{<br />
								byte[] databuffer = new byte[120];<br />
				uint byteread=0;<br />
				GCHandle br= GCHandle.Alloc(byteread);<br />
								GCHandle handle = GCHandle.Alloc(databuffer);<br />
								IntPtr ptr =(IntPtr)handle;<br />
			<br />
			if((Toolhelp32ReadProcessMemory(p.Handle,p.BaseAddess,(IntPtr)handle,120,(IntPtr)br)== false))<br />

I can't even see disassembly on PocketPC, but p.Handle and p.BaseAddress seems ok
thanks
Paolo

Heath Stewart13-May-04 9:37

13-May-04 9:37

Don't use (IntPtr)br. You don't need to fix that in memory. Actually, you don't need to really fix anything at all, but the reason I gave you the code with the GCHandle was to get the address. What you need to pass to the P/Invoked function is an IntPtr, but now the address. Technically, the cbRead param should be an IntPtr too, passing it like so:

byte[] databuffer = new byte[120];
uint bytesread;
GCHandle handle = GCHandle.Alloc(databuffer);
bool ret = Toolhelp32ReadProcessMemory(p.Handle, p.BaseAddress,
  (IntPtr)handle, (uint)databuffer.Length, bytesread);
handle.Free();
if (!ret) // ...

The method signature (for Windows CE - differs for Windows) should look like this:

[DllImport("toolhelp.dll")]
private static extern bool Toolhelp32ReadProcessMemory(
  uint processID,
  IntPtr baseAddress,
  [Out] IntPtr buffer,
  uint readbytes,
  [Out] out uint bytesread);

A DWORD is a 32-bit unsigned integer, which is uint C# (or UInt32 in .NET). LPVOID is an address, for which the bit width is dependent on the processor. An address on a 32-bit processor is 32 bits; on a 64-bit processor it's 64 bits. That's why you use an IntPtr. If you look at the API documentation for this function in Windows, you'd see SIZE_T. That, too, would be an IntPtr because it too is processor-dependent.

In your code, what's happening is that the data is getting read incorrectly because when it's marshaled all the params are pushed onto the stack. The callee will grab the params with their known sizes, meaning that your values are mis-aligned. It's very important that parameters map so a parameter of the same size, and the same is true for the return value (since it too is marshaled and pushed on the stack when the call returns).

Microsoft MVP, Visual C#
My Articles

Paolo Ponzano13-May-04 11:43

13-May-04 11:43

thanks again, but since Process class is defined as

<br />
		private Process(IntPtr id, string procname, int threadcount, int baseaddress)<br />
{	<br />
handle = id;<br />
processName = procname;<br />
threadCount = threadcount;<br />
baseAddress = baseaddress;<br />
}<br />

as I've found here Creating a Microsoft .net .....Oricess Manager Application[^]
I've type mismatch, I tryed to convert int base address to IntPtr using GC.Alloc but it says it's not blittable, thanks again ( for christmas I'll sent you a gift or for your birthday Big Grin | :-D

)
Paolo

Heath Stewart13-May-04 12:36

13-May-04 12:36

You should read the documentation for the IntPtr. First, you only need the GCHandle to get the address of the byte[] array. For any other numbers you need to pass where the param Type is an IntPtr (processor-dependent bit width), just use create a new IntPtr passing the number into the constructor, like:

IntPtr ptr = new IntPtr(p.Handle);

If the Handle was 12345, then the IntPtr created with this as a param would be:

// On a 32-bit platform:
0x00003039
// On a 64-bit platform:
0x0000000000003039

This is not the address of the numeric variable, merely the number wrapped in a platform-dependent numeric type. The only place you need the address is for the byte[] array. Using the GCHandle is just the easiest way in the .NET CF to get it's address (the address of the first element which the rest of the elements allocated on the stack, which is why you pass the number of bytes in the array as the next param to Toolhelp32ReadProcessMemory.

Microsoft MVP, Visual C#
My Articles

Paolo Ponzano13-May-04 20:18

13-May-04 20:18

I've done as you said,since I need a IntPtr for BaseAddress I did

<br />
IntPtr q = new IntPtr(p.BaseAddress);<br />

but for p.Handle that in ToolHelp32ProcessMemory is uint and I've a IntPtr how do I get the uint value?
have u got some good link to understand marshalling/pinvoke?
thanks

Heath Stewart14-May-04 2:16