techbreeds

Using UAC with C#

2011-12-23T12:24:00.001+05:00

User Account Control (UAC) is a new technology introduced by Microsoft in Windows Vista and most of the time it is misunderstood by users and developers. It’s main purpose is to protect the operating system by running applications with reduced privileges.

Why should we use this? Most applications DO NOT require full privileges. Think to the applications you have written and ask yourself if most of the job can be done without full writes (if you write to disk think if you could write in the user’s folder or an isolated storage, if writing in registry to HKLM think if you could write to HKLU, etc). The answer is mostly sure “Yes”.

So why run applications with full privileges when they can be run with limited? Running with more privileges than required is just a security vulnerability - If an attacker exploits a vulnerability in your application he will gain more control.

There are two mistakes developers tend to do:

Request the end-user to run an application with full rights even though this is not necessarily (most of the time because of bad design practices)
Do not request to user to run the application elevated but try to perform operations that require more rights

By design UAC can only elevate code at process level and only at process’ startup (means that a running process cannot be elevated). In the .NET world this also means that you cannot elevate code running in another app domain because the app domain is part of a running process. In order to elevate an existing application this must be closed and reopen with more privileges.

There are two types on UAC dialogs: blue and yellow. When you see a blue dialog you can be sure that the application requesting privileges is signed and trusted. The yellow dialog shows for any application that is not digitally signed and is not fully trusted.

User Account Control also prevents a lower privilege process to do the following (list below taken from MSDN):

Perform a window handle validation of higher process privilege.
SendMessage or PostMessage to higher privilege application windows. These Application Programming Interfaces (APIs) return success but silently drop the window message.
Use thread hooks to attach to a higher privilege process.
Use Journal hooks to monitor a higher privilege process.
Perform DLL injection to a higher privilege process.

Let’s see how an UAC aware application should look.

It should be composed of two executables (one that will be run with limited privileges and another one that will be started only with needed and with full rights) or two working modes (a mode for limited rights and another one for full rights). Either way you must remember that once you elevated the application and finalized the administrative tasks, the process should be destroyed in order to reduce an attacker’s privileges.

In order to launch an elevated process in Windows Vista the process must be started with the “runas” verb. The Verb property is part of System.Diagnostics.Process.StartInfo class. The code snippet that launches “notepad.exe” with full rights is showed below:

    ProcessStartInfo processInfo = new ProcessStartInfo();     processInfo.Verb = "runas";     processInfo.FileName = "notepad.exe";     Process.Start(processInfo);

If you choose to have only one executable file that acts differently based on permissions you should check if the user is part of the administrative group. In Vista even if your user is part of the Administrators group it runs with reduced privileges by default and gains his full rights on demand. The code below stores true in thehasAdministrativeRight boolean variable if the user’s privileges are administrative and false otherwise.

    WindowsPrincipal pricipal = new WindowsPrincipal(WindowsIdentity.GetCurrent());     bool hasAdministrativeRight = pricipal.IsInRole(WindowsBuiltInRole.Administrator);

To elevate the current application you must create a process with elevated rights and close the existing instance. However you cannot start a process with limited privileges – I couldn’t find a solution. Anyone knows how to start a less privilege process from a higher privilege one? The sample creates an elevated instance of the current executable and closes the existing one.

    RunElevated(Application.ExecutablePath);     this.Close();

RunElevated is a method that takes the name of an executable and spawns it in a new elevated process (see the attached code).

I have created a sample application that illustrates all the things written so far: it displays the user’s rights, elevates the current application and starts a process with more privileges. In order to see all features of the application you must have UAC enabled. You can download the code from this link.

Please note that here I recommend to run applications with limited privileges but there are situations when applications need to run unrestricted – this is the case of system configuration utilities or other special applications. What I want to say is that you should run applications in an unprivileged environment when possible.

This is part one of the tutorial. Part 2 will explain how to use the manifest file to specify that an executable must be always run with full privleges.

New Features Announced for Silverlight 5

2011-05-29T00:16:00.000+05:00

Improved media support and rich UI capabilities

Hardware Decode and presentation of H.264 improve performance for lower-power devices to render high-definition video using GPU support.
TrickPlay allows video to be played at different speeds and supports fast-forward and rewind. At up to twice the speed, audio pitch correction allows users to watch videos while preserving a normal audio pitch.
Improved power awareness prevents the screen saver from being shown while watching video and allows the computer to sleep when video is not active.
Remote-control support allows users to control media playback.
Digital rights management advancements allow seamless switching between DRM media sources.

Building next-generation business applications

Silverlight 5 text (bottom) has improved clarity.

Fluid user interface enables smoother animation within the UI. Inter-Layout Transitions allow developers to specify animations to apply when elements are added, removed or re-ordered within a layout. This provides smoother user experiences when, for example, items are inserted into a list.

Text improvements make it possible to build rich magazine-style text layouts:

Multicolumn text and linked text container allow text to flow around other elements.
Tracking/leading set precisely how far apart each character is for full creative control.
Text clarity is improved with Pixel Snapping.
Text layout performance is significantly improved.
OpenType support has been enhanced.
Support for Postscript vector printing enables users to create reports and documents, including the ability to create a virtual print view different from what is shown on the screen.
Added support for double-click and Combobox type ahead.
Model View ViewModel (MVVM) and Databinding enhancements allow more work to be done more easily via XAML:

Debugging support now allows breakpoints to be set on a binding, so you can step through binding failures.
Implicit DataTemplates allow templates to be created across an application to support a particular type by default.
Ancestor RelativeSource allows, for example, a DataTemplate to bind to a property on the control that contains it.
Binding in style setters allows bindings to be used within styles to reference other properties.
The DataContextChanged event is being introduced. Markup extensions allow code to be run at XAML parse time for both properties and event handlers, enabling cutting-edge MVVM support.

Silverlight 5 performance improvements

Reduced network latency by using a background thread for networking.
XAML parser improvements that speed up startup and runtime performance.
Support for 64-bit operating systems.
Reduced network latency by using a background thread for networking.

Graphics improvements

Graphics Processing Unit (GPU) accelerated 3-D application programming interface (API) provides rich graphics on the Web for building advanced data visualizations and rich user experience (UI).
Immediate mode graphics API allows direct rendering to the GPU.
Hardware acceleration is enabled in windowless mode with Internet Explorer 9.

Silverlight 5 extends features of the "Trusted Application" model

Silverlight 5 extends features of the ‘Trusted Application’ model to the browser for the first time. These features, when enabled via a group policy registry key and an application certificate, mean users won’t need to leave the browser to perform complex tasks:

Host HTML content as a Web browser control within the Silverlight application. HTML pages, such as help content or e-mail, can be integrated within the application.
Read and write files to the user’s My Documents folder, making it easier to find media files or create local copies of reports.
Launch Microsoft Office and other desktop programs. Users can open Microsoft Outlook and create an e-mail message, or send a report to Word utilizing the power of Office.
Access devices and other system capabilities by calling into application COM components. Users can access a USB security card reader or a bar-code scanner.
Enjoy full keyboard support in full screen, which enables richer kiosk and media viewing applications.
Call existing unmanaged code directly from within Silverlight with PInvoke.
Tools improvements

Microsoft Visual Studio profiling support including CPU, memory, thread contention.
Visual Studio Team Test support.

Features included in the final release are dependent on feedback and testing that comes from close communications with partners and customers that participate in the beta process

Profile Management in ASP.NET 2.0

2009-04-09T14:54:00.001+05:00

A good web site will remember me. Perhaps the site will remember my favorite color scheme, or my preferred shipping address. Either way, if a site makes me feel like I’m not just another IP address on the web, I’m more likely to return in the future. Adding a personal touch for your end-users can make a difference.

Personalization requires a bit of work, however. We need to track users and save their preferences between visits. We need database tables, SQL queries, and some well designed classes. Fortunately, ASP.NET 2.0 saves us from all the grunge work by giving us built-in profiling features we can use.
A Simple Profile

The Profile provider in ASP.NET stores and retrieves information about our site’s users. The default profile provider keeps data in SQL Server tables. All we need to provide is a definition of the user profile. The profile definition lives in the application’s web.config file. The following is a simple profile with name and age properties.

Using the profile we’ve defined is straightforward. The following is a content page that will read the current user’s profile settings into TextBox controls, and update the profile if the user clicks an update button. Notice we don’t need to use any database access code or explicitly load or save profile settings – ASP.NET takes care of all this work in the background.

<%@ Page Language="C#" MasterPageFile="~/Layout1.master" %>

The above sample works even for anonymous users. We will take a look later in the article how the system tracks unnamed users, but for now let’s introduce the software behind the curtain.
The Profile Provider
SqlProfileProvider

The ASP.NET team implemented the profile management features using a provider model. A base ProfileProvider class defines the interface, or contract, that all profile providers must implement. ASP.NET 2.0 ships with an implementation of the ProfileProvider that uses SQL Server – the SqlProfileProvider class. SqlProfileProvider implements the ProfileProvider methods (like FindProfilesByUserName) by executing stored procedures in SQL Server.

The provider model is extensible. If you don’t want to use SQL Server, but want to use an XML file or a different relational database engine, you can define your own class derived from the ProfileProvider class and implement all the Profile features using a different data store. The beauty of the provider model is how you can plug your own implementation of a feature into the system, and the runtime and application continue to work without knowing the details of the implementation. Later in the article, we will discuss the provider configuration. For now, let’s take a closer look at configuring Profile properties in web.config.
Profiles, Users, Values

Let’s extend our Profile settings with the following web.config.

The above configuration demonstrates several features. First, Profile properties use the String type by default. We can change the default with the type attribute, as we do with the Age property (typed as Int16). We can define a default value for a profile property with the defaultValue attribute. The provider will use the default value when a property value does not yet exist in the data store.
The Unidentified User

By default, Profile properties are only available for authenticated users. If we want a property to be available for an anonymous user, we need to add allowAnonymous=”true” to the property. Without the attribute, the runtime will throw an exception if the current user is anonymous and we write to the property.

In order for allowAnonymous to work, we need to configure ASP.NET to track anonymous users. We configure tracking using the anonymousIdentification section of web.config. Anonymous user tracking is off by default, but enabled=”true” will tell the ASP.NET runtime to load an AnonymousIdentificationModule into the HttpModule request pipeline. When an anonymous user makes a request, this module creates a globally unique identifier using the System.Guid class, and writes the GUID into a persistent cookie named .ASPXANONYMOUS. The GUID will be the anonymous user’s “name”. Using a persistent cookie means the user’s GUID will be available between visits. The cookie name, cookie timeout, and other characteristics of anonymous user tracking are configurable in the anonymousIdentification configuration element.
Groupings

We can create a hierarchy of profile properties using the group element. Grouping allows us to categorize properties, which can be helpful when there are a large number of profile properties. We can specify more than one property group, but we cannot nest a group beneath another group element. As you may have noticed in our first code sample, the ASP.NET compiler generates a class with strongly typed profile properties. A grouping adds an additional layer in the generated class, as can be seen in the following code snippet.

Profile.Name = "scott";
Profile.UI.Theme = "Reddish";
Profile.UI.MasterPage = "layout1.master";

Profiles At Compilation and Runtime

Where does the strongly typed Profile come from? The ASP.NET compiler parses web.config to uncover the profile schema defined inside, and then code-generates a class in the Temporary ASP.NET Files directory. The following class is an excerpt of the class generated from the web.config in this article.

public class ProfileCommon : System.Web.Profile.ProfileBase {

public virtual short Age
{
get
{
return ((short)(this.GetPropertyValue("Age")));
}
set
{
this.SetPropertyValue("Age", value);
}
}

// other properties ...
}

The above class (ProfileCommon) will compile into the App_Code assembly, meaning the class is visible to all of our web forms, user controls, master pages, and to any classes in the App_Code directory. We can use the Profile object from a base page class in App_Code:

using System;
using System.Web;
using System.Web.UI;

public class BasePage : Page
{
public BasePage()
{
PreInit += new EventHandler(BasePage_PreInit);
}

void BasePage_PreInit(object sender, EventArgs e)
{
ProfileCommon profile = HttpContext.Current.Profile
as ProfileCommon;

if (!String.IsNullOrEmpty(profile.UI.MasterPage))
{
MasterPageFile = profile.UI.MasterPage;
}

if (!String.IsNullOrEmpty(profile.UI.Theme))
{
Theme = profile.UI.Theme;
}
}
}

The above class sets the layout and look of a page based on a user’s preferences. Notice we can pull the Profile object out of the current HttpContext object. There is another HttpModule in the pipeline, the ProfileModule, which creates the Profile object during the AcquireRequestState event of the request processing lifecycle. The ProfileModule places the ProfileCommon object into the current HttpContext so the object is available for the duration of the request.

Notice we need to coerce the Profile object into a ProfileCommon reference (the as ProfileCommon in the code). Since the ProfileCommon class is generated by ASP.NET from web.config, so it’s not possible for the HttpContext class to know the definition of ProfileCommon. HttpContext has to return a ProfileBase reference. The ProfileCommon class derives from ProfileBase. All we need to do is cast the ProfileBase reference to a ProfileCommon reference.

Why doesn’t our web form code need to use the same type cast? The answer is that the ASP.NET compiler code-generates a Profile property into our web form. If you poke around at the generated code in the Temporary ASP.NET Files directory (with debug enabled), you’ll find each web form has a property defined like the following:

protected ProfileCommon Profile {
get {
return ((ProfileCommon)(this.Context.Profile));
}
}

Our web form also pulls the profile object from the current HttpContext and casts the value to a ProfileCommon reference. Since the ASP.NET compiler is kind enough to generate this code, we don’t need to cast the reference in our web form code.

If we want to use the ProfileBase object in a class library outside the web application, however, we will not be able to see the definition for the ProfileCommon class. You can still use a ProfileBase reference from a class library project and read write properties using the GetPropertyValue and SetPropertyValue methods of ProfileBase. Another solution might be to use Profile inheritance, which we will look at later in the article.
Provider Configuration

The machine.config file configures the default Profile provider for all web sites on the computer. The machine.config file is located in the framework installation config directory, typically Windows\Microsoft.NET\Framework\v2.0.xxxx\Config. Inside is the following.

The LocalSqlServer connection string points to a SQL Server 2005 Express database in the application’s App_Data folder. You can create a database on a different instance of SQL Server, or on a remote SQL Server, using the ASP.NET Sql Server Registration Tool (aspnet_regsql.exe). With a new database in place, you can either replace the LocalSqlServer connection string in your application’s web.config file, or reconfigure the provider to use a different connection string name. The following replaces the LocalSqlServer connection string to point to a different server.

...

The following configures a the SqlProfileProvider using a connection string named MySqlServer.

For the configuration to work, you’ll need to create a MySqlServer connection string in web.config. Note also that the account logging into SQL Server will need permission to access the profile related tables and stored procedures. ASP.NET creates several roles in the database, including the aspnet_Profile_BasicAccess role, which grants all the permissions required for creating, updating, and deleting profiles.
Serialization

The runtime serializes primitive Profile properties (like strings, integers, and DateTime instances) as strings. We can override serialization behavior with the serializeAs attribute and select the XmlSerializer (serializeAs="Xml") or the BinarySerializer (serializeAs="Binary"). The default serializer is the XmlSerializer. Let’s say we want to keep track of a user’s favorite Pet with the following class in App_Code:

using System;

public class Pet
{
public Pet()
{
// default ctor required for serializer
}

public Pet(string name)
{
_name = name;
}

private string _name = String.Empty;
public string Name
{
get { return _name; }
set { _name = value; }
}
}

Notice we need a default constructor for our class to work with serialization. We can add a favorite Pet into the profile by first adding a new property into web.config:

If we put the following code into a web form’s Page_Load method, the runtime will serialize the Pet object into the database as XML (the default).

protected void Page_Load(object sender, EventArgs e)
{
Profile.Pet = new Pet("Beaker The Cat");
}

You can look in the dbo.aspnet_Profile table to see serialized profiles. String and XML properties will be in the PropertyValuesString column, while objects serialized into binary will appear in the PropertyValuesBinary column. Side note: you’ll never want to store sensitive information into a user’s profile without encrypting the data first. Information in the profile columns is easy to extract.

Looking at the PropertyValuesString column in the aspnet_Profile table for our user's record, we will find the following (amongst the other property values).

Beaker The Cat

If we want to use a binary serializer with Pet objects, we could change the property configuration as follows:

The above configuration will throw an error: “The type for the property 'Pet' cannot be serialized using the binary serializer, since the type is not marked as serializable”. We need to make one small adjustment to the Pet class:

using System;

[Serializable]
public class Pet
{
// ...
}

Our pet objects will now appear as binary data in the PropertyValuesBinary column.
Profile Inheritance

The Profile object can inherit from an existing class. For example:

using System;
using System.Web.Profile;
using System.Collections.Generic;

public class CustomProfile : ProfileBase
{
[SettingsAllowAnonymous(true)]
public string Name
{
get { return base["Name"] as string; }
set { base["Name"] = value; }
}

[SettingsAllowAnonymous(true)]
public int Age
{
get { return (int)base["Age"]; }
set { base["Age"] = value; }
}

[SettingsAllowAnonymous(true)]
public List Pets
{
get { return base["Pets"] as List; }
set { base["Pets"] = value; }
}
}

A Profile class has to derive from ProfileBase. The public properties in the CustomProfile class forward calls to the ProfileBase indexer ([] in C#, () in VB). The base class will interact with the Profile provider to retrieve the values we need. Notice the class even uses a generic collection to store a list of all the user’s pets. To use the class, we just need to reconfigure our profile settings in web.config and use the inherits attribute.

Notice we can still augment the properties of our CustomProfile class with additional properties in web.config. The following code puts the new Profile to work.

Profile.LuckyNumber = 21;
Profile.Pets = new List();
Profile.Pets.Add(new Pet("Dolly the Dolphin"));
Profile.Pets.Add(new Pet("Bessie the Cow"));

One good reason to inherit from a custom base class is that we can add additional logic to the Profile object. For instance, we can add validation logic to the Age property to ensure the user provides us with a sensible age, and not a value like 443.
Migrating Anonymous User Settings

If your web application allows anonymous users to set Profile properties, and your web application includes not only authenticated but anonymous users, then there is a sticky scenario to handle. At some point an anonymous user might login and become an authenticated user. After a user authenticates, their Profile changes, because the Profile system keys Profile information by username.

At the point an anonymous user changes to an authenticated user, the Profile module gives us a chance to migrate the user’s anonymous profile to the new authenticated profile with a MigrateAnonymous event. We can handle this global event in global.asax with the following code.

void Profile_MigrateAnonymous(object sender,
ProfileMigrateEventArgs e)
{
ProfileCommon anonProfile =
Profile.GetProfile(e.AnonymousID);

Profile.Age = anonProfile.Age;
Profile.LuckyNumber = anonProfile.LuckyNumber;
Profile.Pets = anonProfile.Pets;
AnonymousIdentificationModule.ClearAnonymousIdentifier();
}

It is important to tell the AnonymousIdentificationModule to clear the anonymous identifier (the cookie). Without this call the event will continue to fire with each page the authenticated user visits.

The MigrateAnonymous event isn’t perfect, however, because it will fire each time an anonymous user logs in – even if we migrated their anonymous profile on a previous visit. If you want to prevent a user from overwriting their authenticated profile with inadvertent changes to their anonymous profile, you should consider adding a boolean flag to the profile, and migrate the profile settings only when the flag is false (then set the flag to true).
The ProfileManager
ProfileManager

discussion of Profiles would be complete without mentioning the ProfileManager class. The ProfileManager class is useful for managing profiles. Since the class is a static class, all the members are available to call without creating an instance of the class. The class is useful for managing profiles (ProfileManager.DeleteInactiveProfiles, for example), and for reporting on profiles. The GetAllProfiles method, for instance, includes an overload which accepts paging parameters (pageSize, pageIndex). The DeleteInactiveProfiles method will clean up profile records that have not been touched since a certain date.
Conclusions

Hopefully this article has demonstrated the flexibility of the ASP.NET Profile features. The ProfileProvider and company will save us time in developing a framework to store user specific data between visits. Use the feature to build a shopping cart, personalize your web application, and more.

google7c29c9953a23d08f

2009-03-31T00:23:00.000+05:00

vvv

Run Application on windows Start up

2009-03-23T12:04:00.002+05:00

Making
the application run or not run at startup involves a few simple lines of code for operating on the Windows Registry. More exactly the registry key we're interested in is Run. The full path to it is HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run or if you want the setting for all the users of the operating system use HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run.

Before we start, make sure you add the following using directive:

using Microsoft.Win32;
Define a RegistryKey object we're going to use for accessing the path to the Run registry key:

// The path to the key where Windows looks for startup applications
RegistryKey rkApp = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);

You can change CurrentUser to LocalMachine if you want the application to run at startup for all the users of the operating system.

Now here's the code used to make the current application run at startup:
// Add the value in the registry so that the application runs at startup

rkApp.SetValue("MyApp", Application.ExecutablePath.ToString());

Of course, change MyApp to the name of your application as you want it to appear in the System Configuration Utility (msconfig.exe which can be opened by typing msconfig at Start Menu -> Run). Application.ExecutablePath.ToString()retrieves the path to the application executable that's currently running, so we don't have to write it ourselves, not to mention that we don't normally know where the user installs the application.

So basically what we did here is add a value to the Run registry key, containing the name of the application and the path to the executable. That's enough for the executable to run at startup.

Now how do we disable the application from running at startup. Obviously, we delete the registry value we just created:

// Remove the value from the registry so that the application doesn't start
rkApp.DeleteValue("MyApp", false);

And how do we check the current state of the application to see if it's set to run at startup or not.

// Check to see the current state (running at startup or not)
if (rkApp.GetValue("MyApp") == null)
{

// The value doesn't exist, the application is not set to run at startup

chkRun.Checked = false;

}

else

{

// The value exists, the application is set to run at startup

chkRun.Checked = true;

}

AB

2009-02-21T17:02:00.001+05:00

Your Ad Here

2009-02-21T16:59:00.000+05:00

Your Ad Here

Applying Permissions on any Windows Folder using C#

2009-02-16T18:03:00.000+05:00

System.IO and System.Security.AccessControl

   1:  using System.IO;

   2:  using System.Security.AccessControl;

   3:  using System.Management;

   4:  using System.Management.Instrumentation;

7. Now we are going to define a method which will fill our combobox with names of all user account.

   1:  public void GetUsers()

   2:  {

   3:          // This query will query for all user account names in our current Domain

   4:          SelectQuery sQuery = new SelectQuery("Win32_UserAccount", "Domain='"

                             + System.Environment.UserDomainName.ToString() + "'");

5:

   6:           try

   7:           {

   8:                     // Searching for available Users

   9:                      ManagementObjectSearcher mSearcher = new

                                                        ManagementObjectSearcher(sQuery);

10:

  11:                      foreach (ManagementObject mObject in mSearcher.Get())

  12:                      {

  13:                              // Adding all user names in our combobox

  14:                              comboBox1.Items.Add(mObject["Name"]);

  15:                      }

  16:           }

  17:           catch (Exception ex)

  18:           {

  19:                      MessageBox.Show(ex.ToString());

  20:           }

  21:  }

Note: System.Environment.UserDomainName is going to deliver us our current domain.

8. In order to make the above method effective, we need to modify our form constructor.

   1:  public Form1()

   2:  {

   3:              InitializeComponent();

   4:              GetUsers();

   5:  }

9. Now we’ll go back to our design window and double click Select Directory button to define its clicking event. Change the definition to following;

   1:  private void SelectDirectorybtn_Click(object sender, EventArgs e)

   2:  {

   3:             // creating a new instance fot FolderBrowsingDialog

                                    to provide user capability to select target Folder

   4:             FolderBrowserDialog myFolderBrowserDialog = new FolderBrowserDialog();

5:

   6:             // showing dialog

   7:             myFolderBrowserDialog.ShowDialog();

8:

   9:             // Show the path of selected directory in our text Box

  10:             textBox1.Text myFolderBrowserDialog.SelectedPath.ToString();

  11:  }

10. Move back to your design view and add a Click event to the second button i.e. Make Unreadable, double click it to modify the event.

   1:  private void Permissionbtn_Click(object sender, EventArgs e)

   2:  {

   3:             // retrieving the directory information

   4:             DirectoryInfo myDirectoryInfo = new DirectoryInfo(textBox1.Text);

5:

   6:             // Get a DirectorySecurity object that represents the

   7:             // current security settings.

   8:             DirectorySecurity myDirectorySecurity = myDirectoryInfo.GetAccessControl();

   9:             string User = System.Environment.UserDomainName + "\\" +

                                                           comboBox1.SelectedItem.ToString();

10:

  11:             // Add the FileSystemAccessRule to the security settings.

                 // FileSystemRights is a big list we are current using Read property but you

                 // can alter any other or many sme of which are:

  12:            // Create Directories: for sub directories Authority

  13:            // Create Files: for files creation access in a particular folder

  14:            // Delete: for deletion athority on folder

  15:            // Delete Subdirectories and files: for authority of deletion over

                  //subdirectories and files

  16:            // Execute file: For execution accessibility in folder

  17:            // Modify: For folder modification

  18:            // Read: For directory opening

  19:            // Write: to add things in directory

  20:            // Full Control: For administration rights etc etc

21:

  22:            // Also AccessControlType which are of two kinds either “Allow” or “Deny”

  23:            myDirectorySecurity.AddAccessRule(new FileSystemAccessRule(User,

                                              FileSystemRights.Read, AccessControlType.Deny));

24:

  25:            // Set the new access settings.

  26:            myDirectoryInfo.SetAccessControl(myDirectorySecurity);

27:

  28:           // Showing a Succesfully Done Message

  29:           MessageBox.Show("Permissions Altered Successfully");

  30:  }

get MAC address of Your Card

2009-02-07T17:27:00.000+05:00

using System.Management;

ManagementClass mgmtObj = new ManagementClass("Win32_NetworkAdapterConfiguration");

ManagementObjectCollection mgmtObjCollection = mgmtObj.GetInstances();

foreach (ManagementObject obj in mgmtObjCollection)
{
if (((bool)(obj["IPEnabled"])) == true)
{
Console.WriteLine(obj["MacAddress"].ToString());
}
}

Registering Assembly Codebase

2009-02-06T13:51:00.000+05:00

using System.Reflection;
using System.Configuration.Assemblies;
using System.Runtime.InteropServices;

Assembly obj = Assembly.LoadFrom(Assembly name);
RegistrationServices reg = new RegistrationServices();
bool result = reg.RegisterAssembly(obj, AssemblyRegistrationFlags.SetCodeBase);
Console.WriteLine(result.ToString());

cookie hack

2009-01-30T12:10:00.001+05:00

Cookies are a way that a browser stores important and unimportant data. They store anything from user names and passwords to the last time you were at a site to what pages you visted.
There are many expolits you can do with this if the page is not properly coded. Many forums can be hacked if they have html enabled and a password harvesting script could be easy implemented.

Now how does it work? I thought you could not see other cookies from other domains on your own site. Well that is the truth, but it is easy to get around and I will let you figure that part out, but I will show you the tricks of the trade.
Okay now the address bar is your friend if you want to see what the cookie is holding on any site. You access the cookie through the document object. For all the examples I will be using an alert to show the cookie instead of document.write. This way you do not have to keep reloading the page.

The first step is to see the cookie code stored on your computer. Goto any site that has cookies. (I ran all of my code at hotmail to see what they had going on there. I would post screenshots, but I do not want to give away my hotmail info!)

javascript:alert(document.cookie)

Okay this alerts all of the unformatted code of the cookie. Now we need to make some more sense of this so we will have to unescape the information. (basic idea: Escaping the code replaces special characters with a code so the browser can store it without problems. Unescaping replaces all of the gibberish with the characters you can understand!)

javascript:alert(unescape(document.cookie))

Okay you should be able to read it, but it is still a large jumbled mess so we need to space it out a bit. For this I will use regular expressiosn to replace the semicolons with two carriage returns. (If you are using document.write then you want to use html breaks)

javascript:alert(unescape(document.cookie).replace(/;/gi,"\n\n"))

Looking at the code I still see that there is escaped information in the strings so I am going to unescape the string again.

javascript:alert(unescape(unescape(document.cookie)).replace(/;/gi,"\n\n"))

Now what is left is a formatted bunch of strings. Yes the strings are encrypted, but you will find out that not everyone will encrypt the strings in their cookies! And if you look the source code you miight find out how to break encryption if they do not use server side code.

Data Encryption over Internet

2009-01-29T12:02:00.001+05:00

Encryption is the process of transforming data into an unintelligible form to prevent the unauthorized use of the data. To read an encrypted file, you must have access to a secret key or password that enables you to decrypt it. Unencrypted data is called plain text; encrypted data is called cipher text. A cipher is an encryption-decryption algorithm.

The Data Encryption Standard (DES) is a cryptographic algorithm designed to encrypt and decrypt data using 8-byte blocks and a 64-bit key.

The Triple DES (DES3) is a variation of DES in which three 64-bit keys are used for a 192-bit key. DES3 works by first encrypting the plain text using the first 64-bits of the key. Then the cipher text is decrypted using the next part of the key. Finally the resulting cipher text is re-encrypted using the last part of the key.

The Advanced Encryption Standard (AES) is a replacement algorithm that is used by the United States government.

Two encryption modes are:

Block Mode, a method of encryption in which the message is broken into blocks and the encryption occurs on each block as a unit. Since each block is at least 8 bytes large, block mode provides the ability for 64-bit arithmetic in the encryption algorithm.
Stream Mode, a method of encryption in which each individual byte is encrypted. It is generally considered to be a weak form of encryption.

A blowfish is a block cipher that operates on 64-bit (8-byte) blocks of data. It uses a variable size key, but typically, 128-bit (16-byte) keys are considered to be good for strong encryption. Blowfish can be used in the same modes as DES.

How you configure network encryption depends on what type of network communication you use.

How to read / download the content of a web page using C# and store it in a file?

2009-01-28T18:22:00.002+05:00

using System;
using System.IO;
using System.Net;
using System.Text;

...

public static void GetFile
(
string strURL,
string strFilePath
)
{

WebRequest myWebRequest = WebRequest.Create(strURL);

WebResponse myWebResponse = myWebRequest.GetResponse();

Stream ReceiveStream = myWebResponse.GetResponseStream();

Encoding encode = System.Text.Encoding.GetEncoding("utf-8");

StreamReader readStream = new StreamReader( ReceiveStream, encode );

string strResponse=readStream.ReadToEnd();

StreamWriter oSw=new StreamWriter(strFilePath);

oSw.WriteLine(strResponse);

oSw.Close();

readStream.Close();

myWebResponse.Close();

}

Image Downloader

2009-01-28T18:22:00.001+05:00

using System;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using System.Net;

public class DownloadImage {
private string imageUrl;
private Bitmap bitmap;
public DownloadImage(string imageUrl) {
this.imageUrl = imageUrl;
}
public void Download() {
try {
WebClient client = new WebClient();
Stream stream = client.OpenRead(imageUrl);
bitmap = new Bitmap(stream);
stream.Flush();
stream.Close();
}
catch (Exception e) {
Console.WriteLine(e.Message);
}
}
public Bitmap GetImage() {
return bitmap;
}
public void SaveImage(string filename, ImageFormat format) {
if (bitmap != null) {
bitmap.Save(filename, format);
}
}
}

Image Thumbmaling

2009-01-28T18:20:00.000+05:00

The GetThumbnailImage method of the Bitmap class in GDI+ and C# is used to create a small thumbnail image of a lange image. The following code snippet/page shows how to create an image thumbnail using Bitmap.GetThumbnailImage method.

using System;
using System.Data;
using System.Configuration;
using System.Collections;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
using System.Drawing;
using System.IO;
using System.Text;
using System.Net.Mail;
using System.Text.RegularExpressions;
using System.Threading;

public partial class _Default : System.Web.UI.Page
{
private string Finalimagename = "";
protected void Page_Load(object sender, EventArgs e)
{

}
protected void btnUpload1_Click(object sender, EventArgs e)
{
ImageUpload();
}

private void ImageUpload()
{
/* this code used to make directory name RealImage */
Directory.CreateDirectory(Server.MapPath("RealImage\\"));
HtmlInputFile htmlFile = (HtmlInputFile)BrowseImage0;
if (htmlFile.PostedFile.ContentLength > 0)
{
string sFormat = String.Format("{0:#.##}", (float)htmlFile.PostedFile.ContentLength / 2048);
if (float.Parse(sFormat) < float.Parse("2048"))
{
if (htmlFile.PostedFile != null)
{
ViewState["ImageName"] = htmlFile.PostedFile.FileName.Substring(htmlFile.PostedFile.FileName.LastIndexOf("\\") + 1);//browseImagePath[0];
}
else
{
ViewState["ImageName"] = "";
}
}
else
{
lblError1.Visible = true;
lblError1.Text = "Image Size is Large, please resize it !!";
}
}
else
{
ViewState["ImageName"] = "";
if (ViewState["ImageName"].ToString() == "")
{
lblError1.Visible = true;
lblError1.Text = "Attach an image to upload";
}
return;
}

//This function is used to make image thumbnail
MakeThumbnail();
}

//Return thumbnail callback
public bool ThumbnailCallback()
{
return true;
}
//For image thumbnial
private void MakeThumbnail()
{
System.Drawing.Image myThumbnail150;
object obj = new object();
obj = BrowseImage0;
System.Drawing.Image.GetThumbnailImageAbort myCallback = new System.Drawing.Image.GetThumbnailImageAbort(ThumbnailCallback);
HtmlInputFile hFile = (HtmlInputFile)obj;
if (hFile.PostedFile != null && hFile.PostedFile.ContentLength > 0)
{
//this code used to remove some symbols between image name and replace with space
string imgname1 = hFile.PostedFile.FileName.Replace('%', ' ').Substring(hFile.PostedFile.FileName.LastIndexOf("\\") + 1);
string imgname2 = imgname1.Replace('#', ' ').Substring(imgname1.LastIndexOf("\\") + 1);
string imgname3 = imgname2.Replace('@', ' ').Substring(imgname1.LastIndexOf("\\") + 1);
string imgname4 = imgname3.Replace(',', ' ').Substring(imgname1.LastIndexOf("\\") + 1);
string imgname5 = imgname4.Replace('&', ' ').Substring(imgname1.LastIndexOf("\\") + 1);

Finalimagename = imgname5.ToString();

string imgname = hFile.PostedFile.FileName.Substring(hFile.PostedFile.FileName.LastIndexOf("\\") + 1);
string sExtension = imgname.Substring(imgname.LastIndexOf(".") + 1);

//this code is used to check image extension
if (sExtension.ToLower() == "jpg" || sExtension.ToLower() == "gif" || sExtension.ToLower() == "bmp" || sExtension.ToLower() == "jpeg")
{
if (!File.Exists(MapPath("RealImage\\" + Finalimagename)))
{
hFile.PostedFile.SaveAs(ResolveUrl(Server.MapPath("RealImage\\" + Finalimagename)));

System.Drawing.Image imagesize = System.Drawing.Image.FromFile(ResolveUrl(Server.MapPath("RealImage\\" + Finalimagename)));
Bitmap bitmapNew = new Bitmap(imagesize);
if (imagesize.Width < imagesize.Height)
{
myThumbnail150 = bitmapNew.GetThumbnailImage(150 * imagesize.Width / imagesize.Height, 150, myCallback, IntPtr.Zero);
}
else
{
myThumbnail150 = bitmapNew.GetThumbnailImage(150, imagesize.Height * 150 / imagesize.Width, myCallback, IntPtr.Zero);
}

//Create a new directory name ThumbnailImage
Directory.CreateDirectory(Server.MapPath("ThumbnailImage"));
//Save image in TumbnailImage folder
myThumbnail150.Save(ResolveUrl(Server.MapPath("ThumbnailImage\\")) + Finalimagename,
System.Drawing.Imaging.ImageFormat.Jpeg);
MessageLabel.Text = "Successfully uploaded"
}
}
else
{
lblError1.Visible = true;
lblError1.Text = "Check image extension";
}
}
}
}

Bytes to Hexa Converter

2009-01-23T14:34:00.000+05:00

public static string BytestoHexaConversion(Byte[] bytes)
{
StringBuilder HexaString = new StringBuilder(bytes.Length);
foreach (Byte b in bytes)
{
HexaString.Append(b.ToString("X2"));
}
return HexaString.ToString();
}

Capturing screenshots using C#

2009-01-09T22:45:00.000+05:00

using System.Drawing.Imaging;

private static Bitmap bmpScreenshot;

private static Graphics gfxScreenshot;

bmpScreenshot = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height, PixelFormat.Format32bppArgb);
gfxScreenshot = Graphics.FromImage(bmpScreenshot);
gfxScreenshot.CopyFromScreen(Screen.PrimaryScreen.Bounds.X, Screen.PrimaryScreen.Bounds.Y, 0, 0, Screen.PrimaryScreen.Bounds.Size, CopyPixelOperation.SourceCopy);
bmpScreenshot.Save("filename.ping");

Enabling Multiple Remote Desktop Sessions in Windows XP Professional and Media Center Edition 2005

2009-01-03T10:57:00.000+05:00

If you have ever used a real remote computer system like Citrix, then you have probably been craving multiple Remote Desktop sessions since you first fired up Windows XP Professional and/or Media Center Edition. Here is a HACK (translated: USE AT YOUR OWN RISK), to enable multiple Remote Desktop sessions on your XP Pro or MCE 2005 box:

NOTE: You will have to have knowledge of the Windows operating system and more specifically the Windows Registry. If you have no experience with the registry, then I would recommend you find someone who does or leave these alone. I do not make any kind of warranty that this will work for you or your friends. This is provided for entertainment purposes only. Don’t call me if your computer stops working. Got it?

Print these directions so that you have them to work from.
Restart your computer in Safe Mode - Follow this link to learn how to restart Windows XP in Safe Mode
Turn off/disable Remote Desktop Connection (RDC) and Terminal Services

Right click My Computer
Select Properties
Click on the Remote tab at the top of the window
UNCHECK the box next to, “Allow users to connect remotely to this computer“
Click OK
Go to Start -> Control Panel -> Administrative Tools -> Services
Find Terminal Services in the list
Right click on Terminal Services and click Properties
In the Startup Type box, select Disabled
Click OK to close the window

Next you will replace the current version of the Terminal Services DLL (termsrv.dll) with an unrestricted version from a previous release of Terminal Services.

Here is a copy of the Terminal Services DLL - Save it to your Desktop or other suitable location
Using a file manager like Windows Explorer open C:\Windows\system32\dllcache
Rename the file termsrv.dll to termsrv_dll.bak or whatever you would like.
Copy the downloaded termsrv.dll file (the one you just downloaded from the web) to C:\Windows\system32\dllcache
Open the C:\Windows\system32 folder
Delete the file termsrv.dll in C:\Windows\system32

Now we can edit the Windows Registry to enable more than one RDP connection. Go to Start -> Run and type regedit - Hopefully you knew that already

Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core

Add a DWORD Key named EnableConcurrentSessions and give it a value of 1

Close the Registry Editor window

Go to Start -> Run and type gpedit.msc to run the Group Policy Editor

Browse to Computer Configuration -> Administrative Templates -> Windows Components -> Terminal Services and double click Limit number of connections

Select the Enabled button and enter the number of connections you would like to enable….at least 2.

Restart Windows

Right click My Computer and select Properties.

Click on the Remote tab at the top of the window

CHECK the box next to, “Allow users to connect remotely to this computer“

Click OK

Go to Start -> Control Panel ->Administrative Tools -> Services. Select Terminal Services from the list and double click it or right-click -> Properties. Set the Startup Type to Manual.

Restart Windows/Computer

You must get this...

Increase your cable modem or DSL speed in XP

2008-12-28T06:11:00.001+05:00

This tweak is for broad band cable connections on stand alone machines with winXP professional version - might work on Home version also. It will probably work with networked machines as well but I haven't tried it in that configuration. This is for windows XP only, it does not work on win2000.
I use 3 Com cards so I don't know how it works on others at this point. It does not involve editing the registry. This tweak assumes that you have let winXP create a connection on install for your cable modem/NIC combination and that your connection has tcp/ip - QoS - file and print sharing - and client for microsoft networks , only, installed. It also assumes that winxp will detect your NIC and has in-box drivers for it. If it doesn't do not try this.
In the "My Network Places" properties (right click on the desktop icon and choose properties), highlight the connection then at the menu bar choose "Advanced" then "Advanced Settings". Uncheck the two boxes in the lower half for the bindings for File and Printer sharing and Client for MS networks. Click OK

From the windows XP cd in the support directory from the support cab, extract the file netcap.exe and place it in a directory on your hard drive or even in the root of your C:\ drive.
next, open up a command prompt window and change directories to where you put netcap.exe. then type "netcap/?". It will list some commands that are available for netcap and a netmon driver will be installed. At the bottom you will see your adapters. You should see two of them if using a 3Com card. One will be for LAN and the other will be for WAN something or other.
Next type "netcap/Remove". This will remove the netmon driver.
Open up control panel / system / dev man and look at your network adapters. You should now see two of them and one will have a yellow ! on it. Right click on the one without the yellow ! and choose uninstall. YES! you are uninstalling your network adapter, continue with the uninstall. Do not restart yet.
Check your connection properties to make sure that no connection exists. If you get a wizard just cancel out of it.

2008-12-28T06:09:00.000+05:00

Now re-start the machine.

After re-start go to your connection properties again and you should have a new connection called "Local area connection 2". highlight the connection then at the menu bar choose "Advanced" then "Advanced Settings". Uncheck the two boxes in the lower half for the bindings for File and Printer sharing and Client for MS networks. Click OK.
Choose connection properties and uncheck the "QOS" box
Re-start the machine
after restart enjoy the increased responsivness of IE, faster page loading, and a connection speed boost.

Why it works, it seems that windows XP, in its zeal to make sure every base is covered installs two seperate versions of the NIC card. One you do not normally see in any properties. Remember the "netcap/?" command above showing two different adapters? The LAN one is the one you see. The invisible one loads everything down and its like your running two separate cards together, sharing a connection among two cards, this method breaks this "bond" and allows the NIC to run un-hindered.

Death of Google Adsense

2008-12-26T03:11:00.000+05:00

Recent changes in the Google Adsense program has many online website owners and marketers seriously concerned. Many have seen their Adsense profits and income flatline... seen their four or five figure monthly Adsense income disappear overnight. For many the Google Adsense bubble has burst.

What happened?

First, Google made a change in its Adsense program, letting advertisers choose between putting their ads in the search results or on the content pages of Adsense publishers. Search won out and started to receive the higher bids. Search results convert better than content ads.

Next, Google has cracked down on Junk Adsense sites, like they should. These sites consisted mainly of software generated re-hashed search engine links and were totally annoying to say the least. But Google also cracked down on 'squeeze pages' or 'affiliate landing pages' - a lucrative source of income for many online marketers, mainly because these pages helped marketers build an opt-in list or use permission based email.

2008-12-26T03:10:00.000+05:00

The results of these changes produced an Adsense meltdown for many online marketers.

Some Internet marketers are speculating recent changes could even mean the death of Adsense. One online marketer, Scott Boulch even published a free report entitled 'The Death of Adsense".

Many affiliate marketers would agree with Boulch on some of his points, especially the obvious fact that using Adsense on your web content is starting on the bottom rung of the online marketing ladder. Instead of receiving pennies per click with Adsense, alert marketers and webmasters have already discovered that by using CPA (Cost-Per-Action) and direct affiliate links, they can produce significantly more revenue from their web pages. Why earn pennies per click when you can earn $5, $10 or OVER $100 per click?

But the fine people at Google are catching on...

In the past Google has made its own swing to the Cost-Per-Action direction with its referral system for the Firefox Browser and giving webmasters credit for signing up Adwords and Adsense accounts.

Many online marketers believe Google needs to expand on these baby steps and open their Adsense affiliate program up to third party products/advertisers. In a recent company statement Google offered some hope: "We're always looking for new ways to provide effective and useful features to advertisers, publishers, and users," the company stated "As part of these efforts we are currently testing a cost-per-action (CPA) pricing model to give advertisers more flexibility and provide publishers another way to earn revenue through AdSense." Basically, in cost-per-action, advertisers pay for leads, purchases or customer acquisition. It would help with the click fraud issue and the monetary returns could potentially make Adsense's revenues pale in comparison.

As more and more commerce goes online... acquiring customers for such diverse services as insurance, real estate, telephone, marketing, web hosting, travel, mortgage loans, cable TV, banking... you name it, almost any service or product sold in the marketplace is now turning to the Internet for customers and lifelong clients.

2008-12-26T03:07:00.000+05:00

Enormous sums of money will change hands. Perhaps, the most lucrative of these is customer acquisition. Advertisers are turning to the Internet and webmasters/marketers for acquiring these lifelong customers for their respective services and products. Businesses and companies are quickly realizing paying an attractive lead generating fee/commission is smart business. They quickly build a client base for their services or products and quickly recoup their expenses - realizing in the long run these leads will generate huge profits.

It can also mean huge profits for the CPA networks like ValueClick's Commission Junction and Rakuten's LinkShare who supply the advertisers with publishers and website marketers to harvest these leads. It can be a lucrative venture for all involved, especially for those online marketers who have cornered the search engines for lucrative niche markets in big ticket items. Even small ticket items pay quite well for those marketers who know how to market online.

Contextual advertising is fine, but CPA (Cost-Per-Action) will offer much better returns for the website owner. Making any profitable site much more profitable. It will and is opening up a whole area of marketing opportunities that never existed before we had the Internet. Creating a complex structure of advertisers, publishers and the Affiliate/CPA companies that connect the two.

Of course, cutting out the middle man has always been even a more profitable venture for most marketers. As more and more webmasters realize they can make much more with dealing directly with companies, rather than going through a middle process like Google Adsense or the countless other affiliate/CPA networks ... online marketers can reap even bigger rewards.

For an online marketer when you get a phone call or email from the CEO or the affiliate manager with a company or service you're promoting with your website - you know you have made it! Dealing directly with a company usually means bigger commissions and special exclusive deals just for you or your sites.

Only fly in the ointment, all that extra paperwork and business wheeling and dealing. Many marketers and website owners like the idea of someone else handling all the tracking, collecting payments, promotional materials... they just like to sit back and build more websites and content. It gives the affiliate marketer a lifestyle that they are looking for on the web. They just like to market and promote with their sites and let someone else worry about the details. Therefore, there will always be a place for contextual ads like Google Adsense... "Rumors of my demise have been greatly exaggerated."

However, could CPA be a better alternative for the current Adsense contextual ads?

Google would be the natural choice for a middleman if there ever was one. Besides, many savvy marketers know the Google brand name is trusted online, any product/service promoted through Google would be an easy sell. Many argue Google already dominates the web, why should it not be the one to handle these CPA transactions through its Adsense program.

On the flip side, over countless updates and changes to its indexing, many webmasters have experienced more than a few negative dealings with Google. Many have won, many have lost in this Google Age, but all have realized riding the Google Search Engine is like running with the bulls at Pamplona, totally thrilling unless you're one of the unfortunate few who get trampled in the process.

.NET Reflector: Soup to Nuts

2008-12-24T13:11:00.001+05:00

NET Reflector has a special place in the pantheon of NET Development tools. It was first written by Lutz Roeder when the .NET Framework was still in beta, and since then has developed alongside it. So ubiquitous has it become that .NET Developers use its' name as a verb, as in 'let's reflector it'. What they mean is to browse and investigate the assemblies that comprise the code with a tool that is capable of showing what's there, and how classes, methods, or entire assemblies relate to each other, within the context of the application.

Why use .NET Reflector?

NET Reflector gives you the means to inspect, analyze, and browse the contents of a .NET component, such as an assembly. It will show you the metadata, IL instructions, resources and XML documentation. This tool can disassemble the instructions into source code in a variety of .NET languages, and translates the other binary information into an intelligible form. It does this through a process called 'reflection', which retrieves information about the various classes, methods, and properties included in a particular assembly (hence the name of the tool).

Most likely, you'll need .NET Reflector to track down performance problems and bugs. It is great for browsing classes, and maintaining, or becoming familiar with, code bases. Some of its features include:

An Analyzer option, which can be used to find assembly dependencies, and even windows DLL dependencies.
A call tree and inheritance-browser, which will pick up documentation or comments, stored in the xml files that are used to drive Intellisense inside Visual Studio. It will then display this information alongside the associated assemblies.
Ability to cross-navigate related documentation (xmldoc), searching for specific types, members and references.
Ability to convert your source between languages, such as C# and VB!

All sorts of questions crop up during development that can be answered with .NET Reflector:

What line of code is producing that error message?
What uses a particular piece of code, and what code does it, in turn, use?
How does a class, method, or entire assembly fit into your application?
What are the differences between two versions of the same assembly?
What features of the API of some legacy code can you use?
How do the various parts of your system interact with each other?

When you're working on a large team-based project, .NET Reflector is often the quickest way of getting a clear insight into how the application is working and where the bugs and weaknesses are. There is a great difference between knowing the public interface of a module and actually seeing what the code does.

Once .NET Reflector is combined with add-ins, it can become a tool to facilitate testing and make team-working more effective. There have been many occasions when .NET Reflector has assisted in the recovery of source code after it has been lost.

What is in a .NET Assembly?

Essentially, .NET Reflector allows you to 'see' what is in a .NET assembly.

A .NET language compiler will produce binary CIL (MSIL) code, and any resources that are required, in a file called an 'assembly'. The binary CIL code is written for a theoretical stack-based processor, to make it easy to run assemblies securely on different processors, in any environment supporting the .NET framework.

Then, a just-in-time (JIT) compiler will compile this abstracted, language-independent binary code, and optimise it into actual machine 'native' code for the target processor, and compile all the resources used. The .NET Common Language Runtime (CLR) supplies at least one JIT compiler for every NET-supported computer architecture, so the same set of CIL can be JIT-compiled and run on different architectures.

The CIL includes instructions for loading, storing, initializing, and calling methods on objects, as well as instructions for arithmetic and logical operations, control flow, direct memory access, exception handling, and other operations. It is designed to support polymorphism, inheritance, abstract types, and so on. When a high level language, such as C#, compiles code, it converts it to CIL. The process is reversible but because it is possible for two different high-level syntaxes to produce the same CIL, it may not be exactly the same as the original code.

As well as producing CIL, a .NET compiler will also produce metadata. This will contain everything needed for runtime, sufficient for the code to describe itself during execution without needing type libraries or the Interface Definition Language (IDL), and allowing JIT compilation, linking and introspection to work.

All the classes and class members that are defined in the assembly, as well as the external classes and class members called from the assembly, are described in the metadata, as are all the class methods. This includes details of its parameters, the return type, and the assembly in which it belongs. When the CLR executes CIL, it checks that the metadata of the called method matches that of the calling method. This metadata is used by the process of reflection, and is read by ..NET Reflector.

As well as the metadata, the assembly will also contain any required resources such as attributes, custom attributes, images and strings, and will also contain security information. You can browse this information from within reflector, as shown in Figure 1:

Figure 1: .NET Reflector displaying string resources

The whole assembly is put in an extended version of the portable executable (PE) file, used for executables, object code, and DLLs, and which enables the operating system to recognize common language runtime images. The PE file has only one import – mscoree.dll – which then loads the CLR Header and Data sections, and runs the assembly's just-in-time (JIT) compiler. The PE header's data directory contains a .NET directory entry, which points to a new header in the file containing everything the operating system needs to run it.

.NET Reflector, ILASM and ILDASM

Microsoft supplies two tools for investigating assemblies:

ILASM, the Microsoft IL Assembler. It will take an ASCIII assembly language source-code file, and produce binary IL (MSIL) code. It adds in all the specified resources to create the assembly.
ILDASM, the .NET disassembler. This is part of the .NET framework, and works the other way round. It will produce an 'assembly' file from an IL file. This assembly file is very much like a traditional Assembly source code file.

They are designed to be complementary, so that the output of one can go into the other to produce an identical file to the original.

The ILASM and ILDASM tools are useful, but not sufficient by themselves. Unfortunately, ILDASM is best only with CLI assembly sections, whereas EXE files are in PE format, which ILDASM may not extract correctly. The tool will show method signatures and member variables, but the code will be in .NET byte code.

To be able to extract everything you want from a NET assembly, in the language that was used originally to create the assembly, you will need .NET Reflector. This will also allow you to browse and inspect the other resources in the assembly, and even the XML documentation used by the IDE that created the assembly.

.NET Reflector, as we've said, uses 'Reflection' to do its work. Reflection is used to retrieve information about the various classes, methods, and properties included in a particular assembly. Reflection has to determine the interface, structure, enumeration, or delegate of a type at runtime. This process can be used to examine any .NET code, whether a single class or an entire assembly, and .NET Reflector uses this process to make sense of the contents of an assembly.

Reflector cannot view itself. It needs to use reflection but, because .NET Reflector needs to work with all versions of the .NET Framework, it uses its own assembly loading infrastructure, which does not rely on the Reflection API. This allows .NET Reflector to load .NET Framework 2.0 assemblies without having the .NET Framework 2.0 installed. However, it also makes it difficult for anyone trying to explore how .NET Reflector works!

Installing, Registering and Launching .NET Reflector

2008-12-24T13:10:00.001+05:00

.NET Reflector was written by Lutz Roeder, and has evolved over the entire life of the .NET Framework. It was first released in October 2000 running on .NET Framework 1.0 Beta. It has been updated continuously to work with each new release of the framework and is now on Version 5. This current version supports query expressions and other concepts introduced in C# 3.5 but only if you select ".NET 3.5" as the optimisation within the menu (under View |Options | Disassembler | Optimization). Along the way, a number of additions have been made, on request, sometimes for very general requirements, but occasionally for supporting special uses.

Lutz provided licenses only to users who register their names and email addresses. Registration was, and remains, free, but the software was never open-source or in the public domain. The new owners, Red Gate, will continue with this policy.

The application comes as a zipped package without an installer. It consists of .NET Reflector, the configuration file, license file and readme file.

Reflector can be launched, unregistered, just by clicking on the file in Explorer. However, there are many advantages to registering it with the Windows Shell.

You can register Reflector simply by issuing the following from the command line:

Reflector.exe /register

Once Reflector is integrated into the Windows shell, you can simply right-click on any DLL to open and browse it using Reflector, as shown in figure 2:

Figure 2: Immediately you've registered the program, life becomes easier (Note the context menu)

You can unregister Reflector by issuing:

Reflector.exe /unregister

As discussed, once registered, you'll generally launch Reflector just by clicking on the file in Explorer. However, if you are using reflector as a tool for several projects you may want to invoke it from the command line, using a particular configuration file (more on this later) for each project:

Reflector.exe /configuration:

Or, to specify the assembly you wish to examine:

Reflector

This syntax is used by the operating system to display assemblies on startup of .NET Reflector once .NET Reflector is registered.

A Quick Spin through .NET Reflector

2008-12-24T13:09:00.000+05:00

The following sections provide a simple example of the "disassembling" power of Reflector, followed by a brief tour of some of the useful features that are enabled once you register the tool with the operating system.

Disassembling Hello World

We can create the simplest possible program, and assemble it:

Figure 3: Assembler source code for Hello World

And, at the command-line, execute:

C:\WINNT\Microsoft.NET\Framework\v2.0.50727\ilasm.exe helloWorld.il

Run the program:

HelloWorld.exe

You can then do one of the following…

Drag and drop it into Reflector
Use 'File-> Open' in Reflector (or Ctrl O)
Use the following URI (from Notepad, for example):
code ://HelloWorld:1.0.0.1//main()
Pop the above URI in your browser (if you ran Reflector.exe /register)
Run reflector from the command line

And this is what you'd see…

Figure 4: Hello World in Reflector, with disassembler window set to IL

Notice that the disassembly is not perfect, because some symbolic information is always lost in the original compilation.

Ever wondered how what the PowerShell 'Hello world' looks like?

Figure 5: PowerShell Hello world!

You can right-click any type or Assembly, or press Ctrl-R, to see what the class depends on, and what is exposed by, instantiated by, and assigned by the class.

Figure 6: The analyser looking at class dependencies

Maintaining Assembly lists

When you launch Reflector for the first time, you can choose a default set of assemblies. With .NET Reflector, you can create the groups of assemblies that you are interested in, and open/browse them as a set. The list of assemblies is stored in the Reflector configuration file, Reflector.cfg, and will be loaded next time you open the program. Reflector allows you to create as many assembly lists as you want.

As discussed earlier, not only can you define and store an assembly set into a file, but you can also launch reflector.exe with a particular assembly list file, via the command line.

Creating, selecting and deleting assembly lists in Reflector can be slightly confusing at first because it's not immediately obvious that the place to go to do it is the File | Open List dialog box. You can create new lists from the box by clicking 'Add' to clone the current list.You can also remove assembly lists from the same dialog box.

Figure 7: Managing your assembly lists!

2008-12-24T13:08:00.000+05:00

You can switch between assembly lists with the same dialog box, or from the command line. To choose a different set of default assemblies for the current assembly list you should:

Remove all assemblies from the list, by selecting them and using the Delete key
Invoke the Refresh command.
Add the assemblies to make up the set

This feature makes it easy to browse a variety of projects and frameworks, even if they have conflicting names

Sharing URIs

One of the great advantages of registering Reflector is that you can then, from within reflector, 'bookmark' any item within an assembly just by recording a custom URI for it (i.e. putting the URI on the clipboard by pressing Ctrl-Alt-C). Once a URI is clicked on, .NET Reflector displays the item. The URI includes the version and hash value for the assembly.

The URI can be shared with fellow developers to provide a link to the item, since it only requires the other person to have Reflector and the same .dll/.exe to which you created a shortcut. There is also a CodeShortcut add-in that allows you to save URIs on the desktop.

So, if you click on the following URI:

code://System.Xml:2.0.0.0:b77a5c561934e089/System.Xml.XmlConvert

You will see something similar to figure 7:

Figure 7: Opening a file in Reflector from a URI

2008-12-24T11:52:00.004+05:00

Reflector Add-ins

A number of add-ins have been written for Reflector most, but not all, of which are open-source. There are many different add-ins and it is best to get an up-to-date listing and description than to rely on an article like this that will soon get out-of-date. An up-to-date listing is always kept at CodeProject:

http://www.codeplex.com/reflectoraddins

Some of the add-ins extend the language that Reflector disassembled to, such as PowerShell, Delphi, and MC++. Other add-ins will analyse assemblies in different ways, such as providing quality metrics, sequence diagrams, class diagrams, dependency structure matrices or dependency graphs. It is possible to use add-ins to search text, save disassembled code to disk, export an assembly to XMI/UML, to do side-by-side comparisons of different versions of code, or to search code.

Add-ins are being added the whole time and include those that: allow the debugging of processes, Facilitate testing by creating stubs and wrappers and allow browsing assemblies in other .NET foundations, such as Silverlight, WWF, Biztalk, SQL Server, or windows Forms

There are also a range of utility add-ins, one of which allows .NET Reflector to be used within Visual Studio, and another that allows you to save the URI shortcuts of an item onto the desktop

Conclusions

.NET Reflector has always been an essential tool for understanding NET assemblies. There are many reasons for wanting to look at what is going on in an assembly. Any developer will need to do so, even if it is just a tool to help with understanding performance issues. With all the features that have been added over the years in response to requests by developers, and the add-in contributions, it has become a tool that it is impossible to be without when doing .NET software development.

Yahoo Messenger Decoding: Introduction

2008-11-30T03:19:00.002+05:00

While I was given a task, at my company to work on module to analyze the network traffic of the computer on which our client application would run, to monitor the Instant Messages that a user is doing being logged into (AIM, Yahoo, MSN etc) Messengers, while initial studies for this task, i came across many chat sniffer applications being sold on many websites, simply Amazing for me... then i found some network monitoring tools, like Wireshark, a step above than chat sniffers. after some hours study I decided to make my own network analyzer. So I started..

style="font: 9px sans-serif" title="counters">counters

What does it do? to break Yahoo Messenger Packets

2008-11-30T03:18:00.001+05:00

This sample Application, I have posted on techbreeds.blogspot.com is helpful to monitor Yahoo Chat Streams, on a computer, What it does? seems to be simple it runs on a computer, and monitors your computer traffic, identifies yahoo Protocol and Sniffs its Packets, into a human understandable format.

Background
this application is based on WINPCAP library extension for .NET; SharpPCap that I have used for capturing the packets of yahoo protocol coming to my Network Device, and ofcourse go out from my network device. Thanks to WINPCAP
And some help is taken from wireshark also, that is the amazing tool for network analysis.
Before expaling some details I must prefer you, to study about Yahoo Messenger Protol
at: http://en.wikipedia.org/wiki/YMSG
and about WINPCAP and SharpPCap: http://www.winpcap.org/ and
http://www.tamirgal.com/home/
Now about my Yahoo Sniffer,

Using the code

add ShapPCap libraries:
using Tamir.IPLib;
using Tamir.IPLib.Protocols;
using Tamir.IPLib.Util;
using Tamir.IPLib.Packets;

Get Your Network Device Informatiom

2008-11-30T03:16:00.001+05:00

devices = SharpPcap.GetAllDevices();
Console.WriteLine("Totaol No of network Devices : " + devices.Count);
device = devices[devices.Count - 1];
device.PcapOnPacketArrival += new SharpPcap.PacketArrivalEvent(device_PcapOnPacketArrival);
device.PcapOpen(true, 1000);
device.PcapCapture(SharpPcap.INFINITE);
device.PcapStopCapture();
device.PcapClose();

(Packet Arrival Event Handler)

2008-11-30T02:26:00.007+05:00

and this code actually breaks up the Yahoo Messenger Packet into bytes and then bytes are decoded to human understandable information ...

device_PcapOnPacketArrival Event

(This Event is called regularly, whenever any packet arrives at or goes out of your network device )

running the Program after you Download from here, just run and you will watch the Console Window Showing the Yahoo Sender's ID Reciever's ID and IP Address of both participants and The Messages Send or Received.

Welcome to techbreeds blogspot

2008-11-07T00:48:00.004+05:00

Why Techbreeds

As understood to every body, breeding is to propagation, for us breeding comes side by side to technology, so we think to propagate the knowledge of Information Technology thorough using the resources of IT. For programmers and IT Professionals we would rate technology breeding as highest value.

What is Techbreeds

Techbreeds is about free programming material and programming tutorials for programmers and IT professionals, on this blog you will find many helpful and easy learning projects by different IT professionals. We will really appreciate those friends and IT professionals who send there Stuff on this blog that they think, may help other professionals and specially beneficial for students.

How TechBreeding goes

Well, through your feedback of course your posts and comments, and the helping material that you wish that the people would know about in the field of programming for publication on this blog.
continue>>