–Advanced Windows Debugging

CComVariant bstrTarget;
CComBSTR strSource("test");

// Use CComBSTR::Copy to make a copy
// of the source string.
bstrTarget.bstrVal = strSource.Copy();

If you don’t make a copy of the source string, it will wind up being freed twice—once by the CComVariant‘s destructor, and once by the original CComBSTR‘s destructor. 

Daniel Plakosh, Software Engineering Institute [vita]

Copyright © 2005 Pearson Education, Inc.

The strncpy() and strncat() functions are a source of buffer overflow vulnerabilities. The strncpy_s() and strncat_s() functions are defined in ISO/IEC TR 24731 as drop-in replacements for strncpy() and strncat().

Development Context

Copying and concatenating character strings

Technology Context

C, UNIX, Win32

Attacks

Attacker executes arbitrary code on machine with permissions of compromised process or changes the behavior of the program.

Risk

The strncpy() and strncat() functions are a source of buffer overflow vulnerabilities.

Description

ISO/IEC TR 24731 specifies the strncpy_s() and strncat_s() functions as close replacements for strncpy() and strncat().

The strncpy_s() function copies not more than a specified number of successive characters (characters that follow a null character are not copied) from a source string to a destination character array. If no null character was copied, then the last character of the destination character array is set to a null character.

The strncpy_s() function returns zero to indicate success. If the input arguments are invalid, strncpy_s() returns a nonzero value and sets the destination string to the null string. Input validation fails if either the source or destination pointers are NULL or if the maximum size of the destination string is zero or greater than RSIZE_MAX. The input is also considered invalid when the specified number of characters to be copied exceeds RSIZE_MAX.

A strncpy_s() operation can actually succeed when the number of characters specified to be copied exceeds the maximum length of the destination string as long as the actual source string is shorter than the maximum length of the destination string. If the number of characters to copy is greater than or equal to the maximum size of the destination string and the source string is longer than the destination buffer, the operation will fail.

Figure 1. Sample use of strncpy_s() function

1. char src1[100] = "hello";
2. char src2[7] = {'g','o','o','d','b','y','e'};
3. char dst1[6], dst2[5], dst3[5];
4. int r1, r2, r3;
5. r1 = strncpy_s(dst1, 6, src1, 100);
6. r2 = strncpy_s(dst2, 5, src2, 7);
7. r3 = strncpy_s(dst3, 5, src2, 4);

Users of these functions are less likely to introduce a security flaw because the size of the destination buffer and the maximum number of characters to append must be specified. The strncat_s() function also ensures null termination of the destination string. For example, the first call to strncpy_s() on line 5 of the sample program shown in Figure 1 assigns the value zero to r1 and the sequence hello to dst1. The second call on line 6 assigns a non-zero value to r2 and the sequence to dst2. The third call on line 7 assigns the value zero to r3 and the sequence good to dst3. If strncpy() had been used instead of strncpy_s(), a buffer overflow would have occurred during the execution of line 6.

The strncat_s() function appends not more than a specified number of successive characters (characters that follow a null character are not copied) from a source string to a destination character array. The initial character from the source string overwrites the null character at the end of the destination array. If no null character was copied from the source string, then a null character is written at the end of the appended string.

The strncat_s() function fails and returns a nonzero value if either the source or destination pointers are NULL or if the maximum length of the destination buffer is equal to zero or greater than RSIZE_MAX. The function also fails when the destination string is already full or if there is not enough room to fully append the source string.

The strncpy_s() and strncat_s() functions are still capable of overflowing a buffer if the maximum length of the destination buffer and number of characters to copy are incorrectly specified.

References

It’s a frequent task to make a case insensitive search for a string into another string. I believe everyone is able to write code that does this. And I am sure everyone did this many times I don’t want to bring up here a discussion about code reusability and the benefits of having functions to handle one task instead of pasting same code locally wherever it is needed. However, my experience with programs written by professional developers led me to implement case insensitive search with the same interface as strstr() and post it here, so that everyone can take it and put it to their utility library.

I am including two different ways how to do the case insensitive search. They show the classical memory/speed trade-off. I have the feeling that the reason why case insensitive search function is not included in the runtime library is because there’s no solution which is clearly better than all others. The first technique allocates memory for copies of both strings, but it is significantly more time efficient for large strings. The other way has no memory overhead, but takes more CPU time. I didn’t compare performance for small strings, where I expect the efficiency to be pretty much the same. If anyone wants to investigate, please post your results.

The second implementation has the additional benefit that it is possible to specify a substring of the first string that will be searched.

I wrote the functions as C++ templates, but they can be converted to C functions very easily.

A. stristr – makes internal copies, converts to lower case and uses strstr

#include <string.h>
#include <malloc.h>
#include <tchar.h>

template <typename CHAR_TYPE>
CHAR_TYPE *stristr
(
   CHAR_TYPE         *  szStringToBeSearched,
   const CHAR_TYPE   *  szSubstringToSearchFor
)
{
   CHAR_TYPE   *  pPos = NULL;
   CHAR_TYPE   *  szCopy1 = NULL;
   CHAR_TYPE   *  szCopy2 = NULL;

   // verify parameters
   if ( szStringToBeSearched == NULL ||
        szSubstringToSearchFor == NULL )
   {
      return szStringToBeSearched;
   }

   // empty substring - return input (consistent with strstr)
   if ( _tcslen(szSubstringToSearchFor) == 0 ) {
      return szStringToBeSearched;
   }

   szCopy1 = _tcslwr(_tcsdup(szStringToBeSearched));
   szCopy2 = _tcslwr(_tcsdup(szSubstringToSearchFor));

   if ( szCopy1 == NULL || szCopy2 == NULL  ) {
      // another option is to raise an exception here
      free((void*)szCopy1);
      free((void*)szCopy2);
      return NULL;
   }

   pPos = strstr(szCopy1, szCopy2);

   if ( pPos != NULL ) {
      // map to the original string
      pPos = szStringToBeSearched + (pPos - szCopy1);
   }

   free((void*)szCopy1);
   free((void*)szCopy2);

   return pPos;
} // stristr(...)

B. strnistr – uses strnicmp in a loop, and may search in a substring of the searched string

#include <string.h>
#include <malloc.h>
#include <tchar.h>

template <typename CHAR_TYPE>
CHAR_TYPE *strnistr
(
   CHAR_TYPE         *  szStringToBeSearched,
   const CHAR_TYPE   *  szSubstringToSearchFor,
   const int            nStringLen = -1
)
{
   int            nLen;
   int            nOffset;
   int            nMaxOffset;
   CHAR_TYPE   *  pPos;
   int            nStringLenInt;

   // verify parameters
   if ( szStringToBeSearched == NULL ||
        szSubstringToSearchFor == NULL )
   {
      return szStringToBeSearched;
   }

   // get length of the substring
   nLen = _tcslen(szSubstringToSearchFor);

   // empty substring-return input (consistent w/ strstr)
   if ( nLen == 0 ) {
      return szStringToBeSearched;
   }

   if ( nStringLen == -1 || nStringLen >
               (int)_tcslen(szStringToBeSearched) )
   {
      nStringLenInt = _tcslen(szStringToBeSearched);
   } else {
      nStringLenInt = nStringLen;
   }

   nMaxOffset = nStringLenInt - nLen;

   pPos = szStringToBeSearched;

   for ( nOffset = 0; nOffset <= nMaxOffset; nOffset++ ) {

      if ( _tcsnicmp(pPos, szSubstringToSearchFor, nLen) == 0 ) {
         return pPos;
      }
      // move on to the next character
      pPos++; //_tcsinc was causing problems  
   }

   return NULL;
} // strnistr(...)

Here’s a fragment of code I used to compare the performance of the functions:

{
   int      i;
   char     x1[3 * 100000];
   char     x2[3 * 10000];

   for ( i = 0; i < sizeof(x1); i++ ) x1[i] = 'A'+ (i % 3);
   for ( i = 0; i < sizeof(x2); i++ ) x2[i] = 'a'+ (i % 3);
   x1[sizeof(x1) - 2] = x2[sizeof(x2) - 2] = 'y';
   x1[sizeof(x1) - 1] = x2[sizeof(x2) - 1] = 0;
   // use a profiler to compare
   printf("%p\n", stristr(x1, x2));
   printf("%p\n", strnistr(x1, x2));
}
zz from http://www.codeguru.com/cpp/cpp/string/article.php/c5641/

•Published: Feb 06, 2007
•Updated: Feb 27, 2007
•Section: Management & Administration
•Author: Anderson Patricio
Printable Version
Adjust font size:
•Rating: 4.6/5 – 38 Votes

1
2
3
4
5

If you would like to read the next part in this article series please go to Managing mailboxes in Exchange Server 2007 (Part 2).

Overview
In this article, we are going to approach a simple but important subject: the mailbox user management for Exchange Server 2007.

It may seem a simple issue to discuss, but we will see some advanced points related to user management tasks in order to assist beginners and advanced administrators. This article will be split into two parts; in this first part we will review mailbox management and user level functionalities.

Creating a mailbox using the Exchange Management Console
This procedure is the starting point of this article. Exchange Server 2007 allows administrators to create objects such as Mailboxes, Contacts, Mail Users, and Distribution Groups. In the following steps we will see how to create a mailbox object:

1.Open Exchange Management Console
2.Expand Recipient Configuration
3.Click on Mailbox
4.In the Mailbox pane, click on New Mailbox… (Figure 01)

Figure 01: Creating a new user in the Exchange Management Console

5.Introduction. We have to choose what kind of object we are creating, in Exchange Server 2007 we have four different mailbox types:

- User mailbox: This is a traditional mailbox.

- Resource mailbox: This is a mailbox specifically assigned to Meeting Rooms. Its associated user account will be disabled in Active Directory.

- Equipment mailbox: This is a mailbox specific to resources, (i.e. TV, Projector and so on). As with a Resource mailbox, this kind of mailbox will disable a user in Active Directory.

- Linked Mailbox: This kind of mailbox will be used in environments with multiple forests. This specific feature will be explained in a later article on MSExchange.org.

In the Introduction window, select the appropriate mailbox type and then click Next to continue. (Figure 02).

Figure 02: Choosing what kind of mailbox will be created

6.User Type. In the User Type window, we can choose either to create a new user or to assign an existing user to the new mailbox. If we choose to assign it to an existing user, we will have to check if the account does not already have a mailbox associated with it. Click Next to continue (Figure 03).

Figure 03: Creating a new user for a new mailbox

7.User Information. In the User Information window, we should fill out the personal information of the user and select the Organization Unit where it will be created. After that click on Next (Figure 04).

Figure 04: Filling out the personal user data and OU localization

8.Mailbox Settings. On the Mailbox Settings page, we can define the mailbox information such as Alias, Mailbox Server, and Mailbox Store where the new mailbox will be located. The policies for Mailbox and ActiveSync can also be defined in this step. We can choose which fields we are going to fill out and then click Next to continue. (Figure 05).

Figure 05: Choosing Server, Storage Group, Mailbox database and policies during the mailbox creation process

9.New Mailbox. In the New Mailbox window, we will get a summary of all the information that we selected in the previous steps. These parameters will be used by the PowerShell engine for the creation of this mailbox object. To create the mailbox, click on New (Figure 06).

Figure 06: The parameters that will be used in the creation of the new mailbox

10.Completion. In the Completion window, we will see the cmdlet New-mailbox and the parameters that we used in the creation process of this new mailbox.

Figure 07: The final screen of the New Mailbox Wizard, showing us the cmdlet used in the creation of the mailbox

Creating a mailbox through Exchange Management Shell
Another way to create users is by using the Exchange Management Shell. To do this, we can use a cmdlet called New-Mailbox. There are many parameters associated with this commandlet, and the required parameters for the cmdlet are the following:

•Alias
•Name
•Database
•OrganizationalUnit
•UserPrincipalName
To create a user using Exchange Management Shell, we can run the following cmdlet:

New-Mailbox –alias -name -Database -OrganizationUnit Users –UserPrincipalName

If we do not type all the required parameters, we will get a prompt asking for the parameters that are missing. In Figure 08, we can see that we have received the password prompt to fill out the password. After the password was entered, the user was created.

Figure 08: Creating a mailbox through the cmdlet New-Mailbox in the Exchange Management Console

Using *.csv files to create mailboxes
Another interesting feature is the one that lets an administrator create several users from a *.csv file. In the following section, we will review a step by step procedure to create mailboxes:

1.First of all, we will have to create a *.csv file called recipients.csv on the root drive (C:\) and we will type the column names for the file in the first line. Those columns will be the Alias, the Name and UPN. in the following lines we will complete the user information (Figure 09).

Figure 09: Creating a csv file to be used in the creation of users through Exchange Management Shell

2.Once the user information is complete, we will have to create a variable in the Exchange Management Shell that will keep the initial password for all of the accounts on the recipients.csv file. To do so, we will type the following:

$Password = Read-Host “Type the default password for the new accounts:” -AsSecureString

Figure 10: Creating a variable to keep the initial password on the new accounts

3.In the following step, we will run two cmdlets using a pipe to create the new users using the *.csv file. This is the syntax of our cmdlet:

Import-Csv recipients.csv | foreach { New-Mailbox –alias $_.Alias –name $_.Name –UserPrincipalName $_.UPN –Database “mailbox database” –OrganizationalUnit Users –Password $Password –ResetPasswordOnNextLogon:$true
The options are explained here:

•$_.: This is the name of each column of the recipients.csv file.
•Foreach: For each line of the file; Note: the first line is the header.
•$Password: variable that we just typed in the previous step.
•-ResetPasswordOnNextLogon:$true: If we set this parameter to true, all the users will have to change their password on the first logon.

Figure 11: Creating users through a *.csv file

4.To check if the users were created, we will go to the Exchange Management Console (Figure 12).

Figure 12: The new users created through the csv file

Managing Mailbox Features
We can manage functionalities at the user level, enabling or disabling the following features:

•OWA
•Exchange ActiveSync
•Unified Messaging
•MAPI access.
This task can be completed in two different ways, both will be detailed in the following sections:

Using the Exchange Management Console

1.Open Exchange Management Console
2.Expand Recipient Configuration
3.Click on Mailbox
4.Click on the user and in Toolbox Actions, click on Properties
5.Click on Mailbox Features tab
6.Now we can see all the mailbox features of the user and we can disable or enable each functionality

Figure 13: Managing Mailbox Features at user level

Listing all the users and their features…

In some cases, we have to verify the functionalities that users have, and there is no way to do this user by user. In Exchange Server 2007, this task is very easy, and can be done with a cmdlet called get-casmailbox (figure 14).

Using this cmdlet, we can export the results to a *.csv file and analyze it in Microsoft Excel and generate reports or analyze it any way we want.

Figure 14: All the users with their functionalities through Exchange Management Shell

Using Exchange Management Shell to change user features
To manage features using the Exchange Management Shell, we can use the cmdlet called set-casmailbox, as follows:

Set-casmailbox -OWAEnabled:

Where: is the user name; can be $true or $false

To show you the real impact of the use of the Exchange Management Shell, here is an example.

Scenario: We have a company with fifty (50) branch offices and we have to disable MAPI access for all users in Toronto.

How can we do this with the least administrative work?

First of all, we must insure that all the Active Directory information is consistent. In our scenario, all of the users have the attributes City and StateorProvince filled out correctly. One example of this is shown in the Figure 15 through cmdlets get-user | select name, recipientType, City, StateorProvince

Figure 15: Verifying the attributes City, StateorProvince of all the users

If all of the Active Directory information is consistent, we can use the pipe resource on the Windows PowerShell where an output from one command is used as input for another cmdlet.

We will need some specific user attributes that we cannot get through get-mailbox because this cmdlet only returns mailbox information. We will have to use the get-user cmdlet to filter the city attribute from users and combine these results with the set-casmailbox cmdlet.

To resolve this, we can use this subset of cmdlets, as is shown in figure 16.

Get-User | Where-Object { $_.City –eq “Toronto”} | Set-CasMailbox –OWAEnabled:$false

Figure 16: Disabling OWA access of all of the users located in Toronto city and Ontario State, and after that a list of the new user features

Now, let’s check if everything worked as expected. None of the users who had the OWA feature set as disabled will be able to access their mailboxes through Outlook Web Access. We can test it, trying to see if the user Anderson.Patricio can access his mailbox with Outlook Web Access. We can see that everything worked as shown in the next figure (Figure 17).

Figure 17: After authentication, the user receives the message that OWA is disabled

Conclusion
We have reviewed the steps required to create users (in the traditional way) by using the Exchange Management Console. Then, we reviewed similar tasks using the flexibility of the Exchange Management Shell to help us to create one or more users through commandlets. At the end of this article, we discussed how to manage some mailbox features at user level.

I received a question today about the Multipart-MIME examples in my Serving Word presentation. The question is, “What are all those ‘3D’ letters and how can I make Word documents without them?”

The 3D is related to encodings. The most common encoding mechanism for text in a Multipart-MIME message in called Quoted-Printable encoding. In this encoding mechanism most standard symbols, numbers, and letters are left exactly as is. All other characters are encoded using an equal sign followed by the two-digit hexidecimal code for the character. For example, a tab can be encoded as “=09″ since a tab is represented by 09.

Since the equal sign is used to indicate encodings, the equal sign itself must also be encoded whenver it’s encoutered. The equal sign is represented by decimal 61 or hexidecimal 3D, and thus is shown as “=3D” in a quoted-printable encoded message.

So, whenever you encode an HTML document, which has a lot of equals signs in it, in quoted-printable format, you’re going to have a lot of “=3D” sequences in the resulting document.

Only a developer will see these, the target application which reads the quoted-printable message will convert them back to regular equal signs, so a user will never see them.

So in short, don’t worry about it, =3D is normal and user’s won’t see it.

http://rewindlife.com/2003/12/08/whats-all-that-3d-stuff-in-my-mime-message/
]]> http://natex.wordpress.com/2008/11/16/what%e2%80%99s-all-that-3d-stuff-in-my-mime-message/feed/ 0 natex http://natex.wordpress.com/2008/10/26/cdo-121-meeting-item-respond-on-master-recurring-appointment-returns-mapi_e_not_found/ http://natex.wordpress.com/2008/10/26/cdo-121-meeting-item-respond-on-master-recurring-appointment-returns-mapi_e_not_found/#comments Sun, 26 Oct 2008 06:11:36 +0000 natex http://natex.wordpress.com/?p=19 ]]> http://www.netomatix.com/articles/KBArticle.aspx?a=921548

The help file that comes with the WinDbg installation documents commands well, but the following basic commands should get you started:

Note:

1. There is no “step out” (Shift+F11). You have to find the return address on the stack manually and use “g adr”. You can find this address by using “k”. If you know the function uses ebp frames you can use “g poi(ebp+4)” to step out.
2. To inspect local variables:
   1. Use the “dv” command.
   2. Then use the “dt <variablename>” command.
   3. Note: you may not see correct values if values are stored in registers or due to FPO.

More Commands

Handy Extension Commands

• !help – help for WinDbg extension commands.
• !load, !unload – to load and unload debugger extension DLLs.
• !handle – displays information about handles owned by processes.
• !peb – shows the PEB (process environment block) including DLL information.

from: http://www.codeproject.com/KB/debug/windbg_part1.aspx
Another reference: http://www.software.rkuster.com/windbg/cmd.htm

Win-Space: Show sidebar

Win-D: Show desktop

Win-Tab: Flip 3D

Ctrl Win-Tab: Flip 3D which stays onto desktop, you can then scroll with up, down, left and right keys

Win-E: Opens explorer window

Win-R: Opens the run dialogue box, yes it still exists

Win-T: Tabs between running applications onto the taskbar, you know like you would hover over each task with the mouse and get a live preview of the app’s.

Win-Q: When I tried this one out it launches the Office communicator for me, how does this behave for you?

Win-F: Opens the search window.

Win-G: Gives the sidebar the focus and when you press this key combination again it tabs between the gadgets on the sidebar

Win-L: Locks the computer, I use this a lot just quickly lock the PC when you go grab a cup of coffee.

Win-U: Opens the Ease of Access Center

Win-M: Minimizes all windows

Shift Win-M: Undo minimize windows

Win-X: Opens the Windows Mobility center

Win-Number: Press the Win key and then choose a number of the applications that are in the quick launch task bar. An example the third icon on the taskbar (starting from left) is IE so to run IE press Win-3 and it will launch IE.

Another shortcut of key combination I use often is the ctrl-shift-esc to open the Task Manager

Which shortcuts are you using?