Network And Security

January 22, 2024/in Uncategorized /by Daniel Jennings

Project: Malware Analysis CS 6262 Project 3

Agenda

• Part 1: Analyzing Windows Malware

• Part 2: Analyzing Android Malware

Scenario

• Analyzing Windows Malware • You got a malware sample from the wild. Your task is to discover what

malware does by analyzing it

• How do you discover the malware’s behaviors? • Static Analysis

• Manual Reverse Engineering

• Programming binary analysis

• Dynamic Analysis • Network behavioral tracing

• Run-time system behavioral tracing(File/Process/Thread/Registry)

• Symbolic Execution

• Fuzzing

Scenario

• In our scenario, you are going to analyze the given malware with tools that we provide.

• The tools help you to analyze the malware with static and dynamic analysis.

• Objective 1. Find which server controls the malware (the command and control (C2)

server) 2. Discover how the malware communicates with the command and control

(C2) server • URL and Payload

3. Discover what activities are done by the malware payload • Attack Activities

Scenario

• Requirement • Make sure that no malware traffic goes out from the virtual machine

• But, updating of malware (stage 2), and downloading payload (stage 3) are required to be allowed (set as default option)

• The command and control server is dead. You need to reconstruct it • Use tools to reconstruct the server, then reveal hidden behaviors of the malware

• Analyze network traffic on the host, and figure out the list of available commands for the malware

• Analyze network traffic trace of the host, and figure out what malware does • Write down your answer into assignment-questionnaire.txt

Project Structure

• A Virtual Machine for Malware analysis • Please download and install the latest version or update your virtual box.

• https://www.virtualbox.org/wiki/Downloads

• Download the VM • Download links

• http://ironhide.gtisc.gatech.edu/vm_2018.7z

• http://bombshell.gtisc.gatech.edu/vm_2018.7z

• Verify the md5 hash of the 7z file: 537e70c4cb4662d3e3b46af5d8223fd

• Please install 7zip or p7zip • Windows, Linux and MacOs: http://www.7-zip.org/download.html

• Unarchive the 7z file • Password: GTVM!

https://www.virtualbox.org/wiki/Downloads

http://ironhide.gtisc.gatech.edu/vm_2018.7z

http://bombshell.gtisc.gatech.edu/vm_2018.7z

http://www.7-zip.org/download.html

Project Structure

• Open VirtualBox • Go to File->Import Appliance.

• Select the ova file and import it.

• For detailed information on how to import the VM, see: • https://docs.oracle.com/cd/E26217_01/E26796/html/qs-import-vm.html

• VM user credentials • Username: analysis

• Password: analysis

https://docs.oracle.com/cd/E26217_01/E26796/html/qs-import-vm.html

Project Structure

• In the Virtual Machine (VM) • Files

• init.py • This initializes the project environment

• Type your Georgia Tech username (same login name as Canvas) after running this

• update.sh • This script updates the VM if any further update has been made by TA

• DO NOT execute the script unless TAs ask you to execute.

• archive.sh • This will archive the answer sheet for submission (create a zip file)

Project Structure

• In the Virtual Machine (VM) • Directories

• vm • A directory that stores Windows XP virtual machine (runs with QEMU) • We use the given VM for both Cuckoo and a testbed. Please see page 17.

• shared • A shared directory between Ubuntu and Windows machine. You can put/copy the file in/from

this directory. • Please see page 22.

• report • The answer sheet for project questionnaire.

• setup • Required files for setting up the machine. You don’t need to modify, nor use the files in this

directory.

Project Structure

• In the Virtual Machine (VM) • Directories

• tools • network

• Configure your network firewall rules (iptables) by editing iptables-rules.

• You can allow/disallow/redirect the traffic from the malware

• ‘./reset’ command in this directory will apply the changes

• cfg-generation (CFG stands for Control-Flow Graph)

• An analysis tool that helps you to find interesting function of malicious activity

• You need to edit score.h to generate the control-flow graph

• Use xdot to open the generated CFG.

Project Structure

• In the Virtual Machine (VM) • Directories

• tools • sym-exec

• A symbolic executor (based on angr: https://github.com/angr)

• Helps you to figure out the commands that malware expects

• Use cfg-generation tool to figure out the address of the function of interests

• c2-command

• A simplified tool for C2 server reconstruction

• You can write down command in the *.txt file as a line

• In the default settings, it will randomly send a command in the line

https://github.com/angr)

Project Structure

• Network Configurations

Ubuntu Windows (QEMU)

Malware

tap0 (vif)

br0 (network bridge)

enp0s3 (NAT Network)

Analysis tools Fake servers

iptables

The Internet

C2 server Fake targets

Project Structure

• Network Configurations • tap0

• Virtual network interface for Windows XP • IP Address: 192.168.133.101

• br0 • A network bridge between Windows XP and Ubuntu

• IP Address: 192.168.133.1

• enp0s3 • A network that faces the Internet

• IP Address: 10.0.2.15 (it varies by your VirtualBox settings)

Project Structure

• Malware • stage1.exe – stage 1 malware

• It will be updated into stage 2 malware if the malware receives the correct command

• stage2.exe – stage 2 malware • It will download the payload

• payload.exe – the malware attack payload • Please discover that what payload is doing on the command from C&C

Questionnaire • 1) To get your credit for the project, you have to answer the questionnaire

on ~/report/assignment-questionnaire.txt !!!!! • 2) Please strictly follow the format or the example answer on each

question on assignment-questionnaire.txt. TAs use a autograder for your submit.

• Windows Part • Read ~/report/assignment-questionnaire.txt • Read carefully the questionnaire, and answer them on ~/report/assignment-

questionnaire.txt • For each stage, there are 4~6 questionnaire that inquires regarding the behavior of

the malware.

• Android Part • READ ~/Android/MaliciousMessenger/writeup.pdf • Read carefully the writeup, answer on on ~/report/assignment-questionnaire.txt

Submitting Questionnaire

• Required files • Zip the following files and upload to T-Square

• Run ~/archive.sh will automatically zip the whole files • ~/report/assignment-questionnaire.txt

• Stage1.exe, stage2.exe, payload.exe

• ~/tools/network/iptables_rules

• ~/tools/cfg-generation/score.h

• Running ~/archive.sh will create report.zip automatically • Please check the content of zip file before submitting it to T-square

Tutorial (for stage1.exe malware)

• Initializing the project • Open the terminal (Ctrl-Alt-T, or choose terminal from the menu)

• Run ./init.py • Type your Georgia Tech username (the login name used for Canvas)

• This will download stage1 malware (stage1.exe) into ~/shared directory

Tutorial – Secure Experiment Environment

• We need a secure experiment environment to execute the malware. • Why?

• Insecure analysis environment could damage your system • You may not want:

• Encrypting your file during a ransomware analysis • Infecting machines in your corporate network during a worm analysis • Creating a tons of infected bot client in your network during a bot/trojan analysis

• The solution: • Contain malware in a virtual environment

• Virtual Machine • Virtual Network

• Conservative rules(allow network traffic only if it is secure)

• We provide a Win XP VM as a testbed!

Tutorial – Run Win XP VM • Run Windows XP Virtual Machine with virt-manager

• Open a terminal

• Type “virt-manager” and double click “winxpsp3”

• Click the icon with the two monitors and click on “basecamp”

• Run Windows XP Virtual Machine with virt-manager • Right click on basecamp, and click “Start snapshot.” Click Yes if prompted.

• Once, virt-manager successfully calls the snapshot, click Show the graphical console. • Click on the Windows Start Menu and Turn off Computer.

• Then select Restart

Tutorial – Run Win XP VM

• DO NOT MODIFY OR DELETE THE GIVEN SNAPSHOTS!

• The given snapshots are your backups for your analysis.

• If something bad happens on your testbed, always revert back to the basecamp snapshot.

Tutorial – Run Win XP VM

Tutorial – Copy from Shared Directory

• Go to shared directory by clicking icon (in Windows XP) • Copy stage1.exe into Desktop

Tutorial – Run the malware!

• Now we will run the malware • Execute stage1.exe (double click the icon)

• It will say “Executing Stage 1 Malware”. Then, click OK. • You should click OK on each dialog to dismiss it

• Otherwise, malware execution will be blocked

Tutorial – Run the malware!

• If you want halt the running malware. • Execute stop_malware in temp directory at Desktop.

• Then it will quit the current running malware.

• Please halt first before you execute another malwares.

Tutorial – Network behavioral analysis

• To analyze network behaviors, you need • Wireshark (https://www.wireshark.org/)

• Network Protocol Analyzer

• Cuckoo (https://cuckoosandbox.org/) • Capturing & Recording inbound/outbound network packets

https://www.wireshark.org/)

https://cuckoosandbox.org/)

Tutorial – Observing Network Behavior

• By capturing and recording network packets through the tools, • Reveal C&C protocol

• Attack Source & Destination

• But, malware will not do anything. Why? • The C2 server is dead!

• Therefore, the malware(C2 client) will never unfold its behaviors.

• Question? • If we know C&C dialog of malware, can we build a fake C2 server in order to unfold the

malware behaviors?

• Answer: Hack Yeah! That is your job for this project!

Tutorial – Wireshark

• Let’s check it through network monitoring • Open wireshark (open a terminal. Type “sudo wireshark“ – you can ignore the

error message that pops up)

• Choose br0 to capture the network traffic

• Then start capture by clicking on the shark-fin on the top left

Tutorial – Redirect Network Connection

• Redirecting Network Connection • From WireShark, we can notice that the malware tries to connect to the host

at 128.61.240.66, but it fails

• Let’s make it to be redirected to our fake C2 server • Goto ~/tools/network

• Edit iptables_rules to redirect the traffic to 128.61.240.66 to 192.168.133.1 (fake host)

• Whenever you edit iptables_rules, always do reset. (~/tools/network/reset)

Tutorial – Reading C2 Traffic

• Observing C2 traffic • In the WireShark, we can notice that now the malware can communicate with

our fake C2 • But there will not be further execution, because the command is wrong..

Tutorial – Reading C2 Traffic

• Observing C2 traffic • You can see the contents of the traffic by right-clicking on the line, then click

Follow – TCP Stream

Tutorial – Cuckoo • Let’s use cuckoo this time.

• NOTE! You can’t run the testbed vm and cuckoo simultaneously.

• Always turn off the testbed vm, and follow the steps below to execute Cuckoo

• Open two terminals. • $workon cuckoo #Set virtualenv as cuckoo for both terminal1 and terminal2

• $cuckoo –d #To run cuckoo daemon for terminal1

• $cuckoo web #To run cuckoo webserver for terminal2 If you get an error when running cuckoo web because port 8000 is already in use, run “sudo fuser -k 8000/tcp” and try again

Tutorial – Cuckoo

• The given Cuckoo uses the snapshot of the given testbed VM.

• The snapshot is 1501466914

• DO NOT TOUCH the snapshot!

• When you want to use the testVM back, • Always follow the page 21.

Tutorial – Upload a file to Cuckoo

• To open cuckoo webserver, type the following URL into Chromium • http://localhost:8000

• To upload a file, click the redbox and choose a file.

Tutorial – Analysis on Cuckoo

• Once you click the analyze button, will take some time to run the malware.

Tutorial – Analysis on Cuckoo

• Once the pending job is done, You are ready to see the result

• Click the redbox

Tutorial – Analysis on Cuckoo(File Info)

Tutorial – Analysis on Cuckoo(Network Info)

• After redirecting, the result of cuckoo shows high-level information

• Observing the C2 traffic.

• Please compare this result with your Wireshark’s result.

Tutorial – Analysis on Cuckoo(Network Info)

• In network analysis tab, cuckoo provides more detailed info: payload, HTTPs, etc.

Tutorial – Figuring Out the List of Commands

• The malware does not exhibit its behavior because we did not send the correct command through our fake C2 server

• We will use • File/Registry/Process tracing analysis to guess the malware behavior. • control-flow graph (CFG) analysis and symbolic execution to figure out the list of the

correct commands

• The purpose of tracing analysis is to draw a big picture of the malware • What kinds of System call/API the malware use? • Does the malware create/read/write a file? How about registry?

• The purpose of CFG analysis is to find the exact logic that involves the interpretation of the command and the execution of malicious behavior

• Then, symbolic execution finds the command that drives the malware into that execution path

Tutorial – Tracing Analysis on Cuckoo

• On the side bar, there are useful menus for tracing analysis. • We are focusing on:

• Static Analysis • API/System Call.

• Behavioral Analysis • Trace behaviors in time sequence.

Tutorial – Static Analysis on Cuckoo

• Static Analysis • Information of the malware. • Win32 PE format information

• Windows binary use PE format • Complicated structure • Sections shows that

• .text

• Strings, etc. • .data

• .idata

• .reloc • Virtual link, dynamic link, etc.

• More ref: http://resources.infosecinstitute.com/2-malware-researchers-handbook-demystifying-pe-file/#gref

http://resources.infosecinstitute.com/2-malware-researchers-handbook-demystifying-pe-file/#gref

Tutorial – Static Analysis on Cuckoo

• Interestingly three DLL(Dynamic Link Libaries) files are imported.

• In WININET.dll, we can see the malware use http protocol.

• In ADVAPI32.dll, we can check the malware touch registry files

• In Kernel32.dll, we can check the malware waiting signal, also sleep.

Tutorial – Behavior Analysis on Cuckoo

• Tracing a behavior(file/process/thread/registry/network) in time sequence.

• Useful to figure out cause-and-effect in process/file/network.

• Malware create a new file and run the process, write the process on memory.

Tutorial – Analysis result on Cuckoo

• Based on the analysis of Cuckoo, We can sniff • The malware uses HTTP protocol to communicate

• Communicate with whom? C&C?

• Web server access? For checking alive C2 server?

• Commands through http protocol? Cookie?

• The malware touches(create/write/read) a file/registry/process • This might be a dropper? Or Download a binary from the C2 server?

• What is the purpose of creating process? Modifying registry?

Tutorial – Control Flow Graph Analysis

• Based on the pre-information that we collected from the previous step, we are going to perform CFG analysis & symbolic execution analysis

• CFG: • graph representation of computation and control flow in the program

• Nodes are basic blocks

• Edges represent possible flow of control from the end of one block to the beginning of the other.

Tutorial – Control Flow Graph Analysis

• CFG : An Example

• But, in malware analysis, we are analyzing CFG in instruction-level.

Tutorial – Control Flow Graph Analysis

• We provide a tool for you that helps to find command interpretation logic and the malicious logic • We list down the functions or system calls the malware uses internally • If you provide the score (how malicious it is, or how likely the malicious logic will use

such a function) for the functions, then the tool will find where the malicious logic is, by its score • Example: if you set StrCmpNIA to score 10, then the function that calls StrCmpNIA 5 times

within itself will have the score 50. • Higher score implies more functions related to the malicious activity is used with in the

function. • Your job is to write the score value per each function

• More ref: • http://www.cs.cornell.edu/courses/cs412/2008sp/lectures/lec24.pdf

http://www.cs.cornell.edu/courses/cs412/2008sp/lectures/lec24.pdf

Tutorial – Control Flow Graph Analysis

• From our network analysis, we know that the malware uses the Internet connection to 128.61.240.66

• From our cuckoo-based analysis, we know that the malware use HTTP protocol. • Let’s make the Internet related functions to have higher score

• Open score.h, and edit the score of all of the Internet related functions • The score is the value at the end (all others are set as 1)

Tutorial – Control Flow Graph Analysis

• Build control flow graph • By executing ./generate.py stage1, the tool gives you the CFG

• This finds the function with higher score • Implies that this calls high score functions on its execution

• For stage2 and payload • Use ’stage2’ and ‘payload’ as an argument respectively

• Note: your graph and its memory addresses will vary from this example • The function entry is at the address of 405190

• And, there is a function (marked as sub) of score 12 • At the address of 40525a (marked as red) • Use the block_address, not the call sub_address

• This implies that • sub_4050c0 calls some internet related functions. • We need to find the command that makes malware to

• Run from 405190 to 40525a

Tutorial – Finding Command

• Finding Command by Symbolic Execution • We want to find a command that drives malware from 405190 to 40525a

• Let’s do symbolic execution to figure that out

• What is symbolic execution? • Rather than executing the program with some input, symbolic execution treats the input

data as symbolic variable, then tries to calculate expressions for the input along the execution.

• Let’s take an example

Example – Symbolic Execution

Symbolic execution moves along the path of conditional statements, and combine all conditions until it reaches to the target function. At the end, it solves the expression to get an input that satisfies all of the conditions

• What is Symbolic Execution?

• Path explosion • Modeling statements and environments • Constraint solving

Example – Symbolic Execution

Code Example Type i, j

If i+5 < j

If i%2 == 0

If j%3 == 0

Incorrect!Correct!

i+5 < j

i+5 < j; i%2==0

i+5 < j; i%2==0; j%3 == 0

Solve the expression i = 2

j > 7, but multiple of 3 so j=9

Expressions

i=2, j=9 will lead the program to print “Correct!”

Example – Symbolic Execution

Code Example Receive command

Command == ‘launch-attack’

Command == ‘remove’

destroy_itself()

Expressions

attack()

Command == ‘launch-attack’

Command == ‘remove’

This executes attack() on command ‘launch-attack’, and destroy_itself() on ‘remove’ command

Example – Symbolic execution engine

• Symbolic Execution Engine: Klee, Angr, Mayhem, etc. • Loading a binary into the analysis program • Translating a binary into an intermediate representation (IR). • Translating that IR into a semantic representation • Performing the actual analysis with symbolic execution.

Feel free to check this for more information https://www.cs.umd.edu/~mwh/se-tutorial/symbolic-exec.pdf

https://www.cs.umd.edu/~mwh/se-tutorial/symbolic-exec.pdf

Tutorial – Finding Command on Angr

• We prepared a symbolic executor and a solver for you • Your job is to find the starting point of the function which interprets the

command, and find the end point where malware actually executes some function that does malicious operations • Use Control-flow Graph (CFG) analysis tool!

• The symbolic executor is called angr.(http://angr.io/index.html)

http://angr.io/index.html

Tutorial – Finding Command on Angr

• We prepared a symbolic executor and a solver for you • How to run?

• Go to ~/tools/sym-exec

• Run it as • ./sym-exec-on-addr [program_path] [start_address] [end_address]

• ./sym-exec-on-addr ~/shared/stage1.exe 405190 40525a

• The command will be printed at the end (if found)

Replace these with start and end addresses from your graph

Symbolic Execution – Special Note for stage2.exe

• sys-exec for stage2 takes a lot of time to resolve (up to 20 minutes) – you are welcome to modify the VM performance settings (memory, cores) based on your hardware to speed this up

• If you get a single error message, keep trying again – sym-exec will occasionally fail for stage2

• If your screen is filling up with error messages, then you have the wrong start and/or end address

Tutorial – Reconstructing C2

• After CFG analysis + symbolic execution, reconstruct the C2

Malware

Connect to C&C

Test2: $command2

Test1: $command1

Fake C&C server

Test3: $command3

Tutorial – Reconstructing C2 • The tool for helping the reconstruction of C2 server is ready on the

VM • It runs nginx and php script

• This will read ~/tools/c2-command/stage*-command.txt

• Your job is to write each command on that *.txt file • The command that leads the execution from 405190 to 40525a is “$uninstall”

• Then, type ”$uninstall” and save the file.

• Important: be sure to put the ‘$’ character before you commands, even if stage*- command.txt says that it’s optional

• The order of commands in the file does not matter – they’ll run in a random order

After that…

• If you find all commands for stage1.exe malware, the malware will download stage2.exe by updating itself.

• For stage2.exe, please follow the same step on the tutorial • Check its network access by Wireshark

• Redirect network traffic to fake host if required (if connection fails)

• Try to identify malicious function by editing score.h and cfg-generation tool

• Discover the list of commands using the symbolic execution tool

• Fill the commands in ~/tools/c2-command/stage2-command.txt

• Do the same step for payload.exe (stage3)

Tutorial – Copy to Shared Directory

• As described in page 14, you will see a malware is downloaded.

• You need to copy the malware into the Linux host to analyze. • Right-click the downloaded malware in Desktop, then click “Copy”.

• Open Shared Directory and right-click, then click “paste”

Tutorial – Copy to Shared Directory

• Back to the Linux host, open a terminal and go to “~/shared”.

• Please the following steps below.

Tips for assignment-questionnaire.txt

• Complete the questionnaire as you go; try to avoid backtracking as this wastes time

• The URL example in the questionnaire is “http://scouter.cc.gatech.edu/a/b/c”, but some URLs may not include the path (a/b/c) – this is fine, just be sure to include the path in your answer for the URLs that include it

• The grading script will ignore “http://”, “https://” and “www.” for your convenience, but try to be thorough and match what you see exactly

• Commands and memory addresses are NOT case sensitive, but be sure you don’t mix up 0 (zero) and O – the zero should have a dot in it in the VM

Tips

• Getting the domain name from an IP address (if packet is encrypted) • Use nslookup (IP -> domain, and domain name -> IP vice versa)

Tips

• Getting the exact domain name from an IP address • Let fake connection can happen (redirect to 192.168.133.1)

• Then look at the TCP stream data

• HTTP header will give the answer • Host: netscan.gtisc.gatech.edu

Tips

• Getting the process name of the malware • Use taskmgr in Windows

• Start menu -> run -> taskmgr; or, press Ctrl-Shift-Esc on Windows.

• Click on the ‘Processes’ tab to see the list of processes

• Or use cuckoo in behavior analysis

Tips

• Getting the process name of the malware and the registery key that created by the malware • Use the given Procmon in ProcessMonitor at the testbed VM

Tips

• If the malware does not run • E.g., not displaying the dialog box with “Starting Stage X malware” on start

• Try to run stop_malware on the desktop • This will stop all malware activity, and you can run in the clean state

Tips

• Click OK to proceed malware execution • Currently, the dialog is set to block the execution of the malware

• Click OK whenever this dialog pops-up from the malware • Otherwise, the malware will not execute further to show their behavior

Tips

• Iptables rules • Edit ~/tools/network/iptables_rules

• Make sure you have no error on writing rules

• Make sure you execute ./reset on that directory • This command will update the current iptables rules…

• NAT Redirect Syntax • iptables -t nat -A PREROUTING -p tcp -s [source-ip-address] -d [destination-ip-address] —

dport 80 -j DNAT –to 192.168.133.1:80 • Insert the rule in the PREROUTING table of NAT,

• And if the protocol is tcp, source ip is matched with [source-ip-address],

• Destination IP is matched with [destination-ip-address], and destination port is 80

• Then redirect this traffic to 192.168.133.1, port 80.

Advanced Tips

• For those of you who is interested in Reverse Engineering, this slides covers a fundamental material that you need to study.

• Dissembler/Debugger • IDA Pro, binary ninja, radare2, x64 dbg, GDB, immunity debugger, etc.

• Packer/Obfuscation • Ether, VMIUnpacker, xorunpacker, etc.

• PE/ELF binary format

• Memory snapshot.

• More.

Advanced Tips

• Most malware are packed or obfuscated by a known/unknown packer or obfuscator.

• For Win32 binary, by checking PE32 format, we can check whether binary is packed.

• For obfuscation, we need to usually reverse engineer whether to check the binary is obfuscated.

Advanced Tips

• Assembly code & OS architecture • X86, x86-64, arm64, etc.

• Stack, heap, canary, guardian, etc.

• An example:

Advanced Tips

• Anti debugging/Anti VM techniques • Malware is becoming more advanced.

• Malware authors knows: • Malware analyst use debugging/disassembler tool

• Malware analyst use VM environment

• Malware authors embedded evasion of debugging software and VM environment. • Detection software/hardware breakpoint

• Detection memory/conditional breakpoint

• Timing/Artifact based VM detection

Android Malware Analysis

• Manifest Analysis • Identifying suspicious components

• Static Analysis • Search for C&C commands and trigger conditions

• Vet the app for any anti-analysis techniques that need to be removed.

• Dynamic analysis • Leverage the information found via static analysis to trigger the malicious

behavior.

Manifest Analysis

• Identify suspicious components • Broadcast receivers registering for suspicious actions.

• Background services

• Narrow the scope of analysis • Malicious apps are repackaged in benign apps with 1000’s of classes.

Broadcast receiver from CoinPirate’s malware family.

Static Analysis

• Search for C&C commands and trigger conditions

Static Analysis

• Identifying Anti-analysis techniques

Scenario

Analyzing Android Malware • You have received a malware sample sms.apk.

• You need to identify communication with C&C server

• Identify anti-analysis techniques being used by the app.

• Identify commands that trigger any malicious behavior.

Project Structure

• Android emulator • An emulator for Android 4.4 is pre-installed

• Run ‘run-emulator’ • This will open Android emulator.

• Jadx • Disassembles apk files into Java source code.

• Apktool • Disassembles apk file into Smali.

• Rebuilds apk files.

• Write-up (~/Android/MaliciousMessenger/writeup.pdf) • Detailed guide on how to complete the Android section of the lab.

Project Structure

• Android App • ~/Android/MaliciousMessenger/tutorialApps

• emu-check.apk • A tutorial example (Shown as ‘My application’ in the emulator)

• CoinPirate.apk • Another tutorial example

• ~/Android/MaliciousMessenger/sms.apk • Target app to analyze to answer the questionnaire

• READ ~/Android/MaliciousMessenger/writeup.pdf

Starting C&C Server

• Starting C&C Server • Run `start_server`

How to

• Emulator • Run with ‘run-emulator’

How to

• Emulator • Run Application

• My Application (tutorial, not required) • emu-check.apk

• Coin Pirates (tutorial, not required) • CoinPirates.apk

• Messenger • Sms.apk (analysis target)

How to

• Emulator • Click ‘…’ to control the emulator

How to

• Emulator • Send SMS

• Can change sender ID

• Can change content

How to

• Decompile • Run jadx-gui

How to

• Disassemble • Run apktool

• apktool d –f –r sms.apk • This command generates decompilied *.smali files

• Copy APK file before doing this.

• Repackage (requires signing) • apktool b sms –o sms.apk

• This command will re-assemble *.smali files into an apk file (as sms.apk, you can change this)

• Sign • You should sign the app to install the app to emulator

• Run ‘signer.py sms.apk’

How to

• Install / uninstall (you should uninstall first to re-install the app) • Install

• adb install sms.apk • This command will install sms.apk into the emulator

• Make sure turn on the emulator first

• adb uninstall com.smsmessenger • This command will uninstall sms.apk from the emulator

How to

• Decompile • Run jadx-gui

• Open apk file

• Open class…

Questionnaire • 1) To get your credit for the project, you have to answer the questionnaire

on ~/report/assignment-questionnaire.txt !!!!! • 2) Please strictly follow the format or the example answer on each

question on assignment-questionnaire.txt. TAs use a autograder for your submit.

• Windows Part • Read ~/report/assignment-questionnaire.txt • Read carefully the questionnaire, and answer them on ~/report/assignment-

questionnaire.txt • For each stage, there are 4~6 questionnaire that inquires regarding the behavior of

the malware.

• Android Part • READ ~/Android/MaliciousMessenger/writeup.pdf • Read carefully the writeup, answer on on ~/report/assignment-questionnaire.txt

Submitting Questionnaire

• Required files • Zip the following files and upload to T-Square

• Run ~/archive.sh will automatically zip the whole files • ~/report/assignment-questionnaire.txt

• Stage1.exe, stage2.exe, payload.exe

• ~/tools/network/iptables_rules

• ~/tools/cfg-generation/score.h

• Running ~/archive.sh will create report.zip automatically • Please check the content of zip file before submitting it to T-square

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Excel_Ch07_Cap_Real_Estate | Excel Chapter 7 Real Estate

January 22, 2024/in Uncategorized /by Daniel Jennings

Excel_Ch07_Cap_Real_Estate | Excel Chapter 7 Real Estate

You are the office manager for a real estate company in northern Utah County. You tracked real estate listings, including city, agent, listing price, sold price, etc. Agents can represent a seller, a buyer, or both (known as dual agents). Your assistant prepared the spreadsheet structure with agent names, agent types, the listing and sold prices, and the listing and sold dates. You want to complete the spreadsheet by calculating the number of days each house was on the market before being sold, agent commissions, and bonuses. In addition, you will use conditional functions to calculate summary statistics. For further analysis, you will insert a map chart to indicate the average house selling price by city. Finally, you will create a partial loan amortization table and calculate cumulative interest and principal to show a potential buyer to help the buyer make decisions.

The   spreadsheet contains codes (BA, DA, SA) to represent agent roles (Buyer’s   Agent, Dual Agent,   Seller’s Agent). You want to switch the codes for the actual descriptions.
In cell E12 of the Details sheet, insert the SWITCH function to evaluate the   agent code in cell D12. Include mixed cell references to the codes and roles   in the range J2:K4 for the values
and results arguments. use all cell references in the function. Copy the   function to the range E13:E39.

Now you want to calculate the number of days between the list date and sale date.
In cell J12, insert the DAYS function to calculate the number of days between the Listing Date and the Sale Date. Copy the function to the range J13:J39.

You want to calculate agent commissions based on their role.
In cell K12, insert the IFS function to calculate the agent’s commission based on the agent code and the applicable rates in the range L2:L4. Use relative and mixed references correctly. Copy the function to the range K13:K39.

You want to calculate a bonus if the sold price was at least equal to the listing price, and if the house sold within 30 days after being listed.
In cell L12, insert an IF function with a nested AND function to calculate a bonus. The AND function should ensure both conditions are met: Sold Price divided by the Listing Price is greater than or equal to 100% (cell L7) and the Days on Market are less than or equal to 30 (cell L8). If both conditions are met, the bonus is $1,000 (cell L9). Otherwise, the bonus is $0. Use mixed cell references to the input values in the range L7:L9. Copy the function to the range L12:L39.

The top-left section of the spreadsheet is designed for summary statistics for one condition. You will calculate average selling prices and the number of houses sold in each city (the condition).
In cell B2, insert the AVERAGEIF function to calculate the average Sold Price for houses in the city of Alpine. Use mixed references for the range; use a relative reference to cell A2. Copy the function and use the Paste Formulas option to paste the function in the range B3:B5 so that the bottom border in cell B5 is preserved.

You want to count the number of houses in one city.
In cell C2, insert the COUNTIF function to count the number of houses in the city of Alpine. Use mixed references for the range; and use a relative reference to cell A2. Copy the function and use the Paste Formulas option to paste the function in the range C3:C5 so that the border in cell C5 is preserved.

You want to calculate the total commissions for each agent (the condition).
In cell B7, insert the SUMIF function to total the commissions by agent. Use mixed references for the ranges; and use a relative reference to cell A7. Copy the function and use the Paste Formulas option to paste the function in the range B8:B9 so that the borders are preserved.

The top-middle section of the spreadsheet is designed for summary statistics for multiple conditions. You will calculate the number of houses sold for each agent when he or she served as a Dual Agent (DA). Use mixed references for ranges and the agent code condition in cell J3. Use relative cell references to the agent condition in cell E2. When you copy the formulas, use the paste Formulas options to preserve border formatting.
In cell F2, insert the COUNTIFS function in cell F2 to count the number of houses sold by the first agent (cell E2) who was a Dual Agent (DA) (J3) for that house. Use all cell references in the function. Copy the function to the range F3:F4 and preserve the bottom border for cell F4.

You are ready to calculate the total value of those houses for each agent when he or she served as a Dual Agent (DA). Use mixed references for ranges and the agent code condition in cell J3. Use relative cell references to the agent condition in cell E2. When you copy the formulas, use the paste Formulas options to preserve border formatting.
In cell G2, insert the SUMIFS function to sum the selling prices of the houses sold by the first agent (cell E2) who was a Dual Agent (DA) (J3) for that house. Copy the function to the range G3:G4 and preserve the bottom border for cell G4.

Now, you will calculate the highest-price house highest-price house sold for each agent when he or she served as a Dual Agent (DA). Use mixed references for ranges and the agent code condition in cell J3. Use relative cell references to the agent condition in cell E2. When you copy the formulas, use the paste Formulas options to preserve border formatting.
In cell H2, insert the MAXIFS function in cell H2 to display the highest-price house sold by the first agent (cell E2) who was a Dual Agent (DA) (J3) for that house. Copy the function to the range H3:H4 and preserve the borders in the range H3:H4.

The Map worksheet contains a list of cities, postal codes, and average house sales. You will insert a map chart to depict the averages visually using the default gradient fill colors.
Display the Map worksheet, select the range B1:C5 and insert a map chart.

Cut the map chart and paste it in cell A7. Set a 2.31″ height and 3.62″ width.

You want to enter a meaningful title for the map.
Change the map title to Average Selling Price by Zip Code.

Display the Format Data Series task pane, select the option to display only regions with data, and show all labels. Close the task pane.

You are ready to start completing the loan amortization table.
Display the Loan worksheet. In cell B8, type a reference formula to cell B1. The balance before the first payment is identical to the loan amount. Do not type the value; use the cell reference instead. In cell B9, subtract the principal from the beginning balance on the previous row. Copy the formula to the range B10:B19.

Now, you will calculate the interest for the first payment.
In cell C8, calculate the interest for the first payment using the IPMT function. Copy the function to the range C9:C19.

Next, you will calculate the principal paid.
In cell D8, calculate the principal paid for the first payment using the PPMT function. Copy the
function to the range D9:D19.

Rows 21-23 contain a summary section for cumulative totals after the first year.
In cell B22, insert the CUMIPMT function that calculates the cumulative interest after the first year. Use references to cells A8 and A19 for the period arguments.

The next summary statistic will calculate the principal paid after the first year.
In cell B23, insert the CUMPRINC function that calculates the cumulative principal paid after the first year. Use references to cells A8 and A19 for the period arguments.

Rows 25-28 contain a section for   what-if analysis.
In cell B27, use the RATE financial function to calculate the periodic rate   using $1,400 as the
monthly payment (cell B26), the NPER, and loan amount in the original input   section.

In cell B28, calculate the APR by multiplying the monthly rate (cell B27) by 12.

Create a footer with your name on the left side, the sheet name code in the center, and the file name code on the right side of each worksheet.

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

A Video Store (AVS) Runs A Series Of Fairly Standard Video Stores

January 22, 2024/in Uncategorized /by Daniel Jennings

Consider the following scenario and then answer the corresponding questions.

A Video Store (AVS) runs a series of fairly standard video stores. Before a video can be put on the shelf, it must be cataloged and entered into the video database. Every customer must have a valid AVS customer card in order to rent a video. Customers rent videos for three days at a time. Every time a customer rents a video, the system must ensure that they do not have any overdue videos. If so, the overdue videos must be returned and an overdue fee paid before customer can rent more videos. Likewise, if the customer has returned overdue videos, but has not paid the overdue fee, the fee must be paid before new videos can be rented. Every morning, the store manager prints a report that lists overdue videos. If a video is two or more days overdue, the manager calls the customer to remind them to return the video. If a video is returned in damaged condition, the manager removes it from the video database and may sometimes charge the customer.

Upon your review complete the following:

1. Identify at least 3 classes that could be part of the AVS system. For each class identify at least 5 attributes and 2 methods. (9 pts)

2. Provide a one-sentence description of each of the methods you have identified in the previous step. (6 pts)

3. For each of the methods identified in question 1, list any arguments (data) required to perform the method. (3 pts)

4. Whenever a video is added, the system will increase the total number of available for checkout for that movie. How will you model the operation of increasing the total number of available videos? Will this be a public or private operation? Explain your reasoning briefly. (6 pts)

Explain the concept of polymorphism using an example in the AVS context.

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Concepts Of Programming Language: Building A Scanner

January 22, 2024/in Uncategorized /by Daniel Jennings

Example Pseudocode

Problem: Given a sorted array a with n elements (i.e., a[0] <= a[1] <= … a[n-1]) and a number m, find if m is in the array.

1. Main pseudo code

data

given data

n: the number of integers given

a[0], …, a[n-1]: the given integers

m: given integer (to check if it is in a)

unknown data: N.A.

intermediate data:

found: indicating if m is found from a

plan

// get array a, n from user input (numbers in a must be ordered).

n = getseries(a)

// find if m is in array a from index 0 to n-1

found = search(a, 0 , n-1, m)

if found print m is found in a.

Otherwise print m is not found in a.

(Pseudo code for all functions used in the main pseudocode)

2. Pseudo code for search function

Function name: search

input:

a: an array of numbers

bottom, top: bottom and top index

m: the number to search from a[bottom] to a[top]

output:

b: 1 if m is in a a[bottom] to a[top], 0 otherwise

Data

mid: middle index of the array

plan:

if (bottom > top) b = 0 and stop.

find the mid point mid of the array between bottom and top

if (a[mid] == m) b = 1

else if (m > a[mid])

P2.1 // find if m is in a from mid+1 to top:

b = search(a, mid+1, top, m)

else P2.2 // find if m is in a from bottom to mid-1

b = search(a, bottom, mid-1,m)

3. Pseudo code for getSeries function

omitted here

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Computer

January 22, 2024/in Uncategorized /by Daniel Jennings

Assignment #2 Security in Computing COSC2536/2537

Total Marks: 35 Submission Deadline: Week 10, May 11 2018 11:59pm

Q1 (Privacy) (Mark 6) Answer either Question (a) or (b) (a): Suppose there are seven voters to vote for YES or NO to give their opinions.

Design a secure voting prototype as shown in Fig. 1 using Paillier cryptosystem where the votes must be encrypted from Voting Booth before sending them to the Voting Server. Assume, four voters will vote for YES and three voters will vote for NO. The Voting Authority should find four YESs and three NOs after counting the votes. The Voting Authority chooses p=59, q=97 and select g=5724. Seven voters select the random numbers as 𝒓𝟏 = 𝟗𝟎, 𝒓𝟐 = 𝟗𝟏, 𝒓𝟑 = 𝟗𝟐, 𝒓𝟒 = 𝟗𝟑, 𝒓𝟓 = 𝟗𝟒, 𝒓𝟔 = 𝟗𝟓 and 𝒓𝟕 = 𝟗𝟔 respectively. Show the encryption, homomorphic computations and decryption processes.

Fig. 1: Secure E-voting Scenario

Hints: Refer to the lecture-5 Secure e voting. You need to represent the total number of votes by 6-bit string. The first three of bits should represent the votes for YES and the rest for NO. When adding a vote for YES, the system adds 001000, which is 8 in integer. Similarly, the system adds 000001 when voting for NO, which is 1 in the integer form. (b) As shown in Fig. 2, Alice owns two different shops where she sells mobile phones of a specific brand. The prices of the phones are different based on the shops. Now with

the help of a third-party cloud server, Alice wants to know remotely and securely, how much she earned by selling the mobile phones in both shops with different price rate (assume that Alice does not have the homomorphic computation power). Note that, Alice does not want to reveal how many phones are sold also the total amount of money that she earned to the server. How can you build a secure protocol using Exponential ElGamal cryptosystem where the cloud server can perform such computations without knowing the number of phones that are sold and the total earnings? Please refer to the below table for detail information.

Shops Shop 1 Shop 2 Phones sold 20 25 Price rate 50 30

Total Earning per shop 1000 750 Total Earning 1750

Fig. 2: Secure Transactions

Hints: Alice as a receiver, should generate the public and private key pairs (as shown in figure) and sends the public keys to the shops. The corresponding shops as senders can encrypt (with random numbers given in the figure) the number of phones sold and send the cipher-texts with the price rate (as plaintext) to the cloud server. The server with computation power should perform the required computations homomorphically so that it cannot reveal the total amount that is earned by selling the phones, since it is privacy sensitive. Only Alice should decrypt and find the Total earning. Q2 (Signatures) (Mark 2+2+1+1=6) (a) Suppose Bob (the sender) wants to send a signed message m=456789 to Alice (the receiver). However, before sending the message he would like to sign the message. When Alice receives the signed message, she would like to verify that the message is

indeed from Bob. To facilitate signing and verification Bob generates public and private keys using RSA encryption algorithm and sends the public key to Alice. Bob uses parameter p=10009 and q=9739, and chooses a suitable public key parameter e=5737. How would Bob sign message m=456789? How would Alice verify the signed message from Bob? (b) Suppose Bob (the sender) wants to send a signed message m=3456 to Alice (the receiver). However, before sending the message he would like to sign the message. When Alice receives the signed message, she would like to verify that the message is indeed from Bob. To facilitate signing and verification Bob generates public and private keys using ElGamal encryption algorithm and sends the public key to Alice. Bob chooses p=8081, g=2849, x=59. How would Bob sign message m=3456? How would Alice verify the signed message from Bob? (c) Recall that we use both a public key system and a hash function when computing digital signatures. Suppose that the hash function used to compute and verify signatures is insecure, but the public key system is secure. Show that you can forge signatures. (d) Why is it a bad idea to use the same RSA key pair for both signing and decryption? Explain with an example (i.e. a numerical example). Is this also true for ElGamal?   Q3 (BlockChain) (Mark 12) Study (i.e. research) various supply-chain systems as listed below. Choose one of the supply-chain systems as a case study (or you may choose any, which is not listed) and write a short report/proposal on how integrity and traceability of the chosen system can be improved by using BlockChain principle. Use plenty of diagrams to explain your concept. We are not asking you to write code and develop the system, but your report should contain enough information for a system architect to understand and build the proposed system. Some existing Blockchain based Supply-chain case studies are as follows.

1. Blockchain in Pharmaceutical supply chain to prevent counterfeit drugs supply.

2. Blockchain based Port logistics 3. Food safety and traceability using Blockchain: Meat traceability, Sea food

traceability etc. 4. Blockchain based garment products supply chain. 5. Tracking and tracing the provenance of diamonds using blockchain.

Some resources to study about existing Blockchain based Supply chain systems to improve the trust, traceability and integrity: Seafood Traceability using Blockchain IBM’s Solution on Blockchain based Food Supply chain

Q4 (Authentication and Intrusion Detection) (Mark 2+2+3+2=9) (a) Consider the following mutual authentication protocol, where KAB is a shared symmetric key.   Give two different attacks that Trudy can use to convince Bob that she is Alice.

(b) Suppose R is a random challenge sent in the clear from Alice to Bob and K is a symmetric key known only to Alice and Bob. Which of the following are secure session keys and which are not? Justify your answers.

(i)

(ii)

(i) Many other statistics could be used as part of an anomaly-based IDS. For example, network usage would be a sensible statistic to consider. List five other statistics that could reasonably be used in an anomaly-based IDS.

(ii) Why might it be a good idea to combine several statistics rather than relying on just a few?

(iii) Why might it not be a good idea to combine several statistics rather than relying on just a few?

(d) Alice forgets her password. She goes to the system administrator’s office, and the admin resets her password and gives Alice the new password.

(i) Why does the SA reset the password instead of giving Alice her previous (forgotten) password? Why should Alice re-reset her password immediately after the SA has reset it?

(ii) Suppose that after the SA resets Alice’s password, she remembers her

340 SIMPLE AUTHENTICATION PROTOCOLS

9.8 Problems 1. Modify the authentication protocol in Figure 9.12 so that it uses a hash

function instead of symmetric key encryption. The resulting protocol must be secure.

2. The insecure protocol in Figure 9.24 was modified in Figure 9.26 to be secure. Find two other distinct ways to slightly modify the protocol in Figure 9.24 so that the resulting protocol is secure. Your protocols must use a timestamp and “encrypt and sign.”

3. We want to design a secure mutual authentication protocol based on a shared symmetric key. We also want to establish a session key, and we want perfect forward secrecy.

a. Design such a protocol that uses three messages.

b. Design such a protocol that uses two messages.

4. Consider the following mutual authentication protocol, where KAB is a shared symmetric key.

“I’m Alice”, R ►

E(R,KAB)

E(R+1,KAB) r Bob

Give two different attacks that Trudy can use to convince Bob that she is Alice.

5. Consider the attack on TCP authentication illustrated in Figure 9.28. Suppose that Trudy cannot guess the initial sequence number 62 ex- actly. Instead, Trudy can only narrow 62 down to one of, say, 1,000 possible values. How can Trudy conduct an attack so that she is likely to succeed?

6. Timestamps can be used in place of nonces in security protocols.

a. What is the primary advantage of using timestamps?

b. What is the primary disadvantage of using timestamps?

7. Consider the following protocol, where CLNT and SRVR are constants, and the session key is K = h(S, RA, RB)·

Alice ~

9.8 PROBLEMS 341

“I’m Alice”, RA Certificate, RB

{ S ^ , E(CLNT.K)

E(SRVR,K) Alice + Bob

a. Does Alice authenticate Bob? Justify your answer.

b. Does Bob authenticate Alice? Justify your answer.

Consider the following protocol, where KAB is a shared symmetric key, CLNT and SRVR are constants, and K = h(S,RA,Re) is the session key.

“I’m Alice”, RA

3s. E(S, Κ^), E(CLNT.K) t

E(SRVR,K) Alice ■* Bob

a. Does Alice authenticate Bob? Justify your answer. b. Does Bob authenticate Alice? Justify your answer.

9. The following two-message protocol is designed for mutual authentica- tion and to establish a session key K. Here, T is a timestamp.

“I’m Alice”, \J]Miœ, {K>Bob

Alice Bob

This protocol is insecure. Illustrate a successful attack by Trudy.

10. Suppose R is a random challenge sent in the clear from Alice to Bob and K is a symmetric key known only to Alice and Bob. Which of the following are secure session keys and which are not? Justify your answers.

a. R®K b. E{R,K) c. E(K,R)

9.8 PROBLEMS 341

“I’m Alice”, RA Certificate, RB

{ S ^ , E(CLNT.K)

E(SRVR,K) Alice + Bob

a. Does Alice authenticate Bob? Justify your answer.

b. Does Bob authenticate Alice? Justify your answer.

Consider the following protocol, where KAB is a shared symmetric key, CLNT and SRVR are constants, and K = h(S,RA,Re) is the session key.

“I’m Alice”, RA

3s. E(S, Κ^), E(CLNT.K) t

E(SRVR,K) Alice ■* Bob

a. Does Alice authenticate Bob? Justify your answer. b. Does Bob authenticate Alice? Justify your answer.

9. The following two-message protocol is designed for mutual authentica- tion and to establish a session key K. Here, T is a timestamp.

“I’m Alice”, \J]Miœ, {K>Bob

Alice Bob

This protocol is insecure. Illustrate a successful attack by Trudy.

a. R®K b. E{R,K) c. E(K,R)

previous password. Alice likes her old password, so she resets it to its previous value. Would it be possible for the SA to determine that Alice has chosen the same password as before? Why or why not?

Q5 (Data Hiding) (Mark 2) Assume that we have a stego ECG signal with 200 samples in which binary bits of a text message is hidden as secret message. There are 168 bits of the binary secret message. A bit is hidden in the least significant bit (LSB) of an ECG sample. Please note that the bits are embedded sequentially. For example, we have a text message “hello world”. The equivalent binary of secret message is:

011010000110010101101100011011000110111100100000011101110110111 1011100100110110001100100

Now, if we hide first 5 bits of the binary string given above in LSB of first 5 ECG samples then the resultant ECG samples will look like as follows:

ECG Samples

Equivalent Binary Binary After Hiding a bit in LSB

-0.045 10111101001110000101000111101100 10111101001110000101000111101100 -0.055 10111101011000010100011110101110 10111101011000010100011110101111 -0.055 10111101011000010100011110101110 10111101011000010100011110101111 -0.075 10111101100110011001100110011010 10111101100110011001100110011010 -0.065 10111101100001010001111010111000 10111101100001010001111010111001 ⁞ ⁞ ⁞

You need to perform steganalysis to find out the secret text message from the stego ECG signal. In order to do this, convert each ECG samples into 64 bit binary and read corresponding LSB to store. At the end, convert retrieved bits into text.

The contents of stego ECG signal file (stego_ecg.txt) are given in the Appendix.

APPENDIX Stego_ecg.txt: -0.16999999999999998 -0.16 -0.17 -0.165 -0.15499999999999997 -0.15999999999999998 -0.17 -0.15 -0.10499999999999998 -0.045000000000000005 -0.030000000000000002 0.019999999999999997 0.065 0.12000000000000001 0.05499999999999999 0.01 -0.07999999999999999 -0.16 -0.17 -0.19 -0.21499999999999997 -0.21499999999999997 -0.4000000000000001 -0.39000000000000007 0.475 2.07 3.28 2.345 0.22499999999999998 -0.48000000000000004 -0.235 -0.23500000000000001 -0.275 -0.26000000000000006 -0.26000000000000006 -0.2800000000000001 -0.265 -0.255 -0.2750000000000001 -0.24 -0.24 -0.23 -0.215 -0.195 -0.19000000000000003 -0.16999999999999998 -0.175 -0.13500000000000004 -0.12 -0.08 -0.08 -0.08 -0.07 -0.055 -0.05 -0.004999999999999999 -0.015

-0.030000000000000002 -0.04 -0.07000000000000002 -0.08 -0.07999999999999999 -0.135 -0.12000000000000001 -0.135 -0.135 -0.17 -0.16499999999999998 -0.175 -0.16499999999999998 -0.14 -0.14 -0.175 -0.13500000000000004 -0.145 -0.14 -0.13000000000000003 -0.13 -0.15499999999999997 -0.14000000000000004 -0.16499999999999998 -0.16 -0.13500000000000004 -0.135 -0.165 -0.15 -0.155 -0.15999999999999998 -0.15999999999999998 -0.15499999999999997 -0.17 -0.14999999999999997 -0.14999999999999997 -0.15999999999999998 -0.15499999999999997 -0.13 -0.14999999999999997 -0.12000000000000001 -0.10000000000000002 -0.05499999999999999 -0.03 0.045 0.085 0.11 0.09 0.02 -0.10000000000000002 -0.14 -0.18500000000000003 -0.19000000000000003 -0.20000000000000004 -0.18000000000000002 -0.395 -0.34500000000000003 0.5200000000000001 2.0299999999999994 3.1300000000000003

2.1600000000000006 0.1 -0.505 -0.26 -0.24000000000000002 -0.26000000000000006 -0.26000000000000006 -0.275 -0.24 -0.235 -0.22499999999999998 -0.255 -0.25000000000000006 -0.24000000000000002 -0.19000000000000003 -0.18 -0.19000000000000003 -0.18 -0.165 -0.15999999999999998 -0.12000000000000001 -0.10000000000000002 -0.09500000000000001 -0.07999999999999999 -0.07000000000000002 -0.07999999999999999 -0.039999999999999994 -0.06 -0.04 -0.030000000000000002 -0.035 -0.07000000000000002 -0.07 -0.1 -0.105 -0.14 -0.12000000000000001 -0.14000000000000004 -0.14 -0.165 -0.18000000000000002 -0.15 -0.13 -0.175 -0.155 -0.13500000000000004 -0.13 -0.14499999999999996 -0.115 -0.12000000000000001 -0.14000000000000004 -0.15 -0.145 -0.15 -0.16 -0.17 -0.145 -0.165 -0.155 -0.18

-0.18 -0.175 -0.165 -0.19 -0.17 -0.175 -0.155 -0.12 -0.06 -0.04 0.01 0.06 0.1 0.08 0.06 -0.06 -0.12 -0.185 -0.195 -0.2 -0.195 -0.27 -0.425

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Solved Exp19_Excel_Ch07_Cap_Real_Estate | Excel Chapter 7 Real Estate

January 22, 2024/in Uncategorized /by Daniel Jennings

Project Description:

Cut the map chart and paste it in cell A7. Set a 2.31″ height and 3.62″ width.

You want to enter a meaningful title for the map.
Change the map title to Average Selling Price by Zip Code.

Display the Format Data Series task pane, select the option to display only regions with data, and show all labels. Close the task pane.

Now, you will calculate the interest for the first payment.
In cell C8, calculate the interest for the first payment using the IPMT function. Copy the function to the range C9:C19.

Next, you will calculate the principal paid.
In cell D8, calculate the principal paid for the first payment using the PPMT function. Copy the
function to the range D9:D19.

In cell B28, calculate the APR by multiplying the monthly rate (cell B27) by 12.

Create a footer with your name on the left side, the sheet name code in the center, and the file name code on the right side of each worksheet.

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Logism Combinational Logic Circuit

January 22, 2024/in Uncategorized /by Daniel Jennings

Logism Combinational Logic Circuit

THE TABLE PROVIDED MUST BE USED FOR THE CIRCUIT. I CAN’T MAKE MY OWN VALUES.

for example 0011 MUST equal the hexadecimal value C for the project (Logism Combinational Logic Circuit)

Preface

You will need Logisim to complete this project assignment. Further information about LogiSim is at http://www.cburch.com/logisim/. If you have not done so already, download and install Logisim 2.7.1 from http://sourceforge.net/projects/circuit/.

1. Introduction

The objective of this project is to reinforce your understanding of binary codes, combinational logic design, and logic simulation. You must: (i) design a combinational logic circuit that displays the hexadecimal value of a gray code input according to the specifications given below; (ii) debug and test your design by simulating it using the Logisim simulator; and (iii) document your work in a short report.

2. Gray Codes

Consider a system where a value is changed by being incremented or decremented by one. The value is encoded by n binary signals. As a specific example, consider a value, represented with 4 bits, being incremented from 3 to 4. In a traditional weighted binary encoding, 3 is represented as 0011 and 4 is represented as 0100. For the change from 3 to 4, three bits must change. Since the time of the transitions in the actual signals will always be different if examined at a sufficiently fine scale, the value will not change instantaneously from 3 to 4. As an example, the transition could occur as follows, where the transitions to value 7 and then value 5 are transient in nature.

0011 (3) ® 0111 (7) ® 0101 (5) ® 0100 (4)

The physical reality of such signal transitions can create problems for applications including mechanical encoders and asynchronous (clock-free) systems. This problem can be overcome using Gray codes, which are non-weighted codes that can be used to represent values. Gray codes have the special property that any two adjacent values differ in just one bit. For example, the standard four-bit Gray code for 3 is 0010 and the code for 4 is 0110. These two codes differ in just one bit, the second bit from the left. So, only a single signal needs to change from 0 to 1 (or 1 to 0 for other values) to represent an adjacent value. You can read more about Gray codes at http://en.wikipedia.org/wiki/Gray_code.

For this project we consider a special type of Gray code called a Balanced Gray code. In a Balanced Gray code, the number of transitions for each bit position is the same when counting through the values. For example, a four-bit Balanced Gray code can be used to count from 0 to 15 (hexadecimal F). There are 16 transitions as the count goes from 0 to 1 to 2 and so on to 15 and then back to 0. For a Balanced Gray code, there are four bit transitions for each of the four bit positions during the 16 total transitions. This property is useful in some applications.

(Logism Combinational Logic Circuit)

Table I below shows the encoding of hexadecimal values 0 through F using a 4-bit Balanced Gray code.

Table I. Hexadecimal Values and Associated 4-bit Balanced Gray Code and Binary Code

Hexadecimal Value	Balanced Gray Code (X₃X₂X₁X₀)	Binary Code (Y₃Y₂Y₁Y₀)
0	0 0 0 0	0 0 0 0
1	1 0 0 0	0 0 0 1
2	1 1 0 0	0 0 1 0
3	1 1 0 1	0 0 1 1
4	1 1 1 1	0 1 0 0
5	1 1 1 0	0 1 0 1
6	1 0 1 0	0 1 1 0
7	0 0 1 0	0 1 1 1
8	0 1 1 0	1 0 0 0
9	0 1 0 0	1 0 0 1
A	0 1 0 1	1 0 1 0
B	0 1 1 1	1 0 1 1
C	0 0 1 1	1 1 0 0
D	1 0 1 1	1 1 0 1
E	1 0 0 1	1 1 1 0
F	0 0 0 1	1 1 1 1

3. Design Specification

(Logism Combinational Logic Circuit)

You are to design a combinational logic circuit that accepts a four-bit Balanced Gray code (X₃ X₂ X₁ X₀) as its input and creates a four-bit output (Y₃ Y₂ Y₁ Y₀) that uses standard binary encoding to represent the same hexadecimal value. In other words, the circuit translates between the Balanced Gray code input and the binary code output as indicated in Table I. Figure 1 provides a block diagram of the function. You do not need to minimize the logic function or associated circuit, but you may choose to do so.

Note that Table I is not a true truth table in that it is not ordered by input. You can rearrange the rows in Table I to construct a standard truth table with inputs X₃ X₂ X₁ X₀ appearing in order from 0000, 0001, 0010, …, 1111.

Figure 1. Block diagram of the converter function.

(Logism Combinational Logic Circuit)

4. Modeling the Circuit in Logisim

Use the Pin device in Logisim’s Wiring library to control the four inputs (X₃ X₂ X₁ X₀) to the combinational circuit. The Pin device is also available on Logisim’s toolbar. Each pin can be interactively set to 0 or 1 using Logisim’s Poke tool to test the circuit for different Balanced Gray code input values. If the proper connections are in place when Logisim is running, signals with logic level 1 appear in bright green and signals with logic level 0 are shown in dark green.

The circuit’s four output bits should be used to control a hexadecimal display to show values 0 through F, inclusive. Use the Hex Digit Display device in Logisim’s Input/Output library. It accepts a 4-bit binary encoded value as input and displays the hexadecimal digit corresponding to the binary-encoded input. Use the Splitter device in Logisim’s Wiring library to interface the four individual single bits produced by the combinational circuit (Y₃ Y₂ Y₁ Y₀) to the four-bit wide input to the Hex Digit Display. The Hex Digit Display device has a second input to control the decimal (hexadecimal) point. The decimal point input can be left unconnected.

Figure 2 shows a possible layout for the design. The associated Logisim circuit file is provided with this assignment.

Figure 2. Possible circuit layout including logic to produce output Y₀ (input is for Balanced Gray Code value 0011 which produces output 1100 or hexadecimal C).

The design in Figure 2 includes the combinational logic to produce output Y0. By observation, we see that output Y0 is true if and only if there are an odd number of logic 1 inputs. Thus, Y0 is implemented by the exclusive-or (XOR) function, i.e., Y0 = X3 Å X2 Å X1 Å X0. For the Logisim XOR Gate, the Multiple-Input Behavior attribute needs to be set to “When an odd number are on.”

5. Simulation

After you create your design, use Logisim to simulate the code conversion circuit. You should test all 16 possible input combinations and verify that the correct values of Y₃, Y₂, Y₁, and Y₀ are produced and that the correct hexadecimal value is displayed. (Logism Combinational Logic Circuit)

References

https://www.cs.hmc.edu/~cs5grad/MyCS/2013/Logisim.pdf

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Just Answer 1 Question

January 22, 2024/in Uncategorized /by Daniel Jennings

choose 1 question and answer it. (200 words)

use the pdf file chapter 1 to answer

1. What is encompassed in the question “why computer ethics?” In other words, what more specific questions are included in the broad question?

– What is computer ethics? What does it mean?

– Why do we have to learn ethics?

– Is computer ethics important or not?

– Is it connected to our course?

– Is computer ethics helpful?

2. Give a concise summary of Moor’s standard account of computer ethics.

– Moor’s standard account of computer ethics is saying that when IT comes up a new possibilities for people’s action that is because Ethical issues arises around IT.

3. What is a policy vacuum? Give an example, and explain it using the standard account.

– Policy vacuum means “no policy”. For example, A Benildean girl went to her school wearing slippers. At that time, the school accepts slippers then suddenly made a school policy of dress code. She wore slippers because there were no rules of not wearing slippers. She can be excused if her feet/s were injured.

Using it in the standard account, the policy vacuum are filled when there are questions or conceptual muddle that needs to be solved or answered.

4. What is a conceptual muddle, and how do they get in the way of filling policy vacuums? Illustrate with an example.

By the word itself, muddle means mix-up, confusing, or jumble. Conceptual muddle gets in the way of filling policy vacuums because conceptual muddles are the questions that to be answered and be solved so they are like making the created policy change. For example, A man asked the IT department if he could access his email account to read his personal emails. The IT says “no” but with reconsiderations and depending on his request he can access his email account with a desired time and if it is business related.

5. What is wrong with the standard account of computer ethics? Identify at least two criticisms, and explain.

The problem with the standard account of computer ethics is the “newness”. In the book, “newness” may skew the kind of analysis that is done.

6. What are the two tenets of the view referred to as “technological determinism”? What is the STS critique of each tenet?

– “technology develops in isolation and according to its own logic – should be rejected outright”

= It does not follow a predetermined or “natural” order of development.

– “technologies are adopted by societies or particular social groups, the adoption brings about – determines – social arrangements and patterns of social behavior”

= When we say that technology determines society, we are forgetting that the technology has been socially shaped; social factors and forces have influenced the development and design of the technology.

7. What is wrong with thinking of technology as merely material objects?

In the statement “thinking of technology as merely material objects”, it sounds normal but it doesn’t look at the main idea why technologies are invented.

In the chapter 1 of Computer Ethics, about “Sociotechnical”, one of the lessons of STS, is not to think of technology as material objects. As sited in this chapter, that “Facebook users think of the site not just as a material object or piece of software, but as a “social” networking site”.

8. What is a sociotechnical system?

For me, sociotechnical system is a system that people should might know. It helps in our decision making and critical thinking. It helps us stretch our mind, ask questions that obviously want decent answers.

Written in the book of Computer Ethics, “sociotechnical systems perspective provides a richer account of situations in which ethical decisions are made, one that may help in articulating moral concerns as well as revealing additional avenues for addressing ethical questions and issues”.

9. Choose a familiar technology and describe its values?

– Internet

= helps users to reconnect with other people

= to gather informations

= to send files from other people

10. What is the difference between micro-level ethical issues and macro-level ethical issues?

Micro-level ethical issues are for the individuals’choices and their behavior.

Macro-level ethical issues are for big groups that everyone can be affected.

11. Why is the study of ethics and technology needed? Why is the study of ethics, and IT in particular, needed?

The study of ethics and technology is needed because:

= Ethics -> In ethics, ethics gives us to explore our mind or to widen our mind, ask questions to the unknown, ask questions to the unjust, and etc. It helps us to think more of cases that are somehow wrong and right.

= Technology -> We need technology. As we our world continues to grow on technologies, we began to be attached to the technologies we created. We are so attached that people can’t live without it. That is why Ethics is needed because Ethics is like the one stopping the evil deeds of an evil person using technology.

The study of ethics and IT in particular is needed because these IT people are mostly creating ethics. Reading some of the recent cases can actually relate some of your problems that can be solved under some of the circumstances.

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Exp19_Excel_Ch07_CapAssessment_Shipping

January 22, 2024/in Uncategorized /by Daniel Jennings

Exp19_Excel_Ch07_CapAssessment_Shipping

Project Description:

You work for a company that sells cell phone accessories. The company has distribution centers in three states. You want to analyze shipping data for one week in April to determine if shipping times are too long. You will perform other analysis and insert a map. Finally, you will prepare a partial loan amortization table for a new delivery van.

Start Excel. Download and open the file named Exp19_Excel_Ch07_CapAssessment_Shipping.xlsx. Grader has automatically added your last name to the beginning of the filename.

The Week worksheet contains data for the week of April 5.
In cell D7, insert the appropriate date function to calculate the number of days between the Date Arrived and Date Ordered. Copy the function to the range D8:D35.

Next, you want to display the city names that correspond with the city airport codes.
In cell F7, insert the SWITCH function to evaluate the airport code in cell E7. Include mixed cell references to the city names in the range F2:F4. Use the airport codes as text for the Value arguments. Copy the function to the range F8:F35.

Now you want to display the standard shipping costs by city.
In cell H7, insert the IFS function to identify the shipping cost based on the airport code and the applicable shipping rates in the range G2:G4. Use relative and mixed references correctly. Copy the function to the range H8:H35.

Finally, you want to calculate a partial shipping refund if two conditions are met.
In cell I7, insert an IF function with a nested AND function to determine shipping refunds. The AND function should ensure both conditions are met: Total Days is grater than Total Days Delivery Goal (cell C3) and Order Total is equal to or greater than Order Total Threshold (cell C2). If both conditions are met, the refund is 50% (cell C4) of the Shipping Cost. Otherwise, the refund is $0. Use mixed references as needed. Copy the function to the range I8:I35.

The Stats worksheet contains similar data. Now you want to enter summary statistics.
In cell B2, insert the COUNTIF function to count the number of shipments for Austin (cell B1). Use appropriate mixed references to the range argument to keep the column letters the same. Copy the function to the range C2:D2.

In cell B3, insert the SUMIF function to calculate the total orders for Austin (cell B1). Use appropriate mixed references to the range argument to keep the column letters the same. Copy the function to the range C3:D3.

In cell B4, insert the AVERAGEIF function to calculate the average number of days for shipments from Austin (cell B1). Use appropriate mixed references to the range argument to keep the column letters the same. Copy the function to the range C4:D4.

Now you want to focus on shipments from Houston where the order was greater than $1,000.
In cell C7, insert the COUNTIFS function to count the number of orders where the Airport Code is IAH (Cell D1) and the Order Total is greater than $1,000.

In cell C8, insert the SUMIFS function to calculate the total orders where the Airport Code is IAH (Cell D1) and the Order Total is greater than $1,000.

In cell C9, insert the MAXIFS function to return the highest order total where the Airport Code is IAH (Cell D1) and the Order Total is greater than $1,000.

On the Map worksheet, insert a map for the states and revenues. Cut and paste the map in cell C1.

Format the data series to show only regions with data and show all map labels.

Change the map title to April 5-9 Gross Revenue.

Use the Loan worksheet to complete the loan amortization table.
In cell F2, insert the IPMT function to calculate the interest for the first payment. Copy the function to the range F3:F25. (The results will update after you complete the other functions and formulas.)

In cell G2, insert the PPMT function to calculate the principal paid for the first payment. Copy the function to the range G3:G25.

In cell H2, insert a formula to calculate the ending principal balance. Copy the formula to the range H3:H25.

Now you want to determine how much interest was paid during the first two years.
In cell B10, insert the CUMIPMT function to calculate the cumulative interest after the first two years. Make sure the result is positive.

In cell B11, insert the CUMPRINC function to calculate the cumulative principal paid at the end of the first two years. Make sure the result is positive.

You want to perform a what-if analysis to determine the rate if the monthly payment is $1,150 instead of $1,207.87.
In cell B15, insert the RATE function to calculate the necessary monthly rate given the NPER, proposed monthly payment, and loan. Make sure the result is positive.

Finally, you want to convert the monthly rate to an APR.
In cell B16, insert a formula to calculate the APR for the monthly rate in cell B15.

Insert a footer on all sheets with your name on the left side, the sheet name code in the center, and the file name code on the right side.

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Windows ProDiscover Forensics Lab

January 22, 2024/in Uncategorized /by Daniel Jennings

Advanced Computer Forensics

Windows ProDiscover Forensics Lab

This lab is a replacement for the EnCase lab (122) for students who have been unable to access EnCase through RLES. In order to do this lab, you will need to download and install ProDiscover Basic (make sure to pick 32-bit or 64-bit depending on your version of Windows) from this URL: http://www.techpathways.com/desktopdefault.aspx?tabindex=8&tabid=14 (scroll down until you see the download links at the bottom of the page). You will also need to download a copy of the image files for this lab, 123img.zip. These image files are distributed under the GPL and were originally created by Brian Carrier.

Instructions appear as bullet points, questions are numbered and bolded.

Instructions & Questions

Start ProDiscover Basic.
Create a new project for this laboratory. Give it a unique number and name.
Click “Add” then “Image File” and add “123img1.dd”.
Click the “Action” menu then generate “OS Info”. This adds some information about the image to the report, which you can view at any time during your examination by clicking on “View” then “Report”.

What is the file system of this image file?
What is the volume name?

Go to “Cluster View” and click on the image.

How many clusters are used on this image file?

Go to “Content View” and click on the image.

List all the Deleted files recovered by ProDiscover in a table – and calculate the MD5 hash value for each deleted file.
Is there anything special about any of the files?

ProDiscover will use the time zone setting of your examiner workstation if no time zone is set for the evidence. When you acquire a computer as evidence it is important to make note of the computer’s time and time zone, especially if you need to correlate evidence from different time zones (never assume the time or time zone on a computer is correct.)

Where does the Time Zone information reside in a Windows system?

Set the timezone by clicking on File, then Preferences. The timezone should be US Central Time in this particular case (the image file has been extracted from a computer in that timezone although it is not an image of the system partition so there is no way to find the computer’s actual timezone from the image itself).

What is the latest file creation time on the image?
Which files are resident files? Hint: you can right-click on a file and say “Show Cluster Numbers” to see the cluster/s in which the file is stored – you can do this for the $MFT of the disk image to see which clusters are allocated to the $MFT.

Add the second image to the case – “123img2.dd”
Go to the “Content View” and click “All Files”.
Go to the “View” menu and select “Gallery View”.

Which files display a thumbnail in Gallery View?
Are there any files with mismatching file extensions? If so, which ones? Identify their types according to their extension versus their actual type and explain how you have identified the actual type.

Disable Gallery View.
Extract all JPEG files from the image by selecting each of them. You will be prompted to add a comment about the file for the report. Record “JPEG file” and whether the file has been hidden, deleted, mislabelled or is in any other way special.
Right-click on a file and click “Copy All Selected Files”. Save them in a temporary directory on your computer.

Paste each JPEG file from your temporary directory into your submission document as an embedded image.
Do you think you have identified every JPEG file in the image? Hint: You can search for the JPEG file header by clicking on “Search”, selecting “Hex” and searching for the pattern FFD8. Do any files contain the pattern which do not appear in your temporary directory? If so, which ones?
Create a table for all files on the second image, listing each file’s name and MD5 hash value.

Your answers to all questions should be stored in a LibreOffice document, Word document or PDF, and uploaded to Dropbox in the “EnCase Lab” folder as this exercise replaces the EnCase lab.

Do you need a similar assignment done for you from scratch? Order now! Use Discount Code "Newclient" for a 15% Discount!

Excel_Ch07_Cap_Real_Estate | Excel Chapter 7 Real Estate

Do you need a similar assignment done for you from scratch? Order now! Use Discount Code "Newclient" for a 15% Discount!

Do you need a similar assignment done for you from scratch? Order now! Use Discount Code "Newclient" for a 15% Discount!

Example Pseudocode

1. Main pseudo code

2. Pseudo code for search function

3. Pseudo code for getSeries function

Do you need a similar assignment done for you from scratch? Order now! Use Discount Code "Newclient" for a 15% Discount!

Do you need a similar assignment done for you from scratch? Order now! Use Discount Code "Newclient" for a 15% Discount!

Project Description:

Do you need a similar assignment done for you from scratch? Order now! Use Discount Code "Newclient" for a 15% Discount!

Logism Combinational Logic Circuit

Preface

1. Introduction

2. Gray Codes

3. Design Specification

4. Modeling the Circuit in Logisim

5. Simulation

Do you need a similar assignment done for you from scratch? Order now! Use Discount Code "Newclient" for a 15% Discount!

Do you need a similar assignment done for you from scratch? Order now! Use Discount Code "Newclient" for a 15% Discount!

Do you need a similar assignment done for you from scratch? Order now! Use Discount Code "Newclient" for a 15% Discount!

Advanced Computer Forensics

Windows ProDiscover Forensics Lab

Instructions & Questions

Do you need a similar assignment done for you from scratch? Order now! Use Discount Code "Newclient" for a 15% Discount!

DISCLAIMER

PAYMENT METHODS

CONTACT US

E MAIL:

Archive

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!

Do you need a similar assignment done for you from scratch? Order now!
Use Discount Code "Newclient" for a 15% Discount!