林志炫 - 多一點少一點

林志炫 - 多一點少一點

作詞：樓南蔚
作曲：韓賢光

溫柔一點　浪漫一點　我都不會
wen rou yi dian lang man yi dian wo du bu hui
冷漠一點　疏遠一點　又怕你心碎
leng mo yi dian shu yuan yi dian you pa ni xin sui
愛太濃　　嫌太甜　　愛太鬆　　淡無味
ai tai nong xian tai tian ai tai song dan wu wei
我已失去了判斷　不知如何去調配
wo yi shi qu liao pan duan bu zhi ru he qu diao pei

自由一點　隨性一點　別太累
zi you yi dian sui xing yi dian bie tai lei
退後一點　找回一些　初戀的滋味
tui hou yi dian zhao hui yi xie chu lian de zi wei
想要飛　　儘管飛　　想要醉　　徹底醉
xiang yao fei jin guan fei xiang yao zui che di zui
愛情不必多言語　一個眼神就體會
ai qing bu bi duo yan yu yi ge yan shen jiu ti hui

*
愛你多一點　頂多是感動到落淚　愛你少一點　也不是罪
ai ni duo yi dian ding duo shi gan dong dao luo lei ai ni shao yi dian ye bu shi zui
我不想強求完美　也不會徹夜不歸　愛應該隨心所欲　行雲流水
wo bu xiang qiang qiu wan mei ye bu hui che ye bu gui ai ying gai sui xin suo yu xing yun liu shui
雖然我　做不到如影跟随　卻不會　讓你任憑風吹
sui ran wo zuo bu dao ru ying gen sui que bu hui rang ni ren ping feng chui
相信我　愛你的心　永不收回
xiang xin wo ai ni de xin yong bu shou hui

溫柔一點　浪漫一點　我都不會
wen rou yi dian lang man yi dian wo du bu hui
冷漠一點　疏遠一點　又怕你心碎
leng mo yi dian shu yuan yi dian you pa ni xin sui
愛太濃　　嫌太甜　　愛太鬆　　淡無味
ai tai nong xian tai tian ai tai song dan wu wei
愛情不必多言語　一個眼神就體會
ai qing bu bi duo yan yu yi ge yan shen jiu ti hui

Repeat *

溫柔一點　浪漫一點　冷漠一點　疏遠一點
wen rou yi dian lang man yi dian leng mo yi dian shu yuan yi dian
自由一點　隨性一點　退後一點　找回一些
zi you yi dian sui xing yi dian tui hou yi dian zhao hui yi xie

張惠妹 - 真實

張惠妹 - 真實

作詞：徐世珍
作曲：Won Tae Yeon/Cho Kyuman
編曲：屠穎

你說的話
ni shuo de hua
在我心中生了根
zai wo xin zhong sheng le gen
愛得很深
ai de hen shen
所以心會疼
suo yi xin hui teng
記憶 在我的心中翻滾
ji yi zai wo de xin zhong fan gun
是不是每一個人
shi bu shi mei yi ge ren
都像我一樣笨
dou xiang wo yi yang ben

只怕再問
zhi pa zai wen
對彼此都太殘忍
dui bi ci dou tai can ren
我能感覺
wo neng gan jue
另外一個人
ling wai yi ge ren
我等 等笑容換成淚痕
wo deng deng xiao rong huan cheng lei hen
愛在崩潰的時候
ai zai beng kui de shi hou
比較真
bi jiao zhen
太多疑問
tai duo yi wen
知道答案又如何
zhi dao da an you ru he
原來容忍不需要天份
yuan lai yong ren bu xu yao tian fen
只要愛錯一個人
zhi yao ai cuo yi ge ren
心痛比快樂更真實
xin tong bi kuai le geng zhen shi
愛為何這樣的諷刺
ai wei he zhe yang de feng ci
我忘了這是第幾次
wo wang le zhe shi di ji ci
一見你就無法堅持
yi jian ni jiu wu fa jian chi
孤獨比擁抱更真實
gu du bi yong bao geng zhen shi
愛讓人失去了理智
ai rang ren shi qu le li zh
i會不會是我太自私
hui bu hui shi wo tai zi si
拒絕更寂寞的日子
ju jue geng ji mo de ri zi
放不開
fang bu kai
也看不見未來
ye kan bu jian wei lai
難道這種不完美
nan dao zhe zhong bu wan mei
才是愛情真實的樣子
cai shi ai qing zhen shi de yang zi
太多疑問
tai duo yi wen
知道答案又如何
zhi dao da an you ru he
原來容忍不需要天份
yuan lai yong ren bu xu yao tian fen
只要愛錯一個人
zhi yao ai cuo yi ge ren
心痛比快樂更真實
xin tong bi kuai le geng zhen shi
愛為何這樣的諷刺
ai wei he zhe yang de feng ci
我忘了這是第幾次
wo wang le zhe shi di ji ci
一見你就無法堅持
yi jian ni jiu wu fa jian chi
孤獨比擁抱更真實
gu du bi yong bao geng zhen shi
愛讓人失去了理智
ai rang ren shi qu le li zhi
會不會是我太自私
hui bu hui shi wo tai zi si
拒絕更寂寞的日子
ju jue geng ji mo de ri zi

孤獨比擁抱更真實
gu du bi yong bao geng zhen shi
愛讓人失去了理智
ai rang ren shi qu le li zhi
會不會是我太自私
hui bu hui shi wo tai zi si
拒絕更寂寞的日子
ju jue geng ji mo de ri zi

放不開
fang bu kai
也看不見未來
ye kan bu jian wei lai
難道這種不完美
nan dao zhe zhong bu wan mei
才是愛情真實的樣子
cai shi ai qing zhen shi de yang zi

周杰倫 - 好久不見

周杰倫 - 好久不見

作詞：周杰倫
作曲：周杰倫
編曲：蔡庭貴

好久不見 你還好嗎
hao jiu bu jian ni hai hao ma 
你的小狗 長大了嗎
ni de xiao gou zhang da le ma 
我的圍巾 還圍著嗎
wo de wei jin hai wei zhe ma 
我的相片 都丟了吧
wo de xiang pian dou diu le ba 

我剪不到 後面頭髮
wo jian bu dao hou mian tou fa 
這個藉口  還不錯吧(哎呦不錯)
zhe ge ji kou hai bu cuo ba (ai you bu cuo) 
一把剪刀一堆廢話
yi ba jian dao yi dui fei hua 
還不是想求求你回來吧
hai bu shi xiang qiu qiu ni hui lai ba 

*
麥擱一個人咧生氣 乎伊煩惱 乎伊操心
mai gu ji gei lang lie xiu qi hu yi huan no hu yi co xin 
雖然不關我的代誌 誰叫他是我的兄弟 耶
sui ran bu guan wa eh dai ji shui gio ee sii wa eh hei di ye 
攏這麼久就唰唰去 想想秋天就馬過去 耶
lu jia ni gu jiu shua shua ki xiu xiu qiu ti jiu bei ge ke ye 
冬天來臨他會怕冷 你不回來甘講要我抱伊
dong tin lai lin ee eii kia leng li bei teng lai gan kong ai wa po yi 
按呢甘好 是我不好 我沒有緊緊抱住你(緊緊抱住你)
an ni gum ho shi wo bu hao wo mei you jin jin bao zhu ni (jin jin bao zhu ni)
你說淚留著 很危險
ni shuo lei liu zhe hen wei xian
如果等雨一起(等雨一起) 流下不讓同情發現
ru guo deng yu yi qi (deng yu yi qi) liu xia bu rang tong qing fa xian 

我對天空這個那個流星 大喊後會不會有奇蹟
wo dui tian kong zhe ge na ge liu xing da han hou hui bu hui you qi ji 
就算做朋友也沒關係 為你改變了自己都不認識自己
jiu suan zuo peng you ye mei guan xi wei ni gai bian le zi ji dou bu ren shi zi ji 
不是我跑去了整形 只是我拿出真心
bu shi wo pao qu le zheng xing zhi shi wo na chu zhen xin 

開一瓶這個那個香檳 去我的Mr.J餐廳
kai yi ping zhe ge na ge xiang bin qu wo de Mr. J can ting 
點蠟燭順便吃個甜品 慶祝你打死不連絡的毅力
dian la zhu shun bian chi ge tian pin qing zhu ni da si bu lian luo de yi li 
冷戰早已經不流行 趕快回來到 我身邊
leng zhan zao yi jing bu liu xing gan kuai hui lai dao wo xin bi

Repeat *

Beini 1.2.5

Been years since I last looked into WiFi hacking. I've since upgraded my access point to WPA2, so I thought I'd try to crack it.

Tool of choice is still Beini, the latest (and last ever) version being 1.2.5. Alternative are Xiaopan OS and Backtrack, but I'm too lazy to experiment.

As discussed in a previous post, WEP networks are easiest to hack because all Feeding Bottle needs to do is to collect enough IVs, and the password is eventually revealed. Protip: Instead of using the default ARP Replay Attack, try using P0841 Replay Attack or even Fragmentation Forge Attack as the attack parameter (with Fake Auth by force enabled). This gets you lots of IVs in a short time.

WEP is one thing, and WPA/WPA2 is another. Basically, what we're after is to capture a 4-way handshake between the WiFi router and the client(s). If you can't wait for the authentication to happen, just press the Deauth button (every few minutes) to force the step. That said, sometimes the client just drop out with authenticating again (for some reason). Once the handshake is captured, we can then try to crack the password using dictionaries. For my testing purposes, I have Beini running on a 256MB USB stick. Not enough to host those 13GB dictionaries. What I have on hand are darkcode.lst and rockyou.txt (from Backtrack and Kali) and a small dictionary set called fcicq-dict-unidct-20100410.tce. So far, can't find a match for my WPA2 password. Either the dictionaries are crap, or my password is very secure.

Technically, it IS possible to crack WPA/WPA2 without using dictionaries. Instead of cracking the WPA password, you crack the WPS PIN, and get in that way. Using the open-source reaver, Inflator scans for a WPS-enabled AP, then uses brute-force attack to guess the WPS PIN. It does take a couple of hours minimum, especially if the router has AP rate-limiting feature, but Inflator/reaver will get the password eventually.

Wireshark Can't Decode Gy Diameter Packets

Need to look at some specific Diameter AVPs in a tcpdump trace. For some reason, I'm only getting the intial Gx and Gy, but not the update requests.

Packets 8 and onwards look like they're the update Gy messages I'm looking for, but Wireshark is not decoding them as Diameter. Tried to force-decode it using the "Decode as" option, but no dice. Expert info on the SEQ/ACK analysis tells me that these are suspected TCP retransmissions (of the initial Diameter messages), which they're not.

A workaround I came up with is to mark and export the Diameter request-answer pairs into their own pcap files, so Wireshark is able to decode them properly. Not the most elegant solution - quite time-consuming - but it works.

Gave it some thought, and found an even better solution. Go to Edit --> Preferences --> Protocols --> TCP, and disable Analyze TCP sequence numbers.

Voila!

Bypassing Torrent Block

Can't seem to access your favourite torrent sites lately? Getting an error page that says "Access to this website has been disabled"? That's your tax dollars at work. (Sort of.)

As requested by Foxtel and Village Roadshow, the Australian Federal Court has ordered the major ISPs (Telstra, Optus, iiNet, Dodo, TPG, etc.) to block access to 5 torrent sites, specifically:

• The Pirate Bay
• Torrentz
• TorrentHound (I thought this has already been shut down?)
• IsoHunt, and
• SolarMovie

From what I've read, Foxtel and Village Roadshow will have to pay the ISPs $50 for every domain that is blocked. Any new domains that they want blocked will have to go through the courts.

Based on my experience, Telstra and Optus are using DNS blocking. Simplest workaround is to use another DNS server, instead of your ISP's. Change your WiFi/Ethernet connection's DNS server configuration to point to for example, Google's DNS servers, 8.8.8.8 and 8.8.4.4. Problem solved.

2 DS in 2 Days

No, not a 2DS. What I meant was, I somehow managed to get two DS consoles in two days.

So my kid saw me playing on my Nintendo DS Lite, and he wanted one for himself. Had a quick look on eBay and Gumtree. Would you believe these things are still selling for around $50 to $100 (from DS Lites to DSi's and DSi XLs)?

Anyway, found this guy on Gumtree selling his DSi and DSi LL relatively cheap ($20 and $30, respectively). Reason why they're cheap is because they're Japanese consoles, and there's no way to switch the language to English (Yes, I checked.) They should be able to take in any region cartridge and you should be able to just play away. Between the two, I decided to get the LL. (Bigger is always better.) I probably would've also bought the other one, if only he can find it. Instead of buying game cartridges, I went to oz3ds.net and bought myself an R4i Gold 3DS flashcart. True, there are cheaper alternatives out there, but I was told this is the gold standard.

Now that I think about it, I should've bought a DS Lite (since I already have an extra R4 DS just lying around), instead of buying the DSi LL, plus the flashcart. So this time I started looking around for a DS Lite. Found one for sale on Gumtree for $5. By the time I inquired, price has gone up to $20 ("due to popular demand"). I guess a lot of potential buyers got turned off by the price increase because I managed to snag it. Heck, even comes with an M3DSReal flashcart. Not the best, but hey, it's free. For the latest firmware, go here or here.

Downloading Brightcove Videos

Got some Brightcove webinars from work that I need to download, but finding it quite challenging. Most of the blog posts talk about disabling Flash, enabling developer tools, then setting device emulation and/or user-agent spoofing to Apple iPad.

Logic here is that Brightcove typically transports videos via Flash, as this makes saving videos for offline very difficult. By spoofing the device as an Apple iPad, the theory is that the Brightcove player should fallback to HTML5 mode and we should then be able to save the file as mp4.
So the steps are:

1. Disable Flash via chrome://plugins
2. Go to Developer Tools (Ctrl-Shft-I), and switch to Apple iPad mode.
3. Go to Network tab and filter for mp4.
4. Reload the page (F5) and wait for the mp4 link to show up.

What I noticed is that disabling the Flash plug-in doesn’t really help. I’m not seeing any mp4 URL. Other blog posts talk about rtmp hacking. Again, I don’t see any reference to rtmp on the Network tab.

Now that I think about it, Brightcove probably doesn’t even use Flash anymore, as almost everyone else is now using HTML5 for video streaming. A closer look at the network traffic shows that the Brightcove player is sending over binary blobs of video using xhr (XMLHttpRequest/Response). It’s possible that the player is not falling back to mp4 mode because it assumes the Apple iPad (and Safari) can handle HTML5 XHR. To test my theory, I switched the device emulation to Google Nexus 4, and this time the tricked worked just fine – even without disabling Flash. On the Network tab, I can see the mp4 link, which can be copied and pasted to your favourite downloader.

While this worked for now, there’s no telling what Brightcove might come up next. For reference, below are some blog posts on what other people have done.

Using rtmp:
http://johntantalo.com/blog/extracting-video-from-brightcove-player-with-rtmpdump/
http://forum.videohelp.com/threads/354508-Brightcove
http://www.benfrancom.com/2016/03/17/download-brightcove-videos.html
http://mrbluecoat.blogspot.com.au/2013/11/download-brightcove-videos-tutorial.html
https://www.reddit.com/r/techsupport/comments/2ro9vn/need_help_downloading_embedded_video/

Using mp4 fallback:
http://grumblesmeckerecke.blogspot.com.au/2015/01/how-to-download-brightcove-videos.html
http://words.bombast.net/download-brightcove-videos/
http://www.mikewebguy.com/2013/08/20/save-brightcove-videos-from-google-chrome/
https://tjkelly.com/blog/how-to-download-brightcove-video/

Nougat on Grouper

Who would believe that the Nexus 7 (2012) 32GB WiFi tablet is still selling for $200 on ebay?! I mean, this thing is already 4 years old! I found someone selling it for $35 on Gumtree, so I immediately snatched it up.

Latest factory image for nakasi (a.k.a. grouper) is Android 5.1.1 (LMY47V). A check on XDA-Developers show that there's an unofficial AOSP 7.1.1_r4 Nougat build for it, so guess which one I went for?

Before anything anything else, given that this is a stock device, you have to first unlock the bootloader, root, and install a custom recovery. All these are done with WugFresh's Nexus Root Toolkit. Just tell NRT what Nexus device you have, and on what software level, and it will take care of downloading all the files that you need from the Internet. Remember to enable USB debugging on the device first!

If NRT/adb cannot detect your tablet when connected to your PC's USB port, you might have to download and install the Nexus 7 USB drivers:
https://developer.android.com/studio/run/win-usb.html
https://androidmtk.com/download-google-nexus-usb-drivers

If the drivers won't install properly on Windows 8.1 or Windows 10, you might have to disable Driver Signature Enforcement:
https://www.youtube.com/watch?v=Z6HbmjXONuk

Download ROM, 7.1 pico Gapps, and SuperSU here:
http://forum.xda-developers.com/nexus-7/development/rom-android-7-aosp-grouper-t3467514
Gapps have to be pico or else it won't fit in the /system partition given the size of the ROM.
With SuperSU, we'll be doing a systemless install (via recovery) to prevent potential bootloops.

In summary, here are the steps:

1. Enable USB debugging on N7 (via Developer Options) and connect to PC via USB.
2. Using NRT, unlock bootloader. Takes a loooong time for the N7 to boot up. Have patience.
3. Enable USB debugging again.
4. Again using NRT, root and install customer recovery.
5. Boot to recovery using NRT's Advanced Utilities.
6. Wipe --> Factory Reset. You might also want to Format Data if you want to start fresh with no leftover crap.
7. Reboot to system. At this point, you can copy the ROM, Gapps, and SuperSU zips to the device via MTP.
8. Again, boot to recovery using NRT's Advanced Utilities.
9. Flash ROM and reboot to recovery.
10. Flash Gapps and reboot to recovery.
11. Mount the /data partition, if not already mounted.
12. Open Terminal and enter the following command: # echo "SYSTEMLESS=true" >/data/.supersu
13. Close Terminal and flash SuperSU.
14. Reboot system.

Enjoy that Nougat goodness on your grouper!