RIM has the keygen published on their website but you need a password to get to it (Perhaps it is for partners only?) You can see the site here: https://www.blackberry.com/EngineeringScreens/

Earlier this year a few websites published their own keygen to compute the unlock code. Much to my dismay, however, none of them decided to share exactly how they did this. With that, I decided to discover the unlock code myself and publish the results.

The unlock code is actually a simple HMAC digest with a SHA1 variant. The trick is knowing what data to throw at the algorithm to produce the proper unlock code. The data used includes:

1. The BlackBerry device PIN
2. The application version (including parentheses if provided)
3. The current uptime of the device in seconds
4. The unlock duration
5. The secret sauce

The relevant data needed was found by inspecting “net.rim.device.internal.EScreens.EngScreenSecurity”, however, I will not go into the details of that here. Once I found the unlock duration codes and the secret key, it was just a matter of putting them into a standard HMAC hash function and out came the unlock code.

In order to use an unlock code, you simply visit the “Help Me!” screen by pressing alt+shift+H on your BlackBerry device to get the necessary information, generate a code, and then type it directly into the Help Me screen. No characters will be echoed, but if you enter it correctly, the screen with change over to the “Engineering Screen” main page. Do note it is possible to make some changes in the “eScreen” that could cause your phone to operate improperly or even break completely so do proceed with changing values at your own risk.

Now I wont point fingers at the various people that have already discovered how this is done but refused to share the code or details with anyone. They are what prompted me to undertake this project in the first place. With that, I give you the Python source code to my basic unlock code keygen:

#!/usr/bin/env python
 
import hmac
import hashlib
 
pin = 'ffaa0000'            # Device PIN                [XXXXXXXX]
app = '4.6.0.100 (233)'     # OS Application version    [n.n.n.n (n)]
uptime = '12345'            # Uptime in seconds             
duration = 30               # Duration for key to last  [1, 3, 6, 15, or 30]
 
lifetime = {
 1: "",
 3: "Hello my baby, hello my honey, hello my rag time gal",
 7: "He was a boy, and she was a girl, can I make it any more obvious?",
 15: "So am I, still waiting, for this world to stop hating?",
 30: "I love myself today, not like yesterday. I'm cool, I'm calm, I'm gonna be okay"
}
 
secret = 'Up the time stream without a TARDIS'
 
data = pin + app + uptime + lifetime[duration]
hash = hmac.new(secret, data, digestmod = hashlib.sha1)
key = hash.hexdigest()[:8]
 
print key

Weighing in at only 25 lines, this shows how simple the algorithm actually is if one only knows how to put it together. If you want a packaged online tool, then by all means check out the other published keygens, but if you are curious how the codes actually are generated (like I was) feel free to take, use, and share this code at your will.

Recently, Google took the reduction of privacy a little further by allowing you to setup a web site badge for Latitude. Up until this point, you could only share your location with select friends, however, now you can share it with the whole world via your website, blog, etc. I do use this, so you can spy on my location if you wish.

But to the privacy elements shall we… When you generate a badge, Google gives you a snippet of HTML code that looks like this:

<!-- Google Public Location Badge -->
<iframe src="http://www.google.com/latitude/apps/badge/api?user=1234567890&type=iframe&maptype=roadmap" width="180" frameborder="0" height="300"></iframe>
<!-- To disable location sharing, you *must* visit http://www.google.com/latitude/apps/badge and disable the Google Public Location badge. Removing this code snippet is not enough! -->

This works fine as is if you place it on your site, however, that number there (1234567890) is actually your API “username” and given inspecting this from your site, any user could simply place your position on their site or access the API by other programmatic methods. Notice Google’s warning that to disable it, you have to disable the badge globally via their site, but what if you just don’t want some people using your badge or plan to put it on a password protected area of your site… This is where a little privacy can help.

What I did for my site is use some PHP code to add a layer of abstraction to the Google Latitude API. It requests the content server side and displays it without ever revealing my Latitude user id. I then include my own PHP page within an iframe just as i would have the Google snippet and that’s it. Here is the simple PHP code to do this:

location.php

<?php
 
$url = "http://www.google.com/latitude/apps/badge/api?user=1234567890&type=iframe&maptype=roadmap";
 
$content = file_get_contents($url);
print $content;
?>

The resulting PHP page will generate a map that fills the entire browser. Then simply add an iframe that references that PHP script and your desired width and height and boom, no one can inspect your user id and you have added a little privacy back to Google Latitude.

<iframe src="location.php" width="650" frameborder="0" height="480"></iframe>

P.S. For the advanced users out there you can also do some creative things with the “$content” object within PHP such as inject your own CSS or even remove elements of the badge that you don’t want on your site since Google gives very limited customization to this.

However, our task was to be able to make outbound calls without the need to use the web interface to place the call. What essentially had to happen is when you dialed a number on your SIP phone, Asterisk would have to talk to the Google Voice site and handle the call setup for you.

***UPDATE***: I worked with Ward Mundy of Nerd Vittles who put togeather a complete solution for both Asterisk 1.4 and 1.6. Additionally we are now using pyGoogleVoice which is a more complete library than Paul’s script below. For the full write up, check out: http://nerdvittles.com/?p=635

Paul then created a Python AGI (Asterisk Gateway Interface) script. It integrates into your dial plan and allows for the call to be made. The logic flow is as follows:

1. You pick up your SIP phone and make a call.
2. Asterisk receives your call and the google-voice-dialout.agi script is called.
3. The script contacts Google Voice and initiates a call based on the number passed to asterisk.
4. Google Voice then dials your Gizmo5 number which rings into Asterisk.
5. Asterisk identifies this call by its caller id and the script binds your outbound call and the incoming call from Google
6. Google proceeds to call out to your destination.
7. Call is connected!

Now a few caveats to this approach. As Paul’s script is essentially screen scraping using unpublished API’s to the Google Voice application, any changes made to their web API could break this script. (As he notes in the script comments) At any rate, at the time of writing it works and the script is available for download here, google-voice-dialout.agi, or shown below for reference.

When I get some more time, I will post details how to integrate this into an Asterisk dialplan and other features.

#!/usr/bin/env python
 
# google-voice-dialout.agi
# Paul Marks (http://pmarks.net)
#
# This is an Asterisk 1.6 script to place outgoing calls through Google Voice.
# It will automatically sign into the web interface, and submit a click2call
# request through your registered Gizmo number.  Asterisk can then answer
# the incoming call, and Bridge() it into your original outgoing call.
#
# I deduced the click2call sequence by using the "Live HTTP Headers" Firefox
# plugin.  If the website changes too much, this script will probably stop
# working, so don't use it for anything too important.
#
# This assumes you've already configured Asterisk to receive Gizmo calls.
#
#
# This rule will redirect outbound calls to this script:
#   exten => _1NXXNXXXXXX,1,AGI(google-voice-dialout.agi)
#
# This rule will connect the inbound GV/Gizmo calls:
#   exten => s/6502650000,1,Bridge(${DB_DELETE(gv_dialout/channel)}, p)
#              ^-- Put your 10-digit Google Voice number here.
#
#
# To test this script from the command line without Asterisk, type the
# following.  Be sure to type a few linefeeds at the end:
#
#   $ ./google-voice-dialout.agi
#   agi_channel:
#   agi_dnid: 18004664411
#
 
# Put your Google login and Gizmo number here:
USERNAME = "username@gmail.com"
PASSWORD = "password"
GIZMO_NUMBER = "17475555555"
 
import httplib
import urllib
import re
import sys
import time
 
class Error(Exception):
    pass
 
def ReadAgiEnvironment():
    env = {}
    while 1:
        line = sys.stdin.readline().strip()
        if not line:
            break
        key, data = line.split(':')
        env[key.strip()] = data.strip()
    return env
 
def SendAgi(cmd):
    sys.stdout.write("%s\n" % cmd)
    sys.stdout.flush()
    sys.stdin.readline()
 
class SimpleCookieJar(object):
    cookie_re = re.compile(r"(?i)set-cookie: (\w+)=([^;]+).*")
    def __init__(self):
        self.cookies = {}
    def addCookies(self, response):
        for header in response.msg.headers:
            m = self.cookie_re.match(header)
            if not m:
                continue
            self.cookies[m.group(1)] = m.group(2)
    def get(self):
        return "; ".join("%s=%s" % kv for kv in self.cookies.iteritems())
 
class GVClickToCall(object):
    USER_AGENT = "google-voice-dialout.agi/1.1"
 
    def __init__(self, username, password, via, dial):
        self.username = username
        self.password = password
        self.via = via
        self.dial = dial
        self.cj = SimpleCookieJar()
        self.h = httplib.HTTPSConnection("www.google.com")
        self.login()
        self.placeCall()
        self.logout()
 
    def login(self):
        print >>sys.stderr, "Logging in."
        postdata = urllib.urlencode({ "Email": self.username,
                                      "Passwd": self.password })
        self.doRequest(
            method="POST", url="/accounts/ServiceLoginAuth",
            body=postdata,
            headers={ "Content-Type": "application/x-www-form-urlencoded" })
 
        # Start at https://www.google.com/voice, and collect cookies as we
        # follow all the redirects.
        PREFIX = "https://www.google.com/"
        location = "/voice"
        for i in xrange(5):
            response, html = self.doRequest(
                method="GET", url=location,
                headers={})
 
            location = response.getheader("location")
            if not location:
                # No more redirects, yay!
                break
 
            # All redirects should fall within the same domain.
            if not location.startswith(PREFIX):
                raise Error("Unexpected redirect: %s" % location)
            location = location[len(PREFIX)-1:]
 
        # Scrape magic _rnr_se value from the HTML.
        m = re.search(r'name="_rnr_se" type="hidden" value="([^"]+)"', html)
        if not m:
            raise Error("Can't find _rnr_se.  Not logged in?")
        self.magic_rnr_se = m.group(1)
 
    def placeCall(self):
        print >>sys.stderr, "Calling %s via %s" % (self.dial, self.via)
        postdata = urllib.urlencode({ "outgoingNumber": self.dial,
                                      "forwardingNumber": self.via,
                                      "_rnr_se": self.magic_rnr_se })
        response, http = self.doRequest(
            method="POST", url="/voice/call/connect",
            body=postdata,
            headers={ "Content-Type": "application/x-www-form-urlencoded" })
        print >>sys.stderr, "Dial response:", http
 
    def logout(self):
        self.doRequest(
            method="GET", url="/accounts/Logout",
            headers={ "Connection": "close" })
        print >>sys.stderr, "Logged out."
 
    def doRequest(self, headers, **kw):
        headers["User-agent"] = self.USER_AGENT
        headers["Cookie"] = self.cj.get()
        self.h.request(headers=headers, **kw)
        response = self.h.getresponse()
        self.cj.addCookies(response)
        return response, response.read()
 
def main():
    env = ReadAgiEnvironment()
    print >>sys.stderr, env
 
    agi_channel = env["agi_channel"]
    agi_dnid = env["agi_dnid"]
 
    # Write the channel ID to Asterisk's database, so it can be accessed
    # by the incoming call when it arrives.
    SendAgi("database put gv_dialout channel %s" % agi_channel)
 
    SendAgi("answer")
    try:
        GVClickToCall(username=USERNAME, password=PASSWORD,
                      dial=agi_dnid, via=GIZMO_NUMBER)
 
        # Asterisk should patch in the incoming call while we're asleep.
        time.sleep(10)
    finally:
        SendAgi("hangup")
 
if __name__ == '__main__':
    main()

DISCLAIMER: Stripping DRM from eBooks treads heavily on the DMCA. Any instructions here should be considered to be for educational purposes only. Therefore you are responsible for how you use this information.

Here were the steps I followed to free my books from my iPod:

Step 1

First you need an iPod or iPhone. I find it is easiest and most cross-platform to use a jailbroken device as that makes this process all the easier.

Step 2

Install the Kindle app from the App Store

Step 3

When you open the app for the first time, you will be prompted for your Amazon.com username and password. Once you enter this your device will be registered and you can purchase books from the Amazon Kindle Book Store.

Step 4

UPDATE: Amazon has taken the “security by obscurity” route and removed the UUID from the website. You can still find it easily by connecting your iPod/iPhone to iTunes and when you see the Serial Number, click on the word “Serial Number” and it will change to “Identifier” this is the string you are looking for. Here is a picture for clarity.

Step 5

Purchase your favorite book from the Store ;-) Your purchase will be automatically downloaded by the app once you are connected to the internet.

Step 6

This is the tricky part. Now that you have the books purchased and on your iPod/iPhone you will need to get them off. There are two routes here. A few folks over at MobileRead.com mentioned that you can use the iPhone Backup Extractor, however, at this time it is only for Mac OS X.

UPDATE: fugislider informed me there is also a iPhone Backup Extractor version for Windows and Linux you can use as well if you don’t want to jailbreak your device.

The better solution in my opinion is to use a jailbroken phone and copy the books direct from the device using SCP or similar mechanism. I wont go into the details of how to jailbreak or SCP files as that is covered by several other articles…

The eBooks are stored as .prc files which are DRM’d MobiPocket format. (Same as the Kindle, no surprises there) You can find all of them in this folder on the iPod / iPhone:

1

/var/mobile/Applications/{Appplication UUID}/Documents/eBooks

There are also some .mbp files in the directory, which seem to be unneeded for extracting the books. Also note they have some crazy names that don’t appear to correlate to their actual title, so you will have to rely on software such as Calibre to read the headers and tell you what files you have.

Step 7

Well, there is no longer a Step 7. Sorry.

On March 11, I received notice from Amazon.com to remove the instructions relating to removal of the DRM from the books. I left the first 6 steps intact since they do not relate to breaking any portion of the DRM and are in full compliance with the DMCA. If you want to remove the DRM from these books you will have to find instructions elsewhere.

The End!

In this part I will describe how I setup this system. I had specific goals in mind so this may need to be adapted for your needs. Additionally I will briefly cover the Subversion setup that was required to make this work.

Goals

1. Multiple Trac projects needed to be hosted
2. Seamless integration to the Subversion server
3. Simple adding of new projects without the need for configuration changes
4. Single Sign On (SSO) for all projects (see #5)
5. Centralized authentication for all projects (one account is all you need)
6. Per project authorization / permissions

Requirements / Supplies

1. Ubuntu Server 8.04.1 LTS
2. Subversion 1.5
3. Python 2.5
4. Setuptools (for Python)
5. Trac 0.11.3
6. Apache 2
   1. mod_wsgi
   2. mod_dav

Preliminary Notes

In order to attain the goals I mentioned before, I determined the easiest way to proceed was to use subdomains for the “sections” and then subdirectories for the projects. For example:

http://dev.mydomain.com/<project1>
http://dev.mydomain.com/<project2>

and

http://svn.mydomain.com/<project1>
http://svn.mydomain.com/<project2>

Additionally, it is important to note that I will be applying authentication at the root of each subdomain (thus there is no anonymous access to the Trac instances. If this is not what you want, it is possible to modify your Apache configuration to allow anonymous access.

When I am referring to configuration names and paths, I will use to represent any generic project name for which you may have a Trac and Subversion instance.

Procedure

First of all we will need to prepare space on the server for the Trac instances as well as the Subversion repository. These can really be anywhere but for my server I chose the following:

Subversion Repositories: /var/repos/
Trac Instances: /var/trac/

Next we will setup the Apache2 server for the Subversion server. I will assume you are familiar with making a new VirtualHost within Apache and will just go over the snippet for the Subversion handler.

1
2
3
4
5
6
7
8
9
10
11

<Location />
    AuthType Basic
    AuthName "My Subversion Server"
    AuthUserFile /var/trac/htpasswd
    Require valid-user
 
    DAV svn
    SVNParentPath /var/repos/
    SVNListParentPath on
    AuthzSVNAccessFile /etc/apache2/subversion.authz
</Location>

The first section deals with enforcing authentication. Notice that it points to /var/trac/htpasswd which will be the global password file for all Trac instances and Subversion.

Also, I used the SVNParentPath to point to /var/repos so that it will automatically map any repository under that path without having to change the VirtualHost.

Notice also the AuthzSVNAccessFile. This is the permissions file for the Subversion server. If you specify this, then you can grant read and write permissions to the repository on a user by user basis. NOTE: If you choose to omit this, then anyone that is in your htpasswd file will be able to write to the repository. For the sake of consistance I placed the global authz file in /var/apache2/

Here is an example “subversion.authz” file:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

# Groups
[groups]
admin = myusername
 
# Global permissions ( "* = "  means default is no access)
[/]
* =
@admin = rw
 
# Permissions for <project1>
[<project1>:/]
 
# Permissions for <project2>
[<project2>:/]
user1 = rw
user2 = r

So, now that we have the Subversion hosting working via apache, we will setup the Trac instance. Start by making sure you have the latest version of Trac installed. At the time of writing this was Trac 0.11.3:

easy_install Trac

Next, you will need the following WSGI handler code to dispatch requests to the Trac server.

Create a file “trac.wsgi” in /var/www/wsgi/

1
2
3

import trac.web.main
 
application = trac.web.main.dispatch_request

After we have this file, we will add the following code to the VirdualHost for trac.mydomain.com:

1
2
3
4
5
6
7
8
9
10
11
12
13
14

WSGIScriptAlias / /var/www/wsgi/trac.wsgi
 
<Location />
    WSGIApplicationGroup %{GLOBAL}
    Order deny,allow
    Allow from all
 
    SetEnv trac.env_parent_dir /var/trac
 
    AuthType Basic
    AuthName "My Trac Server"
    AuthUserFile /var/trac/htpasswd
    Require valid-user
</Location>

Once you have added that restart the web server and you should have the Trac site enabled.

Now we will make a new project called “TestProject”. The following commands will do that:

1
2
3
4
5
6
7
8
9
10
11

cd /var/repos
 
mkdir TestProject
svnadmin create TestProject
 
cd /var/trac
mkdir TestProject
trac-admin TestProject initenv
 
chown www-data:www-data -R /var/repos
chown www-data:www-data -R /var/trac

This will create the Subversion repository as well as initialize the Trac instance.  Note the last two lines where we set the owner of the Subversion and Trac instances to “www-data” this is so that the Apache process owns the files and manages all permissions to them.

Next Steps

The next steps will be to configure your Trac instances. The config for each instance will be located at “/var/trac/<project>/config/trac.ini”. If you used the SVN authz file as I did, there is a place in the config file to specify this:

1
2
3
4

[trac]
authz_file = /etc/apache2/subversion.authz
authz_module_name = <project>
# Where <project> is the repository name.

This configuratuion will ensure that even if someone has trac browser access, they still must have svn autorization otherwise the browser will display a permission denied error.

The End!

I hope you found this useful. If you have any comments or find any errors in my tutorial, please leave me a comment so that I may answer you or fix the issue.

We just release PyAMF 0.4-RC2 yesterday! While it is not quite the final version, this is a huge step for the project and includes a ton of updates and features.

Some highlighted features include:

• cPyAMF – An implementation of PyAMF serialization that results in tremendous speedups.
• SQLAlchemy Adapter – Adapter for the popular Python Database ORM.
• Improved Google AppEngine Adapter – makes deploying Flex/Flash apps on Google’s new service even easier.

You can see our official announcement on the PyAMF Blog.

Currently PyAMF 0.4 is in the Release Candidate stage so we are testing and getting feedback. The release candidate and final version (when it is ready) are available for download here.

Some of the notable changes include:

• Grouped categories into logical groups.
• Better search with context provided along with titles.
• New logo based on old site logo + favicon (with a touch of red)
• A few other interesting features that I may take advantage of in the near future

Everything should be in place, if anyone notices some stray PHP code or CSS trying to escape, please let me know so I can put it in its place.

Last night, Google launched App Engine which allows developers to create web applications and publish them on Google’s infrastructure. The exciting part of the App Engine in my eyes is that the language you use to develop on it is Python. Google provides many API’s to interface the Python programming language with the various services they offer. You can authenticate via Google accounts, use Bigtable to store data, and use Google Aps to bind your application to your own domain. They opened the initial “Preview Release” to the first 10,000 developers to sign up. From the looks of it, those 10,000 spots filled up within the first few hours of the launch.

I was fortunate to be one of the first to sign up and got my account last night. I created a basic hello world application to test and overall the system seems very easy to use. My demo is at http://labs.appspot.com.

I also created an account for the PyAMF project and we were able to get a PyAMF echo server running on App Engine. It is currently located at: http://ae.pyamf.org We are continuing to work with it today and tomorrow to write up some examples and a How-to to get people started quickly. We will continue to add more examples to the site as time progresses and we get everything documented.

The most noticeable addition to Hydra recently has been the addition of the Flex UI. Flex is an open source Flash framework from Adobe that allows for rapid development of Rich Internet Applications (RIAs). Behind the Flex UI is the powerful Twisted framework that powers the data back end. Communication between Flex and Twisted is handled by the PyAMF library. PyAMF is an implementation of Adobe’s Action Message Format (AMF) for Python. This library allows for data to be exchanged in a binary form which is many times faster than the traditional XML mechanism.

Enough talk, lets get to the show! Here is a shot of the CPE LiveGrid module from Hydra. LiveGrid handles adding, searching, modifying, and deleting of CPE’s and assets withing the system. This module was originally based on an XML API, however, after changing to PyAMF speeds over doubled when running:

The second example here is of the CPE LiveDiag module. This allows for real time graphing and analysis of a CPE’s performance in the network and will allow network administrators to make faster diagnostics when problems occur. This module was also a port from its original XML interface to the PyAMF library:

These are just a few of the new interfaces coming in the release of Hydra EMS.

The first step is to make a template directory under your site root for the template. Then add your PHP files to the directory and make the following .htaccess file:

source/theme/apache/.htaccess

1
2
3

AddType text/html .php
AddHandler application/x-httpd-php .php
Options -indexes

The AddHandler statement tells Apache to process the PHP files when used as a template.

Next I added the Directory Indexing statements to the main .htaccess file under the root of the site:

1
2
3
4
5

Options +Indexes
IndexOptions +FancyIndexing +SuppressDescription +SuppressHTMLPreamble +XHTML
IndexOptions +FoldersFirst +IgnoreCase +NameWidth=*
HeaderName /source/theme/apache/header.php
ReadmeName /source/theme/apache/footer.php

And it works! You can see it in action at http://feisley.com/python/