Author Archive

Friends don’t let friends reinvent System.Security.Cryptography

A fellow coworker is upgrading one of our long time customer’s ASP.NET web site that was originally created in 2003, and all is going swimmingly. Alas, this project could not go gently into that good night.

He makes the web page and code changes, modifies the database, pushes all the changes up to the web site, and the site is working well. Customers are placing orders on the web site, order e-mails are being sent to the site owners with encrypted credit card information, and all are happy.

But there is always a fly in the ointment. All of a sudden, an order is placed on the web site, but when the site owner tries to run a decrypt on the credit card information in the e-mail, the decryption routine is reporting a failure. So naturally, we assume that we broke the code somehow, so we started to dive into the project to see what we did to destabilize it.

He asked for my opinions on this problem, so I came over and we started to go through the VB.NET Framework v2.0 project. While investigating the area of the code containing the exact message that the customer was getting, my blood pressure started to go up right away as we started to see code that looked like this:

If intNumberLength = 16 Then
    'go through each of the 16 numbers and
    'add the code for them into the return string
    intNumber(0) = CType(Mid(strNumber, 1, 1), Integer)
    intNumber(1) = CType(Mid(strNumber, 2, 1), Integer)
    intNumber(2) = CType(Mid(strNumber, 3, 1), Integer)
    intNumber(3) = CType(Mid(strNumber, 4, 1), Integer)
    intNumber(4) = CType(Mid(strNumber, 5, 1), Integer)
    intNumber(5) = CType(Mid(strNumber, 6, 1), Integer)
    intNumber(6) = CType(Mid(strNumber, 7, 1), Integer)
    intNumber(7) = CType(Mid(strNumber, 8, 1), Integer)
    intNumber(8) = CType(Mid(strNumber, 9, 1), Integer)
    intNumber(9) = CType(Mid(strNumber, 10, 1), Integer)
    intNumber(10) = CType(Mid(strNumber, 11, 1), Integer)
    intNumber(11) = CType(Mid(strNumber, 12, 1), Integer)
    intNumber(12) = CType(Mid(strNumber, 13, 1), Integer)
    intNumber(13) = CType(Mid(strNumber, 14, 1), Integer)
    intNumber(14) = CType(Mid(strNumber, 15, 1), Integer)
    intNumber(15) = CType(Mid(strNumber, 16, 1), Integer)
 
    strCharCodes(0) = encrypt_Char1(intNumber(0), intIndexCode)
    strCharCodes(1) = encrypt_Char2(intNumber(1), intIndexCode)
    strCharCodes(2) = encrypt_Char3(intNumber(2), intIndexCode)
    strCharCodes(3) = encrypt_Char4(intNumber(3), intIndexCode)
    strCharCodes(4) = encrypt_Char5(intNumber(4), intIndexCode)
    strCharCodes(5) = encrypt_Char6(intNumber(5), intIndexCode)
    strCharCodes(6) = encrypt_Char7(intNumber(6), intIndexCode)
    strCharCodes(7) = encrypt_Char8(intNumber(7), intIndexCode)
    strCharCodes(8) = encrypt_Char9(intNumber(8), intIndexCode)
    strCharCodes(9) = encrypt_Char10(intNumber(9), intIndexCode)
    strCharCodes(10) = encrypt_Char11(intNumber(10), intIndexCode)
    strCharCodes(11) = encrypt_Char12(intNumber(11), intIndexCode)
    strCharCodes(12) = encrypt_Char13(intNumber(12), intIndexCode)
    strCharCodes(13) = encrypt_Char14(intNumber(13), intIndexCode)
    strCharCodes(14) = encrypt_Char15(intNumber(14), intIndexCode)
    strCharCodes(15) = encrypt_Char16(intNumber(15), intIndexCode)
 
    'strReturnValue = strCharCodes.ToString
ElseIf intNumberLength = 15 Then
    ' you get the idea

And this…

'first char
Select Case Left(strEncodeCard, 1)
    Case "X"    ' these character constants were originally all different
        strCardNumber(0) = "0"
    Case "X"    ' I have masked them out for this blog posting
        strCardNumber(0) = "1"
    Case "X"
        strCardNumber(0) = "2"
    Case "X"
        strCardNumber(0) = "3"
    Case "X"
        strCardNumber(0) = "4"
    Case "X"
        strCardNumber(0) = "5"
    Case "X"
        strCardNumber(0) = "6"
    Case "X"
        strCardNumber(0) = "7"
    Case "X"
        strCardNumber(0) = "8"
    Case "X"
        strCardNumber(0) = "9"
    Case Else
        blnSuccess = False
End Select

(The above code was repeated 32 times, once for each digit of a potential 16 digit credit card number, and there were two sets of these that were switched if the digit position was odd or even. There was definitely some thought put into this. I’m not saying it was good thought, just thought. Perhaps they were paid by the lines of code written?)

OK, I have done things like this from time to time, usually not to this extent, but the original designers and coders of this project at least had the good sense to encrypt the credit card information that was being e-mailed, so maybe it will get better.

Yeah, I was wrong about that, I should remember a tenet of code maintenance that I learned a long time ago: TWGW. (This stands for Things Will Get Worse.) As we stepped through the order that was confusing the system, we came upon this nugget.

'second, select the expiration year code
Select Case intExpYear
    Case 2003
        cryptoExp_Year = "X"    ' these character constants were originally all different
    Case 2004
        cryptoExp_Year = "X"    ' I have masked them out for this blog posting
    Case 2005
        cryptoExp_Year = "X"
    Case 2006
        cryptoExp_Year = "X"
    Case 2007
        cryptoExp_Year = "X"
    Case 2008
        cryptoExp_Year = "X"
    Case 2009
        cryptoExp_Year = "X"
    Case 2010
        cryptoExp_Year = "X"
    Case 2011
        cryptoExp_Year = "X"
    Case 2012
        cryptoExp_Year = "X"
End Select

Of course, the customer had a credit card that expired in 2013, and as such, no character was begin inserted into the encrypted string for the expiration year, and that was causing the problem.

I don’t even know where to begin, except to say that eventually this code was going to break, and that was the day. (System.Security.Cryptography was in .NET Framework v1.1, so they can’t use that as an excuse.) So the moral of the story is, if you are going to reinvent a Microsoft namespace, at least make it work more than six years.

Setting up an Objective-C delegate for the iPhone SDK

Once Ben Gottlieb of Standalone helped me get past the problem of creating and displaying my main view controller class, I set out to figure out how to do an Objective-C delegate. Unfortunately, none of the examples or tutorials I could find on the internet had a simple, straightforward explanation of what I needed to do to get it working.

After much trial and error, and reading up on as many descriptions on delegates that I could find, I got it working. Here are the steps that I had to go through in my code to get it working:

In my view subclass header file, this line was added to the top:

@protocol KeyboardViewDelegate;

This line was added to the class definition in the subclass header file:

id <KeyboardViewDelegate> delegate;

This line was added to the property definitions in the subclass header file:

@property (nonatomic, assign) id delegate;

And this section was added to the bottom of the subclass header file:

@protocol KeyboardViewDelegate<NSObject>
- (void) keyPressHandler:(int)keyPress;
@end

In my view subclass implementation file, this synthesize was added near the top:

@synthesize delegate;

And this section was added to the method in the subclass view that is wired up (via Interface Builder) to be called when a button is pressed on the view:

if(delegate && [delegate respondsToSelector:@selector(keyPressHandler:)]) {
    [delegate keyPressHandler:key];
}

In the view controller header file, of course the view subclass header needs to be included:

#import "KeyboardView.h"

I had to add the delegate name as part of the interface definition in the view controller header, adding the delegate name in angle brackets, changing it to look like this:

@interface MainViewController : UIViewController <KeyboardViewDelegate> {

And at the bottom of the view controller header file, I added a definition for the method that matches up with the one from the keyboard view:

- (void) keyPressHandler:(int)keyPress;

In the view controller implementation file, again the view header subclass needs to be included:

#import "KeyboardView.h"

In the viewDidLoad method of the view controller, during the creation of the view subclass, I had to set the subclass delegate to be the view controller:

CGRect sizeRect = CGRectMake(0, 225, 320, 190);
KeyboardView *view = [[KeyboardView alloc] init];
view.view.frame = sizeRect;
[view setDelegate:self];  // this line is pretty important !!!
[self.view addSubview:view.view];

And at the bottom of the view controller implementation file, thie method defined above is added:

- (void) keyPressHandler:(int)keyPress;
{
    NSLog(@"keyPressHandler just fired");
    // do something here
}

And that is it! When running in the simulator, the method in the view controller is fired whenever the method in the view subclass is fired.

Oh, and by the way, I am using a UIPageControl on my view controller, and I found out that, for some reason, I had to go into the viewDidLoad method and add the following line:

pageControl.backgroundColor = [UIColor grayColor];

If I did not add this line, the page control would never be visible, even though it was working, as when I tapped on either side of it, the code associated with it fired correctly. The background color of the page control was set to gray in Interface Builder. Anyone have any ideas why that would be?

System.MissingMethodException error in System.Data.SqlServerCe

After getting the new development machine up and running for the most part, I started once again to work on the web and client projects that we are going balls to the wall to get finished.

And of course, a roadblock was hit. On the Windows Mobile client, I got through most of the requisite re-referencing and compile errors that inevitably pop up when doing something like this. This client uses the Microsoft Synchronization Services to sync it’s local SQL Server Compact Edition database to our central SQL Server database.

When trying to create a new ServerSyncProviderProxy, the following error is being thrown:

System.MissingMethodException: File or assembly name 'System.Data.SqlServerCe,
Version=3.5.1.0, Culture=neutral, PublicKeyToken=3BE235DF1C8D2AD3', or one of
its dependencies, was not found.

After much headbanging, trial and error on both the 5.0 and 6.0 emulator and on an actual device, Google and Server Overflow searching, and staring at the code, we finally figured out what the problem was. As it turns out, I must have installed the SQL Server Compact Edition Service Pack 1 on my previous machine, and those references were saved and somehow survived in the project. On my new machine, there was a version of SQL Server Compact Edition that was installed by some component (Visual Studio 2008, Windows Mobile SDK, etc.), so to me everything looked OK. However, after installing the SQL Server Compact Edition SP1 on the computer, the error magically went away on the emulator.

As an aside, I tried to put the code on the handheld that it had not worked on previously, and it still did not work. After inspecting the error output, which was different, I found that I needed to redeploy the new SQL Server Compact Edition SP1 Windows Mobile sqlce.ppc.wce5.armv4i.CAB file on the device, unpack it (which overwrote the previous SQL Server CE files on the device), and then all was well.

Stanford iPhone App Programming lecture 12

Lecture 12 from the Stanford University iPhone Application Programming class was hosted by Alex Aybes. Alex covered using the address book functionality provided in the iPhone SDK.

His talk included several demonstrations of the C-based Address Book API, along with some of the ins and outs of Core Foundation, which shares many of the same concepts of the Objective-C based Foundation framework. His demos showed how to use the various person view controllers, getting person entries from the user’s Contacts applications, and diving into these entries to read and update the values existing in the person entry.

This does not directly apply to any of the applications I am currently working on, but no doubt it eventually will be useful in my development efforts. If you have a need to access the address book entries in the iPhone Contacts application, this is the presentation you want to check out.

Stanford iPhone App Programming lecture 11

Lecture 11 from the Stanford University iPhone Application Programming class was hosted by Evan Doll, who is apparently an achiever. He covered text input and displaying views modally, both of which I have had trouble with in my work on my various iPhone app projects that I have started.

His talk included a demonstration on the Clang code analyzer, using the keyboard with UITextView and UITextField controls, displaying and dismissing view controllers modally, and the proper way to dismiss said modal view controllers by setting up delegation in the parent view controller.

I have been developing an application in which it would be awesome to have some kind of custom virtual keyboard for entering data, as none of the canned keyboards seem to exactly fit the bill. This presentation should help me untangle some of the complexities that I have run across in trying to get this application done. Maybe then I too can be an achiever.

NetCFSvcUtil and Windows 7

So I have, for the most part, got the new development machine all set up and running pretty well. But ah, there is always a fly in the ointment…

I have a Windows Mobile client application that talks to a WCF service to move data back and forth. I have been using a batch file that I created that ran the NetCFSvcUtil.exe program included in the Power Toys for .NET Compact Framework 3.5. This tool reads information from the provided URL of the web service and creates C# or VB.NET source files that can be included in your project.

And of course, this utility program does not work on my shiny new Windows 7 RC machine, it gives the following error:

Attempting to download metadata from 'http://www.site.net/Service.svc'
using WS-Metadata Exchange or DISCO.
Error: An error occurred in the tool.
Error: Error in the application.

Some searching for this problem yielded the following posts:

NetCFSvcUtil.exe and Windows 7

Ambiguous error message from NetCFSvcUtil.exe

These links appear to indicate that the NetCFSvcUtil does not work on Windows 7 and there is no workaround just yet. And now I have a nice shiny new VirtualBox Windows XP image that contains installs of the .NET Compact Framework 3.5 with the Power Toys, and a copy of my old batch files, along with a shared folder that I can grab the files when I need them. Thanks Microsoft!

However, it appears that Microsoft does not have the market cornered on “D’oh!” backwards compatibility moments. It appears that some users have had some issues with the load times of Firefox 3.5, and believe it or not, removing the cookies and temporary internet files associated with IE can actually help. I will give you a link to look at while you ponder this interesting nugget.

The Firefox 3.5 fiasco

I guess you could say that Mozilla is a big believer in the More Randomer theory.

Setting up a new development machine

When you are forced to set up a new dev box, it can be a big hassle. (Especially if you, like myself, are a jack of all trades developer and master of none.)

It has taken the better part of a few days for me to overcome all of the problems (too many to list here) in trying to resurrect my old machine and get the new one built and up to speed, but I seem to be able to do actual work now. There are still some tools that I have not installed yet, mainly because I will need to dig around and find the original install CDs, and some less used data and files that I have not got into place on the new box just yet.

The new dev box has a Core 2 Quad chip, 8 GB of RAM, and a 1.5 TB hard drive. It seems to sizzle through the routine tasks much better than the trusty old 2 GHz P4 Precision 380 that I was using. (Although TortoiseSVN still crawls at times, anyone have any suggestions???)

Thanks to my company president Chris, he came through for me on this one in a big way, as per usual.

Stanford iPhone App Programming lecture 10

Lecture 10 from the Stanford University iPhone Application Programming class was hosted by Alan Cannistraro. He covered memory and performance, two topics that are often overlooked when developing software for mobile devices.

His talk included a demonstration on using Instruments to find memory leaks and memory allocations, the dangers of autorelease objects, and using NSThread and an NSOperationQueue to keep the program running during blocking operations.

If I ever get a halfway functional iPhone app developed, the information about finding memory leaks and threading should prove very useful.

CodeStock 2009 recap

Michael Neel has posted a recap of the CodeStock 2009 developer conference.

CodeStock Wiki

Thanks again to Michael for a humdinger of a conference.

Stanford iPhone App Programming lecture 9

Lecture 9 from the Stanford University iPhone Application Programming class was hosted by Evan Doll, clad in another interesting t-shirt. His topic of the day was persisting data on the iPhone by the use of property lists and SQLite databases, and communicating with web services using the JSON framework.

His talk was incredibly informative and straightforward, and I thought the demos that he used emphasized his points perfectly. Specifically, he covered reading and writing arrays and dictionaries to the iPhone’s file system, use of the NSCoding protocol, basic SQLite operations, and a demo that showed using the json-framework to pull down data from the Flickr web site and display image search results in a list. Finally, at the end, Evan talked about passing data between objects (such as from a list controller to a detail view controller).

The SQLite information should prove extremely valuable, as I am going to want to do some data storage in my iPhone app that goes beyond simply storing preferences in the NSUserDefaults area.