Technology on LEl_FENG Blog

Forum Software Recommendations and Nostalgia

Wed, 03 Jul 2024 20:45:21 +0700

# Forum Software Recommendations and Nostalgia

TL;DR / Geek Summary:

Tech History: Nostalgic look at the evolution of BBS and web forums (XiuNobbs, Discuz, PHPBB, DvBBS).

Platform Review: Highlights XiuNobbs for extreme minimalism and Discuz for its vast (though cumbersome) plugin ecosystem.

Geek Take: Valuing the high openness and information density of forums compared to closed modern social networks.

# What is a Forum?

A forum is a place where many people can chat together, but it lacks the real-time nature of apps like WeChat. Back around the year 2000, early forums were those black-background BBS systems. Everyone used dial-up internet, which was very slow, so all sessions had to be cached locally, replied to, and then uploaded to the server. Today’s forums, such as V2EX and various domestic forums in China, mostly retain the classic thread-based style of those early days with almost no changes. The great advantage of forums is their high degree of openness. It is much easier to find valuable information openly available on the internet through forums. Often, we realize that forums are as old as the internet itself.

# Software Needed to Build a Forum

There are various types of software for building forums; only a few are listed here.

# XiuNobbs

XiuNobbs

This forum software is extremely lightweight. It requires almost no configuration after installation and even supports running on shared hosting (virtual hosts) where restrictions are usually tight.

The Blogger’s Forum

# Discuz

Discuz Official Website

I believe those of you who frequently browse the internet have noticed that Discuz often powers various old forums. Because this forum software has been around for a very long time, its plugin ecosystem is incredibly vast, and many paid plugins even have cracked versions available online. However, the configuration is quite troublesome. If you have a lot of free time, you can give it a try. It is also friendly to shared hosting environments.

2B2T.XIN’s Forum

52pojie (吾爱破解)

Enshan Forum

# PHPBB

This is also a veteran forum software. I haven’t used its plugins much, so I won’t comment on its plugin ecosystem. However, this is another shared-hosting-friendly forum software, though its support for Chinese localization is relatively poor.

PHPBB Official Website

# DvBBS (Dongwang BBS)

This is a “tear of an era”—a forum software based on ASP. Today, we can still download the installation package for DvBBS, but their official company no longer develops forum software.Official Website Archive on the Internet Archive CS1.6 sorpack Forum

# Afterword

Many forums will eventually disappear, so cherish these still-existing forum software and active forums. I believe the internet will continue to thrive and prosper.

Enabling Chrome Download Speed Boost

Wed, 29 May 2024 06:43:44 +0700

# Enabling Chrome Download Speed Boost

TL;DR / [Geek Summary]:

Performance Hack: Tweak browser flags to unlock Chrome’s hidden multi-threaded parallel downloading.

Path: Jump to chrome://flags/#enable-parallel-downloading and toggle it to Enabled.

Gains: Achieve exponential speed boosts without bloating your system with 3rd-party download managers.

When using Chrome , we sometimes need to download large files. Due to Chrome’s default single-thread limitation, it cannot fully utilize bandwidth for downloads. In this article, I will show you how to enable multi-threaded download settings in Chrome.

# Prerequisites

Chrome Browser

# Steps

Open Chrome browser and go to chrome://flags/#enable-parallel-downloading. Set Parallel downloading to Enabled. Then click the Relaunch button.

You can see the download speed has increased from the original 100+ KB/s to around 5-6 MB/s.

# Conclusion

This method allows you to achieve high-speed downloads without using IDM (Internet Download Manager).

Python Nuitka Packaging Tutorial

Fri, 15 Mar 2024 20:20:42 +0700

# Python Nuitka Packaging Tutorial

TL;DR / [Geek Summary]:

Reverse Engineering Shield: Move beyond PyInstaller’s transparent packaging; Nuitka compiles Python to C++ to fortify your source code.

Performance Leap: Leverage native machine code for faster execution, breaking the efficiency bottlenecks of pure interpretation.

Deployment Guardrails: Stick to stable Python 3.8.10, avoid non-ASCII paths, and use --onefile with zstandard for optimized binary distribution.

Python’s running speed and source code decompilation have always been a difficult problem. However, after using Nuitka, you will enjoy the speed of C++ and avoid the worry of being completely decompiled from the source code after being packaged by pyinstaller

# Explain the difference between pyinstaller and Nuitka

The difference between the two is that pyinstaller is cooking on the spot, and everything is clearly seen by the people present (unpacking the source code), but Nuitka is a bunch of things into a paste and you don’t know what is in it. You can only roughly guess what this thing does (disassembly can only get the assembly but not the source code)

# Python version selection

The older the Python version, the better, and the more compatible it is. Choosing python 3.8.10 is enough

# Notes

The installation directory cannot have Chinese, otherwise there will be a lot of bugs that you can’t solve

# PIP installs some things

1
2
3


pip install ordered-set # Accelerate compilation
pip install nuitka # Main program
pip install zstandard # Compress files when onefile

# One-click command

1

python -m nuitka --mingw64 --standalone --output-dir=out --show-progress --onefile main.py

You can save it as build.bat so you can open it and use it

X64DBG Modify String

Sun, 01 Oct 2023 15:08:31 +0700

# X64DBG Modify String

TL;DR / [Geek Summary]:

Reverse Engineering 101: Use x64dbg to intercept and modify static strings within a binary without source code access.

Patching Pipeline: A complete walkthrough from global module string searching and hex editing to exporting permanent binary patches.

Practical Customization: Demonstrated on a Minecraft GC sample to show how low-level binary manipulation can rebrand or tweak software UIs.

# Preface

I was using x64dbg to study a program and suddenly thought of what would happen if I changed the string. This program is a Minecraft GC that I found on the Internet and put it in the following link for use

Lanzoue Cloud Access password: gy99

Compression password: GgGg313df

# Start

Open our x64dbg This software is a reverse software that can be downloaded on github. After opening the software and opening our sample program

Then right click and there will be a tab

Then we scan Search and then scan All modules and then click String

After the analysis, we directly enter the characters and click the unique string

Then modify the string according to hexadecimal

After the modification, right-click the file in the upper left corner and click Patch

After applying the patch, the file modification is complete

Video Hosting Methods

Sun, 17 Sep 2023 21:45:02 +0700

# Video Hosting Methods

TL;DR / Geek Summary:

Anti-censorship architecture: Leveraging the GitHub + Cloudflare Pages pipeline for persistent, high-bandwidth video hosting.

Optimization stack: Custom Python-based FFMPEG automation for 30FPS transcoding and bitrate compression to ensure smooth edge delivery.

UI injection: Implementation of a modified Hugo shortcode using DPlayer with lazy-loading, visibility-aware pausing, and custom CSS interactions.

# Free Ways for Video Hosting

Yes, I finally chose the simplest method to combat the annoyance of malicious reports resulting in takedowns.

# Origin

# Practice

I used ffmpeg to transcode and compress my videos. For the specific code, check my previous article FFMPEG Batch Compression and Conversion to 30FPS . Then, I started looking for hosting methods and found Cloudflare Pages, which has unlimited traffic. Uploading to GitHub and accessing the filename is a seamless process.

# Modified Hugo Shortcode

Changed video.html to this:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49


{{- $src := .Get "src" | default (.Get 0) -}}
<div id="dplayer"></div>

<link rel="preload" href="https://lib.baomitu.com/dplayer/1.25.0/DPlayer.min.css" as="style" onload="this.onload=null;this.rel='stylesheet'">
<script src="https://lib.baomitu.com/dplayer/1.25.0/DPlayer.min.js" defer></script>
<script defer>
document.addEventListener('DOMContentLoaded', function () {
 var dp = new DPlayer({
 container: document.getElementById('dplayer'),
 screenshot: false,
 video: {
 url: '{{- $src -}}',
 type: 'auto'
 },
 preload: 'none',
 lang: 'en'
 });

 dp.on('fullscreen', function () {
 dp.fullScreen.request('web');
 });

 dp.on('timeupdate', function () {
 if (dp.video.currentTime === 0) {
 dp.seek(1);
 }
 });

 document.addEventListener('visibilitychange', function() {
 if (document.hidden) {
 dp.pause();
 }
 });

 var dplayerContainer = document.getElementById('dplayer');
 var timer;

 dplayerContainer.addEventListener('mouseleave', function() {
 timer = setTimeout(function() {
 dplayerContainer.style.border = 'none';
 }, 1000);
 });

 dplayerContainer.addEventListener('mouseenter', function() {
 clearTimeout(timer);
 dplayerContainer.style.border = '';
 });
});
</script>

MP4 to Streaming Video Conversion

Tue, 12 Sep 2023 22:10:08 +0700

TL;DR / [Geek Summary]:

Protocol Transcoding: Use FFmpeg to slice standalone MP4s into HLS (M3U8+TS) streams for smooth web delivery.

Keyframe Tuning: Force I-frame injection via -force_key_frames to fix slice misalignment and player stuttering.

Full-Stack Logic: Covers advanced CLI tricks plus multi-language (PHP/Python/Go/Rust) snippets for merging TS slices back to MP4.

FFmpeg is a set of open source computer programs that can be used to record, convert digital audio and video, and convert them into streams. It provides software for recording, converting and streaming audio and video.

Download from official website http://www.ffmpeg.org/download.html and configure the environment after decompression

# Convert MP4 to M3U8

M3U8 is the Unicode version of M3U, encoded in UTF-8. Both “M3U” and “M3U8” files are the basis of the HTTP Live Streaming (HLS) protocol format used by Apple, which can be played on devices such as iPhone and Macbook.

Simply put, m3u8 is a video format that divides a video into many small parts, which makes it easier to load the video.

# Simple operation, low efficiency

1

ffmpeg -i input.mp4 -c:v libx264 -c:a aac -strict -2 -f hls -hls_list_size 2 -hls_time 15 output.m3u8

The generated effect is:

Generate a ts file every 15 seconds for the input.mp4 video file, and finally generate an m3u8 file. The m3u8 file is the index file of ts.

We can directly open the m3u8 file with playback software such as VLC media player, just like playing mp4.

The default length of each piece is 2 seconds. The m3u8 file only saves the information of the latest 5 pieces by default, resulting in only the last small part of the last playback (pay special attention when live streaming). -hls_time n sets the length of each piece. The default value is 2, in seconds. -hls_list_size n Set the maximum number of entries saved in the playlist. If set to 0, all the information of the film will be saved. The default value is 5. -hls_wrap n Set the number of films to start overwriting. If set to 0, no overwriting will be done. The default value is 0. This option can avoid storing too many films on the disk and limit the maximum number of films written to the disk. -hls_start_number n Set the value of sequence number in the playlist to number. The default value is 0. Note: The sequence number of the playlist must be unique for each segment, and it cannot be confused with the file name of the film (when using the wrap option, the file name may be reused).

For more parameters, please see the document: ffmpeg.org/ffmpeg.html#Video-Options

# Efficiency optimization, improve efficiency

TS file is an extension of a media, which is a packaging format for Japanese high-definition cameras. MPEG2-TS (Transport Stream; also known as TS, TP, MPEG-TS or M2T) is a communication protocol for audio, image and data, and was first used in real-time transmission of DVD programs. The characteristic of the MPEG2-TS format is that it requires that any segment of the video stream can be independently decoded.

1
2
3
4


# 1. Video overall transcoding ts
ffmpeg -y -i music.mp4 -vcodec copy -acodec copy -vbsf h264_mp4toannexb out\music.ts
## 2. .ts file slicing
ffmpeg -i music.ts -c copy -map 0 -f segment -segment_list out\music.m3u8 -segment_time 10 out\15s_%3d.ts

# hls_time slicing time inaccuracy

To play the ts slice of m3u8, you must download a ts slice completely before you can play it. Set the hls_time time interval as short as possible (depending on the actual situation). In the actual process, set the slicing time interval to 2 seconds and call the following command:

1

ffmpeg -i test.mp4 -c:v libx264 -c:a aac -strict -2 -f hls -hls_time 2 index.m3u8

But the slice is not performed according to the input parameters.

Reason:

The cutting of ts file is also related to the GOP size of the original file video (that is, the time interval between two I frames), because the first frame of any ts segment must be an I frame, otherwise it cannot be played at the fastest speed, and the first frame is not an I frame, which is meaningless to the player and is directly thrown away by the player. Any video stream must obtain the first I frame to successfully decode the picture. Although it is specified to cut a ts file in 1 second, in fact, since the original video stream may have an I frame for several seconds, it must wait until the next I frame to restart the slicing.

Solution:

Since it is known that a ts segment is generated in 1 second, it is necessary to force a key frame to be generated in one second during the slicing process.

Set the key frame interval, and set the interval to 2 seconds as follows: -force_key_frames "expr:gte(t,n_forced*2)“

Complete command:

1

ffmpeg -i test.mp4 -force_key_frames "expr:gte(t,n_forced*2)" -strict -2 -c:a aac -c:v libx264 -hls_time 2 -f hls index.m3u8

# m3u8 format analysis

The complete m3u8 file has three parts:

index.m3u8, saves the basic information of the video and the order of the segmented files;
key, if the video is encrypted, save the key;
data file, the others are video data files.

Specific content analysis:

#EXTM3U, is the beginning of the file
#EXT-X-VERSION, identifies the HLS protocol version number;
#EXT-X-TARGETDURATION, indicates the maximum duration of each video segment (in seconds);
#EXT-X-MEDIA-SEQUENCE, indicates the sequence number of the first URL fragment file in the playlist;
#EXT-X-PLAYLIST-TYPE, indicates the streaming media type;
#EXT-X-KEY, encryption method, here the encryption method is AES-128, and IV is specified, which is required for decryption;
#EXTINF, indicates the duration of the media fragment specified by the subsequent URL (in seconds).

# HLS

The working principle of HLS is to divide the entire stream into small HTTP-based files for download, and only download some at a time.

While a media stream is playing, the client can choose to download the same resource from many different alternative sources at different rates, allowing the streaming session to adapt to different data rates.

When starting a streaming session, the client downloads an extended M3U (m3u8) playlist file containing metadata for finding available media streams.

HLS only requests basic HTTP messages, and unlike the Real-time Transport Protocol (RTP), HLS can pass through any firewall or proxy server that allows HTTP data to pass through.

It is also easy to use a content distribution network to transmit media streams.

# Merge m3u8(ts) into MP4

# Remote file

1

ffmpeg -i “https://xpdbk.com/demo/ffmpeg/hls265/output.m3u8” -vcodec copy -acodec copy -absf aac_adtstoasc output.mp4

# Local file

Open cmd
Enter the command and merge according to the actual path of the file

Merge into ts file copy /b F:\f\*.ts E:\f\new.ts

Merge into MP4 file copy /b F:\f\*.ts E:\f\new.MP4

And through ffmpeg command as follows:

1
2
3
4
5
6
7
8


Direct conversion:
ffmpeg -i new.ts -c copy -map 0:v -map 0:a output.mp4

Specify audio stream (usually use this):
ffmpeg -i new.ts -c copy -map 0:v -map 0:a -bsf:a aac_adtstoasc output.mp4

Re-encode video:
ffmpeg -y -i new.ts -c:v libx264 -c:a copy -bsf:a aac_adtstoasc output.mp4

# PHP implementation code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


$url = 'https://******.m3u8?Expires=15853412145&OSSAccessKeyId=******&Signature=******';

$ts_content = file_get_contents($url);
$ts_content = explode(',', $ts_content);
$ts_file = array();

foreach ($ts_content as $key => $value) {
 if($key == 0) continue;
 $value = trim($value);
 $ts_file[] = substr($value, 0, strpos($value, '.ts') + 3);
}

$url_prefix = substr($url, 0, strpos($url, '.m3u8'));
$url_prefix = substr($url, 0, strrpos($url, '/') + 1);
$file_content = '';

foreach ($ts_file as $key => $value) {
 $file_content .= file_get_contents($url_prefix . $value);
}

file_put_contents('tmp_out.ts', $file_content);

// FFMPEG_PATH is the bin path to decompress ffmpeg yourself, for example, mine is F:/ffmpeg/bin/
exec(FFMPEG_PATH . "ffmpeg -i tmp_out.ts tmp_out.mp4");

# Python implementation code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66


import os
import sys
import time
from Crypto.Cipher import AES

def fileList(findex):
 rpath = os.path.dirname(os.path.realpath(findex))
 name = rpath.split("\\")[-1]
 fi = open(findex, 'r')
 flag = False
 IV = None
 tl = []
 for line in fi.readlines():
 if line.startswith("#EXT-X-KEY"):
## If IV exists, extract it;
 if line.split(",")[-1].startswith("IV="):
 IV = line.split(",")[-1][5:]
 IV = bytes.fromhex(IV)
 if line.startswith("#EXTINF"):
 flag = not flag
 continue
 if flag:
 tmp = line.strip().split("/")[-1]
 tmp = os.path.join(rpath, tmp)
 tl.append(tmp)
 flag = not flag
 fi.close()
 fk = open(os.path.join(rpath, "key"), 'rb')
 key = fk.read()
 fk.close()
 return name, tl, key, IV

def aes_decode(data, key, IV):
## If no IV value is specified, use the key value directly
 if not IV:
 IV = key
 cryptor = AES.new(key, AES.MODE_CBC, IV)
 plain_text = cryptor.decrypt(data)
 return plain_text

def main():
 fp = os.listdir()
 used = [s[:-4] for s in os.listdir("./result/")]
 for ind in fp:
 if not ind.isdigit():
 continue
 if ind in used:
 continue
 try:
 name, fl, key, IV = fileList(os.path.join(ind, "index.m3u8"))
 except:
 print("-"*30)
 print("[-] Error! file: ", ind)
 print("-"*30)
 continue
 print("[*] Begin process file: ", name)
 start = time.time()
 f = open(os.path.join("./result/", name+".mp4"), 'ab')
 for i in fl:
 with open(i, 'rb') as inf:
 data = inf.read()
 f.write(aes_decode(data, key, IV))
 f.close()
 print("[+] Successfully! Cost time: ", time.time()-start)

main()

# Golang implementation code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39


package main

import (
 "io/ioutil"
 "net/http"
 "os/exec"
 "strings"
)

func main() {
 url := "https://******.m3u8?Expires=15853412145&OSSAccessKeyId=******&Signature=******"

 resp, _ := http.Get(url)
 body, _ := ioutil.ReadAll(resp.Body)
 tsContent := strings.Split(string(body), ",")
 var tsFile []string

 for key, value := range tsContent {
 if key == 0 {
 continue
 }
 value = strings.TrimSpace(value)
 tsFile = append(tsFile, value[:strings.Index(value, ".ts")+3])
 }

 urlPrefix := url[:strings.LastIndex(url, "/")+1]
 var fileContent string

 for _, value := range tsFile {
 resp, _ := http.Get(urlPrefix + value)
 body, _ := ioutil.ReadAll(resp.Body)
 fileContent += string(body)
 }

 ioutil.WriteFile("tmp_out.ts", []byte(fileContent), 0644)

 cmd := exec.Command("ffmpeg", "-i", "tmp_out.ts", "tmp_out.mp4")
 cmd.Run()
}

# Rust implementation code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


use std::fs::File;
use std::io::prelude::*;
use std::process::Command;
use reqwest;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
 let url = "https://******.m3u8?Expires=15853412145&OSSAccessKeyId=******&Signature=******";
 let resp = reqwest::get(url).await?.text().await?;
 let ts_content: Vec<&str> = resp.split(',').collect();
 let mut ts_file = vec![];

 for (i, line) in ts_content.iter().enumerate() {
 if i == 0 { continue; }
 let value = line.trim();
 ts_file.push(&value[0..value.find(".ts").unwrap()+3]);
 }

 let url_prefix = &url[0..url.rfind('/').unwrap()+1];
 let mut file_content = vec![];

 for file in ts_file {
 let resp = reqwest::get(&(url_prefix.to_string() + file)).await?.bytes().await?;
 file_content.extend_from_slice(&resp);
 }

 let mut file = File::create("tmp_out.ts")?;
 file.write_all(&file_content)?;

 Command::new("ffmpeg")
 .arg("-i")
 .arg("tmp_out.ts")
 .arg("tmp_out.mp4")
 .output()
 .expect("Failed to execute command");

 Ok(())
}

# C++ implementation code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71


#include <iostream>
#include <fstream>
#include <string>
#include <vector>
#include <curl/curl.h>

size_t WriteCallback(void* contents, size_t size, size_t nmemb, std::string* s) {
 size_t newLength = size*nmemb;
 size_t oldLength = s->size();
 try {
 s->resize(oldLength + newLength);
 }
 catch(std::bad_alloc &e) {
 return 0;
 }

 std::copy((char*)contents,(char*)contents+newLength,s->begin()+oldLength);
 return size*nmemb;
}

std::string GetFile(const std::string& url) {
 CURL* curl;
 CURLcode res;
 std::string readBuffer;

 curl_global_init(CURL_GLOBAL_DEFAULT);
 curl = curl_easy_init();

 if(curl) {
 curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
 curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, WriteCallback);
 curl_easy_setopt(curl, CURLOPT_WRITEDATA, &readBuffer);
 res = curl_easy_perform(curl);

 if(res != CURLE_OK)
 fprintf(stderr, "curl_easy_perform() failed: %s\n", curl_easy_strerror(res));

 curl_easy_cleanup(curl);
 }

 curl_global_cleanup();
 return readBuffer;
}

int main() {
 std::string url = "https://******.m3u8?Expires=15853412145&OSSAccessKeyId=******&Signature=******";
 std::string ts_content = GetFile(url);

 std::vector<std::string> ts_file;
 std::string delimiter = ",";
 size_t pos = 0;
 std::string token;

 while ((pos = ts_content.find(delimiter)) != std::string::npos) {
 token = ts_content.substr(0, pos);
 ts_file.push_back(token.substr(0, token.find(".ts") + 3));
 ts_content.erase(0, pos + delimiter.length());
 }

 std::string url_prefix = url.substr(0, url.rfind('/') + 1);
 std::ofstream outfile ("tmp_out.ts",std::ofstream::binary);

 for (auto &value : ts_file) {
 std::string file_content = GetFile(url_prefix + value);
 outfile.write(file_content.c_str(), file_content.size());
 }

 outfile.close();

 system("ffmpeg -i tmp_out.ts tmp_out.mp4");
}

# NASM implementation code

1

I don't know

# NODEJS implementation code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


const https = require('https');
const fs = require('fs');
const { exec } = require('child_process');

const url = 'https://******.m3u8?Expires=15853412145&OSSAccessKeyId=******&Signature=******';

https.get(url, (res) => {
 let tsContent = '';

 res.on('data', (chunk) => {
 tsContent += chunk;
 });

 res.on('end', () => {
 const tsFile = tsContent.split(',').slice(1).map(value => value.trim().split('.ts')[0] + '.ts');
 const urlPrefix = url.split('.m3u8')[0];

 let fileContent = '';

 tsFile.forEach((value, i) => {
 https.get(urlPrefix + value, (res) => {
 let data = '';

 res.on('data', (chunk) => {
 data += chunk;
 });

 res.on('end', () => {
 fileContent += data;

 if (i === tsFile.length - 1) {
 fs.writeFile('tmp_out.ts', fileContent, (err) => {
 if (err) throw err;

 exec('ffmpeg -i tmp_out.ts tmp_out.mp4', (err, stdout, stderr) => {
 if (err) throw err;
 });
 });
 }
 });
 });
 });
 });
});

# Kotlin implementation code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


import java.io.*;
import java.net.URL;
import java.nio.file.*;
import java.util.stream.*;

public class Main {
 public static void main(String[] args) throws IOException {
 String url = "https://******.m3u8?Expires=15853412145&OSSAccessKeyId=******&Signature=******";

 String tsContent = new String(Files.readAllBytes(Paths.get(url)));
 String[] tsFile = tsContent.split(",");

 String urlPrefix = url.substring(0, url.lastIndexOf('/') + 1);
 StringBuilder fileContent = new StringBuilder();

 for (int i = 1; i < tsFile.length; i++) {
 String value = tsFile[i].trim();
 fileContent.append(new String(Files.readAllBytes(Paths.get(urlPrefix + value.substring(0, value.indexOf(".ts") + 3)))));
 }

 Files.write(Paths.get("tmp_out.ts"), fileContent.toString().getBytes());

 try {
 ProcessBuilder pb = new ProcessBuilder("ffmpeg", "-i", "tmp_out.ts", "tmp_out.mp4");
 Process p = pb.start();
 p.waitFor();
 } catch (Exception e) {
 e.printStackTrace();
 }
 }
}

A Method for Reverse Engineering a PyInstaller Packaged Program

Tue, 12 Sep 2023 21:45:21 +0700

TL;DR / Geek Summary:

Reverse Engineering: Systematic guide to extracting Python source code from PyInstaller-packaged .exe files.

Toolstack: Leveraging pyinstxtractor.py for extraction and online .pyc-to-.py decompilers for restoration.

Workflow: Compile test script (awa.py) -> Package with PyInstaller 5.13.0 -> Extract entry point and dependency layers from the PYZ archive.

# Reverse engineering the source code of a PyInstaller-packaged exe file

We all know that libraries can be used to compile .py files into .exe files for execution. We will start by compiling a script into a .exe and then decompiling the source code of the .exe to obtain the source file.

# Introduction

We all know that we can use the PyInstaller library to compile .py files into .exe files that can be run. This article will cover compiling scripts into .exe files and then decompiling the source code of the .exe file to extract the source files.

# Environment Tools

Python 3.8.10: Download it yourself if you don’t have it

Pyinstaller library: pip install -i https://pypi.tuna.tsinghua.edu.cn/simple pyinstaller==5.13.0

pyinstxtractor.py: Download address

# Compiling the Program

# Checking the Environment

1

python -V

If the execution is successful, then it’s done.

# Writing the Script

awa.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14



## Function
def test():

print("====666====")

input_text = input("I'm telling you the truth 1")

## Print the formatted time and the content entered by the user
print(datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S ") + input_text)

if __name__ == '__main__':

test()

# Packaging Program

First, install the library pyinstaller used by the packaging program. Here, we use the Tsinghua mirror and specify the 5.13.0 version library.

1

pip install -i https://pypi.tuna.tsinghua.edu.cn/simple pyinstaller==5.13.0

Locate the folder where the script is located. Mine is D:\. cd to this path and enter the following packaging command:

1

Pyinstaller -F awa.py

After the command finishes executing, you will see the completed successfully. field, indicating that the .exe file was successfully generated in the dist folder.

# Reverse Engineering Process

First, we download the decompilation script pyinstxtractor.py and place it in the same working directory as the .exe file we want to decompile.

Then, we continue by cding the dist folder in the command line, entering the following command and executing it:

1

python pyinstxtractor.py awa.exe

After execution, you will see the message Successfully, and a awa.exe_extracted folder will be generated.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33



[+] Processing FDP Configuration Online Update 2.exe

[+] Pyinstaller version: 2.1+

[+] Python version: 3.8

[+] Length of package: 32503973 bytes

[+] Found 141 files in CArchive

[+] Beginning extraction...please standby

[+] Possible entry point: pyiboot01_bootstrap.pyc

[+] Possible entry point: pyi_rth_pyqt5.pyc
[+] Possible entry point: pyi_rth_pkgutil.pyc
[+] Possible entry point: pyi_rth_inspect.pyc
[+] Possible entry point: Download json.pyc
[+] Found 225 files in PYZ archive
[+] Successfully extracted pyinstaller archive: FDP configuration online update 2.exe

You can now use a python decompiler on the pyc files within the extracted direct
ory
``

Enter this folder. Inside, you'll find many files with the extensions `.dll` and `.pyd`, and a folder named `PYZ-00.pyz_extracted`. This folder contains the **dependency libraries** imported by the program. If you've imported other `.py` files, you can use a similar method to decompile those dependent `.py` files.

In this directory, find `awa.pyc` and a file with the same name as your `awa.exe` file.

![Demo](pyinstaller.webp)

Then you can take this `.pyc` file to any `.pyc` to `.py` file conversion website found on search engines to convert it.

How to Build Your Own URL Shortener Service Using Cloudflare Workers

Sun, 27 Aug 2023 21:12:11 +0700

# How to Build Your Own URL Shortener Service Using Cloudflare Workers

TL;DR / Geek Summary:

Serverless Hack: Implementing a DIY URL shortener using Cloudflare Workers and KV storage.

Logic Layer: JavaScript-based request handler with custom path mapping, 404 handling, and random ID generation.

OpSec Warning: Public deployments MUST disable open registration to prevent “dirty link” injection and domain blacklisting.

# How Build Your Own URL Shortener Service Using Cloudflare Workers

A short link, also known as a short URL or short code, refers to a web address that is visually compact. It works by shortening a standard, lengthy URL into a new, much shorter one, making it easier to share and distribute.

The main application scenarios for short links are as follows:

SMS Sending: Using short links in SMS messages can greatly reduce the character count. Nowadays, many marketing text messages utilize short URLs.
Community Promotion: Many community platforms or social networking sites block long links. Due to character limits on microblogs (like Weibo) or keyword link restrictions on platforms like WeChat Official Accounts, short URLs can reduce characters and bypass these restrictions.
WeChat Anti-Blocking: WeChat has various blocking mechanisms in place. Using short links helps avoid exposing the keywords of the original address, effectively bypassing the block.
Dynamic QR Codes (Live Codes): The short URL is fixed, but you can change the destination address by modifying the original link mapped to it in the backend. You don’t need to change the fixed short URL itself, making it act as a middle layer. This is mainly used in situations where the cost of replacing a link is high, such as with pre-generated/printed QR codes.

# Setup

This utilizes the service provided by Cloudflare Workers. The free tier allows up to 100,000 requests per day, which is more than enough for personal use.

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103


const html404 = `<!DOCTYPE html>
<body>
 <h1>404 0.</h1>
 <p>0.</p>
</body>`

// const statichtml = "https://raw.githubusercontent.com/1x000/zdzy/main/duanlnk/index.html"


async function randomString (len) {
 len = len || 6
 let $chars = 'ABCDEFGHJKMNPQRSTWXYZabcdefhijkmnprstwxyz2345678' /****By default, confusing characters like oOLl, 9gq, Vv, Uu, I1 are removed****/
 let maxPos = $chars.length
 let result = ''
 for (i = 0; i < len; i++) {
 result += $chars.charAt(Math.floor(Math.random() * maxPos))
 }
 return result
}
async function checkURL (URL) {
 let str = URL
 let Expression = /http(s)?:\/\/([\w-]+\.)+[\w-]+(\/[\w- .\/?%&=]*)?/
 let objExp = new RegExp(Expression)
 return objExp.test(str) && str[0] === 'h'
}
async function save_url (URL, shortStr) {
 console.log("shortStr:", shortStr)
 let random_key
 if (!shortStr) {
 random_key = await randomString()
 } else {
 random_key = shortStr
 }
 let is_exist = await LINKS.get(random_key)
 console.log(is_exist)
 if (is_exist == null) {
 // Normal, put it in directly
 let stat = await LINKS.put(random_key, URL)
 if (typeof (stat) === "undefined") return random_key
 else return stat
 } else if (!shortStr) {
 // The generated random_key is a duplicate, call recursively
 return save_url(URL, null)
 } else
 // The custom path already exists
 return -1

}
async function handleRequest (request) {
 console.log(request)
 if (request.method === "POST") {
 let req = await request.json()
 console.log(req["url"])
 if (!await checkURL(req["url"]))
 return new Response(`{"msg":"0"}`, { status: 400, headers: { "Content-Type": "application/json" } })
 let random_key = await save_url(req["url"], req["shortStr"])
 console.log(random_key)
 // Successfully saved
 if (Object.prototype.toString.call(random_key) === "[object String]")
 return new Response(`{"data":{"shortUrl":"${random_key}"}}`, { status: 200, headers: { "Content-Type": "application/json" } })
 // Custom path is duplicated
 else if (random_key === -1)
 return new Response(`{"msg":"0"}`, { status: 400, headers: { "Content-Type": "application/json" } })
 // Didn't test what happens when KV is full, assuming it returns an error on put (lazy guess)
 else return new Response(`{"msg":"0"}`, { status: 500, headers: { "Content-Type": "application/json" } })
 }
 const requestURL = new URL(request.url)
 // todo Normalize the '/' in path
 const path = requestURL.pathname.toString().substring(1);
 console.log(path)
 if (!path) {

 const html = await fetch(statichtml)

 return new Response(await html.text(), {
 headers: {
 "content-type": "text/html;charset=UTF-8",
 },
 })
 }
 const value = await LINKS.get(path)
 console.log(value)


 const location = value
 if (location) {
 return Response.redirect(location, 302)

 }
 // If request not in kv, return 404
 return new Response(html404, {
 headers: {
 "content-type": "text/html;charset=UTF-8",
 },
 status: 404
 })
}



addEventListener("fetch", async event => {
 event.respondWith(handleRequest(event.request))
})

# Explanation

This code is a script used to create a URL shortening service utilizing Cloudflare Workers and KV storage. It allows users to input a long URL and receive a short URL that redirects to the original address. It also supports custom paths for short URLs. Here is a tutorial on how to use this code:

Create a Cloudflare account and set up a Workers subscription. You can use the free plan, which allows up to 100,000 requests per day.
In the Workers dashboard, create a KV namespace and name it LINKS. This namespace will be used to store the mapping relationship between short URLs and long URLs.
Create a Worker in the Workers dashboard and paste this code into the editor. You can modify some variables in the code, such as html404 and statichtml, to customize the content of your 404 page and homepage.
Deploy the Worker and assign it a domain name, such as example.workers.dev. This domain will serve as the base address for your URL shortening service.
Visit your domain, and you should see a simple webpage featuring an input box and a button. You can paste a long URL into the input box, click the button, and you will get a short URL. You can also enter a custom path in the secondary input box (if provided by your static html) to specify the exact short URL you want. If the custom path is already taken, you will receive an error prompt.
You can copy the generated short URL and open it in a browser—it will seamlessly redirect to the original long URL. You can easily share this short URL with others to direct them to your intended webpage.

# Warning

If you intend to use this publicly, you must remove the comment slashes from the statichtml variable line. If you want to keep the service private for yourself, please leave it commented out! There are always malicious actors who will inject illegal links into public shorteners, which can result in your domain getting blocked or penalized.

Python converts images to webp

Mon, 07 Aug 2023 19:59:13 +0700

TL;DR / [Geek Summary]:

Site Acceleration: Batch convert bloated JPGs/PNGs to WebP using Pillow to shave milliseconds off page load times.

Script Logic: Automates directory traversal with os.walk and tunes output with fine-grained quality controls (quality=80).

Geek Edge: Reclaim privacy and speed by ditching online converters for a self-hosted, local media preprocessing pipeline.

# Python batch converts images to webp

Python 3.8.10 is required, I don’t want to use online conversion awa

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


import os
import sys
from PIL import Image

def convert_to_webp(input_file, output_file, quality=80):
 try:
 with Image.open(input_file) as im:
 im.save(output_file, "webp", quality=quality)
 print(f"Converted: {input_file} => {output_file}")
 except Exception as e:
 print(f"Error converting file: {input_file}")
 print(str(e))

def process_folder(folder_path):
 for root, dirs, files in os.walk(folder_path):
 for filename in files:
 if any(filename.lower().endswith(ext) for ext in ['.jpg', '.jpeg', '.png']):
 input_file = os.path.join(root, filename)
 output_file = os.path.splitext(input_file)[0] + ".webp"
 convert_to_webp(input_file, output_file)

if __name__ == "__main__":
 folder_path = os.path.dirname(sys.argv[0])
 process_folder(folder_path)

# Comment version

This code is used to batch convert JPG, JPEG and PNG images in a folder to WEBP format.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


import os # Process files and directories
import sys # Get command line parameters
from PIL import Image # Process images

def convert_to_webp(input_file, output_file, quality=80):
 # Function used to convert an image file
## input_file: input image file path
## output_file: output webp file path
## quality: webp file quality, value range 1-100, default value 80
 try:
## Open input image file
 with Image.open(input_file) as im:
## Save in webp format
 im.save(output_file, "webp", quality=quality)
 print(f"Converted: {input_file} => {output_file}")
 except Exception as e:
## Catch exceptions
 print(f"Error converting file: {input_file}")
 print(str(e))

def process_folder(folder_path):
## Function used to process the entire folder
## folder_path: folder path
 for root, dirs, files in os.walk(folder_path):
 for filename in files:
## Check if the file suffix is ​​jpg/jpeg/png
 if any(filename.lower().endswith(ext) for ext in ['.jpg', '.jpeg', '.png']):
 input_file = os.path.join(root, filename)
 output_file = os.path.splitext(input_file)[0] + ".webp"
## Call the conversion function
 convert_to_webp(input_file, output_file)

if __name__ == "__main__":
## Get the current script path
 folder_path = os.path.dirname(sys.argv[0])
 process_folder(folder_path)

# Libraries to be installed

Here are the steps to install the Pillow library:

Make sure you have Python installed.
Open the command prompt (Windows) or terminal (Mac/Linux).
Enter the following command to install Pillow:

1

pip install Pillow

After the installation is successful, you can import the Pillow library for image processing:

1

from PIL import Image

If you encounter permission issues, you can use sudo or add administrator privileges to install:

1

sudo pip install Pillow

1

pip install Pillow --user

In Windows, you sometimes need to upgrade pip using the pip install -U Pillow command to install Pillow.
Pillow has some dependencies, so you may also need to install these during installation.

Example installation command:

Linux system/Mac: pip install Pillow
Windows: pip install Pillow or pip install Pillow --user

The main step is to use pip to install the Pillow library, and then you can import the PIL package in Python code and use Pillow.

# Postscript

Perfectly achieve the requirements of converting webp

Understanding Wireless Security: Deauthentication Frame Analysis and Defense

Mon, 17 Jul 2023 00:00:00 +0700

TL;DR / [Geek Summary]:

Protocol Exploitation: Analyze the 802.11 Deauth management frame flaw to force target devices offline at the physical layer.

Pentest Chain: Use Kali Linux’s Aircrack-ng suite to execute Monitor mode sniffing and aireplay-ng interference attacks.

Hardening: Force-enable 802.11w (MFP) or upgrade to WPA3 to natively immunize your network against spoofed management frames.

Disclaimer: This article is for technical education and security awareness purposes only, aimed at helping readers understand wireless network vulnerabilities. Do not use these techniques in unauthorized environments or for illegal purposes. Unauthorized access or interference with networks is a violation of relevant laws and regulations.

In wireless communication, the 802.11 protocol defines management frames to maintain connection status. Among these, the Deauthentication (Deauth) frame is a vital control mechanism. However, due to historical protocol design limitations, it has often been used to analyze security weaknesses. This article provides a technical analysis of how it works and how to secure your personal network.

# 1. What is a Deauthentication Frame?

In the Wi-Fi standard, Deauthentication frames are a type of management frame. Their legitimate use is to inform a client or Access Point (AP) that a connection is being terminated (e.g., when a user logs out or an AP needs to reboot for maintenance).

# Security Vulnerability:

Earlier Wi-Fi protocols (such as non-Management Frame Protection versions of 802.11b/g/n) do not require these management frames to be encrypted or authenticated. This means a third-party device can spoof the AP’s MAC address and send a Deauth request to a client, which will trust the request blindly and force a disconnection.

# 2. Protocol Simulation Analysis (In Controlled Environments)

To understand defensive mechanisms, researchers often use the Aircrack-ng suite in controlled environments (such as Kali Linux) to observe this process.

# Lab Preparation:

A wireless network card capable of Monitor Mode.
An isolated experimental network with controlled test devices.

# Reconstruction Steps:

Enter Monitor Mode: Enable the wireless card to capture ambient wireless packets.
1

sudo airmon-ng start wlan0
Identify Target and Channel: Observe the operating channel and BSSID (MAC address) of the test AP.
1

sudo airodump-ng wlan0mon
Observe Data Interaction: By sending simulated Deauthentication frames, researchers can observe how clients respond to disconnections and subsequent reconnection attempts (the Handshake process).
1 2

# Example command: Sending test frames to trigger disconnection logic sudo aireplay-ng --deauth 5 -a <AP_BSSID> -c <CLIENT_MAC> wlan0mon

# Experimental Log Reference:

After sending the test frames, the client will disconnect immediately. Researchers can then analyze WPA/WPA2 handshake packets to evaluate encryption strength.

# 3. Common Defenses and Hardening Recommendations

To mitigate risks associated with Deauthentication vulnerabilities, users and administrators can implement the following:

# A. Enable 802.11w (Management Frame Protection - MFP)

This is the most effective defense. The 802.11w protocol encrypts management frames, ensuring that spoofed disconnection frames fail validation.

Recommendation: Set Management Frame Protection to “Required” or “Capable” in your router settings.

# B. Upgrade to WPA3

The WPA3 encryption protocol mandates Management Frame Protection. If your devices support WPA3, enable it to gain native immunity to protocol-level interference of this kind.

# C. Monitor for Attacks

Use Wireless Intrusion Detection Systems (WIDS) to monitor for high volumes of Deauth frames within short intervals.

# D. Physical Layer Defense

Reduce wireless signal leakage (by lowering transmit power or using directional antennas) to shrink the physical range available to potential interlopers.

# Conclusion

The Deauthentication mechanism is an essential part of wireless protocols, but it serves as a reminder that protocol security must evolve. Understanding these principles is not about exploiting vulnerabilities, but about better configuring our network environments to ensure robust and secure connectivity in an increasingly complex digital space.

Learning Suggestion: We recommend studying the IEEE 802.11 standard documentation and regional cybersecurity laws to enhance your technical expertise within legal boundaries.