If you would like to test this version then downloads are available below. If DroidPad does crash while running it would be very useful to file a bug report (either for the PC part or the Android part); I can then see where it went wrong and fix it.

Downloads

Android

The Android part can be downloaded from the Android Market – search for “DroidPad 2.0″. The old version doesn’t have to be uninstalled.

Please report bugs through the Android bug reporter.

Windows

NOTE: This new version doesn’t currently work with Windows 64-bit. If you have problems installing the drivers then this is most likely the cause.

First, the old version of DroidPad will have to be uninstalled (PPJoy is redundant and can be uninstalled too – if not prompted to do so during DroidPad’s uninstall, remove it now). Make sure the old version of DroidPad is completely removed from your PC before proceeding.

Next, download the new version (link below). This new version does not require PPJoy at all, and should install automatically.

Download DroidPad 2.0 Beta for Windows

Reporting Windows Bugs

If something goes wrong or doesn’t happen as expected, please file a bug through the PC bug reporter. If possible please attach the log files; on Windows XP they are located in C:\Documents and Settings\<Username>\Application Data\droidpad, on Windows 7 in C:\Users\<Username>\AppData\Roaming\droidpad.

Linux

DroidPad 2.0 for Ubuntu can be installed using the PPA ppa:w-shackleton/droidpad-daily. This contains latest versions of DroidPad and will be updated with the latest versions.

Installers for other distros aren’t currently provided however a source package can be downloaded here and built manually.

Bugs should also be reported through the PC bug reporter, however please say that the bug is being reported for Linux.

The download file

Firstly, the extra download file is a minimal version of a debian system – having the same system on each device makes it easier to ensure the same will happen on the same device.

When Network Spoofer is run, the file is loaded (mounted) on the phone to allow the files to be accessed. This is where almost all of the bugs with Network Spoofer not loading occur; for some reason some devices just won’t load the file. If you want to have a go at mounting the file on the phone, then this script is used to actually load it, and the variables used are set by the application itself before running the script.

One of the reasons this stage sometimes doesn’t work is that Android’s app2SD (applications on the SD card) uses this same method to load SD card applications, and this could be interfering on some phones.

Running programs inside the debian system

For programs to function correctly on this new system, a few system folders have to be mounted inside the new system – namely /dev, /proc and /sys. This is also done in the script mentioned above.

The unix command chroot is used to actually run programs inside the new debian system – it makes the program think it has a different ‘root’ (top) folder.

Setting the system up to run spoofs

Inside this new environment (where programs think they are actually running on a debian computer), the script /usr/local/bin/spoof is run. This script uses the phone settings given by the Android app (as well as some detected settings) to set up the phone, ready to start spoofing.

First, it starts arpspoof running in the background on the phone (line 97) which basically gets all internet traffic going first through the phone. The phone tells the victim computer that it is the router, and tells the router that it is the victim – this is called a ‘man in the middle’ attack.

To change information on websites, data travelling on port 80 needs to be redirected to something else (line 115) and then picked up by a proxy server which is started on the phone (line 112). The proxy server can then change or redirect whatever it wants to on the phone.

Changing data on websites

There are a set of scripts in the /rewriters folder in the debian image. Each one waits for URLs to be inputted (typed into it), then returns a new and potentially modified URL. The easiest way to add a new spoof is to add a new script (based off one of the others) along with a text file describing it (see one of the others for an example).

A link is created to the script to be used (line 111), or if multiple spoofs are used a script is created which chains the selected scripts together. There is an option in the configuration for the proxy which tells it to use the linked script to change URLs as they are asked for – this is the key feature of the proxy.

If data on the webpage is changed, the script may download the HTML file, change it and put it in the folder /var/www/images. This folder is visible on a webserver which is run on the phone (see the image flip script for an example)

The spoof is now running – the script then waits for an enter key press before stopping. It then stops the arp spoof, shuts down the proxy and the webserver, removes the port 80 redirect rule and finishes.

I hope this has explained the inner workings and will help people to expand the project, fix issues on certain devices and create more spoofs. If you have a feature that you’ve created / would like implementing, file a request / question or add your own branch of the code on the launchpad code hosting page.

Stage 1 (the code on the website)

For this stage, a Linux computer definitely helps. The Linux file command can reveal (misleadingly) a bit about the code once it is converted to binary. Also note that there is more to the code than is shown on the website – try to find more!

Using GDB to get a memory dump from the program is an easy way to get an answer once you’ve figured out what the code is.

Stage 2

This stage is less of a code cracking challenge, and more of a straight forward programming task. Very little information is provided about what you actually need to do in this stage, however it is useful to know that operand 1 is always an index of a register, starting at 0; even in commands such as movm, the memory address is taken from the selected register, then used to get the value in the memory.

The jmp commands which don’t specify the row of a segment always use cs (this is what it’s for). The jmp commands which specify a register should then also set cs.

The program is self modifying – the program first decodes another part, then runs it. Make sure your program can do this.

Stage 3

Download cygwin and run the program from within it. You need to make a file called ‘license.txt’ containing information which the program will use to give you the password.

Use a disassembler (such as IDA Pro free) to see what the program does. Try to find out what you need to put in license.txt to make it continue.

The extra numbers are located in the previous steps. Look for unused code in Stage 1 and unused numbers in Stage 2 to find numbers that might go here.

I hope these hints will help people having a go at this challenge without giving too much away.

The challenge is to write a Virtual Machine to interpret a block of code given in the instructions – once the program is interpreted, the solution appears in the memory of the virtual computer. The code itself firstly decrypts a section of the memory; this decrypted block is itself a program which is then run by the Virtual Machine.

Solution: Download [tar.gz] [source code repo]

The program can be built using Haskell’s cabal command.

For those who are interested or want to have a go with hexdumps, here is the output of this program:

310433aa40028003520072017301b250
3014c001800010100000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000
3200750c310833324002800352007201
7303b200c3b000301bc001ff00000000
00000000000000000000000000000000
00007510010000000000000000000000
cc000000000000000000000000000000
7d1f15604d4d527d0e276d106d5a0656
4714420eb6b2b2e6ebb4838ed7e5d4d9
c3f08095f182829abd95a48d9a2b3069
4a6965551c7b691c6e04743521262f60
034e371e335439e6bab4a2ada4c595c8
c1e48aece7928be881f0ad98a4d0c08d
ac2252657e272b5a12610a017a6b1d67
474554202f6461373533373066653135
63343134386264346365656338363166
62646161352e65786520485454502f31
2e300000000000000000000000000000
377a07111f1d682532771e62235b4755
53301142f6f1b1e6c3ccf8c5e4ccc0d3
85fd9ae3e681b5bbd7cd87a3d36b366f
6f66553016455e09745c3f292b663d0d
02302835150915ddecb8e2fbd8cbd8d1
8bd582d99af192abe8a6d6d08caad294
cf454667207d44146b456d5403176062
555a4a6661115768750562367d02104b
08224232bae2b9e2d6b9ffc3e98a8fc1
8fe1b8a496f18f81b18d89ccd4787661
723e372356737179637c081120697a14
6805211e322759b7cfabddd5cc9793f2
e7c0ebffe9a3bfa1ab8bbb9e9e8ca0c1
9b5a2f2f4e4e00000000000000000000
00000000000000000000000000000000
00000000000000000000000000000000

The result (and the next stage) are hidden within this data.

Enjoy!

For these new features to work the latest version of the extra files needs to be downloaded.

This version also includes Busybox; this should fix quite a few of the bugs reported. Any log output which includes the text ‘applet not found’ should be fixed.

See the Main Page for more info.

Downloads available on the main page.

I’ve included a new spoof as well, however if there is anything new you’d like to see in this program (new spoofs etc.) then leave a comment below.

The latest version can be downloaded from the Android Market.

See the main project page for more info and downloads.

Building

The basic steps to turn this (or a similar) laptop into a photo frame are to take the screen and lid apart, rotate them round, and secure them to the other half of the laptop again.

Disassembly

The lightweight frame of Portege laptops makes them very easy to disassemble, as there is very little structure to the laptop; the case makes up most of the chassis.

The front case of the screen is held in place with two screws, and is held around the edges, similar to most laptops. Once this is removed, the friction hinges holding the two parts together can be dismantled, detaching the two halves:

The wires here are quite fragile (the screen also has the bluetooth & wifi antennae and the status lights). The visible circuit is a high voltage light controller, so try not to damage it.

At this point, try turning the screen over, so it faces down onto the desk. This may require some disassembly of the main laptop body to loosen the cables, but if the screen can’t be turned over, then it is unlikely that the laptop can be made into a photo frame. If there are only a few cables stopping the screen from being turned, then you could try extending them at your own risk. See this episode of The Ben Heck Show for a warning on extending LCD cables.

Rotating the screen

Once the screen is facing downwards, for some laptops folding the lid over again will result in it being correctly orientated. For the Toshiba M100, part of the screen back has to be cut in the centre to make space for the cables (this laptop has an aluminium lid):

This makes space for the cables when the screen is repositioned:

At this point make sure that the laptop still boots and operates normally.

Fixing the screen

From this point onwards my laptop mod is not perfected, and the method used here to hold the screen is temporary, but does still work.

I put some 2mm machine screws and nuts through the hinges at the bottom of the screen to support it:

and simply used thick double-sided tape to attach the lid to the inside of the main body, either side of the mouse pad. This avoids the mouse buttons being pressed:

at some point I will improve this method of attaching the lid & screen, as this is definitely not the best way. It has the current limitation of also hiding the power button:

Later I will design a proper front to the laptop, which would also safely attach the screen to the hinges.

Mounting the photo frame on the wall

Again, slightly temporary, but I attached the laptop to the wall, in the style of a hanging picture, with a piece of string. Yep.

This works surprisingly well, as the string can go underneath the screws in the laptop back. These screws, the hard drive and battery need to be removed and then replaced after the string is laid:

The string can be fed through into the battery and hard drive compartments.

Software

I installed Ubuntu on the laptop, as the Windows XP installation no longer worked. This allowed me to, as also as using it as a photo frame, use it as an extra desktop monitor to my computer.

Photo updating

My photos were stored on an Ubuntu Server on a Windows (samba) share. To access the photos mount the network share using Linux’s fstab.

To make the screensaver activate when the laptop turns on, enable Automatic Login in ‘Login Screen’ settings.

On your new photo frame, open up a terminal (Accessories->Terminal), then type:

mkdir Pictures/Photos
sudo mkdir /media/photos
sudo apt-get install smbfs

You may also want to install an SSH server for easier control of the photo frame

sudo apt-get install openssh-server

Everything is now installed, so the next step is to set up the access to the photos. Edit the file /etc/fstab, by pressing Alt-F2 and typing:

gksu gedit /etc/fstab

or use the editor of your choice.

At the bottom of the file, add the line:

//SERVERNAME/ShareName	/media/photos cifs  guest,uid=1000,iocharset=utf8,codepage=unicode,unicode  0  0

Replacing SERVERNAME and ShareName with correct settings for you.
If the server always has the same IP address, use this  in place of SERVERNAME.

Syncing photos

In a terminal again, type

export EDITOR=nano
crontab -e

This will open a file. Scroll down to the bottom of it and paste this line into it, replacing USERNAME with your login name

10 * * * * rsync -r --delete-after /media/photos/ /home/USERNAME/Pictures/Photos

Now restart the laptop. It will connect to the remote computer, and each hour rsync will check for photos and copy them onto the laptop. The final step is to set the screensaver to the smallest time interval, and set it to the pictures screensaver. Then in Preferences->Power Management settings, set a suitable brightness and make sure that the screen won’t turn off.

Extra monitor

For me, the best use for this photo frame is as an extra monitor for a computer. This is achieved using a VNC server on the photo frame and the program x2vnc, which bridges mouse and keyboard movements between computers.

On the laptop, open Preferences->Remote Desktop. Check ‘Allow other users to view your desktop’, uncheck ‘You must confirm each access to this machine’, and enter a password for the VNC remote desktop connection. Log out and log back in again.

On your main PC, install x2vnc:

sudo apt-get install x2vnc

Once it is installed, turn on the photo frame and make sure that they are connected to the same network.
Open a terminal on the main PC and run the command:

x2vnc -east PHOTOFRAMEIP:0 -passwdfile ~/.photoframepass

Replace PHOTOFRAMEIP with the IP address of the photo frame. This can be found by running ‘ifconfig’ on the photo frame, and looking for the line that says ‘inet addr’ just underneath eth0 or wlan0. If the new screen is on the left of the PC, replace -east with -west.
This should, if all is set up correctly, should connect to the photo frame, showing a notification on it. For the first time it will ask for the password, but after that the login won’t need a password. To make the connection start automatically, add the line to a new entry in Preferences->Startup Applications, causing it to start when you log in.

Once connected, you should be able to move the mouse and use the keyboard seamlessly between the two computers, effectively giving you an extra monitor.