Victor's Blog

Zeno's Paradox for a Bouncing Ball

2014-07-13T01:42:00+00:00

If a ball is thrown up to a height $h$, falls to the ground, and retains a certain fraction $a$ of its energy when it bounces, it will stop bouncing after a certain amount of time. This is paradoxical as it will have bounced an infinite number of times when it stops.

The fraction of retained kinetic energy is the same as the fraction of retained height:

$$E_n=aE_{n-1}$$
$$mgh_n=mgh_{n-1}a$$
$$h_n=h_{n-1}a$$
$$h_n=h_1a^{n-1}$$

The total distance traveled must be finite, as it is a geometric series that converges: $$d=\displaystyle\sum_{n=1}^\infty h_n=\displaystyle\sum_{n=0}^\infty a^nh_1=\frac{h_1}{1-a}$$

The time it takes for a ball to reach a certain height and come back down is: $$t_n=\sqrt{\frac{8h_n}{g}}=(\sqrt{a})^{n-1}\sqrt{\frac{8h_1}{g}}=t_1\sqrt{a}^{n-1}$$

Time also converges and the total time is also finite: $$T=\displaystyle\sum_{n=1}^\infty t_n=\sqrt{\frac{8h_1}{g}}\displaystyle\sum_{n=0}^\infty (\sqrt{a})^n=\sqrt{\frac{8h_1}{g}}\left(\frac{1}{1-\sqrt{a}}\right)=\frac{t_1}{1-\sqrt{a}}$$

After that amount of time, the ball has bounced an infinite number of times and has stopped bouncing. After each bounce, the ball’s distance is smaller, but the time is also smaller, so both the total time and distance converge to a finite value.

Uniformly Distributed Tweets

2014-03-22T01:49:00+00:00

For my Grammar bot, I added a new feature: GPS coordinates are added to the tweets. This is just for fun and serves no practical purpose.

However, I wanted the tweets to be uniformly distributed over a sphere. Earth’s shape is not a sphere, but the error is under 1%.

$a$ and $b$ are random values uniformly distributed in $[-1,1]$ $$latitude=\theta=\sin^{-1}(u)$$
$$longitude=\phi=\pi v=(180^{\circ}) v$$

According to Wolfram MathWorld, points are randomly distributed over a sphere if:

$\theta$ represents latitude and $\phi$ longitude.
$u$ and $v$ are uniformly distributed in $[0,1]$

$$\theta=\cos^{-1}(2u-1)$$
$$\phi=2\pi v$$

Adjusting $u$ and $v$, now distributed in $[-1,1]$, we get: $$\theta=\cos^{-1}(u)$$
$$\phi=\pi (v + 1)$$

However, latitude is to be in -90 to 90 degrees, not 0 to 180 degrees, and longitude is to be in -180 to 180 degrees, not 0 to 360 degrees. $$\theta=\cos^{-1}(u)-\frac\pi2=-\sin^{-1}u$$
$$\phi=\pi v$$

By spherical symmetry, the negative sign can be removed from latitude, and the distribution will remain the same.

Buffalo buffalo ...

2014-03-06T23:06:00+00:00

Although I have already proven that a repetition of the word ‘buffalo’ $n$ times is grammatically correct, if $n \geq 2$, a year ago, I am now publishing this finding.

‘buffalo’ is a plural noun, allowing the use of zero articles
‘buffalo’ is also a verb that means to bully, confuse, deceive, or intimidate

Theorem:

Repeating $n$ times, where $n \geq 2$, any word that can be a noun or verb forms a grammatically valid sentence.

Proof:

A sentence containing 2 instances of the word is grammatically valid.

[_S [_N I] [_V am]]

The first instance acts as a noun, and the second acts as an intransitive verb.

[subject verb]
[_S [_N buffalo] [_V buffalo]]

A sentence containing 3 instances of the word is grammatically valid.

[_S [_N I] [_VP [_V am] [_N here]]]

[subject verb object]
[_S [_N buffalo] [_VP [_V buffalo] [_N buffalo]]]

The first instance acts as a noun, the second acts as a transitive verb, and the third acts as an object.

Adding 2 instances of the word to the first two examples allows it to remain valid–and potentially causes ambiguity–, but this process may be repeated.

This is accomplished by adding relative clauses, whose head may be omitted when the modified noun acts as an object.

[_N person] -> [_NP [_N person] [_CP who/Ø [_IP [_N I] [_V am] ___]]]

Since the two previous examples have at least one noun, and adding this kind of relative clause introduces another noun, there will always be an available noun for a new relative clause.

In the first example, this process may be repeated, as shown below:

[[subject [Ø noun verb ___]] verb]
[_S [_NP [_N buffalo] [_CP whom/Ø [_IP [_N buffalo] [_V buffalo] ___]]] [_V buffalo]]
[[subject [[Ø noun [Ø noun verb ___]] verb ___]] verb]
[_S [_NP [_N buffalo] [_CP Ø [_IP [_NP [_N buffalo] [_CP Ø [_IP [_N buffalo] [_V buffalo] ___]]] [_V buffalo] ___]]] [_V buffalo]]

In the second example, this process can be applied to either the subject or object, which results in ambiguity.

[[subject [Ø noun verb ___]] verb object] or
[subject verb [object [Ø noun verb ___]]]

It is proven that $n$ instances of the word is valid for

$$ n = 2 + 2x, x \in \mathbb Z_{\ge 0} $$
$$ n = 3 + 2x, x \in \mathbb Z_{\ge 0} $$
$$ \therefore n = 2 + x, x \in \mathbb Z_{\ge 0} $$

which shows what we wanted to prove:

$$ n \geq 2, n \in \mathbb Z $$

Partially Protecting Password Data in Transit

2013-09-28T02:39:00+00:00

HTTP does not encrypt any traffic. Any of the internet routers can see and log your traffic, and your passwords might be compromised if the server does nothing to alleviate this.

On my arcade, my login form requires JavaScript to be more secure, but it is not perfectly secure.

A diagram of the first transmission, unprotected from interception

The first transmission of the password might be intercepted, which is a vulnerability of this method.

However, this is the only time when the password is at risk of interception. Also, the passwords cannot be protected at rest, since the password cannot be salted by the server. Comparing against salted hashes requires the original password to be transmitted. The hashing mere acts as a compression function, so it is as if the server stored its passwords in plaintext.

Protecting passwords in transit by using a pre-shared secret.

During authentication, instead of repeating the first, only a hash of [the password (for compression to make it easier to store at the server), fixed data, and a bunch of random data and timestamps] is sent, from which the original password is not easily derived. This prevents replay attacks as the timestamp must be recent (or exceed the last timestamp used, at risk of locking out), but users need to wait 1 second between logins, which is not an issue. Also, the request can also be denied if the random data matches the previous data, at the risk of a collision. The random data helps to add more entropy and to make reversing of the hash more difficult. Also, when the hash can be fully reversed, the hash algorithm can be changed at any time to increase security, but the passwords must also be changed.

This hash can be rebuilt at and compared against by the server, since the timestamps and random parts are transmitted in the clear, but the password is not. Basically, this is a custom HMAC that is used to sign a timestamp and a random number that must not be the one previously used.

Python Goto Decorator Improved

2013-08-13T23:15:00+00:00

When I found a nice hack to get GOTO statements in Python, I decided to make my own version of it. It has been tested on Python 2.7 but probably also works in Python 3.

To use it, import goto from goto and use the @goto decorator:

from goto import goto
@goto
def test():
  goto .end
  return False
  label .end
  return True
print test() # should be True

But first, you’ll need this code:

goto.py

#!/usr/bin/env python
# Copyright 2013 Victor Zheng
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at

   # https://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# This is fast code that gives you GOTO functionality in functions with minimal start-up overhead!

# Adapted from Carl Cerecke's MIT-licensed code:
# https://code.activestate.com/recipes/576944-the-goto-decorator/

# Caveats:
# - With the block stack, you must push blocks for "while", "try"
# For example, to jump inside a while loop, a block must be simulated:
# i = 10
# while True:
#  goto .insideLoop
# i = 1 # dead code
# while i > 0:
#  label .insideLoop
#  print i
# - entering a "for" or "except" block is probably not supported
# - "cannot create code objects in restricted execution mode"

import dis

class MissingLabelError(Exception):
 """'goto' without matching 'label'."""
 def __init__(self, target):
  super(MissingLabelError, self).__init__('Invalid jump to label %s' % (target))

def goto(fn):
 """
 A function decorator to add the goto command for a function.
 Specify commands like so:
 label .foo
 goto .foo
 """

 labels = {}
 gotos = {}
 i = 0
 end = len(fn.func_code.co_code)
 new_code = list(fn.func_code.co_code)

 nop7 = [chr(dis.opmap['NOP'])] * 7
 # scan through the bytecodes to find the labels and gotos
 while i < end:
  op = ord(fn.func_code.co_code[i])
  i += 1
  if op > dis.HAVE_ARGUMENT:
   i += 2
   # foo .bar
   # 0 LOAD_GLOBAL              0 (foo)
   # 3 LOAD_ATTR                1 (bar)
   # 6 POP_TOP
   # = 7 bytes total
   if (i < end - 7 + 3 and
    op == dis.opmap['LOAD_GLOBAL'] and
    ord(fn.func_code.co_code[i]) == dis.opmap['LOAD_ATTR'] and
    ord(fn.func_code.co_code[i + 3]) == dis.opmap['POP_TOP']):
    # check for label/goto
    if fn.func_code.co_names[
     (ord(fn.func_code.co_code[i - 1]) << 8) +
     ord(fn.func_code.co_code[i - 2])
    ] == 'label':
     labels[fn.func_code.co_names[
      (ord(fn.func_code.co_code[i + 2]) << 8) +
      ord(fn.func_code.co_code[i + 1])
     ]] = i - 3
     # nop the code and move up
     new_code[i-3:i-3+7] = nop7
     i += 4
    elif fn.func_code.co_names[
     (ord(fn.func_code.co_code[i - 1]) << 8) +
     ord(fn.func_code.co_code[i - 2])
    ] == 'goto':
     gotos[fn.func_code.co_names[
      (ord(fn.func_code.co_code[i + 2]) << 8) +
      ord(fn.func_code.co_code[i + 1])
     ]] = i - 3
     # move up only (resolve all gotos in the next loop)
     i += 4

 # change gotos to jumps
 for label,index in gotos.items():
  if label not in labels:
   raise MissingLabelError("Missing label: %s"%label)

  target = labels[label] + 7 # skip NOPs
  new_code[index] = chr(dis.opmap['JUMP_ABSOLUTE'])
  new_code[index + 1] = chr(target & 255)
  new_code[index + 2] = chr((target >> 8) & 255)
  # no need to patch the last 4 bytes: they are unreachable

 # create new function from existing function
 newcode = type(fn.func_code)(fn.func_code.co_argcount,
      fn.func_code.co_nlocals,
      fn.func_code.co_stacksize,
      fn.func_code.co_flags,
      ''.join(new_code),
      fn.func_code.co_consts,
      fn.func_code.co_names,
      fn.func_code.co_varnames,
      fn.func_code.co_filename,
      fn.func_code.co_name,
      fn.func_code.co_firstlineno,
      fn.func_code.co_lnotab)
 fn.func_code = newcode
 return fn

Rewriting the Grammar Bot

2013-08-08T18:53:00+00:00

I have rewritten my Grammar bot. Previously, it had used regular expressions to find errors, which means that it must check every character against the rules. In addition, Python 2.7 doesn’t support variable-length lookbehinds, which adds extra regular expression checks for some rules. Also, it cannot provide good quotes if there is an overlap between two matches.

The new system works by splitting the text into words. Punctuation is included with the spacers. After that, the words are, in a loop, checked against the rules.

Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

This would be parsed as

[Lorem, ( ), ipsum, ( ), dolor, ( ), sit, ( ), amet, (, ), consectetur, ( ), adipisicing, ( ), elit, (, ), sed, ( ), do, ( ), eiusmod, ( ), tempor, ( ), incididunt, ( ), ut, ( ), labore, ( ), et, ( ), dolore, ( ), magna, ( ), aliqua, (.), (empty word)]

and then the words/spaces would be converted to objects so that flags can be set.

Each rule will check if the current word is a specific word, or in a small list, so it can skip rules quickly. If a rule is matched, it will mark the word as “modified” and some nearby words as “automatic stop words”, and the reason will be flagged. Some rules will request a rerun on specific other rules, which will result in another iteration over the rules list, but only some rules will be run the next time.

If at least one reason has been flagged, it will proceed to build the correction list. It will look at each correction and check a few nearby unflagged words and mark them as “stop words” and one “near word”, right beside the last stop word. If there is a one-word gap between two corrections, that gap will then be flagged. Then it will build a list of corrections, which includes the continuous chains of flagged words and spaces in between them.

The last step is to randomly generate a message for the user, and include an english-joined version of the correction list.

Although I must admit that the new method is not as good as before performance-wise, it delivers more accurate results, so the performance loss can be considered a trade-off for a more accurate algorithm. And the new method has an advantage over the previous method. For example, this text would have been reported improperly:

*Their is you’re own. (The[re] is you[r] own.)

The old system would issue a correction for “is [your] own” and “[there] is you’re”. But the problem is that the quotes are done with the order of the rules, rather than the order in which they appear in the text and that the overlap is not merged. The new system would be able to issue a quote for “[there] is [your] own”.

In addition, this text would not be fully corrected until now:

*Your you’re own. (You['re] you[r] own.)

The old system would detect that the user should have said “Your [your] own” instead. However, the new system can do a second pass and report “[you’re your] own”.

Hacking a Flash Payload Crypter with 1 line of code

2013-07-23T17:08:00+00:00

If the flash file puts everything into a binary section and encrypts it, is there any way to decrypt it? If they cut off the header, you won’t be able to memory-dump it, but would you give up there? Of course not!

Somewhere, they have the decrypted data so that they can load it. Just compile some code to intercept it, and inject it:

(new FileReference()).save(_loc_2, "dumped.swf");

In RABCDAsm (AS3), it looks like this:

findpropstrict      QName(PackageNamespace("flash.net"), "FileReference")
constructprop       QName(PackageNamespace("flash.net"), "FileReference"), 0
getlocal2
pushstring          "dumped.swf"
callpropvoid        QName(PackageNamespace(""), "save"), 2

So just put that in the code before it is loaded (call to loadBytes) and replace getlocal2 with whatever will put the decrypted data onto the stack. Once the decrypted data is about to be loaded, you can save it to a file.

In AS2, you’d have to create a server script to echo the file back with FileReference, since it only accepts URL downloads. It’s still feasible though, but writing to a SharedObject and extracting from that might be easier.

In retrospection, I realized that I can also write a fake header if I manage to locate the flash data.

Flasm (ActionScript 2) Bytecode Equivalents

2013-07-20T00:55:00+00:00

Flasm allows people to disassemble flash files (.swf) into human-readable bytecode. I have discovered some of the Flash compiler techniques and other interesting things.

ActionScript // Flasm

Number.POSITIVE_INFINITY // POSITIVE_INFINITY or POSITIVE_INFINITYF
Number.NAN // _NAN or _NANF
return; // push UNDEF / return
trace(x) // push x / trace
// operators: push a / push b / [op]
| // bitwiseOr
^ // bitwiseXor
& // bitwiseAnd
<< // shiftLeft
>> // shiftRight
+ // add
- // subtract
* // multiply
/ // divide
% // modulo

What I find the most interesting is how it compiles logical expressions:

(a && b) or (a || b)

push [a]
dup
not ; only for &&
branchIfTrue label1
pop
push [b]
label1:
not
branchIfTrue label2
>>[body if true]<<
branch label3 ; only if else is present
label2:
>>[body if false]<<
label3: ; only if else is present

Now, how does it compile a compound expression?

Let’s start with (a [op1] b [op2] c), special case: ([op1] ≠ ||), ([op2] ≠ &&)

push [a]
dup
not ; only for [op1] == &&
branchIfTrue label1 ; special case: branchIfTrue label2
pop
push [b]
label1: ; not in special case
{dup}
not ; only for [op2] == &&
branchIfTrue {new_label
pop
push [c]
new_label:
not
branchIfTrue label2}
>>[body if true]<<
branch label3 ; only if else is present
label2:
>>[body if false]<<
label3: ; only if else is present

In the special case, operator precedence will cause (b && c) to be evaluated together. After testing (a && (b || c)), I have discovered that the same thing as the special case occurs above.

I’m still not so sure about why they compile the conditionals like this. But it is interesting how an OR operator can become an AND operator with one not instruction.

Split Infinitives: a non-error

2013-06-13T01:21:00+00:00

Some people are hypercritical and think to boldly go should be to go boldly or even the awkward boldly to go. However, the argument is that English should follow Latin’s rules, but it is impossible to split infinitives in Latin, as there is no infinitive marker in Latin, effectively making the argument invalid.

Also, wouldn’t the effect of some sentences be destroyed? There is no way to reword these without forming an awkward sentence:

I need you all to really pull your weight.

We are determined to completely and utterly eradicate the disease.

I expect him to completely and utterly fail.

We are seeking a plan to gradually, systematically, and economically relieve the burden.

We expect our output to more than double in a year.

I want to not see you anymore. (Well, maybe “I do not want to see you anymore”)

Source: “Split infinitive” from Wikipedia

Remember to, whenever you want, split infinitives. To, regardless of what some prescriptivists say, split an infinitive is perfectly valid.

Digital Roots

2013-05-24T00:56:00+00:00

What happens to the digital root as the numbers increase?

n	dr(n)
0	0
1	1
2	2
3	3
9	9
10	1
11	2
12	3
18	9
19	1

 n | dr(n)
---+------
 0 | 0
 1 | 1
 2 | 2
 3 | 3
 9 | 9
10 | 1
11 | 2
12 | 3
18 | 9
19 | 1

It looks like it is really just a cycle that goes from 1-9 over and over again (except 0). This can be represented using modulus.

$$dr(x) = 1 + (x - 1) \bmod 9$$

What happens if n < 0? Well, I’ve decided to just use the absolute value of it. That means that dr(-1) = 1.

Here is some PHP code:

<?php
for($i = -11; $i <= 20; ++$i)
	echo "dr($i) = ".(1 + (abs($i) - 1) % 9);

See that? There is no need for looping and recursion (nor iteration) to calculate the digital root. Why take O(≫ 1) time when you can take O(1) time?

Many languages handle negative modulus with truncation, but a special case must be created for some languages that use floored division:

# Python
def dr(i):
  if i:
    return 1 + (abs(i) - 1) % 9
  return 0

for i in range(-11, 20 + 1):
  print "dr(%d) = %d" % (i, dr(i))

No more BitTorrent Tracker Services!

2013-05-09T01:09:00+00:00

I am removing my BitTorrent tracker today. It is pointless: it has low bandwidth limits (~30 GB/month), and many other providers are available. Why use this service when there are other public trackers without bandwidth limits?

Prepositions: Reasonable to End Sentences with

2013-04-09T22:52:00+00:00

Why can’t prepositions be used as something to end sentences with?

Prepositions are fine to end sentences with. Prohibitions against preposition stranding are nothing anyone should listen to. (actually an infinitive marker) It is a made-up rule that does not reflect the true state of the language, so it is nothing anyone should worry about. Worrying about it is also something they (because English lacks a singular genderless personal pronoun) should not suffer from.

Look it up! (actually an adverb)

However, the misattribution to Churchill is something with which we should not put up. Even though he did not say it, it is still something no person should put up with.

Some sentences cannot be reworded to avoid stranding the preposition no matter how hard you try to.

The chair was sat on. (passive)

What is this tool for? (copula)

This is what he came back to me with. (fused relative pronoun)

This is something to look at. (infinitive phrase)

The first one simply has nothing it can be replaced with. The object of the preposition is the subject, omitted for the second time.

The second one cannot be reworded as *For what is this tool? because it must be For what purpose does this tool serve? As another example, This is what the tool is for becomes expanded to This is that which the tool is for. It cannot be *This is that for which the tool is, so it is due to the copula rather than the fused relative pronoun.

The third one is ungrammatical as *This is with what he came back to me unless it is a question such as With what did he come back to me?

The last one is awkward when corrected with ^?This is something at which to look. because at which to look might mean that to look at.

The practice of preposition stranding is something that even the University of Oxford’s English Department approves of.

However, when doing formal writing, it is usually better to front the prepositions instead of using them as something with which sentences are ended. Other than that, feel free to end sentences with prepositions without worrying about grammar complaints whenever you want to.

Domain Renewal by Transfer

2013-01-29T00:18:00+00:00

I have extended my domain for a year by transferring it. It won’t expire until April, but it’s unwise to attempt a transfer during the last few days, in case something goes wrong. However, I had to pay extra fees…

$12.88 (base price) - $3.00 (promotion) = $9.88 CAD initially

$9.88 * (100% + 12% HST) + $0.22 Paypal fee = $11.29 (rounded up from $11.2856)

Since it was in CAD, and I received payments in USD, PayPal also charged extra for currency conversion, since 1 USD = 1.01 CAD at that time…

$11.29 CAD / 0.981321 = $11.51 USD finally (rounded up again!!!)

After all that, I ended up paying 16% more (rounded down). All of this rounding was not in my favor.

cIOSCORP Removal Progress

2012-12-28T01:34:00+00:00

This is a big list…

I’ve deleted these IOSes:

IOS40
IOS41
IOS43
IOS45
IOS46
IOS52

Next, I used NUSD to download and package these IOSes:

IOS9 v1034 (0x40A)
IOS11 v256 (0x100)
IOS13 v1032 (0x408)
IOS14 v1032 (0x408)
IOS15 v1032 (0x408)
IOS17 v1032 (0x408)
IOS20 v256 (0x100)
IOS21 v1039 (0x40F)
IOS22 v1294 (0x50E)
IOS28 v1807 (0x70F)
IOS30 v2816 (0xB00)
IOS31 v3608 (0xE18)
IOS33 v3608 (0xE18)
IOS34 v3608 (0xE18)
IOS36 v3608 (0xE18)
IOS37 v5663 (0x161F)
IOS38 v4124 (0x101C)
IOS53 v5663 (0x161F)
IOS55 v5663 (0x161F)
IOS56 v5662 (0x161E)
IOS60 v6400 (0x1900)
IOS70 v6912 (0x1B00)

Then, I added the Trucha Bug, ES_Identify (ES_DiVerify), and NAND Permissions patches to my IOS36, just in case I need it later.

I’m feeling nervous for the next part…

The next step is to restore IOS50 to v4889 (0x1319), but v5120 (0x1400) is a stub.

~~In addition, I should also remove all the old stub IOSes…~~

I have just decided to update to 4.3U. I was smart, so I installed cIOS249 into cIOS 239 so that it wouldn’t be overwritten. After that, I restored cIOS249, and deleted cIOS239. I didn’t bother to remove the stubs.

I also installed the stub into IOS50, since I won’t need it anymore, but that was sort of risky.

Goodbye to cIOSCORP!

2012-12-27T18:55:00+00:00

I have decided to remove cIOSCORP, as it is not necessary anymore: I can still launch backups through backup launchers (NeoGamma, ~~Gecko OS~~, USB loaders, etc.)

TL;DR Since I have System Menu 3.4U, these operations are planned to reverse the effects of cIOSCORP:

These IOSes are present in all of those cIOSCORP packages: (Click Read More…)

IOS9 - update
IOS11 - update into stub, danger for System Menu 2.0
IOS12-15 - update
IOS17 - update
IOS20 - update into stub, danger for System Menu 2.2
IOS21,22 - update
IOS28 - update
IOS30 - update into stub, danger for System Menu 3.0 - 3.3
IOS31 - update
IOS33 - 38 - update
IOS40,41,43,45,46 - Korean IOSes, so delete?
IOS50 - install v4889 (!!!) because v5120 is a stub, danger for System Menu 3.4
IOS52 - I somehow have this, and it’s for 3.5 for Korean Wiis, so update into stub
IOS53 - update
IOS55 - update
IOS56 - update
IOS60 - update into stub, danger for System Menu 4.0 - 4.1
IOS70 - update into stub, danger for System Menu 4.2

In order to do this, I remembered that I have installed cIOSCORP 3.3 to 3.5 in a forgotten order, which means a union of all of them are installed. 3.3 will be ignored, since all of it is overwritten by 3.4. For the lists below, “Patch” means “ES_DiVerify/ES_Identify Patch”, both of which are the same. 3.4 IOSes are listed before 3.5 ones. All the highlighted ones are “scrambled”.

IOS9 = IOS53 v5149 with rev14/13 DIP
IOS11 = IOS53 v5149 with rev14 DIP / IOS60 v6174 with rev13 DIP + Patch
IOS12-15 = IOS53 v5149 with rev14 DIP
IOS17 = IOS53 v5149 with rev14 DIP
IOS20 = IOS53 v5149 with rev14 DIP / IOS60 v6174 with rev13 DIP + Patch
IOS21-22 = IOS53 v5149 with rev14 DIP
IOS28 = IOS28 v1293 with rev14 DIP
IOS30 = (IOS53 v5149 with rev12 DIP / IOS60 v6174 with rev13 DIP) + Patch
IOS31 = IOS31 v3092 with rev14 DIP
IOS33 = IOS33 v2834 with rev14 DIP
IOS34 = IOS34 v3091 with rev14 DIP
IOS35 = IOS35 v3092 with rev14 DIP + Patch
IOS36 = IOS36 v3094 with rev12/13 DIP + Patch + NAND Permissions Patch
IOS37 = IOS37 v3612 with rev14 DIP / IOS37 v3612 with rev14 DIP + ES_Identify Patch + NAND Permissions Patch
IOS38 = IOS38 v3610 with rev14 DIP
IOS50 = IOS50 v4889 with rev12/13 DIP + Patch
IOS53 = IOS53 v5149 with rev14 DIP
IOS55 = IOS55 v5149 with rev14 DIP
IOS56 = IOS56 v5146 with rev14 DIP
IOS60 = IOS60 v6174 with rev12/13 DIP + Patch

With cIOS 3.5, these IOSes were present:

IOS40 = IOS60 v6174 with rev13 DIP + Patch
IOS41 = IOS41 v3091 with rev14 DIP
IOS43 = IOS43 v3091 with rev14 DIP
IOS45 = IOS45 v3091 with rev14 DIP
IOS46 = IOS46 v3093 with rev14 DIP
IOS52 = IOS52 v5661 with rev13 DIP + Patch
IOS70 = IOS60 v6174 with rev13 DIP + Patch

I have also found some other IOSes:

IOS2 0x181 (v385)
IOS16 0x101 (v257) - will be mothballed if I update in the future…

In the future, I shall perform those actions, except for IOS50, and hope that my Wii will not brick.

More Blitz Hacks (Time)

2012-05-22T22:27:00+00:00

The Song of Time just keeps on playing…

I can’t just give you the entire thing–you have to EARN it by being pro and decoding it (similar to the last’s thrice, but only twice) yourself.

Z2FtZS5lbGFwc2VkVGltZSUzZGZ1bmN0aW9uKCklN2JpZihnYW1lLndob3NlVHVybiUzZCUzZGdhbWUuY29sb3IpcmV0dXJuKzAlM2JyZXR1cm4rbmV3K0RhdGUoKS5nZXRUaW1lKCktZ2FtZS5tb3ZlU3RhcnQlN2Qr

Blitz Hacks

2012-04-30T23:54:00+00:00

Have you ever heard of Blitz Chess? It’s a type of chess, with time limits on each side.

Google developers have made an App Engine sample. You can play at blitz.appspot.com, but you need to have a Google Account.

After playing a few times, it was fun, but I thought I should go further than that. I read the server’s Python code, and found a checkmate hack exploit. I even tampered HTTP requests and deleted all the losses I had accumulated. However, the deletion hack can also be done natively.

Now, I shall share some fun with you. Execute this JavaScript, and you ~~can~~ might be able to now move EVERYONE’s pieces ANYWHERE. Note that moving your pawn back one space can kill one of your pieces and promote it. This is now encoded, but a lite version is provided.

I also have one to delete your losses, but I won’t give it away as-is…

Enjoy (hit Read More if needed):

Here is one lite version (pawns get 1 extra space of movement), but there is also a pro version…

Chess.prototype.validatePawn=function(move,color){var coords=Chess.toCoords(move);if(color==Chess.WHITE&&coords.to.y<=coords.from.y){return false}else if(color==Chess.BLACK&&coords.to.y>=coords.from.y){return false}if(Chess.isVertical(coords)){var numSquares=Math.abs(coords.from.y-coords.to.y);if(numSquares>3||(numSquares>2&&this.hasMoved(move.from))){return false}var index=(color==Chess.WHITE?8:-8);var i=move.from;while(1){i=i+index;if(this.getPiece(i)!=Chess.BLANK){return false}if(i==move.to){break}}return true}else{if(!Chess.isDiagonal(coords)){return false}var dx=Math.abs(coords.from.x-coords.to.x);var dy=Math.abs(coords.from.y-coords.to.y);if(dx!=dy||dx>2){return false}if(this.getPiece(move.to)!=Chess.BLANK){return true}else{var capturedPawn=this.isEnPassant(move);var opposingPawn=(color==Chess.WHITE?'p':'P');if(capturedPawn!=null&&this.getPiece(capturedPawn)==opposingPawn){var lastMove=this.getLastMove();if(lastMove){if(lastMove.to==capturedPawn&&Math.abs(lastMove.from-lastMove.to)==16){return true}}}return false}}};

Here it is: (move anything anywhere, except to kill a king)

Z2FtZS5oYW5kbGVDbGljayUzZGZ1bmN0aW9uKCklN2JpZihnYW1lLmNhbk1vdmUpJTdiaWYoJTI0KHRoaXMpLmhhc0NsYXNzKCUyNnF1b3QlM2JzZWxlY3RlZCUyNnF1b3QlM2IpKSU3YiUyNCh0aGlzKS5yZW1vdmVDbGFzcyglMjZxdW90JTNic2VsZWN0ZWQlMjZxdW90JTNiKSU3ZGVsc2UraWYoJTI0KCUyNnF1b3QlM2Iuc2VsZWN0ZWQlMjZxdW90JTNiKS5zaXplKCklMjZndCUzYjApJTdidmFyK29sZFBvcyUzZCUyNCglMjZxdW90JTNiLnNlbGVjdGVkJTI2cXVvdCUzYikuYXR0ciglMjZxdW90JTNicG9zJTI2cXVvdCUzYiklM2J2YXIrbmV3UG9zJTNkJTI0KHRoaXMpLmF0dHIoJTI2cXVvdCUzYnBvcyUyNnF1b3QlM2IpJTNidmFyK29sZENsYXNzJTNkJTI0KCUyNnF1b3QlM2Iuc2VsZWN0ZWQlMjZxdW90JTNiKS5hdHRyKCUyNnF1b3QlM2Jwb3NDbGFzcyUyNnF1b3QlM2IpJTNidmFyK25ld0NsYXNzJTNkJTI0KHRoaXMpLmF0dHIoJTI2cXVvdCUzYnBvc0NsYXNzJTI2cXVvdCUzYiklM2J2YXIrcGllY2UlM2RnYW1lLmNoZXNzLmdldFBpZWNlKENoZXNzLnRvSW5kZXgob2xkUG9zKSklM2JpZihwaWVjZS50b0xvd2VyQ2FzZSgpJTNkJTNkJTI3cCUyNyklN2JpZihuZXdQb3MuY2hhckF0KDEpJTNkJTNkJTI3MSUyNyU3YyU3Y25ld1Bvcy5jaGFyQXQoMSklM2QlM2QlMjc4JTI3KSU3YmJsaXR6LmluaXRBbmREaXNwbGF5RGlhbG9nKCUyNyUyM3Byb21vdGVEaWFsb2clMjcpJTNiZ2FtZS5wZW5kaW5nTW92ZSUzZG9sZFBvcyUyYiUyNnF1b3QlM2ItJTI2cXVvdCUzYiUyYm5ld1BvcyUzYnJldHVybiU3ZCU3ZCUyNCh0aGlzKS5yZW1vdmUoKSUzYiUyNCglMjZxdW90JTNiLnNlbGVjdGVkJTI2cXVvdCUzYikucmVtb3ZlQ2xhc3Mob2xkQ2xhc3MpLmFkZENsYXNzKG5ld0NsYXNzKSUzYmdhbWUuc2VuZE1vdmVUb1NlcnZlcihvbGRQb3MlMmIlMjZxdW90JTNiLSUyNnF1b3QlM2IlMmJuZXdQb3MpJTdkZWxzZSU3YiUyNCglMjZxdW90JTNiLnBpZWNlJTI2cXVvdCUzYikucmVtb3ZlQ2xhc3MoJTI2cXVvdCUzYnNlbGVjdGVkJTI2cXVvdCUzYiklM2IlMjQodGhpcykuYWRkQ2xhc3MoJTI2cXVvdCUzYnNlbGVjdGVkJTI2cXVvdCUzYiklN2QlN2QlN2QlM2IlMjQoJTI2cXVvdCUzYi5nYW1lQm9hcmQrLnBpZWNlJTI2cXVvdCUzYikudW5iaW5kKCUyN2NsaWNrJTI3KSUzYiUyNCglMjZxdW90JTNiLmdhbWVCb2FyZCsucGllY2UlMjZxdW90JTNiKS5jbGljayhnYW1lLmhhbmRsZUNsaWNrKQ==

And if you can get to it, you can also delete your losses/ties.

ZnVuY3Rpb24rcmVmcmVzaFBhZ2UoKSU3YmxvY2F0aW9uLnJlbG9hZCgpJTdkJTNiJTI0KCUyNnF1b3QlM2JhLmJ0biUyNnF1b3QlM2IpLnVuYmluZCglMjYlMjMzOSUzYmNsaWNrJTI2JTIzMzklM2IpLmNsaWNrKGZ1bmN0aW9uKGFyZ3MpJTdidmFyK3JlZiUzZHRoaXMuZ2V0QXR0cmlidXRlKCUyNiUyMzM5JTNicmVmJTI2JTIzMzklM2IpJTNidmFyK2tleSUzZHRoaXMuZ2V0QXR0cmlidXRlKCUyNiUyMzM5JTNia2V5JTI2JTIzMzklM2IpJTNidmFyK29wdGlvbnMlM2QlN2J1cmwlM2ElMjZxdW90JTNiJTJmZ2FtZV9hamF4JTJmJTI2cXVvdCUzYiUyYihyZWYlM2ZyZWYlM2FrZXkpJTJjdHlwZSUzYSUyNnF1b3QlM2JERUxFVEUlMjZxdW90JTNiJTJjc3VjY2VzcyUzYXJlZnJlc2hQYWdlJTdkJTNiJTI0LmFqYXgob3B0aW9ucyklN2QpLnRleHQoJTI2JTIzMzklM2JEZWxldGUlMjYlMjMzOSUzYiklM2I=

How do you use it? Well, you have to decode it (thrice) first, then you can execute it into your browser’s JavaScript console. Finally, enjoy!

Cloud Rendering Shenanigans

2012-04-07T00:07:00+00:00

I have created a web-site that shows all of my cloud renderings of the samples. It is available at victorz.ca/misc/3d/.

At first, 1 render = 1 cloud unit, when the service was called Autodesk Cloud with its subordinate Autodesk Cloud Rendering.

Later, they renamed it to Autodesk 360 and its complement Autodesk 360 Rendering, and made 1 render = 5 cloud units. They also upped the limit to 75 cloud units, and made me have 50 used up (10/15 renders), which is nowhere near the 160 renders.

Still, I noticed a flaw: the cloud units are not subtracted until after the rendering is complete, which causes the following effect, -10 cloud units (-2 renders) remain when I sent 3 renders on the last credit.

To reproduce this, just send multiple renders when you’re on your last credit.

No more Wii Programming

2012-03-10T21:19:00+00:00

I have created a Wii eject channel in the past. Today, I decided to uninstall my devKitPro SDK and release my notes on some important C functions.

// Eject Disc
DI_Eject()
// Return to System Menu
SYS_ResetSystem(SYS_RETURNTOMENU, 0, 0);
// Power Red
STM_ShutdownToStandby()
SYS_ResetSystem(SYS_POWEROFF_STANDBY, 0, 0);
// Reboot
STM_RebootSystem()
SYS_ResetSystem(RESTART, 0, 0);
// Power Yellow
STM_ShutdownToIdle()
SYS_ResetSystem(SYS_POWEROFF_IDLE, 0, 0);
// Power Auto Off
SYS_ResetSystem(SYS_POWEROFF, 0, 0);

FizzBuzz Test

2012-03-08T00:26:00+00:00

This is a controversial way to filter out ~~noobs~~ people who can’t program. Luckily for me, I did very well at it. So what is this challenge about?

Write a program that prints the numbers from 1 to 100. But for multiples of three, print “Fizz” instead of the number, and for the multiples of five, print “Buzz”. For numbers which are multiples of both three and five, print “Fizz-Buzz”.

Well, isn’t that easy… it only took me less than two minutes versus the people who either can’t do this or take a long time to.

<?php
// 70 second solution!
for($i=1;$i<;=100;++$i){
	$a = !($i % 3);
	$b = !($i % 5);
	if($a) echo $b ? "Fizz-Buzz": "Fizz";
	elseif($b) echo "Buzz";
	else echo $i;
}