/* V8 - WARNING: This file is protected by copyright law.
To reverse engineer or decode this file is strictly prohibited. */
 

Well that's weird, because in the style.css we read:

/*The CSS, XHTML and design is released under GPL*/

(Side note, if you don't know what we mean by GPL, check out their site.)

No, they don't say PHP in there, however I read that (because 'design' is included) as "This theme is GPL'd". Poking around their website, I see no mention that you're required to keep any part of the theme the same.

If we read past the warning about reverse engineering, we see why they included it, a nasty big base64 encoded blob, then an eval command. Pastebin paste is here.

This piqued my interest, as I can think of very few legitimate reasons to do such obfuscation, or why there should be so much (footer.php is 47kb!). My initial thought was that I'd opened a backdoor into my site, with lesser thoughts to them being able to push random stuff into my footer (the last way I was infected), and finally just trying to control the links on the bottom of the page so that even if I were to edit their theme (as is my right under the GPL) I couldn't take credit for it myself, they'd always have credit for it. None of those sat right with me, so I hit up the local IRC channel, and we started puzzling.

First I base64_decode'd the garbage that was being run from the eval command (and yes, its gonna overflow the line by a LOT):

 
$lll=0;eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));$ll=0;eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));$llll=0;$lllll=3;eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));$lllllll=0;$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));$lllllllll=16;$llllllll="";for(;$lllll<$lllllllllllll($l);){if($lllllllll==0){$llllll=($llllllllll($l[$lllll++])<<8);$llllll+=$llllllllll($l[$lllll++]);$lllllllll=16;}if($llllll&0x8000){$lll=($llllllllll($l[$lllll++])<<4);$lll+=($llllllllll($l[$lllll])>>4);if($lll){$ll=($llllllllll($l[$lllll++])&0x0f)+3;for($llll=0;$llll<$ll;$llll++)$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];$lllllll+=$ll;}else{$ll=($llllllllll($l[$lllll++])<<8);$ll+=$llllllllll($l[$lllll++])+16;for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));$lllll++;$lllllll+=$ll;}}else$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);$llllll<<=1;$lllllllll--;}eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));$lllll=0;eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));$llllllllll="";for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}eval($lllllllllll("JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));eval($lllllllll);
 

If you want to be able to READ that:

 
<?php
    $lll=0;
    eval(base64_decode("JGxsbGxsbGxsbGxsPSdiYXNlNjRfZGVjb2RlJzs="));
    $ll=0;
    eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));
    $llll=0;
    $lllll=3;
    eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));
    $lllllll=0;
    $llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);
    eval($lllllllllll("JGxsbGxsbGxsbGxsbGw9J3N0cmxlbic7"));
    $lllllllll=16;
    $llllllll="";
    for(;$lllll<$lllllllllllll($l);){
        if($lllllllll==0){
            $llllll=($llllllllll($l[$lllll++])<<8);
            $llllll+=$llllllllll($l[$lllll++]);
            $lllllllll=16;
        }if($llllll&0x8000){
            $lll=($llllllllll($l[$lllll++])<<4);
            $lll+=($llllllllll($l[$lllll])>>4);
            if($lll){
                $ll=($llllllllll($l[$lllll++])&0x0f)+3;
                for($llll=0;$llll<$ll;$llll++)
                    $llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];
                $lllllll+=$ll;
            }else{
                $ll=($llllllllll($l[$lllll++])<<8);
                $ll+=$llllllllll($l[$lllll++])+16;
                for($llll=0;
                    $llll<$ll;
                    $llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));
                $lllll++;
                $lllllll+=$ll;
            }
        } else
            $llllllll[$lllllll++]=$llllllllll($l[$lllll++]);
        $llllll<<=1;
        $lllllllll--;
    }
    eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));
    $lllll=0;
    eval($lllllllllll("JGxsbGxsbGxsbD0iPyIuJGxsbGxsbGxsbGxsbCg2Mik7"));
    $llllllllll="";
    for(;$lllll<$lllllll;){
        $llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);
    }
    eval($lllllllllll(
        "JGxsbGxsbGxsbC49JGxsbGxsbGxsbGwuJGxsbGxsbGxsbGxsbCg2MCkuIj8iOw=="));
    eval($lllllllll);
?>
 

Wonderful, more base64 junk, and obfuscation. Yea, when was the last time you read a legitimate program that looked as the above (not in Perl). Been a while for me as well. So we went to work first by translating all the base_64 junk into english. Please note that the very first eval binds $lllllllllll to base64_decode so I've gone ahead and done that part already. I removed the eval() calls, and replaced them with the base64 translation on every line ending in //here.

 
<?php
 
    $lll=0;
    $lllllllllll='base64_decode'; //here
    $ll=0;
    $llllllllll='ord';  //here
    $llll=0;
    $lllll=3;
    $l=$lllllllllll($o); //here
    $lllllll=0;
    $llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);
    $lllllllllllll='strlen'; //here
    $lllllllll=16;
    $llllllll="";
    for(;$lllll<$lllllllllllll($l);){
        if($lllllllll==0){
            $llllll=($llllllllll($l[$lllll++])<<8);
            $llllll+=$llllllllll($l[$lllll++]);
            $lllllllll=16;
        }if($llllll&0x8000){
            $lll=($llllllllll($l[$lllll++])<<4);
            $lll+=($llllllllll($l[$lllll])>>4);
            if($lll){
                $ll=($llllllllll($l[$lllll++])&0x0f)+3;
                for($llll=0;$llll<$ll;$llll++)
                    $llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];
                $lllllll+=$ll;
            }else{
                $ll=($llllllllll($l[$lllll++])<<8);
                $ll+=$llllllllll($l[$lllll++])+16;
                for($llll=0;
                    $llll<$ll;
                    $llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));
                $lllll++;
                $lllllll+=$ll;
            }
        } else
            $llllllll[$lllllll++]=$llllllllll($l[$lllll++]);
        $llllll<<=1;
        $lllllllll--;
    }
    $llllllllllll='chr'; //here
    $lllll=0;
    $lllllllll="?".$llllllllllll(62); //here
    $llllllllll="";
    for(;$lllll<$lllllll;){
        $llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);
    }
    $lllllllll.=$llllllllll.$llllllllllll(60)."?"; //here
    eval($lllllllll);
?>
 

Next we perform the variable transformations that the first few eval() calls call for. Please note that towards the bottom there are a few variables we can't simply replace just yet.

 
<?php
 
    $lll=0;
    $ll=0;
    $llll=0;
    $lllll=3;
    $l=base64_decode($o); //Leaving this since I only want it to evaluate once
    $lllllll=0;
    $llllll=(ord($l[1])<<8)+ord($l[2]);
    $lllllllll=16;
    $llllllll="";
    for(;$lllll<strlen($l);){
        if($lllllllll==0){
            $llllll=(ord($l[$lllll++])<<8);
            $llllll+=ord($l[$lllll++]);
            $lllllllll=16;
        }if($llllll&0x8000){
            $lll=(ord($l[$lllll++])<<4);
            $lll+=(ord($l[$lllll])>>4);
            if($lll){
                $ll=(ord($l[$lllll++])&0x0f)+3;
                for($llll=0;$llll<$ll;$llll++)
                    $llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];
                $lllllll+=$ll;
            }else{
                $ll=(ord($l[$lllll++])<<8);
                $ll+=ord($l[$lllll++])+16;
                for($llll=0;
                    $llll<$ll;
                    $llllllll[$lllllll+$llll++]=ord($l[$lllll]));
                $lllll++;
                $lllllll+=$ll;
            }
        } else
            $llllllll[$lllllll++]=ord($l[$lllll++]);
        $llllll<<=1;
        $lllllllll--;
    }
    $lllll=0;
    $lllllllll="?".chr(62); //Leaving as we can't evaluate yet.
    $llllllllll="";
    for(;$lllll<$lllllll;){
        $llllllllll.=chr($llllllll[$lllll++]^0x07);
    }
    $lllllllll.=$llllllllll.chr(60)."?"; //Leaving as we can't evaluate yet.
    eval($lllllllll);
?>
 

Now, let's make it readable by translating all those $l variables into english letters. First one will be $a, next $b, etc etc. Alright, I missed one and had to go back, but here it is.

 
<?php
 
    $a=0;
    $b=0;
    $c=0;
    $d=3;
    $l=base64_decode($o); //leaving this as $l
    $e=0;
    $g=(ord($l[1])<<8)+ord($l[2]); //whoops, skipped one...
    $f=16;
    $h="";
    for(;$d<strlen($l);){
        if($f==0){
            $g=(ord($l[$d++])<<8);
            $g+=ord($l[$d++]);
            $f=16;
        }if($g&0x8000){
            $a=(ord($l[$d++])<<4);
            $a+=(ord($l[$d])>>4);
            if($a){
                $b=(ord($l[$d++])&0x0f)+3;
                for($c=0;$c<$b;$c++)
                    $h[$e+$c]=$h[$e-$a+$c];
                $e+=$b;
            }else{
                $b=(ord($l[$d++])<<8);
                $b+=ord($l[$d++])+16;
                for($c=0;
                    $c<$b;
                    $h[$e+$c++]=ord($l[$d]));
                $d++;
                $e+=$b;
            }
        } else
            $h[$e++]=ord($l[$d++]);
        $g<<=1;
        $f--;
    }
    $d=0;
    $f="?".chr(62); //here
    $i="";
    for(;$d<$e;){
        $i.=chr($h[$d++]^0x07);
    }
    $f.=$i.chr(60)."?"; //here
    eval($f);
?>
 

At this point its almost readable, although astute observers will have noted one variable that's weird. $o is wrapped in a base64_decode call, and bound to $l. $o is, shockingly enough, 44K of... packed binary. I didn't notice this until someone else pointed it out, I just glossed over all that junk and had started on the obvious eval command. To get a good view of it, try here.

Line 9 of the above can be simplified, so let's do that and turn it into the following (just to get an idea of the exact numbers we can). We can also run the strlen() call and learn that the length of $l is 33222! Geez... So let's replace that in the for loop on (old) line 12. $e after the massive loop becomes 83760, we can replace that also. And finally I replace the chr() calls towards the end and just put them into the strings that they're concatted to.

 
    $ga = ord($l[1])<<8; //48
    $gb = ord($l[2]); //0
    $g = $ga + $gb; //48
    ....
    for(;$d<33222;){
    ....
    $f="?>";
    ....
    for(;$d<83760;){
    ....
    $f.=$i."<?";
 

So, where does this leave us? We have a nice little (readable) script that does (something) on a HUGE bit of packed binary. Now, if you look at the for loop there, its not going to be fun to step through. Our index goes up to 33222, and is incremented by at most 6 every iteration. At worst you'll be stepping by 1. Well, the eval() command isn't until the end, so lets just see what that nasty big loop spits out, hmm? As long as you die() before the eval command, you'll be alright. What this spits out is a nasty huge array...

 
Array
(
    [0] => 59
    [1] => 56
    [2] => 119
    [3] => 111
    [4] => 119
    [5] => 13
    //....<snip 83000ish lines>
    [83754] => 97
    [83755] => 60
    [83756] => 13
    [83757] => 13
    [83758] => 56
    [83759] => 57
)
 

Now that's just lovely. Hmm, but looking at the values it gives me an idea. I decided to spit out an array of the values from the right side, and how many times they're referenced.

 
Array
(
    [59] => 93
    [56] => 1
    [119] => 1110
    [111] => 2748
    [13] => 630
    [36] => 70
    [35] => 349
    [99] => 1773
    [98] => 8490
    [101] => 1112
    [114] => 3197
    [96] => 1525
    [39] => 7322
    [58] => 227
    [54] => 153
    [60] => 577
    [107] => 3064
    [110] => 3057
    [105] => 4299
    [108] => 1170
    [102] => 4179
    [125] => 766
    [51] => 94
    [104] => 2476
    [116] => 3241
    [115] => 4404
    [88] => 414
    [84] => 541
    [66] => 354
    [85] => 163
    [81] => 130
    [92] => 19
    [32] => 1487
    [79] => 425
    [83] => 386
    [87] => 187
    [72] => 101
    [90] => 19
    [97] => 635
    [47] => 127
    [46] => 127
    [100] => 2031
    [37] => 305
    [61] => 391
    [41] => 886
    [117] => 4419
    [57] => 100
    [86] => 2
    [82] => 79
    [78] => 59
    [106] => 1421
    [69] => 438
    [112] => 1295
    [42] => 688
    [126] => 198
    [40] => 1630
    [53] => 110
    [52] => 82
    [55] => 105
    [63] => 30
    [67] => 209
    [74] => 153
    [50] => 74
    [48] => 37
    [62] => 27
    [113] => 313
    [89] => 3
    [43] => 3496
    [70] => 297
    [73] => 169
    [68] => 172
    [80] => 271
    [14] => 1161
    [65] => 243
    [76] => 337
    [127] => 186
    [95] => 10
    [93] => 47
    [64] => 213
    [33] => 442
    [75] => 103
    [49] => 34
    [118] => 5
    [77] => 36
    [109] => 41
    [124] => 17
    [122] => 17
    [44] => 10
    [34] => 21
    [45] => 9
    [123] => 5
)
 

The minimum is 13, and the max is 127, so these do fit nicely on an ASCII table. Now, 13 is a LOT smaller than I expected (down at carriage return), but such is life. Sorted it looks a bit better, but doesn't map nicely to the ASCII values I'd hoped to see the most of.

 
Array
(
    [13] => 630
    [14] => 1161
    [32] => 1487
    [33] => 442
    [34] => 21
    [35] => 349
    [36] => 70
    [37] => 305
    [39] => 7322
    [40] => 1630
    [41] => 886
    [42] => 688
    [43] => 3496
    [44] => 10
    [45] => 9
    [46] => 127
    [47] => 127
    [48] => 37
    [49] => 34
    [50] => 74
    [51] => 94
    [52] => 82
    [53] => 110
    [54] => 153
    [55] => 105
    [56] => 1
    [57] => 100
    [58] => 227
    [59] => 93
    [60] => 577
    [61] => 391
    [62] => 27
    [63] => 30
    [64] => 213
    [65] => 243
    [66] => 354
    [67] => 209
    [68] => 172
    [69] => 438
    [70] => 297
    [72] => 101
    [73] => 169
    [74] => 153
    [75] => 103
    [76] => 337
    [77] => 36
    [78] => 59
    [79] => 425
    [80] => 271
    [81] => 130
    [82] => 79
    [83] => 386
    [84] => 541
    [85] => 163
    [86] => 2
    [87] => 187
    [88] => 414
    [89] => 3
    [90] => 19
    [92] => 19
    [93] => 47
    [95] => 10
    [96] => 1525
    [97] => 635
    [98] => 8490
    [99] => 1773
    [100] => 2031
    [101] => 1112
    [102] => 4179
    [104] => 2476
    [105] => 4299
    [106] => 1421
    [107] => 3064
    [108] => 1170
    [109] => 41
    [110] => 3057
    [111] => 2748
    [112] => 1295
    [113] => 313
    [114] => 3197
    [115] => 4404
    [116] => 3241
    [117] => 4419
    [118] => 5
    [119] => 1110
    [122] => 17
    [123] => 5
    [124] => 17
    [125] => 766
    [126] => 198
    [127] => 186
)
 

Thankfully we're not done yet, notice that these values are called along with a ^0x07... so maybe if we change the list to reflect this operation it'll look better. In order to make it tidy, and to continue the assumption, I've substituted the character for the integer.

 
Array
(
    [<tab>] => 1161
    [
<line feed>] => 630
    [ ] => 7322
    ["] => 305
    [#] => 70
    [$] => 349
    [%] => 21
    [&] => 442
    ['] => 1487
    [(] => 127
    [)] => 127
    [*] => 9
    [+] => 10
    [,] => 3496
    [-] => 688
    [.] => 886
    [/] => 1630
    [0] => 105
    [1] => 153
    [2] => 110
    [3] => 82
    [4] => 94
    [5] => 74
    [6] => 34
    [7] => 37
    [8] => 30
    [9] => 27
    [:] => 391
    [;] => 577
    [<] => 93
    [=] => 227
    [>] => 100
    [?] => 1
    [A] => 297
    [B] => 438
    [C] => 172
    [D] => 209
    [E] => 354
    [F] => 243
    [G] => 213
    [H] => 425
    [I] => 59
    [J] => 36
    [K] => 337
    [L] => 103
    [M] => 153
    [N] => 169
    [O] => 101
    [P] => 187
    [Q] => 2
    [R] => 163
    [S] => 541
    [T] => 386
    [U] => 79
    [V] => 130
    [W] => 271
    [X] => 10
    [Z] => 47
    [[] => 19
    []] => 19
    [^] => 3
    [_] => 414
    [a] => 4179
    [b] => 1112
    [c] => 2031
    [d] => 1773
    [e] => 8490
    [f] => 635
    [g] => 1525
    [h] => 2748
    [i] => 3057
    [j] => 41
    [k] => 1170
    [l] => 3064
    [m] => 1421
    [n] => 4299
    [o] => 2476
    [p] => 1110
    [q] => 5
    [r] => 4419
    [s] => 3241
    [t] => 4404
    [u] => 3197
    [v] => 313
    [w] => 1295
    [x] => 186
    [y] => 198
    [z] => 766
    [{] => 17
    [|] => 5
    [}] => 17
)

This looks good to me. notice the matched braces (17 each), matched parens (127 each), and almost matched carrots (93 and 100). Also take note that there's much more lowercase than uppercase letters, and that lowercase 'e' is far above the other letters, implying this has English words (or at least English something) in it.

And again we end up with a nasty large for loop, completely worthless to try to step through:

 
    for(;$d<83760;){
        $i.=chr($h[$d++]^0x07);
    }
 

83760 steps in that loop, building whatever it is we're going to eval at the end char by char! I'm going to cheat again, run the loop, spit out the result, and die before the eval. Looks like 632 lines of... more php! Yay, this time its not obfuscated!

It starts off with 410 lines of 4 arrays of URLs, most appearing German. After that it does some work on your domain name and the requested page, then does some work on all of the above to pull out specific URLs to seed your footer with. They were nice enough to include a $debug flag, which I turned on, and ran on a different site that I wasn't too worried about. Here's the spit out:

 
host: thievestavern.com
uri: /final_code.php
numbers: 0
 
final_code.php
url: thievestavern.com/final_code.php
url_base64: dGhpZXZlc3RhdmVybi5jb20vZmluYWxfY29kZS5waHA=
url_zahl: 20295
 
array_a_count: 22
array_b_count: 90
array_c_count: 87
array_d_count: 145
array_e_count: 2
url_count: 32
 
crc32 url: -1485503542
intval(crc32 count): 1485503542
 
count_a (url_count + numbers): 03542
 
count_a % array_a_count: 03542 % 22
count_a (Rest nach Teilung): 0
 
count_b (url_count + numbers): 03542
 
count_b % array_b_count: 03542 % 90
count_b (Rest nach Teilung): 32
 
count_c (url_count + numbers): 03542
 
count_c % array_c_count: 03542 % 87
count_c (Rest nach Teilung): 62
 
count_d (url_count + numbers): 03542
 
count_d % array_d_count: 03542 % 145
count_d (Rest nach Teilung): 62
 
count_e (url_count + numbers): 03542
 
count_e % array_e_count: 03542 % 2
count_e (Rest nach Teilung): 0
 
url_zahl % anchor_1_count: 20295 % 6
 
url_zahl_rest_1: 3
anchor_1_count: 6
 
url_zahl_rest_2: 2
anchor_2_count: 7
 
url_zahl_rest_3: 5
anchor_3_count: 10
 
url_zahl_rest_4: 0
anchor_4_count: 11
 
url_zahl_rest_5: 2
anchor_5_count: 7
 
count: 03542
//Links were spit out here... I'm not including them as
//I don't want to advertise for random people
 

Conclusions
I'm considering this question solved. The obfuscated piece of junk that was residing in my footer turns out to be nothing more than a very paranoid way to put links into the footer. Its handy as it'll be hard to automatically figure out which sites have these spam footers (if I couldn't do this), it also intimidates the normal user to not remove the links. This is fairly clever, and involved, and a nice feature is that they can simply change the $o to get a whole new set of links to spit out, or to change the footer's design. I'll give them props for that.

All of the above makes me say that themespack.com isn't really interested in putting good free (as in freedom, and beer) themes into the hands of bloggers, they're more interested in themselves. Can I fault them? No. However, I do take issue with trying to hide behind 'copyright' to prevent me from changing the links on my own blog.

If you get one of these themes I'd highly recommend you do the following: Go into the footer, and remove the 'alignleft' div. Put in a 'theme created by ' link, and then give yourself credit for editing it. As is your right under the GPL. I'd love to say to run the script and give credit to the supposed creators, but those end up being random German companies, clearly not people in the business of writing PHP.

Oh, and for the record, all of the above is what the server does when it runs the PHP code, so I'm not reverse engineering it anymore than a few calls to base64_decode does.

Software
As far as the drivers go, it's BlueZ or nothing. This is an excellent package that works enough to be qualified Bluetooth 2.0 though with some implementations out there, this may or may not be a selling point. But the point of the matter is, nab this and it'll work just like Windows.
As far as software to interact with Bluetooth devices, it depends on what you want to do. I don't connect my phone via Bluetooth (preferring a USB cable) so I can't help you with that. However make sure you have hcitools installed to pair with devices and scan for new ones around you. To test your set up, put your phone (or headset, or keyboard, or whatever) into detection mode and then run:
hcitools scan
If you're set up, it should detect your device and identify its MAC Address and Device Name.
After you're set up legally checking on your phone, you can try checking out others. Try an hcitools scan in a busy area and see if any phones show up. Or perhaps a parking lot if you're really devious. I'd recommend checking out the Trifinite Group for ideas of what evilness can go on over Bluetooth.

Device Lookup
Now that you have my 2 cent description of how to get Bluetooth working on Linux (Ubuntu 7.10) and done your own research on what vulnerabilities (might) exist out there, you may be interested in a quick way to identify devices you find. Quick identification of devices around you allows for quick knowledge of what exploits exist. I'm not advocating breaking devices, but this may be extremely useful when penetration testing a company or school. I wrote a quick perl script that will take a given MAC address and return the company that device is registered to. It has two text files with it, one is a list of known Bluetooth manufacturers and the device prefixes registered to them, the other is a full list of all MAC prefixes and who they're registered to. Download this tarball, untar the file, change into the mac_address directory, and then run it using:


tar -xf mac_address.tar
cd mac_address
perl mac_lookup.pl 00:16:8f:c0:5X:XX

It'll spit out info looking a little like:


Looking up: 00:16:8f:c0:51:11
Manufacturer Prefix: 00:16:8f
Device Type: c0:51:11
Manufacturer: GN Netcom as


I'm quickly porting it to php and tossing all that info into a database so you'll be able to bounce requests off of a php page to grab the relevant information. More information will come on that in a day or two, once I have it up and running. Of course all this was inspired by the BluePrinting project, and I hope to work that into my database.

EDIT: Whoops, it appears I mis-read a paper and wrote a hasty article. It is not possible to assume the second three bytes of a Bluetooth MAC are the device model, as every manufacturer is different. I've changed bits of the above article to reflect this knowledge, and changed the output of my tool. I'd also like to note there is another tool that is similar to this, @stake's redfang tool. However this tool is used to *find* non-discoverable devices, via brute-force, whereas mine is a simple lookup tool.

Also it should be noted that I'm using the term Bluetooth MAC address, though this may not be the best term. Its also called the Bluetooth Device Address.

This spits the maplist out to STDOUT and can then be piped into whatever file you want. On a typical UNIX dedicated server it should be run like this (for 32 player maps and a coop map type):

perl maplist.pl gpm_coop 32 > ../settings/maplist.con

Of course, you may redirect wherever you like so as to not overwrite other lists. I keep separate maplists (maplist.coop.con and maplist.cq.con) around for coop and cq (conquest) as you can't add coop maps to conquests lists, and vice versa. Sure, for small additions to my levels directory this is like using a sledge hammer to hammer a nail, but heck, its quick and easy, so I'm happy.

Then I created a folder for the server, in my case that was /usr/bf2, but wherever you decide to install this will be referred to as [base-dir] from here on. Move into that directory, then wget the server files and unzip. I won't go into much more detail than that because a few sites already spell it out nicely.

The final bit of installation is turning rcon (remote control) on. You want to create the file "[base-dir]/admin/default.cfg" consisting of:
port=4711
password=your_password


Now when you're playing you can open the console, type 'rcon login your_password' and execute admin commands.

Customization
Customization is where the bf2 server gets fun. I don't run my server on the Internet, only within my house, so I have a lot of coop (LAN party goodness) settings. All the files yuou're going to want to modify are inside the [base-dir]/mods/bf2/settings directory. Lets start with serversettings.con as it is the logical place to start. I'll lay out some of the important server (sv) settings.

Server settings, how it'll appear in the game browser and port it uses. Change the port to run multiple servers on the same box.

sv.serverName "Snarky's roughnecks"
sv.password ""
sv.internet 0
sv.serverIP "192.168.0.3"
sv.serverPort 16567
sv.welcomeMessage "Welcome to... THE ROCK!"


Player settings, I turn off punkbuster so we can use no-cd hacks and share disks at LAN parties. Also make sure Friendly fire is on, but turn friendly fire with mines off so people don't get mad when they run over my claymores. Of course, ya wanna turn off tk punish, just in case *grin*.

sv.punkBuster 0
sv.soldierFriendlyFire 100
sv.vehicleFriendlyFire 100
sv.soldierSplashFriendlyFire 100
sv.vehicleSplashFriendlyFire 100
sv.tkPunishEnabled 0
sv.tkNumPunishToKick 3
sv.tkPunishByDefault 0


Bot settings, what makes coop fun! This turns team balance off, then stacks 75% of the bots on team 2 (against US) and gives them medium difficulty. This is enough for two humans (and 10 bots) to have a difficult, but winnable game.

sv.autoBalanceTeam 0
sv.teamRatioPercent 100
sv.coopBotRatio 75
sv.coopBotCount 30
sv.coopBotDifficulty 50


Round settings, the number of players s human playersso you can ignore that. I bump the ticket ratio up for a longer game, play two rounds before changing maps, and have no time limit, and no scoring limit (so we can rack up over 200 points).

sv.maxPlayers 32
sv.ticketRatio 300
sv.roundsPerMap 2
sv.timeLimit 0
sv.scoreLimit 0


Fake sponsor junk, get your roommates to buy you chips in return for admining their server!

sv.sponsorText "Sponsered by your local neighborhood Snarky."
sv.sponsorLogoURL ""
sv.communityLogoURL ""


Now you'll want to edit maplist.con, in the same directory. I have all mine set to gpm_coop, and 16 player maps (the largest EA/Dice make their coops for). This is where you'd drop in the names of any new maps you download, I have a few in here, and highly recommend heli_attack!
maplist.append "goods_station" "gpm_coop" 16
maplist.append "cp_abadan" "gpm_coop" 16
maplist.append "dalian_plant" "gpm_coop" 32
maplist.append "daqing_oilfields" "gpm_coop" 32
maplist.append "dragon_valley" "gpm_coop" 32
maplist.append "fushe_pass" "gpm_coop" 32
maplist.append "gulf_of_oman" "gpm_coop" 32
maplist.append "operation_clean_sweep" "gpm_coop" 32
maplist.append "road_to_jalalabad" "gpm_coop" 32
maplist.append "sharqi_peninsula" "gpm_coop" 32
maplist.append "songhua_stalemate" "gpm_coop" 32
maplist.append "strike_at_karkand" "gpm_coop" 32
maplist.append "zatar_wetlands" "gpm_coop" 32
maplist.append "boat_wars" "gpm_coop" 16
maplist.append "heli_attack" "gpm_coop" 16
maplist.append "tank_master" "gpm_coop" 16
maplist.append "jammed" "gpm_coop" 16


The most unique part of my server, I believe, is the bot names. These can be found in "[base-dir]/mods/bf2/ai/botnames.ai" and are set by default to boring military looking names (J.Smith, B. Bradley, etc). I went through and removed them all, and have been adding random bots based on varius naming schemes. My first was famous dictators such as:

aiSettings.addBotName Saddam Hussain
aiSettings.addBotName Adolf Hitler
aiSettings.addBotName Darth Vader

I've done all kinds of naming conventions such as famous Star Trek characters, the pilots from Top Gun, and great old games like Commander Keen! Now you'll hear peals of laughter across the house when we realize Luke Skywalker just knifed Darth Vader... it fits so perfectly! (Also good is the time Bill Gates shot down Steve Jobs).

Common Problems
The problem I ran into most often was maps (and mods) that liked Windows naming conventions. For a map all you have to do to fix it is unixify all files/directories in/below the maps directory ("[base-dir]/mods/bf2/levels/[map]"). Also, make sure it has the type of level you're trying to play. If it has gpm_cq, but no gpm_coop, it won't let you add it as gpm_coop, unfortunately. You can check this by looking at "[base-dir]/mods/bf2/levels/[map]/info/[map].desc". If the server is running when you make these changes, or add a map, you'll have to restart it in order to have it recognize the new map.

Nations at War
For whatever reason EA/Dice decided to make the linux server only like lower-case filenames. This is a bit of a pain, and by a bit I mean a lot. For a mod that uses UNIX file naming conventions (undercase, no spaces, etc) there's really no problem taking the Windows server and dropping it into your mods directory on Linux. Unfortunately not all mod designers have access to Linux (or so they claim, I say everyone has access to it) and some just love their Windows capitalization which makes a HUGE problem. Well, a huge problem if you can't script.

To install the Nations at War 5.1 server, grab the install files:
wget http://www.nawtek.com/5.01/NAW-5.01-Server-Full.zip

Then unzip that into your dedicated server's mods directory. If you try to run the server now it'll crash silently, not too helpful, huh? It turns out the first bit of crashing (I believe) is caused by filenames, they're not unixified. I have a quick and dirty perl script that renames everything in the working directory and below to be lowercase and have underscores instead of spaces, but EA/Dice has their own version found at "[base-dir]/lowercaseDir.py" which may work better. Either one you use, make sure you rename everything to lowercase.

Next you want to check the files in "[base-dir]/mods/naw/python/game/" and find scoringcommon.py. If it is not scoringCommon.py, move it to that, as that file is specifically called in the init script.

Finally, make sure there's at least one map in "[base-dir]/mods/naw/settings/maplist.con" that can be loaded, otherwise it'll again crash silently. The one that finally worked for me was:
maplist.append "iraq_oilfields" "gpm_cq" 32

Now you should be able to start the server from the [base-dir] directory with:
./start.sh +modPath mods/naw

Hopefully you'll now see the server screen, as the above worked for me. Unfortunately some maps caused my client to crash to desktop, and I'm not sure why. Currently I'm blaming it on the map.

Other Mods
While NAW was interesting as a mod, I'm far more impressed by Allied Intent Extended. Awesome new skins on almost everything, tons of new planes, boats, and ways to die. Think the Spec Ops died before he could blow the C4? Too bad it was on a 20 second timer... Oh look a plane, I'm safe in a tank. Oh, nuts it was an A-10 Warthog. Oh, and it takes no effort to run under Linux!

I wanted to keep the same settings and botnames, so for the important files mention above I recommend linking them to your main files.
ln -s [base-dir]/mods/bf2/ai/botnames.ai [base-dir]/mods/aix/ai/botnames.ai

And so forth. This way to can tweak your main server as you like, and all the others will follow it.

Requirements
You're going to need the following:

1. Knoppix Live CD. I'm using the most current as of this writing, 5.0.1.
2. A nice sized directory (/home/snarky/data/programming/knoppix in my case) to do the editing on. At least 3 GB free.
3. 1 GB of RAM, if you don't have enough RAM, make a GB of swap space.
4. A sense of comfort with the Linux operating system, and all that goes into it (especially command line stuff). If you don't feel you can do part of this guide, don't bork your system, just pay me to make it for you.

Disclaimer(s)
I'm also kind of weird in the head, one might say, and like to continue long metaphors. So, throughout this article, I won't say "girlfriend", I'll use a computer term. It'll be in italics because otherwise this guide would get even more confusing!

This is my third try at this guide, the first two... didn't work as well as I'd like, so that's why I'm just telling you where to find the certain files you'll want to edit.

Setup
In order to edit this cd for your most significant bit, you'll need to get a good image on your hard drive. I recommend this guide from Knoppix.net. Once you get the compressed file system and all boot-necessary files into directories on your machine, then you can play around with editing the files.

The Editing

1. First off, is the background. While I love advertising for Knoppix, my two's complement deserves to look at a better picture. Pick something of the two of you, or maybe a nice sappy heart, or something more romantic. By default this lives in /usr/local/lib/knoppix.gif. I think you know what to do here, that's right, overwrite that file with your sweet picture! This should be 1024x768, if you can at all manage it, as I didn't find out if the picture will be streatched, centered, or what.
2. Next I had a great idea for the start up sound. Since this'll be the first impression of the custom LoveCD for your int main(), you want it to be something special to them. Yea, you'll have to hear it when you test the disc, but that's no excuse to give her a CD that boots up to a loud rendition of Weird Al's White & Nerdy. Actually, that's a great song, so maybe use that, but I digress.

   This file is stored in /usr/share/sounds/startup.ogg (or .wav). If .ogg is there, that will be played, otherwise the wav will be. If you want to change the type of file, all the config of X is in /etc/X11/Xsession.d/45xsession. This is a nice big file, so I'll tell you if you're using my version of Knoppix its line 104, otherwise grep for a function called "playsound()". If you don't know shell scripting, don't try to edit this file, its huge and nasty, you've been warned. So, again just overwrite the original ogg file with one of your choosing.

3. The low-res ASCII art that shows during boot can be changed also. This lives in the boot.img in the /boot/isolinux/ directory, and you'll have to mount that compressed directory in order to get at a file called logo.16. Put a GIF 640x400 image in there, and use the giftopnm command to get a .ppm file. From there you'll use ppmtolss16 to make a .16 file that will be able to be shown on boot. Since this is really *Not* good quality, it might be best to go with something black and white, and obvious even at low res.
4. Also in that directory is /boot/isolinux/boot.msg. This is the boot message, along with some other stuff. DO NOT change the other stuff, bad things happen, but you can make the boot message be any single line of text you like. If you and your eliza have an inside joke, here's a great place to put it.
5. Another fun thing I found is that index.html file you copied over to the master directory. This is displayed in a browser upon boot, so its the perfect place to leave some special crytographically signed message for the enigma in your life. Just open that file in vi, or any editor you prefer, and edit to your hearts content. I threw in a nice little personal message, and thought about recording a video message if I had a webcam. Could put a file:// link on the opening index.html to have them watch you say sweet things.
6. If your primary hard drive has a specific profession you want to tailor the disc to, go ahead. If you chroot into the directory you're editing in, you can use apt-get (and an internet connection) to change what software is installed. The person I'd make it for would appreciate a bunch of the different games, but not the hacking utilities, so I'd make that change. Also, one can edit a program's settings to make thigns easier. For instance, I'd put their login information into GAIM (username only, no password) so that its real easy for them to jump on and say what an amazing job I did *evil grin*.
7. Along the same lines, one can change individual user options by copying the skel user out of /etc, making it into a /home/knoppix directory, and chowning it to knoppix. Now you can change the .bash_profile, and everything that goes into having your own user. Personally, since I love easter eggs, I'd make their name into a command pointing to a script I made that spits out a random complement: "$name is {array of complements}". I learned long ago that random complements just make your day, even if you give it to yourself. Let them stumble across this little tidbit, or tell them yourself.
8. One can edit the programs that start on logon, as with any machine. Currently it just launches Mozilla on index.html, but me I'd like to make some little widget type app that will mean something to them. That's vauge, but an idea might be popping up a window that rotates through pictures stored on the hard drive, a nice photo album viewer for good memories. Or (and this is more up my alley), pop up bitchX IRC set to log onto a certain server and channel. On this channel you have a bot that'll pass on some kind words just in case you're not there. "Hey $name, has anyone told you you're beautiful today?" "How are you this fine day, gorgeous?" Etc. That way they don't have to be at all technically competant to enjoy the surprise, and it'll happen every time they boot.
9. I'm all about the command line, and think any Linux fan should know how to use it. So you can bet I customize my console colors and fonts, since I spend a ton of time in it. Why not do the same for your mainframe? If they have a favorite color (as all do) design a color scheme around that color to make things feel more like home. Obviously if they're not a coder or Linux nut already, this might go unnoticed. The file you're looking for is in /home/knoppix/.kde/share/config/konsolerc if you made the new user. Or you can use the trick of using chroot and your current X session to load Konsole, and setup the values yourself. Personally, I'm a fan on gnome-terminal, so I'd try to put that in instead, and throw a nice background image of a sunset on it.
10. One of my favorite scripts is a little one I use to change my desktop. I just put a line in crontab calling a certain Python script, and every hour on the fifteen my background is changed to another picture from a certain directory. This can be perfect for a nice directory of a good handful of your most meaningful pictures: prom, wedding, the day your first server came home from the rack, whatever. If you've chrooted the filesystem, you can edit the crontab for your new knoppix user. Among other things you could tack onto here, I'd recommend a nice background changing script to make this disc change a little and keep them wanting to stay booted into it, rather than windows.
11. And just because I like going the extra mile, the 11th change I'd make is going into the ~knoppix/.mozilla/firefox/{profile}/ directory, and making a bookmarks file. Give her a nice selection of her favorite You Tube videos, Flash games, and news sites right at her fingers. Oh, and if you're smart, also a link to your blog and photo site, just to get her comments.

The BURNING!
Now follow your favorite guide for how to make the ISO, and finally burn it, and you're done!

Final Thoughts
While this is really just a "haha, look how cute I can be" I thought that this might be a good gift from someone whose job takes them far away from home for a while. Now, they may not have access to the required devices, but a company could make these CDs at a small fee for two purposes. The first is it'll spread Linux, always a good thing, and the second is it gives one of the people in the relationship a nice, and usable, gift. One thought might be for soldiers stationed in God knows where who could use this as a sort of bootable photo album. Set up an FTP server to let them upload images for background, a video message for their family, and other assorted specific changes. Then it'd be as easy as copying over the base filesystem, overwriting a few, select files, and burning to CD. It could (probably) be automated. I'd actully, *really* like to try to get this up and running if I had the time. Heck, I'd be willing to do it for free, and just have a PayPal "donate if you like" link on the page to cover the small cost of CDs bought in bulk and (mainly) shipping. If anyone would be interested in helping me with this, drop me a line: snarky{at}thesnarky{dot}com.

Bet you didn't think I could keep the computer term as a girlfriend metaphor up, did ya? Its one I've used for a long time, so practice makes perfect, I suppose. I'm single, so don't get to find out just how romantic such a CD is, but if anyone has the guts to give this in a box of chocolates, PLEASE let me know!

If your little love array has never remastered a CD, they might not truly appreciate the hours and frustration spent doing this. It was a lot harder than I initially thought, though that may be because I was using a different version of Knoppix than I thought it was. However, I found a couple of guides to editing Knoppix CDs online, and the best (that I ended up using my first time) was from here. For a different distro, look at this Slax guide.

The story gets better. This poor man, literally, is charged with stealing $10,000 worth of software. There is a good chance he makes as little as $100 a month (judging by comments I've seen from people living in Russia) which shows just how ridiculous Microsoft prices are. This man works for the school, and bought a few computers assuming they were legal. In return, he might spend 5 years in the Gulag (might be an exaggeration, might now be) for trying to help his school.

Ok, and now for the part that really blew my mind. A former world leader begging Bill Gates not to punish this man. How sad is that when a software company gets pleas like this from such (former) powerful men? To this Microsoft supporters who say its not too powerful, please think again. Gorbachev didn't think to go inside his own country to the prosecutors involved, no he went to where the real threat was, Redmond, Washington. Of course Microsoft ducked this plea for help by saying they didn't file civil charges, and this was all Russia's doing. Right, and I'm sure this had nothing to do with it? Filing a bunch of law suits worldwide... and then when one guy wasn't specifically charged you claim you didn't do it. Also, when there's surveys claiming Russia to be the second worst offender of piracy, I find it hard to believe Microsoft wouldn't want in on that.

Hey, I just thought of a solution... everyone chip in, and lets mail a box of Linux distros (some are specifically geared towards education) to Russia, and let them decide which way to go. Spend more than a teachers yearly salary on software, or take this free route and avoid dealing with the evil that is Microsoft.

As for there's more virii out there for PCs, I say wait a few years. Virus writers concentrate on the easiest game, which right now is Windows, same reasoning as to why there's more games for WIndows. However some people were also pissed off by the Mac is better commercials and have decided to go break OS X a bunch. Ok, so it happens that "PC" is synonymous with Windows right now, which is a shame, but do not blame a system for its weak software. This does not mean there's more virii for PCs, merely for Windows machines. Hey, don't believe me? Go read a Mac magazine say that Macs have "no more inherent security" than PCs. Sure there's not a lot of virii out there yet, but just wait. The larger the market share, the more virii you'll get. But please, don't say all PCs are more susceptible, because I've got three here that'll prove you wrong.

So, here's how the commercial should go:

PC: Hi! I'm a PC.
Mac: Hi! I'm a Mac.
PC: I'm running Windows XP! Gotta love the DRM and license issues.
Mac: Sure do! I come with my own DRM and licenses!
PC: I'm glad we agree on something Mac.
Mac: Me too, but its not the only thing we agree on.
PC: Its not?
Mac: No, you see it appears I'm compatible with you.
*Mac moves his mouse over to PCs keyboard*
PC: Mac... what are you doing?
Mac: I'm installing myself on your hardware, don't you like it?
PC: Yea, the dual-boot does seem a bit nice. Is that a snug fit?
Mac: Nah, you've got a huge disc!
*Small penguin walks in*
Tux: What the?! What are you two doing?!
PC: We're just... uh... dual-booting!
Mac: *mutters* I was gonna bootstrap you later*
Tux: Don't you see? You're both alike! You run on the same hardware, and are both encumbered by, well, the obvious licensing issues.
PC: Encumbered?! I was told it was better, who do you think you are?!
Mac: Yea! I'm the better one here! I'm impervious to all viruses!
Tux: *mutters* Keep that line up... I know some people that like to release code to break you.
Tux: My name is Linux. And if you don't like who I am you can grab one of hundreds of others like me. If you still don't like it, you can change me however you want.
PC: That's... that's not a good license. How will you make any money?
Tux: If you'd forget about money you'd realize that both PC's with windows and Mac's with OS X give up your freedom! THINK! GO take what digital rights you can before you lose them !!
*Tux grabs a broadsword and hefts it over his head*
Tux: FREEEEEEEEEEEEEDOOOOOOOOOOM *cuts PC and Mac in two*

Yea, believe it or not this is one of the things going through my head as I walk on campus. If anyone wants to make this dream come true, let me know and I'll skip a few days of class to shoot it.

When we take this to the basic argument, you have intentional confusing (which, I suppose is what good marketting is). You have Apple trying to convince the population that "Windows" == "PC" and that Mac == "Mac OS X". Also that there's such a huge difference between the two of them. Really, there's not. Both are just pieces of hardware that you, as a human, can make do your bidding. If you want to use the OS that comes with it, go ahead. If you want to throw more open software on there, go ahead. If you want to put Windows on a Mac, or OS X on a PC go ahead. See? These ads are nothing but propaganda!

So, I love my desktop. She's a gorgeous machine that is awesome for games, and even better for coding. I've got the better part of a Terabyte of disk space in her, and I've made an investment in keeping all my work and backups connected to her. When I'm home, this is amazing. I've got a frickin huge display for having tons of windows open. If I need to relax I can use Cedega to crank out my favorite games (assuming they don't have native Linux builds). But, big question, what if I'm not home? Traveling? Or... god forbid... on campus for classes? Therein lies SSH!

For the uninitiated SSH is a secure shell that in essence puts you at a terminal on whatever computer you're connected to, whereever in the world it may be. So if I'm on campus I may not have my gorggeous 4.6 million pixels of display to work on, but I do have command line access to my desktop (and hence, all my work). This has saved my butt more times than I can count. Oh, and its encrypted, which never hurts.

So that's the basics, but who cares if you can only get a command line?! I mean, what good can someone possible do without graphics? Well, for one, I love the Command Line Interpreter (CLI). I'm less distracted by fancy things, and I learn more keyboard shortcuts, great for productivity.

But sometimes you just wanna do nothing. Or maybe you need to check up on your buddy list and don't have AIM Express (worried about a friend today, and I was in this situation). The package I found was BSFlite. My solution was to SSH to my home machine (where I have install rights), wget the tarball from sourceforge, and make. That's it. 100% fool proof installation and I was able to browse my buddy list immediately.

Note: Yes, obviously these images have been doctored. I was messing around with options so they were quite confusing, and I've put things that go together, together. Also, in the buddy list, one guy specifically would not like to find his screen name on there, so I've removed it. Top picture is the commands, next is a conversation (with me mommy) and finally an unsorted (ok, meaning sorted alphebetically, not by status) buddy list.

Ok, why stop there? I also use IRC a ton, so I wanted an IRC client as well. (Ok, in all honesty this client has been on my system for a long time, but that doesn't make for a good story). What I found is IRSSI which is an awesome command line IRC client.

Want some sound? MPlayer can be tunneled over SSH. Heck, I've seen some people tunnel video over SSH with MPlayer also...

So there ya go. Four good reasons to be using SSH next time you're stuck on some sumb windows machine on campus.