18.8.10

Unofficial QtWRT tutorial 1: Hello, view modes!

Almost one month ago, we announced Qt Web Runtime, and released some snapshot for N900. Basically, QtWRT is a framework, using which you can write "native" application with standard web technology, e.g. HTML, CSS, and JavaScript. As a good starting point, you should take a look at this article.

Note that we're still working on it, and it's now just in the technology preview state ;)

1 install QtWRT
You should enable the extras-devel repository on your Rover and install the qtwrt-experimental package from there. Then, you can find in your Application Manager that Qt Web Runtime Technology Preview for N900 installed.


2 config.xml
To write your own web applications, besides the normal HTML pages, you also need a config.xml file to define e.g. the starting file, icon, features you need (i.e. access to Device APIs), as well as author's information, etc. More details and default values are defined here.

The following piece shows a minimum sample:
<?xml version="1.0" encoding="UTF-8"?>
<widget xmlns = "http://www.w3.org/ns/widgets">
</widget>


You can also define the name and icon (only PNG files supported) of the web app in config.xml:
<?xml version="1.0" encoding="UTF-8"?>
<widget xmlns = "http://www.w3.org/ns/widgets">
  <name>A sample web app</name>
  <icon src="app_icon.png" />
</widget>

The name and icon will be appeared in the Application Grid or the Desktop menu --> Add widget based on the view mode the web app supports (see below).

3 view modes
View modes define the visual presentation of web applications. The W3C spec has defined five different view modes, but we only support three of them in this snapshot:
windowed - The default view mode. You can find / launch web apps in this mode from the Application Grid. It also supports the native chromes and user-defined menus.
fullscreen - It can also be found / launched from the Application Grid. No need to say what is full screen, right ;)
minimized - It equals to the native widgets on the Home Screen.

The following piece defines the view modes in config.xml:
<?xml version="1.0" encoding="UTF-8"?>
<widget xmlns = "http://www.w3.org/ns/widgets"
    viewmodes = "someviewmode fullscreen minimized" >
</widget>

The unknown view mode "someviewmode" is ignored. It supports both "fullscreen" and "minimized" mode in this case. If no supported view mode is defined, "windowed" mode is used.

You can get the current view mode through the widget.viewMode interface in JavaScript.

Also, the transfer among different view modes is supported, with the exception from windowed / fullscreen to minimized, e.g.:
<a href="javascript:widget.viewMode='windowed'">Go to windowed mode</a>

With the following code, you can handle the view mode change event in the viewModeChanged function:
widget.onviewmodechange = viewModeChanged;
function viewModeChanged(mode)
{
  if (mode == "windowed") {
    // going to windowed mode
  } else if (mode == "minimized") {
    // going to minimized mode
  } else if (mode == "fullscreen") {
    // going to full screen mode
  }
}


4 package your application and install it
Well, I just assume you have enough knowledge to write whatever HTML page you like, and have renamed it to index.htm (the default starting file name).

Now just zip all your HTML files together with the config.xml file. Note that the config.xml file should be at the top level of the zip, and the name is case sensitive.

Then please rename it to *.wgt and copy it to your Rover. To make it like a native application, you can install it from the File Manager, and you can find your installed web applications in Application Manager!

Eh, I'm talking about some details during the installation here. You can skip this if not interested.

When you tap on the wgt file in File Manager, widgetinstaller is launched. It does some sanity checking of it, e.g. whether it's a valid zip file, if the config.xml is valid, etc., then convert it to a Debian file, and use the Application Manager to install the generated Debian file.

If you are interested in the generated Debian file, you can use the "--no-install" option of the widgetinstaller to have it copied to the current directory.

5 a sample
First, let's write the config.xml file.
<?xml version="1.0" encoding="UTF-8"?>
<widget xmlns="http://www.w3.org/ns/widgets"
    id="http://xizhizhu.blogspot.com/qtwrt/view-modes-sample"
    viewmodes="minimized fullscreen windowed">
  <name>View Modes Sample</name>
  <description>
    Well, it shows how the view modes work.
  </description>
  <author href="http://xizhizhu.blogspot.com/" email="xizhi.zhu@gmail.com">Xizhi Zhu</author>
  <license>In the public domain without any warranty.</license>
</widget>


Then the HTML file.
<html>
<header>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  <title>View Modes</title>
  <script type="text/javascript">
    function init()
    {
      output = document.getElementById("viewmode");
      output.innerHTML = widget.viewMode;

      widget.onviewmodechange = changeViewMode;
    }

    function changeViewMode(mode)
    {
      output.innerHTML = widget.viewMode;
    }
  </script>
</header>

<body onload="init()">
  <div id="viewmode"></div><br />
  <a href="javascript:widget.viewMode='minimized'">minimized</a><br />
  <a href="javascript:widget.viewMode='windowed'">windowed</a><br />
  <a href="javascript:widget.viewMode='fullscreen'">fullscreen</a>
</body>
</html>


Now let's zip the file, send it to N900 and install it from the File Manager. You can find it installed in the Application Manager and already launched in the home screen.


You may ask, why the last line of "fullscreen" is not shown there? Well, that's due to the fixed size in the minimized mode, 312x82. Also, in the minimized mode, you can't actually interact with it, but only tap on it and open the windowed or fullscreen mode if supported. In the minimized mode, it's the same as native widgets that you can move it around, close it and add it back, as well as the transparent background by default.

Then you can tap the links to toggle between windowed and fullscreen mode. And for sure you'll find another "limitation" that you can't go back to minimized mode from the link. The only way is to close the window. Well, that's exactly what is expected.



Another thing is, in the fullscreen mode, it automatically shows the "go back to windowed" button if windowed mode is supported, otherwise the "close" button. Emm, the same as the browser, right?


Updated on 19.8.2010
Screenshots added into the posts ;)

16.8.10

Basic samples for SSL communication over Qt

1) client
class SSLClient: public QObject
{
Q_OBJECT

public:
SSLClient(QObject* parent = NULL)
: QObject(parent)
{
connect(&client, SIGNAL(encrypted()),
this, SLOT(connectionEstablished()));
connect(&client, SIGNAL(sslErrors(const QList<QSslError> &)),
this, SLOT(errorOccured(const QList<QSslError> &)));
}

void start(QString hostName, quint16 port)
{
client.setProtocol(QSsl::TlsV1);
client.connectToHostEncrypted(hostName, port);
}

public slots:
// handle the signal of QSslSocket.encrypted()
void connectionEstablished()
{
// get the peer's certificate
QSslCertificate cert = client.peerCertificate();

// write on the SSL connection
client.write("hello, world", 13);
}

// handle the signal of QSslSocket.sslErrors()
void errorOccured(const QList<QSslError> &error)
{
// simply ignore the errors
// it should be very careful when ignoring errors
client.ignoreSslErrors();
}

private:
QSslSocket client;
};


int main(int argc, char** argv)
{
QApplication app(argc, argv);

SSLClient client;
client.start("127.0.0.1", 8888);

return app.exec();
}



2) server
class SSLServer: public QTcpServer
{
Q_OBJECT

public:
SSLServer(QObject* parent = NULL)
: QTcpServer(parent)
{
}

void start(QString certPath, QString keyPath, quint16 port)
{
listen(QHostAddress::Any, port);
this->certPath = certPath;
this->keyPath = keyPath;
}

public slots:
void readyToRead()
{
qDebug() << serverSocket->readAll();
}

void errorOccured(const QList &)
{
serverSocket->ignoreSslErrors();
}

protected:
void incomingConnection(int socketDescriptor)
{
serverSocket = new QSslSocket;
if (serverSocket->setSocketDescriptor(socketDescriptor)) {
connect(serverSocket, SIGNAL(readyRead()), this, SLOT(readyToRead()));
connect(serverSocket, SIGNAL(sslErrors(const QList &)),
this, SLOT(errorOccured(const QList &)));
serverSocket->setProtocol(QSsl::TlsV1);
serverSocket->setPrivateKey(keyPath);
serverSocket->setLocalCertificate(certPath);
serverSocket->startServerEncryption();
} else {
delete serverSocket;
}
}

private:
QSslSocket *serverSocket;
QString certPath;
QString keyPath;
};

int main(int argc, char** argv)
{
QApplication app(argc, argv);

SSLServer server;
server.start("ca.cer", "ca.key", 8888);

return app.exec();
}


30.5.10

JavaScript benchmarking on N900 PR1.2

Two months earlier, I did my JavaScript benchmarking on N900 PR1.1, and compare it with other platforms. Now, as N900 PR1.2 got released, Opera has released a preview for Maemo, and Chrome is ported to N900 by Jacekowski, I did another round of benchmarking.

V8SunSpiderPeacekeeper
MicroB (default browser)21.235.12128
FireFox21.415.84141
Opera49.524.41119
Qt 4.6.210512.04238
QtWebKit 2.01049.36286
Chrome1138.84344
For V8 and Peacemaker, the higher the score, the better performance it has. For Sunspider, it's the lower the better.

Chrome is really fast as a result of its excellent V8 JavaScript engine and frequent release cycle.

Qt 4.6.2 is still quite good, especially considering the fact that the WebKit integrated is quite old. Note that QtWebKit will be released separately from Qt, meaning we could enjoy more about the latest WebKit technology then.

However, both Opera and FireFox (MicroB uses FireFox's Gecko JavaScript engine) have quite a long way to go. Moreover, when running V8 and Peacekeeper, both MicroB and FireFox complained about unresponsive JavaScript.

15.5.10

这位评论真的用过N900吗?!

刚看了一篇谈论手机杯具的文章,说的是N900。不过很怀疑这位老兄是否真的用过N900......

文章说:N900最大的尴尬在于它那被消极淡化的通话功能。
话说Nokia对Maemo/MeeGo系列的定义是“移动电脑”(mobile computer)吧!打开N900的官方首页,上面就写得非常清楚:Nokia N900 mobile computer。本来定位就不是智能手机,所以通话功能被“淡化”不正常吗?或者说你见过哪部PDA会“强化”电话功能的?好吧,你会说我这样强词夺理了,那我们接着看......

然后文章对N900的“消极淡化通话功能”列出了几个“铁证”:
1,机身正面没有任何拨号快捷键,哪怕是触控按键都没有。
2,默认桌面菜单也没有任何与通话相关的快捷方式。
3,QWERTY全键盘采用了三排式的布局,因此并没有单独的数字键。也就是说,打开侧滑盖还是没法直接拨号。
4,没有竖屏模式,也就是说诺基亚设计它的初衷就是让你始终横着拿它。横着打电话?有难度吧。。。

好吧,我们看图说话:
这是我N900上四个桌面之一,上面可以任意摆设各种Widget、快捷方式和联系人,也可以自行调整其放置的位置。标号为1的红圈就是联系人的快捷方式,标号为2的红圈是最近通话和拨号功能的快捷方式,标号为3的红圈则是放在单个联系人的快捷方式。当然单个联系人也是可以自定义头像的,只不过考虑到隐私我暂时删除罢了。

当然了,默认情况下,桌面也是有联系人和最近通话的快捷方式的,好像也有邮件或者短信息的快捷方式......我就不刷机证明了啊;)

当然了,既然有如此方便的软键盘拨号,为何还要打开侧滑盖呢?

然后我们再看看“没有竖屏模式”的笑话!你点开最近通话和拨号功能,然后看下图:
我觉得这个应该叫做“竖屏模式”了吧?!而且通话功能的竖屏模式是默认开启的......

我想,我只能说这位搞评论的朋友没有用过N900吧!

PS 这三张照片都是用另一部N900的相机在晚上10点左右拍摄的,外界光线不好,室内也没开灯:)

20.3.10

JavaScript benchmarking on N900 and my laptop

I just ran some JavaScript benchmark tests of V8 version 5, SunSpider v0.9.1 and Peacekeeper on my laptop. My laptop is HP EliteBook 6930p, which has Intel Core 2 Duo CPU P8600 @ 2.40GHz, 4 GB RAM, running KUbuntu 9.10 with kernel 2.6.31-20-generic. Also, I ran it on my N900 PR1.1 with Qt 4.6.2, and collected some results for iPhone 3GS, Droid and Nexus One, and HTC Desire.

The following scores are from V8, the higher the better.
FireFox for Ubuntu 3.5.8 - 248
Qt 4.6.2 – 910
Chrome 5.0.307.11 Beta – 4155
QtWebKit 2.0 – 2816
N900 - 105
iPhone 3GS - no results
Droid - 39.5
Nexus One - 63.5
HTC Desire - 66.1

Then I found some results of iPhone 3GS for V8 version 3:
N900 - 103
iPhone 3GS - 53

The following scores are from SunSpider, the lower the better.
FireFox for Ubuntu 3.5.8 – 2484.7
Qt 4.6.2 – 1136.0
Chrome 5.0.307.11 Beta – 462.1
QtWebKit 2.0 – 635.6
N900 - 12.5
iPhone 3GS - 16.7
Droid - 34.2
Nexus One - 14.7
HTC Desire - 12.02

The following scores are from Peacekeeper, the higher the better.
FireFox for Ubuntu 3.5.8 – 1510
Qt 4.6.2 – 3261
Chrome 5.0.307.11 Beta – 4324
QtWebKit 2.0 – 4288
N900 - 244

Chrome’s V8 engine is really fast, and WebKit still has a long way to go!

Also, N900 performs much better than iPhone 3GS, Droid and Nexus. Considering HTC Desire, N900 wins easily on V8, but lost a little on SunSpider. However, if you consider MicroB, the default browser on N900, it’s a disaster due to the slow engine of Gecko and N900 even used a pretty old version.

Then the ACID3 test.
FireFox for Ubuntu 3.5.8 – 93
Qt 4.6.2 – 100
Chrome 5.0.307.11 Beta – 100
QtWebKit 2.0 – 100


* The test for QtWebKit 2.0 is done with the revision number of 56441.

21.2.10

IC cards are vulnerable to MITM attacks

Researchers from Cambridge found a vulnerability in IC cards using EMV, which is used worldwide (with over 730 million cards in circulation) in chip and pin credit/debit cards. Note that the authors claimed that “the protocol is broken”. The details will be published at IEEE Security and Privacy Symposium in May this year, and a working draft is available now.

With this vulnerability, criminals are able to launch Man-In-The-Middle (MITM) attacks easily and use stolen cards without knowing the correct PIN. The attack works for both online and offline transactions on terminals. Fortunately, it can’t work for ATM transactions.

Let’s see how it works. The EMV protocol can be split into three steps:
1 Card authentication – assure which bank issued the card and the data hasn’t been tampered.
1.1 The terminal requests the list of available applications (e.g. card use at shops, ATM functionality, etc.), and selects one of them.
1.2 The terminal reads the information of the card-holder, including card details (e.g. primary account number, start and expiry date), backwards compatibility data, and control parameters for the protocol. Some information is signed by RSA, and the certificate chain is also included in the information.

2 Card-holder verification – assure the PIN entered matches the one stored on the card.
2.1 The terminal sends the inputed PIN to the card for verification.
2.2 If the inputed PIN matches the one stored on the card, 0×9000 is returned to the terminal. Otherwise, 0×63Cx is returned, where ‘x’ is the number of further PIN verification attempts the card allows. Note that the response is NOT directly authenticated.

3 Transaction authorization – assure the bank authorizes the transaction.
3.1 The terminal asks the card to generate a cryptographic MAC over the transaction details, including e.g. the transaction amount, currency, type, a random nonce generated by the terminal, and the terminal verification result. Note that the terminal verification result merely enumerates possible failure conditions, and doesn’t indicate which particular method is used in case of success.
3.2 The card sends back also a sequence counter identifying the transaction, a variable length field containing data generated by the card, and the MAC. The MAC is usually generated using 3DES with a symmetric key shared between the card and the issuer.
3.3 The terminal sends the response to the bank for transaction authorization.
3.4 If the check passes, the bank sends back a two byte long response code, and a MAC over the message sent from the card and the response code.
3.5 The response is forwarded by the terminal to the card. If the card verifies the response from the bank, it updates some internal states to note that the bank authorizes the transaction.
3.6 The terminal asks the card to generate a transaction certification, signifying that it’s authorizing the transaction to proceed. It will be sent to the bank and stored locally for further use.

Due to the above two flaws, the bad boy is able to launch the MITM attack like this:
1) It hijacks the communication in step 2, sending 0×9000 to the terminal to fool it into believing the PIN verification succeeds.
2) As the PIN is never sent to the card, it will be fooled into believing the terminal doesn’t support PIN verification, and the PIN retry counter is not modified.
3) As the terminal verification result doesn’t tell the particular method used, the terminal believes the PIN verification succeeds and the card believes the PIN verification is not attempted.
4) The variable length field containing data generated by the card generated in step 3.2 is issuer-specific, and not specified in EMV. Therefore, the terminal can’t decode it, and the issuing bank doesn’t know which card-holder verification scheme is used.

Also, the researchers found that EMV failed to provide adequate evidence to produce in dispute resolution and litigation, among other issues. And we should be aware that this vulnerability is not implementation-specific, but the fundamental protocol is broken!

16.11.09

SSL renegotiation vulnerability exploited

This post has been moved to http://www.zionsoft.net/2009/11/ssl-renegotiation-vulnerability-exploited/

The SSL renegotiation vulnerability revealed earlier this month has been demonstrated by a Turkish grad student, named Anil Kurmus, to steal user names and passwords of Twitter. The code is also available in the wild.

Yes, it’s totally true that even the attacker can inject a small amount of message at the beginning, he’s still unable to read the encrypted data. But let’s see how Kurmus’ attack works. (Of course, this hole has been patched by Twitter)

You can update your Twitter status with its API by posting your new status to http://twitter.com/statuses/update.xml, as well as your user name and password. The message is something like below:
POST /statuses/update.xml HTTP/1.1
Authorization: Basic username:password
User-Agent: curl/7.19.5
Host: twitter.com
Accept:*/*
Content-Length: 22
Content-Type: application/x-www-form-urlencoded

status=your new status

All that the attacker need to do is to inject a POST request header, and post the victim’s POST request to his own twitter account:
POST /statuses/update.xml HTTP/1.1
Authorization: Basic username:password
User-Agent: curl/7.19.5
Host: twitter.com
Accept:*/*
Content-Length: 140
Content-Type: application/x-www-form-urlencoded
status=
POST /statuses/update.xml HTTP/1.1
Authorization: Basic username:password


The red part is injected by the attacker, and the blue part is submitted by the victim. Then the server would be fooled to post the victim’s credential, and now, the attacker gets the user name and password of the victim.

Quite simple, but really destructive!