Monday November 16, 2009
All
|
General
Monday November 16, 2009 Fun With DTrace: The Windows-Key Prank
The current episode of the German HELDENFunk podcast features an interview with Chris Gerhard about one of his favourite subjects: DTrace (in English, beginning at 14:58):
After the interview, we hear a guy called "Konteener Kalle" express his love (in German) for DTrace by playing a prank on his boss: Whenever he presses the Windows key (on an OpenSolaris system, mind you), he's punished by watching the XScreensaver BSOD hack (of course not knowing that it's just a screensaver).
That little joke challenged me to actually implement this prank. Here's how to do it.
The Idea
The idea of this prank is to start the XScreensaver Blue-Screen-of-Death screensaver (which simulates a Windows crash experience) on an OpenSolaris system whenever the user presses a certain key a certain number of times. This could be the Windows-Key (which doesn't have any real use on an OpenSolaris machine) or any other key. We count the number of key presses and only execute the BSOD after a certain number of key presses in order to make the prank less obvious.
Step 1: Identify the Windows (or any other) Key
If you have a Windows-Keyboard, this is easy: Run xev and press the Windows-Key. Take note of the keycode displayed in the xev output. Of course you can use any other key as well to play this prank. In this case, I'm using the left Control-Key, because I don't have a Windows-Key on the system I'm working on. The Control key has the keycode 37.
Step 2: Configure XScreensaver for BSOD
XScreensaver comes with a great collection of "hacks" that do interesting stuff on the screen when the screensaver activates. Check out the /usr/lib/xscreensaver/hacks directory. Each hack can be run individually, but then it will only execute inside a new window. For the BSOD illusion to be realistic, we want to execute the BSOD hack in full-screen.
This can be achieved by telling XScreensaver to demo the BSOD hack for us. It will then create a full-screen window and execute the BSOD hack inside the new window. The following command will tell XScreensaver to run a hack for us:
xscreensaver-command -demo <number>
The <number> part is a little complicated: XScreensaver looks at its config file ~/.xscreensaver where it stores a list of programs and arguments after the keyword "programs:". <number> simply refers to the number of the hack on that list. Therefore, we must create an entry in our admin user's .xscreensaver file that starts bsod(6) with the right parameters and that gives us a known number to call xscreensaver-command with.
Let's put our entry at the top of the list so we can simply use the number "1" to execute the BSOD screensaver. Somewhere in our .xscreensaver, the programs section should look like this:
... textFile: /etc/motd textProgram: date textURL: http://blogs.sun.com/roller/rss programs: \ - "BSOD Windoze" bsod -root -only nt \n\ - "Qix (solid)" qix -root -solid -segments 100 \n\ - "Qix (transparent)" qix -root -count 4 -solid -transparent \n\ ...
You can test this by running xscreensaver-command -demo 1.
Step 3: Write a DTrace Script That Sets Up the Trap
Now it gets more interesting. How do we use DTrace to find out when a user presses a certain key? All we know is that the Xorg server processes the keystrokes for us. So let's start by watching Xorg in action. The following DTrace command will trace all function calls within Xorg:
pfexec dtrace -n pid`pgrep Xorg`:::entry'{ @func[probefunc] = count(); }'
Let's start it, press the desired key 10 times, then stop it with CTRL-C. You'll see a long list of Xorg functions, sorted by the number of times they've been called. Since we pressed the key 10 times, it's a good idea to look for functions that have been called ca. 10 times. And here, we seem to be lucky:
... miUnionO 8 DeviceFocusInEvents 9 CommonAncestor 10 ComputeFreezes 10 CoreLeaveNotifies 10 key_is_down 11 FreeScratchPixmapHeader 12 GetScratchPixmapHeader 12 LookupIDByType 12 ProcShmDispatch 12 ProcShmPutImage 12 ...
The key_is_down function looks like exactly the function we're looking for! In fact, some googling tells us that this function's 2nd argument is the keycode of the key that is down when the function is called.
Why do we see "11" and not "10" function calls to key_is_down? Because it also counted my pressing of the Ctrl-Key when I stopped the DTrace script through Ctrl-C :).
This gives us enough knowledge to create the following DTrace script:
#!/usr/sbin/dtrace -s
/*
* BSODKey.d
*/
/*
* This D script will monitor a certain key in the system. When this key is
* pressed, a shell script will be executed that simulates a BSOD.
*
* The script needs the process id of the Xorg server to tap into as its
* first argument.
*
* One example of using this script is to punish a user pressing the
* Windows key on an OpenSolaris system by launching the BSOD screen saver.
*/
#pragma D option quiet
#pragma D option destructive
BEGIN
{
ctrlcount = 0;
keycode=37
}
pid$1::key_is_down:entry
/arg1 == keycode/
{
ctrlcount ++;
}
pid$1::key_is_down:return
/ctrlcount == 10/
{
ctrlcount = 0;
system("/usr/bin/xscreensaver-command -demo 1");
}
First, we need to enable DTrace's destructive mode (ever heard of a "constructive prank"?) otherwise we can't call the system-command at the end. The script uses the pid provider to tap into Xorg. Therefore, we need to give it the PID of the Xorg server as an argument:
pfexec ./BSODKey.d `pgrep Xorg`
It then sets up a probe that fires whenever key_is_down is called with our keycode and counts the key presses. At the end of the key_is_down function call, it checks whether we reached 10 keypresses, then executes the BSOD screen saver and resets the counter. You may need to make sure that the DISPLAY variable is set correctly for the BSOD program to show up on the victim's screen when starting this script.
After hitting the Control-Key 10 times, we're rewarded with our beloved BSOD:
Conclusion
That wasn't too difficult, was it? Yes, one could have done the same thing by writing a regular script that taps into /dev/kbd or something similar. But the beauty of DTrace lies in the simplicity of this script (Tap into the right function while it's running) and in the fact that it now can be modified very easily to fire BSODs at any kind of event, including the user hitting a certain area of the screen with his mouse or selecting a particular text or whatever you choose it to be.
So, have fun with this script and let me know in the comments what kind of pranks (or helpful actions) you can imagine with DTrace!
"Fun With DTrace: The Windows-Key Prank" has been brought to you by Constantin's Blooog.
This entry was created on 2009-11-16 08:32:14.0 PST and is associated with the following tags:
bsod
dtrace
fun
heldenfunk
scripting
windows
You're welcome to use this Permalink
, add a comment below or send your feedback to constantin at sun dot com.
Comments:
Post a Comment:
Comments are closed for this entry.
« A Small and Energy-E... | Main | OSDevCon 2009 Paper:... »
