Southern Bread » programming

MIDI Programming in Windows

Dave — Sun, 07 Jan 2007 22:13:00 +0000

I recently wrote a guitar tuner app called FrequentZ that uses the short MIDI functions of Windows to generate it’s tones. I thought I would show everyone how it’s done in case you would like to incorporate some MIDI functionality into your own software. The best resource for Windows MIDI programming on the web is found here, so if you want to do something more complex, see that reference first. But, if your goals are more modest like mine were then you can probably get by with just a few of the MIDI functions that Windows has to offer. All of the code will be in masm32.

Here is the basic code you’ll need to generate some tones:

...
;## Include the multimedia libraries
include   winmm.inc
includelib   winmm.lib

.data
AGUITAR         dd  0000018C0h  ;## Acoustic Guitar
dwMidiMessage   dd  0007F2890h  ;## E Note

.data?
hMidi   HANDLE  ?

.code
...
;## Open a handle to the MIDI device
invoke  MIDIOutOpen, ADDR hMidi, MIDI_MAPPER, 0, 0, 0
mov     hMidi, eax

;## Change patch number
invoke  MIDIOutShortMsg, hMidi, AGUITAR

;## Create a note-off MIDI message
mov     eax, dwMidiMessage
mov     edx, 0FFFFFF80h
and     edx, eax
mov     dwMidiOffMessage, edx 

;## Send a message to play the note
invoke  MIDIOutShortMsg, hMidi, dwMidiMessage
invoke  Sleep, 2000        
invoke  MIDIOutShortMsg, hMidi, dwMidiOffMessage

;## Close the handle
invoke  MIDIOutClose, hMidi
...

So here’s what’s happening. We declare two 32-bit values to hold the MIDI patch number we want to use (AGUITAR) and the note we want to play (E). In the main code we first open a handle to the Windows MIDI mapper device by calling MIDIOutOpen and then change the patch number to 24 wich is supposed to sound like an acoustic guitar. Next, we create a MIDI message to turn the note off. We do this by ANDing the 32-bit MIDI note-on message with a bitmask that will leave everything the same except change the last byte to 128 (80h). The bitwise AND operator compares bits and returns a 1 if both the source AND destination bits are 1. Otherwise it returns 0. It works like this for us:

90h	1	1
80h	1	0
=	1	0

And because the remaining 24 bits of the destination value are all 1’s (FFFFFF), the rest of the MIDI message is preserved.

Finally, we send the message to play the note using MIDIOutShortMsg, sleep for a couple of seconds to make sure the note has time to play and then turn the note back off with another call. Last thing to do is to close the handle when you’re finished. It’s a good idea to look all of these functions up in the Windows multimedia API because they have a description in there about how the MIDI message byte order should be arranged. The other thing to note is that if you are triggering these notes from a GUI element like a button, then you should really fire off a second thread to handle playing the note. Otherwise, your GUI interface will hang because of the Sleep call. That’s very annoying.

SQL Injection Defense – Part I (Authentication)

Dave — Wed, 27 Sep 2006 11:31:00 +0000

I want to do a couple of posts on SQL injection attack prevention. I
am going to show some of the techniques I use to ward them off. For example,
we use a three pronged approach at
the authentication point: variable binding, row counting, and syntax
detection. When a username and password are entered on the login form
we check to make sure that there is nothing obviously wrong with the
input, like password being of acceptable length and such. The next
thing we do is check to make sure there is no known SQL syntax within
the username or password. For example, if someone inputs a password
like this:


’ OR 1=1

it will get rejected at this step. All of the SQL keywords are
stored in big lookup table and checked against. The next step then is
to bind the variables instead of passing them in as plain strings. This
is a crucial step to avoid SQL injection. So instead of:


$sql="SELECT * FROM users WHERE username="$username" AND 
password="$password" LIMIT 1

we use:


$sql="SELECT * FROM users WHERE username=? AND password=? LIMIT 1
$sth=$dbh->prepare($sql);
$sth->execute($username,$password);

The final thing we do is check the row count of the result set. Even
though we used “LIMIT 1″, if there is an injection going on then we must
assume that it has been changed. Be sure and check that you have a row
count that is sane for the operation you are performing. If you are
logging someone in then you should return an error if the result count
is 0 or greater than 1, like this:


die unless($sth->rows() eq 1);

Next time I’ll focus on SQL injection that happens beyond the front
gate. Sometimes you can’t be so strict on row counts and syntax checks
once a user is inside.

NumPad – Pad Numbers in Filenames

Dave — Fri, 22 Sep 2006 20:33:00 +0000

One of the most annoying things with mp3’s (other than DRM of course) is consecutive numbering. The sort algorithm on Windows and most mp3 players sorts as it goes through the filename one character at a time. So if you have 12 files named “file-1.mp3 … file-12.mp3″, they will sort like this:

file-1.mp3
file-10.mp3
file-11.mp3
file-12.mp3
file-2.mp3
file-3.mp3
file-4.mp3
file-5.mp3
file-6.mp3
file-7.mp3
file-8.mp3
file-9.mp3

That is obviously not what anybody wants. To correct this, consecutively numbered files must be zero-padded in order to sort correctly. So the previous list would need to look like this:

file-01.mp3
file-02.mp3
file-03.mp3
file-04.mp3
file-05.mp3
file-06.mp3
file-07.mp3
file-08.mp3
file-09.mp3
file-10.mp3
file-11.mp3
file-12.mp3

I run into this problem often enough that I started looking around for software that would pad the numbers in filenames automatically for me. I couldn’t find anything out there that would do it in an automated fashion so I wrote a perl script to do it. I wrote it in Perl so that I could run it under Linux as well. I frequently need to have jpeg’s consecutively numbered as well so that was important. Here is the script:

#!/usr/bin/perl

use strict;
use warnings;

my $dirname = $ARGV[0] || "";
my $change  = $ARGV[1] || "no";
my $ext     = $ARGV[2] || ".mp3";
my $padsize = $ARGV[3] || 4;

##: Give usage if no arguments are defined
if ($dirname eq "") {
  print STDOUT "Usage: numpad.pl \"directory\" [change?] [.ext] [padsize]\n";
  print STDOUT "  [change?] - default is \"no\" - should I actually rename the file\n";  
  print STDOUT "  [.ext] - default is \".mp3\" - what files should be acted upon\n";
  print STDOUT "  [padsize] - default is \"4\" - how many digits should I pad to\n";
  print STDOUT "\n";
  print STDOUT "Example:\n";
  print STDOUT "  numpad.pl \"c:\\mp3\\album\" yes .wav 5\n";
  exit(1);
}

##: Change to the directory asked for
chdir($dirname) or die "Couldn’t change to directory ’$dirname’: $!";

##: Open and read in the directory based on the fileglob given
opendir(DIR, "$dirname") or die "Couldn’t open directory ’$dirname’: $!";
my @files = grep { /.*$ext/ } readdir(DIR);
closedir DIR;

##: Loop through the file entries and mod them
foreach my $file (@files) {
  my $newfilename="";

  ##: Cut off the extension, to be put back on later
  $file =~ s/$ext//g;

  ##: Split the filename into an array using any number as a separator
  my @fnparts = split(/([0-9]*)/, $file);

  ##: Loop through the array and pad any numerical elements
  foreach (@fnparts) {
    my $result = $_;
    my $number = 0;
    if($result =~ m/[0-9]+/) {
      $number = sprintf("%0".$padsize."d", $result);
      $newfilename.=$number;
    } else {
      $newfilename.=$result;
    }
  }
  $newfilename.=$ext;
  $file.=$ext;
  print STDOUT "$file\n  -> $newfilename\n";
  if($change eq "yes") {
    rename($file, $newfilename);
  }
}

Just save this code as a file named numpad.pl. If you run it on Windows, you will have to either install a perl interpereter first(get the MSI package from ActiveState) or download the native executable version below that was compiled with Perl2Exe. If you use the interpreter method you would need to execute perl and pass the script name to it as the first argument. Like this:

c:\> perl numpad.pl "c:\mp3\album" yes .wav 5

That example would zero-pad all the files in the c:\mp3\album directory that end with .wav, making any number it finds in a filename at least 5 digits long. This script should handle any files you give it; not just mp3’s. You can also re-run it with a different padding amount and it will redo the padding if you put too many on the first time. If you tell it “no” as the second argument, it will just show you what it would do instead of actually doing it. As always, USE AT YOUR OWN RISK!

Native Exe Version: numpad.exe
Perl Source Version: numpad

Fixing HTML Markup Problems

Dave — Sat, 23 Sep 2006 09:22:00 +0000

Every webmaster that is concerned with standards compliance has to constantly keep their site validated. I strive to keep this site compliant with the XHTML 1.0 Strict specification and that means a trip to the W3C validator every time I make a change to the site. One of the constant annoyances with the XHTML Strict specs are character set issues and closing unary tags. I have eased my burden a little by putting in a plugin to my blog software to fix those problems right before the page is rendered. That means even if I mis-type something in a blog post it won’t keep the site from validating, because it gets fixed at display-time.

Here is what the meat of the plugin looks like:


  ##: Tag fixes
  $$body_ref =~ s/\/\/gi;
  $$body_ref =~ s/\/\/gi;
  
  ##: Character code fixes
  $$body_ref =~ s/\’/\&\#8217\;/gi;
  $$body_ref =~ s/\x93/\&\#8220\;/gi;
  $$body_ref =~ s/\x94/\&\#8221\;/gi;  
  $$body_ref =~ s/\x92/\&\#8217\;/gi;
  $$body_ref =~ s/\x91/\&\#8217\;/gi;
  $$body_ref =~ s/\x85/\.\.\./gi;
  $$body_ref =~ s/\x96/-/gi;

You can get the gist of it I hope. The $$body_ref variable just contains the contents of the current blog post that is being assembled. Each line performs a regex search/replace operation and corrects a potential markup problem. The top 2 lines fix the 2 most common problems I run into with unary tag closing. They add closing forward-slash’s to the br and hr html tags. Those are the ones I forget most often. You might need to include the img tag also if it’s a problem for you.

The character code fixes are needed to fix those “non SGML character number” messages that annoy the crap out of everybody. They usually sneak in when you do a copy/paste operation off of a webpage and stick it in your blog post. If you’re not familiar with regex syntax, the x00 in the search string is an octal notation. It means to replace every occurence of that character code with the appropriate html entity name that makes it compliant with XHTML. In my opinion, HTML entity names are the easiest and most readable route to take in this situation. The ones I listed above are the most common for me, but you can find a more complete list here.

This is not all just to make you feel better about being an open standards fanboy. It has a real purpose. For instance, if your site is listed on one of the standards compliance list sites like W3CSites, you don’t want to get delisted just because you forgot to close a br tag on one of your blog posts. This just adds another layer of protection against that happening.

Config::Tiny

Dave — Fri, 25 Aug 2006 09:22:00 +0000

I have a few mod_perl web apps that I maintain for my employer. One of the problems that you run into with any web app is the proper placement of global configuration parameters within the application. I’m talking about things such as database hostname, database login credentials, query timeout parameters, etc. Since a web application is stateless(each reply/request cycle is atomic) you have to make these global variables available from within each of your modules independently, but in a way that still let’s you have only a single point of administration for changing them. Here is the method I use for handling this situation.

I use the cpan module Config::Tiny and create a new module that handles returning the current global configuration data whenever it’s functions are called. Config::Tiny reads an INI style configuration file, and since it reads this file each time it’s called, you don’t have to bounce your apache process just to make a configuration change. Here is a mock example of a file that Config::Tiny might read:

##: Config file

[database]
type=mysql
server=mysql.domain.com
user=username
pass=password
database=mywebapp

[global]
expires=86400
maxusers=5

You could save this file as /etc/mywebapp.conf and that would become the administrative point for any configuration changes to your app. Now here is a look at the module(I’m assuming you are familiar with module creation, if not look here) you would use to retrieve that data from the config file and hand it to your application:

package mywebapp::Conf;

#use 5.008;
use strict;
use warnings;

require Exporter;

our @ISA = qw(Exporter);
our %EXPORT_TAGS = ( ’all’ => [ qw() ] );
our @EXPORT_OK = ( @{ $EXPORT_TAGS{’all’} } );
our @EXPORT = qw(
  get_db_config
);

our $VERSION = ’0.01’;

sub get_db_config {
  use Config::Tiny;

  ##: Hash ref to return
  my $dbase;

  ##: Open the config file
  my $config=Config::Tiny->read(’/etc/mywebapp.conf’);

  ##: Get values
  $dbase->{’type’}=$config->{database}->{type};
  $dbase->{’server’}=$config->{database}->{server};
  $dbase->{’user’}=$config->{database}->{user};
  $dbase->{’pass’}=$config->{database}->{pass};
  $dbase->{’database’}=$config->{database}->{database};

  return($dbase);
}

1;
__END__

So now we have a module who’s subroutines we can call from within our mod_perl modules. But this method is not restricted to only mod_perl. Since we created a generic perl module, we can call it from any perl script. For example sometimes you might have to get access to this same config information if you have a perl script that runs from a cronjob to do cleanup on your database.

If you were going to call it from a mod_perl module you might do something like this:

package mywebapp::UpdateUserInfo;
...
use mywebapp::Conf;

sub handler {
...
my $dbase=get_db_config();
...
}

1;

Now you have a hashref full of all the pertinent info needed to login to your database backend. You could go one step further and add a connect_to_db function to your config module and then you wouldn’t even have to mess with the database info at all. With this setup in place, tasks like changing the database server’s hostname or login credentials are now a trivial task that doesn’t require taking your webapp offline.

LDAP From a CGI

Dave — Tue, 15 Aug 2006 14:28:00 +0000

When I’m writing web code these days, I find myself using LDAP in some form almost every time. It’s become the “glue” that ties a lot of our web/intranet apps together. If you have never worked with LDAP from within a CGI, here is a kind of skeleton example to get you started. It uses perl’s Net::LDAP module to grab a list of users from the “Domain Users” OU of our Active Directory and show them in an HTML table. The returned results are sorted alphabetically by first name (“givenName” in directory speak). Net::LDAP is feature rich and has all the bells and whistles you are likely to need for an intranet app. Check out the API documentation for more details.

#!/usr/bin/perl -w
use Net::LDAP;
use strict;

##: Bind anonymously to the ldap database
my $basedn="ou=Domain Users,dc=domain,dc=com";
my $ldap=Net::LDAP->new(’ldap.domain.com’) 
  or die "Couldn’t connect to directory server.\n";
my $mesg=$ldap->bind(’user@domain.com’,password=>’********’) 
  or die "Couldn’t bind to directory server.\n";

##: Query LDAP to get a list of users and their info
$mesg=$ldap->search( 
  base=> $basedn,
  filter=> "(objectClass=user)",
  attrs=> [’displayName’,’givenName’,
           ’sn’,’mail’,’telephoneNumber’,
           ’streetAddress’,’l’,’st’,
           ’postalCode’,’homePhone’ ] );

##: Display the directory
my $count=0;
my $results="";
foreach my $entry ($mesg->sorted(’givenName’)) {
  $results.="";
  $results.="".$entry->get_value(’displayName’)."";
  $results.="".$entry->get_value(’streetAddress’)."";
  $results.="".$entry->get_value(’l’)."";
  $results.="".$entry->get_value(’st’)."";
  $results.="".$entry->get_value(’postalCode’)."";
  $results.="".$entry->get_value(’homePhone’)."";
  $results.="".$entry->get_value(’mail’)."";
  $results.="";
  $count++;
}
$mesg=$ldap->unbind;

print STDOUT "Content-Type: text/html\n\n";
print STDOUT "\n\n\n";
print STDOUT "User Listing - Full\n";
print STDOUT "\n\n\n";
print STDOUT "Records Returned: $count
\n";
print STDOUT "";
print STDOUT "";
print STDOUT "";
print STDOUT "";
print STDOUT "";
print STDOUT "";
print STDOUT "";
print STDOUT "";
print STDOUT "\n";
print STDOUT $results;
print STDOUT "Name Address City State Zip Phone Email\n";
print STDOUT "\n";

Groupwise Address Book Converter

Dave — Wed, 09 Aug 2006 10:38:00 +0000

Here is a little script I cooked up to help us with the migration from Groupwise to Exchange a couple of months ago. It will take a .nab file exported from Groupwise and convert the field names into Outlook compatible names so the Outook import wizard will map them properly into the contacts list. It will replace the contents of the input file. It also strips out any of the old “internet:” prefixed addresses left over from older versions of Groupwise if you have any. This was a real lifesaver for me when doing the conversion.

Const ForReading = 1
Const ForWriting = 2

Set objArgs = WScript.Arguments

Dim arrFieldSearch
Dim arrFieldReplace
arrFieldSearch = Array("@DOMAIN.GWIA",".DOMAIN.GWIA",
  ".GWIA.DOMAIN","internet:","Internet:",
  "INTERNET:",":::TAGMAP:::0FFE0003:***",
  "3001001E:Name","3A08001E:Office Phone Number",
  "3A18001E:Department","3A23001E:Fax Number",
  "3003001E:E-Mail Address","3A06001E:FirstName",
  "3A11001E:LastName","3A17001E:Title",
  "3A29001E:Address","3A27001E:City","3A28001E:State",
  "3A26001E:Country","3A2A001E:ZIP Code","3002001E:E-Mail Type",
  "3A19001E:Mailstop","3A09001E:Home Phone Number",
  "3A1C001E:Cellular Phone Number","3A21001E:Pager Number",
  "3A1A001E:Phone Number","600B001E:Greeting",
  "600F001E:Owner","3A16001E:Organization","3004001E:Comments",
  "3A00001E:User ID","6604001E:Domain","6609001E:Additional Routing",
  "6605001E:Post Office","6603001E:GUID","6607001E:NDS Distinguished Name",
  "6608001E:Network ID","660D001E:Internet Domain","8000001E:Pumatech_ID"
)

arrFieldReplace = Array("","","","","","","Category","Name",
  "Company Main Phone","Department","Business Fax",
  "E-Mail Address","First Name","Last Name","Job Title",
  "Business Street","Business City","Business State","Business Country",
  "Business Postal Code","E-Mail Type","Office Location","Home Phone",
  "Mobile Phone","Pager","Business Phone","Title","User 1","Company",
  "Notes","User 2","User 3","Office Location","Post Office",
  "6603001E:GUID","6607001E:NDS Distinguished Name",
  "6608001E:Network ID","660D001E:Internet Domain","8000001E:Pumatech_ID"
)

For F = 0 to objArgs.Count - 1
  strFileName = objArgs(F)
  WScript.echo F & ". " & strFileName
  
  Set objFSO = CreateObject("Scripting.FileSystemObject")
  Set objFile = objFSO.OpenTextFile(strFileName, ForReading)
  
  strText = objFile.ReadAll
  objFile.Close
  
  i = 0
  For Each strSearchFor in arrFieldSearch
    strReplaceWith = arrFieldReplace(i)
    strNewText = Replace(strText, strSearchFor, strReplaceWith, 1, -1, 1)
    strText = strNewText
    i = i + 1
  Next
  
  Set objFile = objFSO.OpenTextFile(strFileName, ForWriting)
  objFile.WriteLine strNewText
  objFile.Close
Next

WScript.echo "Finished Conversion!"

Just copy the code into a file called “abconvert.vbs” and put it into your “Send To” folder. Then just right-click on an exported .nab file and send it to the script.

SoftScan and SSReader

Dave — Fri, 04 Aug 2006 11:29:00 +0000

Here is a simple pair of programs that make administering licensing a little easier for sysadmins. SoftScan will simply enumerate the Uninstall key in the registry and dump it all to a file. This is the same key that Add/Remove Programs draws it’s info from. It also dumps the version of Windows being run as well as all the installed PCI devices it can find.

The other program called SSReader will then take all the dump files produced by SoftScan in a directory and aggregate them to produce a count of how many installations of each piece of software there are. I use it here at the office by putting SoftScan in the global login script. Then any time I want to know how many installs of a certain piece of software I have, I just fire up SSReader and check. I then know how many licenses I need to buy if I’m over.

SoftScan Usage:

softscan.exe /p-c:\path\to\store\report

There is also a /q switch that will make SoftScan not display a progress bar, and a /? switch to get usage info.

SSReader Usage:

ssreader.exe

Just double-click it and go. When you first start SSReader it will ask you to choose a directory. Just choose the same directory that you use in the /p- switch of SoftScan. There is a filter box at the top of the SSReader window. When you type in the box, it narrows the displayed programs down in realtime.

This isn’t exactly Beta software but I wouldn’t call it stable either. If you find any glaring problems with it please shoot me an e-mail. I’ll release the masm32 source at a later date after I clean it up.

Download current SoftScan Binary
Download current SSReader Binary

PodWrangler – New Version (v0.1.4.1)

Dave — Fri, 28 Jul 2006 01:23:00 +0000

I prettified the buttons to make it look a little spiffier and squashed a big bug in the code that allows you to change the download directory for a certain feed. It’s getting insanely big though. 96KB is just total bloat-ware. The next release will fix some of those glaring holes in the UI like being able to cancel an in-progress download. Use the “Check for updates” as always to update automatically.

Get the source and binary here

Automatic Power Profile Configuration

Dave — Sat, 22 Jul 2006 21:52:00 +0000

Show me a sysadmin that likes to do the same thing 10 times in a row by hand and I’ll show you the sweater I got from Tony Blair. So in that vain, here is a batch file you can run from your login scripts that will automatically configure desktop and laptop power profiles in windows. Why this isn’t included in Group Policy Management I do not know, but since every copy of Windows XP sp2 has the powercfg.exe program this should be close enough to a sure thing. If you need to tweak the settings just look here for an explanation of the switches.

Desktops

@echo off
cls
:Creates a desktop power profile

:QUERY
powercfg.exe /Q cust_desktop
IF NOT ERRORLEVEL 1 GOTO QUIT
IF ERRORLEVEL 1 GOTO DELETE

:DELETE
powercfg.exe /D OLDPROFILE

:CREATE
powercfg.exe /C cust_desktop

:ADJUST
powercfg.exe /X cust_desktop /monitor-timeout-ac 0
powercfg.exe /X cust_desktop /monitor-timeout-dc 0
powercfg.exe /X cust_desktop /disk-timeout-ac 0
powercfg.exe /X cust_desktop /disk-timeout-dc 0
powercfg.exe /X cust_desktop /standby-timeout-ac 0
powercfg.exe /X cust_desktop /standby-timeout-dc 0
powercfg.exe /X cust_desktop /hibernate-timeout-ac 0
powercfg.exe /X cust_desktop /hibernate-timeout-dc 0
powercfg.exe /X cust_desktop /processor-throttle-ac NONE
powercfg.exe /X cust_desktop /processor-throttle-dc NONE

:GLOBAL
powercfg.exe /G off /OPTION BATTERYICON
powercfg.exe /G off /OPTION RESUMEPASSWORD

:ACTIVATE
powercfg.exe /S cust_desktop

:QUIT
@cls
exit

Laptops

@echo off
cls
:Creates a laptop power profile

:QUERY
powercfg.exe /Q cust_laptop
IF NOT ERRORLEVEL 1 GOTO QUIT
IF ERRORLEVEL 1 GOTO DELETE

:DELETE
powercfg.exe /D OLDPROFILE

:CREATE
powercfg.exe /C cust_laptop

:ADJUST
powercfg.exe /X cust_laptop /monitor-timeout-ac 0
powercfg.exe /X cust_laptop /monitor-timeout-dc 15
powercfg.exe /X cust_laptop /disk-timeout-ac 0
powercfg.exe /X cust_laptop /disk-timeout-dc 30
powercfg.exe /X cust_laptop /standby-timeout-ac 0
powercfg.exe /X cust_laptop /standby-timeout-dc 0
powercfg.exe /X cust_laptop /hibernate-timeout-ac 0
powercfg.exe /X cust_laptop /hibernate-timeout-dc 0
powercfg.exe /X cust_laptop /processor-throttle-ac NONE
powercfg.exe /X cust_laptop /processor-throttle-dc NONE

:GLOBAL
powercfg.exe /G on /OPTION BATTERYICON
powercfg.exe /G off /OPTION RESUMEPASSWORD

:ACTIVATE
powercfg.exe /S cust_laptop

:QUIT
@cls
exit