Annoyance, colored diffs in perforce
Quick one-off here, let’s begin.
Git has nice colored diffs, like this:
Perforce does not:
A simple script can remedy this:
Here’s the script:
Simply drop it somewhere in your $PATH and use it like so:
p4 diff | p4c.rb
You can find it in my one-offs directory (it’s called p4c.rb). We recently switched from subversion to perforce (definitely not my choice, I pushed for git), and so far it’s awful. I am definitely not a fan. This makes it a little better.
Vim setup explained
Since my site is named after a Vim command. I figured that I should eventually write something talking about my favorite text editor, and how I like it configured. What follows is the explanation of my .vimrc, as well as a description of the plugins that I use. A lot of the credit for this configuration goes to Bart Trojanowski, who has an excellent Vim configuration. At the bottom I’ll have a link to download any of the files themselves if you so desire. I hope you find it useful (everything in fixed-width font is the actual text, everything else is comments about it):
My ~/.vimrc:
Modelines have been abused in the past, and while I haven’t heard of anything lately that would abuse them, it’s always better safe than sorry. This requires the securemodelines vim script
" --------------------------------------------------------------------------- " first the disabled features due to security concerns set modelines=0 " no modelines [http://www.guninski.com/vim1.html] let g:secure_modelines_verbose=0 " securemodelines vimscript let g:secure_modelines_modelines = 15 " 15 available modelines
Since these are all simple features, I won’t bother to explain them besides the inline comments:
" --------------------------------------------------------------------------- " operational settings syntax on set ruler " show the line number on the bar set more " use more prompt set autoread " watch for file changes set number " line numbers set hidden set noautowrite " don't automagically write on :next set lazyredraw " don't redraw when don't have to set showmode set showcmd set nocompatible " vim, not vi set autoindent smartindent " auto/smart indent set expandtab " expand tabs to spaces set smarttab " tab and backspace are smart set tabstop=6 " 6 spaces set shiftwidth=6 set scrolloff=5 " keep at least 5 lines above/below set sidescrolloff=5 " keep at least 5 lines left/right set backspace=indent,eol,start set showfulltag " show full completion tags set noerrorbells " no error bells please set linebreak set cmdheight=2 " command line two lines high set undolevels=1000 " 1000 undos set updatecount=100 " switch every 100 chars set complete=.,w,b,u,U,t,i,d " do lots of scanning on tab completion set ttyfast " we have a fast terminal filetype on " Enable filetype detection filetype indent on " Enable filetype-specific indenting filetype plugin on " Enable filetype-specific plugins compiler ruby " Enable compiler support for ruby set wildmode=longest:full set wildignore+=*.o,*~,.lo " ignore object files set wildmenu " menu has tab completion let maplocalleader=',' " all my macros start with , set foldmethod=syntax " fold on syntax automagically, always set foldcolumn=2 " 2 lines of column for fold showing, always set dictionary=/usr/share/dict/words " more words!
I do like candycode for my terminals (which tend to be black) and I like macvim for my GUI, so I change schemes depending on which I’m using.
if !has("gui_running")
colorscheme candycode " yum candy
end
if has("gui_running")
colorscheme macvim " macvim == win
set guioptions-=T " no toolbar
set cursorline " show the cursor line
end
For the taglist plugin, I want it to appear on the right and to quick vim as soon as I close the last file I’m working on.
" Settings for taglist.vim let Tlist_Use_Right_Window=1 let Tlist_Auto_Open=0 let Tlist_Enable_Fold_Column=0 let Tlist_Compact_Format=0 let Tlist_WinWidth=28 let Tlist_Exit_OnlyWindow=1 let Tlist_File_Fold_Auto_Close = 1
Misc TOhtml settings
" Settings for :TOhtml let html_number_lines=1 let html_use_css=1 let use_xhtml=1
My status line is basically <filename> [<filetype>] [+] #<buffernum> <linenum>/<totallines>,<columnnum>
" ---------------------------------------------------------------------------
" status line
set laststatus=2
if has('statusline')
function! SetStatusLineStyle()
let &stl="%f %y " .
\"%([%R%M]%)" .
\"%#StatusLineNC#%{&ff=='unix'?'':&ff.'\ format'}%*" .
\"%{'$'[!&list]}" .
\"%{'~'[&pm=='']}" .
\"%=" .
\"#%n %l/%L,%c%V " .
\""
endfunc
call SetStatusLineStyle()
if has('title')
set titlestring=%t%(\ [%R%M]%)
endif
endif
More simple search options, see inline comments
" --------------------------------------------------------------------------- " searching set incsearch " incremental search set ignorecase " search ignoring case set hlsearch " highlight the search set showmatch " show matching bracket set diffopt=filler,iwhite " ignore all whitespace and sync
I *occasionally* use the mouse. If I have to.
" --------------------------------------------------------------------------- " mouse stuffs set mouse=a " mouse support in all modes set mousehide " hide the mouse when typing " this makes the mouse paste a block of text without formatting it " (good for code) map <MouseMiddle> <esc>"*p
I prefer not to litter my current directory with backup files, so I put them all in ~/.backup. I also save a lot of line positions in the viminfo file.
" --------------------------------------------------------------------------- " backup options set backup set backupdir=~/.backup set viminfo=%100,'100,/100,h,\"500,:100,n~/.viminfo set history=200 "set viminfo='100,f1
I use ,ss to toggle between spellcheck on and spellcheck off.
" --------------------------------------------------------------------------- " spelling... if v:version >= 700 setlocal spell spelllang=en nmap <LocalLeader>ss :set spell!<CR> endif
Here are all the keyboard shortcuts I use most often:
" ---------------------------------------------------------------------------
" some useful mappings
" Y yanks from cursor to $
map Y y$
" for yankring to work with previous mapping:
function! YRRunAfterMaps()
nnoremap Y :<C-U>YRYankCount 'y$'<CR>
endfunction
" toggle list mode
nmap <LocalLeader>tl :set list!<cr>
" toggle paste mode
nmap <LocalLeader>pp :set paste!<cr>
" change directory to that of current file
nmap <LocalLeader>cd :cd%:p:h<cr>
" change local directory to that of current file
nmap <LocalLeader>lcd :lcd%:p:h<cr>
" correct type-o's on exit
nmap q: :q
" save and build
nmap <LocalLeader>wm :w<cr>:make<cr>
" open all folds
nmap <LocalLeader>fo :%foldopen!<cr>
" close all folds
nmap <LocalLeader>fc :%foldclose!<cr>
" ,tt will toggle taglist on and off
nmap <LocalLeader>tt :Tlist<cr>
" ,nn will toggle NERDTree on and off
nmap <LocalLeader>nn :NERDTreeToggle<cr>
" When I'm pretty sure that the first suggestion is correct
map <LocalLeader>r 1z=
I use this one quite often, as I often forget to do “sudo vim file” in the first case, now I don’t have to exit vim to write the file with sudo.
" If I forgot to sudo vim a file, do that with :w!! cmap w!! %!sudo tee > /dev/null % " ruby helpers iab rbang #!/usr/bin/env ruby iab idef def initialize
I think candycode looks good in all the color modes, but it’s still nice to set it up for different terms.
" ---------------------------------------------------------------------------
" setup for the visual environment
if $TERM =~ '^xterm'
set t_Co=256
elseif $TERM =~ '^screen-bce'
set t_Co=256 " just guessing
elseif $TERM =~ '^rxvt'
set t_Co=88
elseif $TERM =~ '^linux'
set t_Co=8
else
set t_Co=16
endif
Switch between tabs with ,tn and ,tp
" --------------------------------------------------------------------------- " tabs " (LocalLeader is ",") map <LocalLeader>tc :tabnew %<cr> " create a new tab map <LocalLeader>td :tabclose<cr> " close a tab map <LocalLeader>tn :tabnext<cr> " next tab map <LocalLeader>tp :tabprev<cr> " previous tab map <LocalLeader>tm :tabmove " move a tab to a new location
Load extensions we need and change some format options for markdown files.
" ---------------------------------------------------------------------------
" auto load extensions for different file types
if has('autocmd')
filetype plugin indent on
syntax on
autocmd BufReadPost *
\ if line("'\"") > 0|
\ if line("'\"") <= line("$")|
\ exe("norm '\"")|
\ else|
\ exe "norm $"|
\ endif|
\ endif
" improve legibility
au BufRead quickfix setlocal nobuflisted wrap number
" improved formatting for markdown
" http://plasticboy.com/markdown-vim-mode/
autocmd BufRead *.mkd set ai formatoptions=tcroqn2 comments=n:>
autocmd BufRead ~/.blog/entries/* set ai formatoptions=tcroqn2 comments=n:>
endif
- NERD Commenter – auto comment sections of code
- NERD Tree – display file tree for directories, like a project view
- Alternate – Alternate between implementation and header files
- Compview – Search for a word and display a window with results
- GetLatestVimScript – Get the latest version of scripts
- Matchit – Extended % matching
- Rails – Tons of RoR stuff
- Securemodelines – Secure modeline support
- Taglist – display a list of tags from the file
- VCScommand – help with files under revision control
- Vimball – install vimball plugins
- Yankring – have a ring of copy/paste buffers for history pasting
- C – A collection of helpful things for C (Although mine is heavily customized)
Well, hope someone out there finds these configuration files useful. I welcome any feedback
Soon to come: an explanation of the project that I’ve been working on that has taken me away from blogging for so long, an Intrusion Detection System based on Locality events.
Update 10/23/08: After some theme changes, updated screenshot (no NERDtree or taglist shown in the image):

Update 12/9/09: Been over a year, just for a teaser of what it looks like now:
Compiling screen from CVS on OSX for vertical split.
Screen in an amazing tool. The latest version from CVS adds an amazing feature to allow you to split screens vertically (previously you could only split horizontally), which is extremely nice if you have a widescreen monitor. The only problem is that the patch isn’t yet included in MacPorts or Fink for this feature.
Here’s how to fetch it from source, patch it and build it yourself on OSX (tested on 10.5.3). First we need to check out the source:
shell> cvs -z3 -d:pserver:anonymous@cvs.savannah.gnu.org:/sources/screen co screen
Next, we need to manually apply the patches from MacPorts (assuming you’ve used MacPorts before). First change into the screen directory and apply the following 3 patches:
shell> cd screen/src
shell> patch < /opt/local/var/macports/sources/rsync.macports.org/
release/ports/sysutils/screen/files/patch-maxargs
shell> patch < /opt/local/var/macports/sources/rsync.macports.org/
release/ports/sysutils/screen/files/patch-windowsize
shell> patch < /opt/local/var/macports/sources/rsync.macports.org/
release/ports/sysutils/screen/files/patch-pty.c
(Each of those should be on one line, I had to split them up to make the wrapping better).
Now, configure using the same method as the macports:
shell> ./configure --enable-locale --enable-telnet --enable-colors256 --enable-rxct_osc
From there, you should be able to do a make and make install to get your screen up and running. Vertical-split is bound to ctrl+a – | (control-a and pipe) (substitute whatever your bind key is for ctrl+a). Then you can use ctrl+a – :resize <x> to resize the window, where <x> is x%, -x, +x or x. Here’s a screenshot of it in action:
Decoding the SANS Christmas packet challenge using only NSM-Console
In my never-ending quest to find justification for writing NSM-Console, I hereby present the following tutorial on how to decode the SANS Christmas packet challenge using nothing but NSM-Console:
I’m going to be using NSM-Console version 0.4-DEVEL, which adds the features that allow this analysis to be performed without external tools. You can get the development version here. Alright, let’s get this party started:
First things first, the fellows at SANS point you to the first packet in the xmas_Starter.pcap file, so let’s load up NSM-Console with the packet capture
./nsm ~/xmas_Starter.pcap
Next, let’s do a printout of all the packets in this dump (since it’s a small file, there shouldn’t be too many)









