But I don’t want to use Eclipse or Netbeans. I want to use Vim.

Enter Eclim, which is a way to use Eclipse’s wide array of features in Vim. Check out the site, it gives a better idea of how it’s used than I can. Unfortunately, only binaries for Linux and Windows are available, so we’re going to have to do this the hard way on OSX. Let’s get started.

The first thing we’ll need is Eclipse. I’m using Eclipse 3.4.3, which I downloaded, uncompressed and moved to /Applications/Eclipse (so the full path is /Applications/Eclipse/Eclipse.app, this is important for later).

Next, let’s grab Eclim from the sourceforge site, the tar.gz file (not the .exe or the .sh). I’m using Eclim 1.4.7. Untar and wait a second, we’ll need to grab something before we can build Eclim.

Eclim requires Ant 1.7.1 in order to build (OSX ships with Ant 1.7.0 instead), so download the Ant 1.7.1 binary for OSX from Apache’s sites, untar, but don’t worry about installing it.

Lastly, grab the latest Vim 7.2 tarball from vim.org. Unfortunately, Apple decided not to compile the system vim with ‘sign’ support, so we’ll have to roll our own version of vim.

Now, let’s begin:

First, we’ll need a folder for the vim plugins, which needs to be created manually or Eclim will complain:

[~]% mkdir ~/.vim/eclim

Next, compile the Eclim files from the eclim directory using the ant 1.7.1 binary. In this example I’m only compiling the ant and jdt plugins for Eclim, because the CDT and PDT plugins require other Eclipse libraries, and I only use Eclipse for Java development anyway. Be sure to change your eclipse.home setting if you didn’t put it in the same place as me:

[~/code/eclim_1.4.7]% ../apache-ant-1.7.1/bin/ant -Declipse.home=/Applications/Eclipse/ -Dplugins=ant,jdt

The Ant command will build and install the files at the same time, so afterwards you shouldn’t have to manually install any Vim or Eclim files.

Next, we need to recompile Vim with sign support, here’s how I compiled my version, make sure to keep the –enable-gui=no and –without-x options, or else vim will start X11 every time you run in:

[~/code/vim72]% ./configure --enable-gui=no --without-x --with-features=huge --prefix=/usr/local
[~/code/vim72]% make
[~/code/vim72]% sudo make install

Switch out the system vim for the one we just created:

[~/code/vim72]% sudo mv /usr/bin/vim /usr/bin/vim.mac.old

We’ll need some way to start the Eclim daemon that was installed, and eclimd doesn’t care for symlinks, so I created an alias in my .zshrc (or .bashrc if you use bash):

alias eclimd='/Applications/Eclipse/eclimd'

Next, we need to fix the /Applications/Eclipse/eclimd shell script, because Apple’s readlink command does NOT support the -f option, so change this line:

RESOLVED=`readlink -f "$0"`

To this:

RESOLVED=`readlink "$0"`

Now, after all that, start up eclimd:

[~]% eclimd

You should see something like this (screenshot):

Alrighty, now we can start Vim, give these two commands a try to see if eclimd communication can be established:

:PingEclim (Will output the Eclipse and Eclim version if everything is working)
:EclimValidate (You should get: “Result: OK, required settings are valid.”)

Hopefully you were able to get a connection. If not, leave a comment and I’ll try to help you out

Okay, so it’s set up, congratulations! Now what can you do with it, well I suggest checking out Eclim’s Java page to see what you can do, but the features I end up using the most are validation, completion and correction. Validation will validate the Java file every time you save it, marking the lines where errors in compilation occur. See the following screenshot (notice the red “>>” markers):

Completion (through Ctrl+x-Ctrl+u) gives you the awesome completion that Eclipse has, like so:

Correction allows you to go to a line with an error marker, and have Eclipse suggestion a fix, just like it would in the IDE, to apply the fix, put the cursor on the red line and hit Enter:

Now go read all the documentation to see the neat things you can do

I usually end up doing the actual project management (adding files, adding external jars to the classpath, generating ant build.xml files and other gui-type stuff) from Eclipse still, but for the actual coding, I’m all about Vim.

Oh yea, one other thing I should mention, so Vim settings for your .vimrc that are really helpful for this:

If you use Supertab (tab-completion with tab instead of Ctrl+x-Ctrl+u):

" Supertab settings
" supertab + eclim == java win
let g:SuperTabDefaultCompletionTypeDiscovery = [
\ "&completefunc:<c-x><c-u>",
\ "&omnifunc:<c-x><c-o>",
\ ]
let g:SuperTabLongestHighlight = 1

And some Eclim .vimrc settings that I use:

" Eclim settings
" ,i imports whatever is needed for current line
nnoremap <silent> <LocalLeader>i :JavaImport<cr>
" ,d opens javadoc for statement in browser
nnoremap <silent> <LocalLeader>d :JavaDocSearch -x declarations<cr>
" ,<enter> searches context for statement
nnoremap <silent> <LocalLeader><cr> :JavaSearchContext<cr>
" ,jv validates current java file
nnoremap <silent> <LocalLeader>jv :Validate<cr>
" ,jc shows corrections for the current line of java
nnoremap <silent> <LocalLeader>jc :JavaCorrect<cr>
" 'open' on OSX will open the url in the default browser without issue
let g:EclimBrowser='open'

Enjoy!

Here’s how to fetch it from source, patch it and build it yourself on OSX (tested on 10.5.3). First we need to check out the source:

shell> cvs -z3 -d:pserver:anonymous@cvs.savannah.gnu.org:/sources/screen co screen

Next, we need to manually apply the patches from MacPorts (assuming you’ve used MacPorts before). First change into the screen directory and apply the following 3 patches:

shell> cd screen/src
shell> patch < /opt/local/var/macports/sources/rsync.macports.org/
release/ports/sysutils/screen/files/patch-maxargs
shell> patch < /opt/local/var/macports/sources/rsync.macports.org/
release/ports/sysutils/screen/files/patch-windowsize
shell> patch < /opt/local/var/macports/sources/rsync.macports.org/
release/ports/sysutils/screen/files/patch-pty.c

(Each of those should be on one line, I had to split them up to make the wrapping better).

Now, configure using the same method as the macports:

shell> ./configure --enable-locale --enable-telnet --enable-colors256 --enable-rxct_osc

From there, you should be able to do a make and make install to get your screen up and running. Vertical-split is bound to ctrl+a – |  (control-a and pipe) (substitute whatever your bind key is for ctrl+a). Then you can use ctrl+a – :resize <x> to resize the window, where <x> is x%, -x, +x or x. Here’s a screenshot of it in action:

Anyone that might have read my blog for a long time might remember this post about how I do GTD (Getting To Done) on my machine(s). Well, I decided it’s been quite a while since I’ve talked about that, so I’ll go through some of my workflow, tools and quirks.

If you read my blog soley for security content, you can skip this post Personally I like to read other people’s workflows/setup to see if there is an interesting way I can fit useful tools into my own setup. Anyhow, on with the details

I have 3 machines that I primarily use. My main machine is a MacBook Pro with an attached Dell LCD monitor running OSX (what else?), the second machine is a Dell Optiplex tower running Ubuntu 8.04. The third machine is a Dell 610 laptop that dual-boots Hex and Windows. Here’s a picture of my default setup on the machines:

OSX

Ubuntu

Hex

Most of my work is done on the MacBook (my personal machine, not supplied by work), I use the Ubuntu machine for tasks that span multiple days, so I can leave a screen term logged in and attach/detach whenever I need to take my laptop home. The Hex machine is mainly used for security purposes, packet analysis, nsm-console development testing, etc.

I like to keep a pretty clean desktop, clutter really tends to irritate me. I try as hard as I can to separate everything that would be on the desktop into either a “papers”, “media”, “code” or “misc” folder. In the previous post about GTD, I mentioned that we use the Mantis ticketing system to keep track of administration tickets. We still use Mantis, just recently upgraded, you can check out a shot here:

If my firefox looks a little strange, it’s because I use the vimperator extension to give firefox Vim-like keybindings and layout. It helps someone who spends a large amount of time in a vim editor to transition quickly between text editing and web-browsing. Speaking of text editing, I absolutely love MacVim and really recommend it to anyone using OSX who likes Vim:

I’ve also transitioned from Mutt to Thunderbird, mostly because Mutt’s 2-way IMAP settings are not so great if you have to check mail between multiple computers. I use the pre-release muttator extension to give Thunderbird mutt-like keybindings:

I use the standard GTD folder naming, which mostly consists of “Inbox”, “Archive” and “Do” folders. (I hope the idea behind each folder is obvious). I still use Gmail for personal email, but can’t access it from inside the work network over POP3 or IMAP due to firewall restrictions, so I use the web client.

Instead of using iCal for meetings, like I was doing, I moved to using Google Calendar, which is aided by the notifier for events, so I don’t have to set up reminders for meetings. It also lets me share my wife’s calendar and see what she’s up to As well as google calendar, I also use gReader to browse my 222 RSS subscriptions, nothing else comes close as far as I’m concerned (yay more vim-like keybindings).

I do still use a moleskine, but lately I’ve transitioned to the next larger notebook (5′ x 7′), so that I can write out larger notes and more information (writting assembly notation in a tiny notebook gets annoying). I make use of the same sort of TODO list as in my last post ( – for an incomplete task, + for a completed task ). I take it to all meetings I go to and doodle in it sometimes I still use the smaller book for lists and small notes.

One of the things I’ve found is that despite having a widescreen 2nd monitor, the ‘wide’ part doesn’t really help any for what I do, so I flipped the monitor up to make it vertical, which is really helpful for using IDA, since I can see more instructions at once, here’s the malware I’ve working on at the moment:

Since I normally have at least 1 VM running, as well as mail, 1 or 2 browsers, X11, Adium, MacVim and any other number of things, I cut down on RAM usage by using cmus (hurray more vim keybindings) for a music playing instead of iTunes (which is such a memory hog for simple things). I also use irssi instead of a graphical client for IRC since it’s a little lighter weight:

I rigged Quicksilver up to the cmus-remote command-line utility so I can have system-wide keybindings for player control, pretty much the other thing I use iTunes for anymore is heavy music folder management (I do like that feature). I spend a great deal of time at the command-line, if you’re interested in configuration files, you can find my zshrc, screenrc, vimrc, gvimrc and nsmcrc at dotfiles.org.

Finally, here’s an overview of my basic whole-desktop setup:

My GTD process has kind of evolved into a stripped down version of the multiple-step instructions from some of the more famous practitioners (receive email, process until inbox has 0 messages, perform actions). I make up a large amount of time by unifying my tools around a certain look and feel (Vim-keybindings for everything), allowing my brain not to have to shift gears for different tasks. By keeping a strict set of rules on which application goes where (as in for virtual spaces), I always know where I can find what I am looking for (application wise). In my opinion, this adds to my efficiency more than any particular tool could have.

Well, that’s about it, hopefully you found something interesting in this post. If you have a neat tool or helpful suggestion, leave a comment below (especially if it has Vim keybindings )

Atlas has written a tool call disass to aid in disassembly and analysis, which is a really cool tool, but can be kind of annoying to get running on different operating systems thanks to Python’s amazingly helpful error messages </sarcasm>

Firstly, make sure you install the dependencies, Python (duh), psyco, atlasutils (from Atlas’ blog), libdisassemble and vtrace (from the Kenshoto guys). Then, install disass-cli (also from Atlas’ blog) just like you would any other python program. You might need to symlink /usr/local/bin/python to /usr/bin/python since disass-cli’s sharp-bang is hardcoded for /usr/bin/python

The first time you run disass-cli, you’ll probably hit this error:

# disass-cli
Traceback (most recent call last):
File "/usr/local/bin/disass-cli", line 3, in <module>
from disass3 import *
File "/usr/local/lib/python2.5/site-packages/disass3/__init__.py", line 105, in <module>
import bsddb
File "/usr/local/lib/python2.5/bsddb/__init__.py", line 51, in <module>
import _bsddb
ImportError: No module named _bsddb

Cryptic eh? Googling is not so helpful on this one (“Recompile Python!”) Well, to fix the problem on FreeBSD, you need to install /usr/ports/databases/py-bsddb, which will rebuild Python with the necessary libraries, easy fix.

On OSX, you’ll need to download the newest Python distro .dmg from python.org (which will have the correct libraries). Now you can update the symlink by doing:

# rm /usr/bin/python
# ln -s /Library/Frameworks/Python.framework/Versions/2.5/bin/python /usr/bin/python

as root. Now you should be able to reinstall the dependencies for disass using the newer Python distribution and disass-cli shouldn’t complain anymore, silly broken Apple versions of Python.

Note: Alternatively, you can edit the disass-cli Python file (in /usr/local/bin/disass-cli) to use the Python distribution you installed directly without changing the symlink, that way everything else still uses Apple’s version of Python (don’t forget to install the dependency libraries for the newer version of Python also).

Hope this helps someone, exploit writing is new to me, coming from more of a network-side, always fun to learn new things

Firstly, power down the image and edit the configuration options for your image, click on the “Video options”. Check ‘Enable custom screen resolutions’ and add the resolution (in this case, 1280×800). Make sure the resolution is enabled (checked). See the screenshot below for an example of what it should look like:

Next, boot into the VM image and let’s take a look at the xorg.conf file, here are the lines I changed that actually matter:

#HorizSync 31.5 - 48.5
HorizSync 30.0 - 82.0
#VertRefresh 50.0 - 90.0
VertRefresh 50.0 - 90.0
#Option "DPMS"
ModeLine "1280x800" 80.58 1280 1344 1480 1680 800 801 804 827 -HSync -VSync

These should be in the section right after ‘Section “Monitor”‘. After changing the hsync and vsync as well as adding the mode, I changed the display section from:

SubSection "Display"
Depth 24
Modes "1024x768" "800x600" "640x480"
to:
SubSection "Display"
Depth 24
Modes "1280x800" "1024x768" "800x600" "640x480"

It’s a good idea to change the modes for each of the depths (at least 8, 15, 16 and 24) also.

After rebooting (or killing X with Ctrl+Alt+Backspace), your screen should come up in 1280×800 resolution. Hurray!

You can see an example of my desktop setup for Hex 1.0.3-RC2 here:

You can get a copy of my entire xorg.conf file here. (Note that in this xorg.conf, CapsLock is remapped to additional control because I hate capslock with a passion).

Hope this helps someone out there

If you get this error:

cc -I. -I../libpcap-0.7.1 -DLINUX -D__FAVOR_BSD -D_LARGEFILE_SOURCE=1 -D_FILE_OFFSET_BITS=64 -L../libpcap-0.7.1 -c stat.c
cc -I. -I../libpcap-0.7.1 -DLINUX -D__FAVOR_BSD -D_LARGEFILE_SOURCE=1 -D_FILE_OFFSET_BITS=64 -L../libpcap-0.7.1 -c net_read.c
net_read.c:74:1: warning: "__FAVOR_BSD" redefined
<command line>:1:1: warning: this is the location of the previous definition
net_read.c:149: error: static declaration of ‘packet_length’ follows non-static declaration
tcpdstat.h:415: error: previous declaration of ‘packet_length’ was here
make: *** [net_read.o] Error 1

Edit the net_read.c file and change line 149 from this:

static int packet_length; /* length of current packet */

to this:

int packet_length; /* length of current packet */

Simple eh? Just type “make” again and tcpdstat should compile just fine. Simple fix.

If all else fails, run “sudo find /opt/local/var/macports/build -name "wdg.*" -print” and it should print the locations of the files. NOTE: These files will only exist *after* attempting the build with macports, so attempt to build first (sudo port install ettercap-ng), and then look for the files. Hope this helps!

UPDATE:
After talking to people in IRC, I found the real root of this problem, wdg.h and wdc.h need to have #include <sys/types.h> included at the top of the file. At this time, I recommend you attempt the install using MacPorts by doing sudo port install ettercap-ng, let it fail, then go into the directory containing the macports build source, add the include into the 2 files, then run sudo port install ettercap-ng again, it will succeed and your copy of ettercap should work!

Thanks @ Raim in #macports and dmacks in #fink for helping track this down. You can see the bug here.

Original message below:

This is a continuation of the pthread error that I mentioned in a previous post

I finally got it working natively; you might be familiar with the following error when trying to compile ettercap-ng using either fink or natively:

gcc -DHAVE_CONFIG_H -I. -I. -I../../../../include -I/sw/include -O2 -funroll-loops -fomit-frame-pointer -Wall -I/sw/include -I/sw/include -I/sw/include -I/sw/include -g -O2 -c -o libwdg_a-wdg.o `test -f 'wdg.c' || echo './'`wdg.c
In file included from wdg.c:23:
./wdg.h:189: error: syntax error before 'u_char'
./wdg.h:189: warning: no semicolon at end of struct or union
./wdg.h:190: warning: type defaults to 'int' in declaration of 'border_color'
./wdg.h:190: warning: data definition has no type or storage class
./wdg.h:191: error: syntax error before 'focus_color'
./wdg.h:191: warning: type defaults to 'int' in declaration of 'focus_color'
etc etc, errors go on forever...

Well, after poking around in the code I was able to find where to fix the code so that it would compile. Open the directory src/interfaces/curses/widgets/ and edit the files wdg.c and wdg.h

Change all of the occurrences of “u_char” to “int” in these two files, you should now be able to compile without errors.

DISCLAIMER: I don’t know what kind of effect this will have on the curses interface, it will probably break the curses interface permanently, personally I use the text interface the entire time (so I run configure with --disable-gtk so I don’t have to deal with the hassle of installing the gtk/glib libraries), but at least you are able to compile, right?

I’ve tar’d up a patched version of the code and configure script (so you don’t get the pthread error). I am planning on hosting on navi.eight7.org, I will put it up and link to it when I’m able to access the machine (work firewall prevents it).

I’m still getting errors when ettercap tries to forward the packets, but I’m positive they are caused by linking to the wrong version of libnet, that has a different number of arguments to the libnet_write_raw_ipv4() function. If I get a fix I’ll post it here.

./Command/failure......................ok 1/0
./Command/failure......................NOK 24/0# Failed test at ./Command/failure.t line 85.
# ''
# !=
# '0'
./Command/failure......................ok 41/0# Looks like you failed 1 test of 49.
./Command/failure......................dubious
Test returned status 1 (wstat 256, 0x100)
DIED. FAILED test 24
Failed 1/49 tests, 97.96% okay

… snip …

Failed 1/39 test programs. 1/905 subtests failed.
make: *** [test] Error 1
### execution of make failed, exit code 2
phase compiling: fink-0.27.8-41 failed

Edit the following file:

<bootstrap_dir>/t/Command/failure.t
Replace <bootstrap_dir> with the directory you untar’d the fink-0.27.* tarball into.

Comment out line 85 by changing:
cmp_ok( $!, '!=', 0 );
To be:
#cmp_ok( $!, '!=', 0 );

Rebootstrap the fink and it should install without a problem.

Note: This is totally unsupported by the Fink team, and might produce unintended results According to the mailinglists, the error seems like it’s actually caused by perl 5.8.8 on Leopard instead of 5.8.6 on Tiger, so the test fails. If you want to install perl 5.8.6, you can link /usr/bin/perl to the older version and it should pass the tests.

Anyone running into the following error:

$ sudo make install
Password:
/usr/bin/install -c -m 555 -o bin -g bin arpwatch /usr/local/sbin
install: bin: Invalid argument
make: *** [install] Error 67

When trying to install arpwatch, edit the Makefile and replace all the occurrences of “-o bin” with “-o root” and all the occurrences of “-g bin” with “-g wheel”

Hope this helps someone.