When Notepad++ doesn't start truly maximized

For as long as I've used Notepad++, it had a certain strange behavior that bothered me a little. While it seemed to remember the location and size of its window, it evidently didn't take into account whether the window was maximized. Therefore, since I always use Notepad++ in full screen, I always got a screen-sized but not actually maximized window when I started a new instance. Since windows have a bit of extra chrome on the edges, the Notepad++ one spilled over onto my second monitor a little.

Yesterday I found out that that behavior was the result of a bug. Updating to the latest Notepad++ version solved the problem. (I had been using v6.3, the bug was fixed in v6.4.)

Blogger's "Select Blogs to Display" Jumps Around

If you own multiple Blogger blogs, Google has a page that lets you set which of those blogs appear in your profile. An interesting property of that page is that the order of the blogs in the list is not constant. In fact, it seems to be random - every time I press "Save changes", the entries reshuffle themselves. Whether I've checked or unchecked an item doesn't seem to affect the shuffling at all.

State of the Deep Web Stack Exchange site

Stack Exchange's Deep Web site has been in private beta for 12 days now. Statistics-wise, we're doing fairly well. At the moment, we have 147 questions, 97% of which are answered. That's an average of 11.5 questions per day. Of the 446 registered users, 25 have more than 200 reputation. It looks like we're doing fine compared to other new beta sites. "Looks like", anyway.

A current issue for us is a need for unique expert-level content. Many of our questions, though interesting, are beginner-level. Fortunately, there are certainly some more technical ones as well. Some of those are about Tor, which already has its own Stack Exchange site. We do also have many non-Tor questions, and I hope we get more.

To help with that, I've e-mailed the Freenet and I2P teams, inviting them to join the site. Getting people who actually develop these technologies would be an excellent asset for the site, and would also be very beneficial to those projects as well (exposure and availability of information).

If you want to get involved, click the "Visit the site now!" link on the site's Area 51 page.

The Hyper-V client is .NET

I just noticed that vmconnect.exe, the Hyper-V Virtual Machine Connection program, is a .NET assembly. I've been mildly interested in how Hyper-V machines are connected to, and since the program that does is .NET, it's possible to decompile it to see an example.

It looks like the actual connection happens inside a native control called IMsRdpClient8, which is wrapped by AxMsRdpClient8NotSafeForScripting, which is controlled by a RdpViewerControl.

Making the Shift key automatically remove Caps Lock

If you find yourself frequently annoyed by Caps Lock being on when it shouldn't, you might appreciate it if hitting Shift automatically disabled Caps Lock. It just so happens that Windows has a feature to do that. How do enable it in the UI changes from version to version, but the Registry change is fairly simple.

There is (or can be) a DWORD value called Attributes in HKCU\Keyboard Layout. The sixteenth bit of its data specifies whether this feature is active, so if the entry isn't there at all or is zero, you can set it to 65536 (decimal).

The feature does have some unusual side effects. Caps Lock can no longer turn itself off, only on. Some applications - Hyper-V as one that I use - start interpreting every Shift press as a toggle of Caps Lock.

Figured out the SQL Anywhere "SET HIDDEN" obfuscation algorithm

I had previously figured out how to get at the unobfuscated text of an SQL Anywhere 11 stored procedure that was protected by SET HIDDEN, but that method requires a lot of manual clicking and is less than reliable when it comes to getting the full text of long procedures.

Today I had some spare time, so I worked at reversing the actual obfuscation process. I was successful, but publishing the algorithm here would be a legally dubious proposition even though I didn't steal any code from the SQL Anywhere server program. Mostly, I just put in lots of slightly different plaintexts to see how the obfuscated output differed. The final necessary epiphany came when I modified certain strings in one file to cause a clearer delineation of the sections of the obfuscated text.

I can say that the algorithm is pretty simple; my function is only 26 lines of VB.NET code. There is no tokenization of any kind, so every bit of the text that gets stored in sys.sysprocedure (e.g. comments but not extra semicolons) is recoverable. The process is lightning fast and not computationally intensive at all.

.crypt ransomware with mention of "RZA4096"

Today I briefly looked at a small outbreak of ransomware, which fortunately didn't affect me personally. The encrypted files had .crypt appended to their names, and the ransom note had several misspellings, including a mention of RZA4096 (should be RSA). The files are indeed scrambled in some way. Kaspersky's tool to decrypt CryptXXX files does not support these. Stories I found on the Internet indicate that paying will not help, so if you're hit with this, don't pay. Instead, restore from backups, which you totally have, right?

Seriously, make backups now. You never know when some kind of exploit will result in your data getting destroyed.