• 1: Home
• 2: Presentations
  • 2.1: Hibernation File Attack
  • 2.2: Stoned Bootkit
  • 2.3: The Rise of MBR Rootkits & Bootkits in the Wild
  • 2.4: Stoned déjà vu - again
• 3: Trainings
  • 3.3: Hibernation File Attack - Reino de España
• 4: Articles
  • 4.1: Polymorphic Encryption Methods
  • 4.2: Writing a Boot Scan Engine
  • 4.3: The Magic of Bootkits
  • 4.4: Analysis of Sinowal
  • 4.5: Advanced Analysis of Sinowal
  • 4.6: Microsofts Rich Header
  • 4.7: Analysis of Conficker
  • 4.8: CIPAV
  • 4.9: Windows Exception Handling
  • 4.10: Pagefile Attack
  • 4.11: Software Watermarking
  • 4.12: Analysis of Stoned
  • 4.13: The Old New Thing About Development
  • 4.14: AntiWPA
  • 4.15: Kon-Boot
  • 4.16: Compiling Shellcode
  • 4.17: Elevated rights, process token and security identifier
  • 4.18: Abusing the TrueCrypt driver
  • 4.19: Nothing new: Msvcrt.dll
  • 4.21: Identifying Source Code
  • 4.22: Analysis of Mebratix
  • 4.23: Popsomp Hills
• 5: Projects
  • 5.1: DiskEdit
  • 5.2: Forensic Deletion Software
    • 5.2.1: Additional Deletion Methods
    • 5.2.2: Visual C++ Source Code
  • 5.3: Forensic Lockdown Software
  • 5.5: Information System
  • 5.6: QuickView
  • 5.7: Smart Boot Manager
  • 5.8: USB View
  • 5.9: Windows 3.1 Emulation
  • 5.10: Windows Boot System
  • 5.11: AV Tracker
  • 5.12: EIPTN
• 6: Services
  • 6.1: Boot-US work
  • 6.2: TeraByte Unlimited work
  • 6.3: EPIGUS work
• 8: Research
  • 8.1: Ascrimez Kit
  • 8.2: Analysing the PDF Exploit
  • 8.3: ZeuS
  • 8.4: infobox.ru: Botnet
  • 8.5: Operating System Development
  • 8.6: 4 million email addresses
• 9: About
  • 9.1: Links
  • 9.3: Peter Kleissner
  • 9.4: Last Modified Pages
  • 9.5: Meeting Points
  • 9.6: Live Search
  • 9.7: Terms of Use
  • 9.8: Contact

EPIGUS work: Datenbank Clean-Up Statistik Austria

EPIGUS is an Institute for Holistic Accident and Safety Research.
It is lead by the university professor DI Dr. Ernst Pfleger.
For information about their research visit their site at http://www.unfallforschung.at/.

Peter Kleissner wrote a program which cleans up databases got from the Statistik Austria.

The clean up process includes following steps:

• finding and solving invalid record sets
• finding and solving gaps in record sets
• exchanging sequenze and id number where necessary

The file format of databases from Statistik Austria is a special file format.
401 characters per line are one record set and every record set is encoded character-wise.
A record set describes an accident with all accident data.
The databases for one year consists about 45 000 lines (~ 15 MB).

All found errors are logged in an automatic generated log file by the program:

---- Datenbank Clean-Up StA generated log file ----- 

Datum: Donnerstag, 22. Mai 2008 20:07
Eingabe Datenbank: C:\Users\Peter Kleissner\Desktop\Test.bak
Ausgabe Datenbank: C:\Users\Peter Kleissner\Desktop\Test_k.txt

Datensätze: 15 [davon ungültig: 0]
Folgeblattnummer-Fehler: 8
Lücken in Datensätzen: 3

0 ungültige Datensätze (mit ungültiger Datensatzlänge) übersprungen:

8 Folgeblatnummern geändert:
0255086 1 0255087
1143174 1 1143173
1143175 2 1143173
1143176 3 1143173
1143177 4 1143173
1299459 1 1299458
1299452 1 1299450
1299447 2 1299450

Lücken in 3 Datensätzen korrigiert:
0130517
0131786
0131791

This program was developed in Visual Studio 2005 Professional Edition C++ (Win32 application without use of frameworks).
It also has the programmed-in command line mode.
The analyzing and converting "engine" is written in Assembler, which features the program to be very fast (2 seconds for 45000 lines).

Here are some Screenshots about the work:

•