Multithreaded AES DSM Plugin

[adzm]

http://adamwalling.com/DSMPlugin/

Multithreaded AES and ARC4 DSM plugins.

--

I found and fixed several issues with the original AES plugin, including a heap corruption issue which can lead to who knows what.

Honestly I never got the old AES plugin to work. Perhaps the source code on the website was out of date, but I had to make some major changes to get everything to work correctly.

Unfortunately due to the way that UltraVNC handles the DSM plugin currently, it is not possible to make use of it without modifications to winvnc (server) source code. The plugin architecture in general is backwards compatible with the old single-threaded model, however.

Fixed some performance hits in winvnc (server) when multiple clients are connected (a mutex was being held for the duration of the network read operation -- no longer necessary with the multithreaded implementation).

I've been testing this out and it seems to work great. Tested direct and through a repeater. Using 128-bit AES encryption. Worked for at least 5 simultaneous viewer connections (have not tested more).

I've been using Visual Studio 2008 so all my binaries, unfortunately, depend on that runtime, including the OpenSSL static lib. So I may need to figure out how to rebuild these things with the standard msvcrt dependencies, so the 2008 runtime libraries are not a requirement.

Are binaries built with Borland for this reason? Or is Visual Studio 2005 a better option? I have both at my disposal.

Also I plan to make a generic TestPlugin using this new architecture so anyone can easily create or migrate to this method.

Whom should I talk to about getting changes into UltraVNC? Currently I am just using a locally modified build. I did end up finding and fixing a dozen or so other bugs throughout the UltraVNC source as well, though.

Thanks,
Adzm

[UltraSam]

Sounds great

Please send me your modified code in a zip when you think it's ok (you can send me the whole UltraVNC branch if you want, I will do the diff/merge ).

We also use vs2005/vs2008.

Thanks for these improvements !

[Rudi De Vos]

Even for a dll you can link with the "multi threaded" libs instead of the
"multi threaded dll" libs. This remove the dependency on the VS2008
redistributables.

PM: Your static also need to be build with "multi threaded" libs, else
you have a linking error.

[redge]

adzm ,

Great work
but where is the AESv2plugin.dsm updated file ?

The actual aesv2 1.0.0 total faulty on vista/seven, crash server and viewer!!!

Thank you a lot by advance.

[Cobra]

Cool stuff! We finally found someone who is a valuable successor! I'm glad to have you onboard adzm!

Best regards,

Cobra

[adzm]

To use the multithreaded version changes in the winvnc server code is required. However it should work for a single thread. I sent code to Sam earlier today and will try to get a build up publicly sometime this weekend.

[adzm]

Latest info will always be at http://adamwalling.com/DSMPlugin/ now.

[redge]

pleaseeeeeeeeeeeeeeeee,
for stable version uvnc 1.0.6.0 Single-Thread for MSRC4 + AESv3 fully working.

You have no excuse.... you have the source and help from adzm at 1st post updated.

Thank you for all your works

[adzm]

I may be able to build it sometime this weekend; the version I am currently using has several other (mostly untested) bugfixes and features.

I would just patch my plugin changes onto the 1.0.6 vncviewer and winvnc source, and not include any extraneous stuff.

However I do have a feature for the viewer that prompts you whether to allow connecting to an unencrypted server even though an encryption plugin was specified, rather than disconnecting with an error message. This is one that I have found very useful. I am not sure if that is acceptable for a mainstream release, though.

Anyway, I will try to make an unofficial build if necessary sometime soon so this can all be tested out. I may look into porting over the MSRC4 plugin, but I am much less inclined to do so since the AES plugin is working fine (and I therefore don't have much impetus to learn how MSRC4 and mscrypto works -- I am fine with the OpenSSL libraries.)

I noticed there was an RC4 implementation by the original author, which may be compatible with MSRC4, which would only require some minor changes in the AESV3PluginMT source. But salting is disabled in the MSRC4 plugin due to Windows 2000 incompatibility. So I'd rather not spend time on an insecure version of the MSRC4 plugin, and if I were to make one that was incompatible with the MSRC4 plugin then people might as well use the AES version.

That said anyone is free to take a look and implement it themselves.

[redge]

However I do have a feature for the viewer that prompts you whether to allow connecting to an unencrypted server even though an encryption plugin was specified, rather than disconnecting with an error message.

Very good news, I remember some users asked this features long time ago.
[topic=10241][/topic]

--------------

fews quick tests about AESv3PluginMT.dsm 3.0.1.7 without aesv3.key

hardware:
network: internal workgroup via AP wlan 802.11g (54Mbit/s)

CPU and OS
Core2Duo 2.1GHz (HT factory enabled) Windows Seven RC English
Pentium4 2.6GHz without HT Windows Seven RC English
PentiumIII 1GHz without HT Windows XP Professional SP3 English


direct connection
vncviewer 1.0.6.0 ---> winvnc 1.0.6.2 = status
xp sp3 pro --> seven rc = OK
seven rc --> xp sp3 pro= OK
seven rc --> seven rc = OK


reverse connection
winvnc 1.0.6.2 --> vncviewer 1.0.6.0 = status
xp sp3 pro --> seven rc = NOK
seven rc --> xp sp3 pro= NOK
seven rc --> seven rc = NOK

maybe you had already seen this issue:
use %temp% for the dsmplugin, in this case, allow plugin run as user level.
(won't need to be run as administrator)

actually, aesv3 3.0.1.7 have this issue for reverse mode,
no problem for direct mode.

vncviewer -dsmplugin AESV3PluginMT.dsm -listen 5500
error protocol after vnc authentication,
won't work as user level or run as administrator.

-- very slow AESv3PluginMT compatibility versus MSRC4 SingleThread --
lag of screen update.
bug optimisation if only SingleThread available by winvnc and vncviewer ?

anyway great work, AES would be alive again soon, thank you very much

[adzm]

Honestly I never tried out the reverse connection; just direct and via a repeater. Do you happen to know if the reverse mode ever worked with V2? I'll try to debug asap.

[redge]

adzm,

aesv2 and aesv3 can only success by the work around on vista/seven under compatibility mode as XP SP3 and need run as administrator.

vncviewer -dsmplugin AESV3PluginMT.dsm -listen 5500


the fix was made on msrc4 1.4.0 for override the limitation and care about level of security.

Can be applied for aesv2 and aesv3 and arc4
hope this help you easy find for made the fix

Comment from the 1.4.0 source code...
#ifdef _WITH_LOG //PGM ifdef'ed all logging out as any logging can cause crash trying to access log file in program files folder on Vista and Win7 so log not used in 1.4.0. Might move log to temp or public folder later if needed. Do same with registry access #ifdef _WITH_REGISTRY

It might help fix aesv2plugin too. I haven't looked at it's source yet.

[adzm]

Well should be easy enough. Logs should always be in a the appdata or temp paths anyway. I'll review the registry access as well. I'll post an update as soon as I can. Probably Monday evening EDT.

[redge]

adzm,

ok i count on user Cobra for test your updated aesv3, i back for news test only week-end.

Thank you for the time you spend for Open Source Community, that cool

[Cobra]

Hi guys,

I would love to test it but unfortunately I run into huge problems with the UltraVNC server... It all began with version 1.0.5.6 already. I updated it to version 1.0.6.2 but the errors are the same. It seems to be a little buggy...

Let me tell you, what's happening on my remote computer (Windows XP SP3). Installation o.k., install service o.k. Now I try to change the properties (right click on the icon -> Admin Properties for example). When I change something like the port number or the DSM plugin to use and click "Apply" and then "OK" the window closes. If I open it up again, all my changes disappeared...

The only way to change those settings (except the Plugin) I have to do it with the "Edit Settings" in the program folder. There I can change the ports, password, etc. and it's accepted and stored at least. The only thing which doesn't work is the plugin section. Use a plugin is activated but no plugin is set...

Does anyone of you has a clue what's going on? Did you already run into the same problems?

Best regards,

Cobra

[YY]

I try to change the properties (right click on the icon -> Admin Properties for example). When I change something like the port number or the DSM plugin to use and click "Apply" and then "OK" the window closes. If I open it up again, all my changes disappeared...

When you click "Apply" and/or "OK", the "Run As" window will popup. You need to UNCHECK the box "Protect my computer and data....", otherwise the change WILL NOT be saved. By default, this box is checked.

I have to do it with the "Edit Settings" (uvnc_settings.exe) in the program folder ........ The only thing which doesn't work is the plugin section. Use a plugin is activated but no plugin is set

Yes, I can repeat this bug in the "uvnc_settings.exe" (ver.1.0.5.6 package). The value of the plugin file is not saved into the "ultravnc.ini"

[Cobra]

Hi YY,

Right, this popup showed up, but I did exactly what you mentioned. I'll give it a try this evening again to see if I did something wrong. I will also try it from another machine (until now: viewer v1.0.6.0 on Vista - this evening: viewer v1.0.6.0 on XP SP3).

Thanks for your help & best regards,

Cobra

[Cobra]

Hi guys,

O.K. - I can give you some feedback now. It seems that I did something wrong in the setup section. I could now test the AESv3 Plugin. It works very smooth without problems. And it is very fast!

There's only one thing I mentioned. After closing the window I tried to initiate another session. I couldn't connect anymore to the PC. This is a strange behaviour but it happened also on another computer. Does anyone has the same problem? Can you connect several times without issues?

Regards,

Cobra

[redge]

Cobra
your are right,
at 2nd connection, is still block after vnc authentication
block at negociate protocol version

AESv3 3.0.1.7 without aesv3.key, direct mode
winvnc 1.0.6.2 (25 June) on xp sp3
vncviewer 1.0.6.0 (13 June)

[redge]

-- very slow AESv3PluginMT compatibility versus MSRC4 SingleThread --
lag of screen update.
bug optimisation if only SingleThread available by winvnc and vncviewer ?

sorry, my mistake, this issue came from compatibility mode xp sp3 on windows seven
otherwise without compatiblity mode, like wrote Cobra, is smooth and fast

[adzm]

You are right; when it runs in legacy mode, the second connections do not seem to work out correctly. I know exactly what the issue is, and will fix it shortly.

[adzm]

Also created new version this weekend that changed the way logging and registry access worked. While I was at it I created another set of configurations for the project which allows me to build both AES and RC4/ARC4 binaries. The RC4 really is the same thing, just with different algorithms. However it does spend about 4 to 5 less cycles in the encryption code, leading to somewhat of a speedup. However most latency still remains in the network, so I did not notice much of a difference over latent connections as compared to connections over a WAN.

[adzm]

New builds are up: http://adamwalling.com/DSMPlugin/

[Cobra]

Hi Adam,

I just tested the new plugin. Everything works fine so far! Now I even can reconnect several times without any issues. Great work!

Is it normal that when I first start the connection that it lasts quite a while until the password popup shows up?

Regards,

Cobra

[redge]

adzm,

test:
AESv3 3.0.1.8 without key (vnc password authentication only)
vncviewer 1.0.6.0
winvnc 1.0.6.2

xp sp3, OK
seven OK
multi connections ok, (1 vncviewer connected 2 computers winvnc)
direct mode, OK
reverse connection work well as native mode. OK
(mean without compatibility mode)...

Very great improvement, that very nice and cool.


I found one bug:
until you right click on vncviewer systray and select Toggle listen mode OFF , Toggle Listen On, all winvnc autoreconnect are buffered fifo, stacked show up all times to vncviewer listening with the plugin asking password instead cancelled.
winvnc start this way by service
service_commandline=-autoreconnect -connect hostname

message error:
DSMPlugin cannot be configured

don't know is bug of winvnc 1.0.6.2 or dsmplugin
without dsmplugin and with dsmplugin with ?.key , password are not requested, so no problem, a lot of vncviewer are open.


This happen if you have 2 different winvnc (xp and seven in my case) autoreconnec to vncviewer listen with plugin on win seven.

[adzm]

I'll take a look into the issues with the password some more. Most of my testing and development has been with key files. Might not have anything until this weekend though.

[redge]

adzm ,

good news:
you won't need to debug next week, cool
loop fixed with winvnc 1.0.6.3, that so nice
http://www.uvnc.eu/download/winvnc_32_1063.zip

double verified, no more trouble with multi reverse winvnc connecting to vnviewer listen after doing toggle ON/OFF

[redge]

Is it normal that when I first start the connection that it lasts quite a while until the password popup shows up?

I confirm have same bug:

aesv3pluginMT & arc4v3pluginMT 3.0.1.8
network: wired lan workgroup
win 6.1.7100: vncviewer 1.0.6.3 quick option= lan, direct
win 5.1.2600: winvnc 1.0.6.3 as service xp

[adzm]

I always use a keyfile, so I havn't had a chance to test out this password issue yet, but I'll get to it ASAP when I am home.

[rak_42]

Any progress made on implementing adzm's code changes into the server?