hdd memo

Make performance tests: HD Tune
Check health of ssd: Crystal Disk Info (it doesn't work if ssd in RAID as I see; one server goes down after start of this util)

C++ snippets memo

hand-made scope_guard without boost scope_guard & other stuff:

std::shared_ptr<void> l(nullptr, [](void*){ system("pause"); });

example of such 'scope_guard' - temp_dir which guaranteed be deleted when out of scope:

std::string temp_filename = MyGetTempFilename();
std::shared_ptr<void> l(nullptr, [temp_filename](void*){
    boost::filesystem::remove(temp_filename);
});

thread & lambda - as for me, useful pattern - especially for unit-testing:

thread to lambda:
std::thread t([](){
    std::this_thread::sleep_for(std::chrono::seconds(1));
    system("taskkill /F /IM calc.exe");
});
t.join();

shared_ptr + placement new

std::shared_ptr<boost::interprocess::interprocess_mutex>
    placement_shared_ptr(
        new(region.get_address())boost::interprocess::interprocess_mutex,
        [](boost::interprocess::interprocess_mutex* l)
        {
            l->~interprocess_mutex();;
        }
    );

boost::thread_group replace to std::thread pattern

std::vector<std::thread> my_threads;
for (size_t i = 0; i < (size_t)threads_num; ++i)
{
    my_threads.push_back(std::thread(std::bind(&MyClass::RunThread, this,
        parameters
        )));
}
for (size_t i = 0; i < my_threads.size(); i++)
{
    my_threads[i].join();
}

.

boost::filesystem::remove_all, RemoveDirectory WinAPI function and 'The directory is not empty' error

Problem

Sometime boost::filesystem::remove_all on windows (or RemoveDirectoryA/RemoveDirectoryW WinAPI functions, which are called into remove_all windows implementation) returns stupid error 'The directory is not empty'.

Problem solving in short

Windows have some problems with long paths (which length more than 260 symbols), and if you want to handle such paths, you need to write instead of C:\my_long_filename stuff like \\?\C:\my_long_filename.
If you have directory C:\dir where located file with long name, RemoveDirectory winapi function called with this path returns error 'The directory is not empty'. But if you call it with \\?\C:\dir parameter - it will work fine.
So, instead of using boost::filesystem::remove_all you can use something like that:

void RemoveAll(const std::wstring & path)
{
    std::wstring current_path = path;

    if (current_path.substr(0, 4) != L"\\\\?\\")
    {
        current_path = L"\\\\?\\" + current_path;
    }

    boost::filesystem::remove_all(current_path);
}

Useful links:

Rot13 in Windows:
https://blog.didierstevens.com/2006/07/24/rot13-is-used-in-windows-you%E2%80%99re-joking/

UserAssist - thing, which stores in registry (in Rot13) what did you run on your PC. And useful util for viewing:
https://blog.didierstevens.com/programs/userassist/

Undetectable windows payload generation (metasploit generates shellcode, then python code generated, who executed this shellcode, then it's aes encrypted & pack to the mzpe):
https://github.com/nccgroup/Winpayloads
(description of UAC bypass used by link (again IFileOperation) - https://www.pretentiousname.com/misc/W7E_Source/win7_uac_poc_details.html)

Masquerade-PEB powershell script (for UAC bypass):
https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Masquerade-PEB.ps1
with interesting idea:

one more UAC bypass:
https://github.com/FuzzySecurity/PowerShell-Suite/tree/master/Bypass-UAC

Masquerade-PEB uses NtQueryInformationProcess to get a handle to powershell's
PEB. From there itreplaces a number of UNICODE_STRING structs in memory to
give powershell the appearance of a different process. Specifically, the
function will overwrite powershell's "ImagePathName" & "CommandLine" in
_RTL_USER_PROCESS_PARAMETERS and the "FullDllName" & "BaseDllName" in the
_LDR_DATA_TABLE_ENTRY linked list.

This can be useful as it would fool any Windows work-flows which rely solely
on the Process Status API to check process identity. A practical example would
be the IFileOperation COM Object which can perform an elevated file copy if it
thinks powershell is really explorer.exe ;)!

Interesting case, how to run stuff in context of InstallUtil.exe from win dir! It can be god damn autorun, for example:
http://www.blackhillsinfosec.com/?p=4881

How to run console program with parameters, when cmd.exe disabled:
http://www.blackhillsinfosec.com/?p=5257

some interesting tool:
https://github.com/goldshtn/etrace

CVE-2016-3308 - corrupt heap in win32k
https://github.com/55-AA/CVE-2016-3308

blind sql framework
http://www.darknet.org.uk/2016/09/bbqsql-blind-sql-injection-framework/

LLMNR/NBNS spoofer:
https://github.com/Kevin-Robertson/Inveigh

notes of yara 3.5.0 compiling

It's modified version of my 'notes of yara 3.4.0 compiling' post

 

What's good in 3.5.0 in comparison with 3.4.0

Official description is quite short, so I watched commits:

• speed up into 2.6x times! - https://twitter.com/plusvic/status/763753320381046784
• bugfixes: ~70 bugfixes - some of them led to crashes - I personally occured crashes bcs of 2 bugs, which is fixed by now
• new stuff:
• length operator ! (don't know who will really use it)
• useful stuff in pe module:
• imports(dll_name)
• imports(dll_name, ordinal)
• is_dll()
• is_3bit()
• is_64bit()
• 2 new functions in 'rich_signature' in 'pe' module:
• version(version, [toolid])
• toolid(toolid, [version])

Also in my yara module I will need to change stuff like:
    foreach_memory_block(context, block)
to
    foreach_memory_block(iterator, block)
and declare this iterator before, and change the way how to deal with this stuff - now need to write smth like 'block_data = block->fetch_data(block);'

and also struct _YR_MATCH changed - match->length became match->match_length so I'd need to fix it in my module source accordingly.

tools & version:

• windows 8.1
• visual studio 2013
• yara library 3.5.0

foreword

Just notes of yara compiling process on windows with visual studio. I will compile without CUCKOO support - bcs I don't need this.

action

1) unpack archive

2) go to yara-3.5.0\windows\lib and delete all these libraries. I prefer to compile everything what I need by myself. And these libraries will interfere with libraries which I will compile.

3) open solution: .\yara-3.5.0\windows\vs2010\yara.sln

4) open 'utils.h' -> replace '#define YR_API EXTERNC __declspec(dllexport)' to '#define YR_API EXTERNC' (bcs I don't like exported symbols in my exe files, and link I wanna statically)

5) choose platform & mode

6) set runtime library for all projects (yara & yarac & libyara):
    properties -> c/c++ -> code generation -> runtime library -> /MTd for debug or /MT for release
    (you can select several projects in time - using 'ctrl'+left_mouse_button_click)

7) add to "Preprocessor Definitions" of 'libyara' project
    (Properties -> Configuration Properties -> C/C++ -> Preprocessor -> Preprocessor Definitions)
    lines to not conflict with mysql c connector, for example:
strlcat=libyara_internal_strlcat

8) open 'strutils.c' and replace '#if !HAVE_STRLCAT && !defined(strlcat)' to '#if !HAVE_STRLCAT', open 'strutils.h' and make the same.

9) Go to libyara properties:
    Properties -> Configuration Properties -> C/C++ -> Preprocessor -> Preprocessor Definitions
    and delete CUCKOO from this list.
Then go to libyara properties:
    Properties -> Configuration Properties -> Librarian -> General -> Additional Dependencies
    and delete jansson64.lib from this list.

10) Here are you must choose - you want to compile it with openssl or without.
Why do you need openssl in yara library:
    - Generate an import hash: https://www.mandiant.com/blog/tracking-malware-import-hashing/ (uses define HAVE_LIBCRYPTO)
    - PE module of yara can extract some info from pe digital signature certificate. (uses define HAVE_LIBCRYPTO)
#if defined(HAVE_LIBCRYPTO)
begin_struct_array("signatures");
  declare_string("issuer");
  declare_string("subject");
  declare_integer("version");
  declare_string("algorithm");
  declare_string("serial");
  declare_integer("not_before");
  declare_integer("not_after");
  declare_function("valid_on", "i", "i", valid_on);
  end_struct_array("signatures");
declare_integer("number_of_signatures");
#endif   
    - HASH module of yara can calc provide you cryptographic hash functions: md5, sha1, sha256, checksum32 (uses define HASH, appeared in 3.3.0 version)
   
If you need some of this functionality - you need to build openssl & you need add for all projects:
    - Additional library directory
    - library file of openssl (libeay32.lib on my pc)
    - add HASH_MODULE to preprocessor of libyara project

If you don't need this functionality
    - delete HAVE_LIBCRYPTO from "Preprocessor Definitions" of libyara, and insert HAVE_TIMEGM line - else you get undefined type 'tm'.
        Properties -> Configuration Properties -> C/C++ -> Preprocessor -> Preprocessor Definitions
    - delete libeay64.lib from
        Properties -> Configuration Properties -> Librarian -> General -> Additional Dependencies

11) If you need add your module - you need add it to 'libyara\modules\module_list'

After that everything will compiles fine.

build libzippp in visual studio 2013

Here are some c++ wrapper over libzip - https://github.com/ctabin/libzippp
But it has terrible building system

• in it hardcoded version of visual studio (well, it's fixable)
• in it hardcoded version of libzip (hardcoded version: 1.1.2, last version: 1.1.3 - well, and it's fixable)
• it's difficult to change building script to adjust zlib & libzip - for example for static linking.

So, it's much easier to create empty project (god bless this project have one cpp & one h file (and one more cpp for tests - author has tests - that's really cool)). So, just create solution with 2 projects - libzippp & tests. Adjust headers, path to headers, lib files, path to lib files, change /MD to /MT & /MTd accordingly and build. Check if tests works fine. Done)

--------------------------------------------------------------------
and for using it as static library, go to libzippp.h, add #include <cstdint> and change:

#ifdef WIN32
        typedef long long libzippp_int64;
        typedef unsigned long long libzippp_uint64;
       
        //special declarations for windows to use libzippp from a DLL
        #define SHARED_LIBRARY_EXPORT __declspec(dllexport)
        #define SHARED_LIBRARY_IMPORT __declspec(dllimport)
#else
        //standard ISO c++ does not support long long
        typedef long int libzippp_int64;
        typedef unsigned long int libzippp_uint64;
       
        #define SHARED_LIBRARY_EXPORT
        #define SHARED_LIBRARY_IMPORT
#endif

to

typedef int64_t libzippp_int64;
typedef uint64_t libzippp_uint64;

#define SHARED_LIBRARY_EXPORT
#define SHARED_LIBRARY_IMPORT
--------------------------------------------------------------------


headers paths for libzippp:
D:\projects\libraries\libzip-1.1.3\lib
D:\projects\libraries\libzip-1.1.3\xcode

headers paths for tests:
D:\projects\libraries\libzippp\libzippp

lib paths for debug tests:
D:\projects\libraries\libzippp\x64\Debug
D:\projects\libraries\libzip-1.1.3\_build_x64_static_mt_mtd\lib\Debug
D:\projects\libraries\zlib-1.2.8\_libraries_debug

lib paths for release tests:
D:\projects\libraries\libzippp\x64\Release
D:\projects\libraries\libzip-1.1.3\_build_x64_static_mt_mtd\lib\Release
D:\projects\libraries\zlib-1.2.8\_libraries_release

lib files:
libzippp.lib
zipstatic.lib
zlibstat.lib

And respect for the author of libzippp - despite of bad building system, I hope project will be useful)
 

building libzip in visual studio 2013

As always - x64, static, debug/release.
You need compiled zlib - I wrote of compiling zlib here
Download from http://www.nih.at/libzip/index.html archive libzip-1.1.3.tar.gz, unpack.

md _build_x64_static_mt_mtd
cd _build_x64_static_mtd
if you want to use only static lib

• go to 'D:\projects\libraries\libzip-1.1.3\lib\CMakeLists.txt' & comment pre-last block & uncomment last block.

• go to D:\projects\libraries\libzip-1.1.3\lib\zip.h and insert into the beginning (after include guard): #define ZIP_STATIC 

• go to D:\projects\libraries\libzip-1.1.3\lib\compat.h and replace '#define ZIP_EXTERN __declspec(dllexport)' -> '#define ZIP_EXTERN'

cmake .. -G "Visual Studio 12 2013 Win64" -DZLIB_LIBRARY:FILEPATH="D:/projects/libraries/zlib-1.2.8/_libraries_debug/zlib.lib" -DZLIB_INCLUDE_DIR:PATH="D:/projects/libraries/zlib-1.2.8"
debug: Md -> MTd, build
release: Md -> MT, build

the simplest nginx cfg for sharing files

just memo - how to share directory

worker_processes  1;
error_log ./logs/error_log.log;
events {
    worker_connections 1024;
}

http {
    server {
      listen 80;
      server_name myvhost;
      access_log ./logs/access_log.log;

      location / {
        root D:/shared_dir/;
        autoindex on;
      }
    }
}

errno values link

Useful link with description of values 'errno' variable on linux - [link]

how to launch debugger when specific process start

Found way to attach automatically debugger when specific process launched:
link
and in parameter 'debugger' you can set  fullpath to ollydbg and it will work - for example: D:\tools\odbg110\OLLYDBG.EXE

asciihex to hex in perl

Found great script on stackoverflow:

my $str = <>;
$str =~ s/(..)/chr(hex($1))/eg;
print($str);

Enable telnet client on windows

Somewhy telnet client not present in windows by default (well, once I've found it present by default in one server windows, but only once).
Here are algorithm - how to install in by standard tools - link.
backuped page:

C++ on windows and linux

Once I've encounted with problem - size of some variable on linux x86-64 differs from size of same variable on windows x86-64. And some years after that I couldn't remember - was it int or long or what. So here are link about it.
backuped article:

and here are another angry post about same problem)
backuped post:

So, problem in 'long' data type.

earlier I've used special macros to get DWORD == 4 bytes on x86 windows, x86-64 windows, x86 linux & x86-64 linux:
#if defined ( _MSC_VER )
    typedef unsigned long DWORD;
#else // for g++
    typedef unsigned int DWORD;
#endif

but now I would prefer _int32_t

Download file on windows by standard tools

Found interesting way - how to download file on windows only with standard tools (like how to make wget/curl on windows by standard tools) - [link]
and backuped article:

It can be useful, when you need do stuff like that and you don't add extra dependencies.

Sort file by lines lengths

Often I need to sort file by length of lines and always I can't remember code which is doing this.

my @elements;

while(my $line = <>){
    push @elements, $line;
}

@sorted = sort { length $a <=> length $b } @elements;

foreach my $l (@sorted){
   print($l);
}

OpenPGP and annoying pinentry window

Foreword

I've started to use PGP in jabber (GnuPG for windows - Gpg4win - I've used this instruction). Backup of instruction just in case:

 

Problem

And every time when I've got incoming message in jabber - appeared windows 'pinentry' and asked me password (passphrase). It's very annoying and in the internet I didn't find solution for Windows OS.
Window - looks like that:

Lyrics

So, in the internet there are lot of posts where people advices create file with properties - 'gpg-agent.conf', but usually it's about linux. Process monitor showed that in Windows this file expected to be in "C:\Users\username\AppData\Roaming\gnupg\gpg-agent.conf"

Action

1. Create file "C:\Users\username\AppData\Roaming\gnupg\gpg-agent.conf"
2. Write in this file 2 lines (values can be any big number - it's seconds of caching your password):
• max-cache-ttl 2592000
• default-cache-ttl 2592000
3. Restart your gpg-agent.exe process

'Copy to clipboard' button on web-page

Here are 3 ways to create such button:

• Use flash-based ZeroClipboard - it's flash - I don't like it
• Use clipboardData.SetData - works only for IE
• Use modern w3c clipboard API (supported by modern browsers) - IMHO the best way

And here are my snippet for the last variant.

API: document.execCommand("copy") - returns true if successed
You can check if it enable by document.queryCommandEnabled("copy") - returns true if enable

Simplest case:
<html>
<body>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
<script LANGUAGE="JavaScript">
function ClipBoard(element) {
    var $temp = $("<textarea visibility: hidden;>");
    $("body").append($temp);
    $temp.val(element).select();
    document.execCommand("copy");
    $temp.remove();
}
</script>
<button onclick="ClipBoard('test\ntest')">Copy to clipboard</button>
</body>
</html>


I've needed next actions for click:

1. Ask data from server
2. Copy it to clipboard

But here are thing - w3c clipboard api works only for 'user-triggered thread' (and in the simplest using of ZeroClipboard it also doesn't work - maybe it need some another API for that - I don't know). And when you asking server by ajax - callback is another thread, not user-triggered. So, you can handle it next ways:

1. obsolete-but-working - not async ajax query
2. you can ask data in background and keep it in browser - in button click handler copy existing data. It's bad when you have a lot of data
3. you can ask user press button twice - first for loading, second for copying
4. you can in click handler ask data by ajax & show textarea with selected text - let user copy it by himself.

So, I choosed not the best by working - 1st case.

function copy_to_clipboard_button_handler()
{
    if (data == '')
    {
        var request_data = ...;
       
        $.ajax({
            type: "POST",
            url: this.url,
            data: request_data,
            async: false,
       
            success: function(data)
            {
                global_object.clipboard_data = data;
            }
        });

    }
   
    var $temp = $("<textarea visibility: hidden;>");
    $("body").append($temp);
    $temp.val(global_object.clipboard_data).select();
    document.execCommand("copy");
    $temp.remove();
}

So.

• 'async: false' means it will be user-triggered thread
• usually in examples used <input> but it kills newline symbols
• be careful with big amount of data - time for handling '$temp.val(global_object.clipboard_data).select()' grows exponential - on my desktop ~3MB handled ~20 seconds and ~30MB handled ~20 minutes and I didn't get patient to wait when it will finished. So, if you want copy more than several megabytes of data to clipboard - consider another variants - for example saving such amount of data to a file.

Mysql memo

Can't remember syntax of console mysql tools (bcs of rare using). Just put it here for myself:

dump database
"C:\Program Files\MySQL\MySQL Workbench 6.2 CE\mysqldump.exe" --host="%HOSTNAME%" --user=%USERNAME% --password=%PASSWORD% --result-file="out.txt" %DATABASE_NAME%

exec sql command
"C:\Program Files\MySQL\MySQL Workbench 6.2 CE\mysql.exe" -h %HOSTNAME% -u %USERNAME% --database=%DATABASE_NAME% --password=%PASSWORD% --execute="%QUERY" >out.txt

Using password in the command line string is insecure, so, possible to leave just '--password' without value. If not not to enter '--password', mysql think you want to connect without password and prints you an error.

Multilingual User Interface

Starting from Windows Vista there are appeared new mechanism - Multilingual User Interface.
If earlier you had one binary file where was code & strings, now it's another mechanism - you have 2 files: binary_filename (for example, crypt32.dll) + binary_filename.mui (for example, crypt32.dll.mui). Now binary file doesn't contain strings, and mui file have only one section - resources (name of section '.rsrc'), where in resource 'MUI' localize strings & their ID located. 'MUI' resource present and in binary with code - but there only a structure which helps find mui file.
MUI file located somewhere in C:\Windows\System32\en-US. en-US - strings in en-US languages, and every language pack presents own set of MUI files.
As I understood (didn't dig long & deeply, may be wrong), MUI file loaded by PE loader (by struct in 'MUI' resource in binary).
In binary with code to get string called LoadStringW() with id of this string.
So
What's good - logic & locale now divided, and you can switch locale dinamically.
What's bad - reversing of these binaries is hell now. If earlier you could find string in IDA, press 'x' and find usage - now you need go to MUI file, find ID, go to binary with code & search LoadStringW with this ID (and if you are lucky one - you will find it).

added

Just now I tried to start 'calc.exe', copied to another dir - it didn't started! with debugger I found out, that it failed in LoadStringW() - this func returned 0 and everything finished. So, I guessed - windows PE loader searched it into subdir - for example if I put calc.exe to c:\mydir\calc.exe, mui file searched by path c:\mydir\en-US\calc.exe.mui

Useful links

tiny article of MUI - [link] (note than 'FILEMUIINFO' struct - is not the same as in 'MUI' resource)
in comment here described struct in MUI resource - [link]

------------------------------------------------------------------------------------------
leave here are copy of that comment
------------------------------------------------------------------------------------------
The FILEMUIINFO structure is not equal to the MUI resource data. Further investigation of the resource data gives the following structure

// resource types defined by string only:
#define RT_MUI       TEXT("MUI")

// default resource name
#define RESFILE32_MUI_RESNAME    MAKEINTRESOURCE(1)

// mui signature
#define RESFILE32_MUI_SIGNATURE  0xFECDFECD

// mui version
#define RESFILE32_MUI_VERSION    0x00010000

// mui filetypes
#define RESFILE32_MUI_FILETYPE_MAIN  0x11
#define RESFILE32_MUI_FILETYPE_MUI   0x10


// ----
// notes about the checksum:
// ----
// - There are multiple methods given by MS about the calculation of the
//   checksums.
// - The actual case is there is no calculation of the checksum by the
//   resourceloader, it only compares checksums.
// - The checksums can be arbitary 16 byte codes.
// - The only requirement is that the MUI files have the same checksums in
//   their MUI resources as the base LN file.
// ----
// one incomplete method given by MS:
//   the main checksum is calculated from the major and minor version numbers of
//      a file and the file name (case sensitive), which are obtained from the
//      version resource
//   the service checksum is calculated based on the localizable resources
//      in the file
// ----
// another method given by MS:
//   The most common convention for checksum handling is to base the checksum on
//   the English (United States) resources. You are free to adopt a different
//   convention, as long as it is consistent for each LN file. It is also
//   acceptable to use the resource configuration file to assign an arbitrary
//   hexadecimal value of up to 16 hexadecimal digits as a checksum. It requires
//   adoption of a method using either GuidGen or some other tool to generate
//   checksum values.
// ----



// mui header
// - followed by array of bytes referenced by the header
// - every offset is 64-bit aligned, padding bytes are added accordingly
typedef struct
{
  UINT32 Signature;         // equal to RESFILE32_MUI_SIGNATURE
  UINT32 Size;              // size in bytes of MUI header and payload
  UINT32 RcCfgVersion;      // equal to RESFILE32_MUI_VERSION
  UINT32 Reserved1;         // equal to 0
  UINT32 FileType;          // one of RESFILE32_MUI_FILETYPE_xxx
  UINT32 Reserved2;         //              - SystemAttributes         ???
  UINT32 Unknown;           // equal to 1   - UltimateFallbackLocation ???
  BYTE   MainChecksum[16];  // checksum, see notes
  BYTE   SvcChecksum[16];   // checksum, see notes
  BYTE   Reserved3[24];
  UINT32 OfsMainTypeNames;  // offset to list with non-numerical resource types in main file (as multistring)
  UINT32 SzeMainTypeNames;  // size in bytes of MainTypeNames
  UINT32 OfsMainTypeIDs;    // offset to list with numerical resource types in main file (as UINT32's)
  UINT32 SzeMainTypeIDs;    // size in bytes of MainTypeIDs
  UINT32 OfsMuiTypeNames;   // offset to list with non-numerical resource types in mui file (as multistring)
  UINT32 SzeMuiTypeNames;   // size in bytes of MuiTypeNames
  UINT32 OfsMuiTypeIDs;     // offset to list with numerical resource types in mui file (as UINT32's)
  UINT32 SzeMuiTypeIDs;     // size in bytes of MuiTypeIDs
  UINT32 Reserved4;
  UINT32 Reserved5;
  UINT32 OfsFbLanguage;     // offset to ultimate fallback language string
  UINT32 SzeFbLanguage;     // size in bytes of FbLanguage, including eos

  //
} TResFile32_MuiHdr;

Add a bit unix functional to windows server

Problem.

I have server with windows. I worked with this server through RDP. And sometime GUI subsystem stop to work correctly, but logs of my service showed that everything other worked fine - processes, services. So, I've needed an not-GUI mechanism to work with this server.

Action.

1) Install freesshd
    If it asks something like "should I generate the keys?" - answer 'yes'
    If it asks something like "install the service?" - answer 'yes'
2) Run freesshd as administrator
3) Add user&pass (password stored as sha1_hash), set tick 'shell' - it gives your user access to ssh
4) Go to 'control panel -> windows firewall -> advanced' and allow access from outside to 22 port
5) Exit from your gui instance of freesshd
6) install gnuwin327) add c:\gnuwin32 to system PATH (not default user PATH)
8) install midnight commander for Windows
9) add dir with installed mc.exe to system PATH (not default user PATH)
10) Restart service freesshd ('control panel -> administrative tools -> services')

So. Now you can connect to your windows server via ssh (for example, in Putty), use in shell comfortable gnu utils & midnight commander. If midnight commander looks bad, try to run it 'mc -ac'.