Automatic Entity Recognition Identifying Antennas Locally - AERIAL

Digital Operatives Kicks Off Project To Automatically Detect Antennas Using Computer Vision

Digital Operatives is a boutique cyber technology firm delivering advanced technologies that radically change the status quo in a multi-dimensional world.

Digital Operatives recently kicked off one of its latest projects under the Defense Advanced Research Projects Agency (DARPA) Cyber Fast Track program called AERIAL (Automatic Entity Recognition Identifying Antennas Locally). 

Existing approaches to conducting communication technology site surveys rely on detecting radio frequency (RF) emissions. This of course is only effective if and when the communications equipment is actively transmitting. Digital Operatives is investigating new approaches to the identification of communications equipment, more specifically antennas, by exploiting one of the few ways that such equipment can be universally detected: by applying state-of-the-art computer vision algorithms to identify antennas. In the AERIAL program, Digital Operatives is developing a prototype entity recognition system for the autonomous detection and classification of antennas. Digital Operatives vision is that this system will be deployed in a very small form factor; work is being done to develop the algorithms as an application on a mobile phone, as well as a sensor payload on a small Unmanned Aerial Vehicle (UAV) that could discover a broad range of antennas in a local area. The ability to automatically detect antennas visually and automatically is an exciting capability with multiple use cases.

Digital Operatives has discovered that small, thin objects like antennas provide a challenge to existing computer vision algorithms since traditional digital image features used in object recognition rely on the existence of facets (i.e., planar surfaces) on the object that are within the camera’s field of view. Since antennas usually appear as collections of one-dimensional lines in images, traditional computer vision and machine learning approaches for object detection will perform poorly. Digital Operatives addresses these challenges using a novel technique that exploits specific features of certain types of antennas such as Yagi-Uda and others.

The views expressed are those of Digital Operatives and do not reflect the official policy or position of the Department of Defense or the U.S. Government.

Read More

LifeProof iPhone Case Review

   Today we are reviewing the LifeProof iPhone case, for iPhone 4 and 4S.  Like their slogan says its life-proof, which means waterproof, shock-proof, and dirt-proof.  It's a bit pricey at $79.99 retail, but all things considered its way cheaper then a new phone. There a many colors and to choose from.  Colors include black, pink, purple, white, blue, green, orange, red, and teal. I have the orange and my husband has the blue.

   The best thing about this cover is that it's not to bulky like some of the ones I have had.  It does add some bulk,  about 1/6" when measured from the center of the phone.  This is great,  just that little bit extra gives it such awesome protection. The  iPhone accessories are small enough to reach the ports that cover the headphone and charger location, but if you use something bigger the case comes with a cord that screws in so that the case maintains its waterproof-ness. They also sale an adapter for the charger port along with many other accessories.  The LifeProof items are readily available at your local Best Buy or at their website at LIFEPROOF.

 

   Now on with the reviews. I (Aimee) am much harder on my phone then Cody is on his.  In the past six years i have destroyed four of my phones  and one of Cody's. Three of those were iPhones, that's why I have had insurance on my iPhone since I've had one. A monthly bill that I have now canceled because of the protection of this case.  After a few months I have payed off the case in what I would have spent on the insurance.  This case is very rugged we have both dropped ours  a couple times with no scratches or damage done to the case or phone.  We've gotten dirt on them from yard work and it has not got inside to the phone.  We cant really test the snow part living in Florida, but if its good in water then snow should not be a problem.  Now we have yet to test the water but we will be doing a video on the test, results to come.  The cover is awesome, camera and flash work fine with it although it does muffle the sound a little bit when the bottom clip is closed, but there is going to be somethings you have to give up to have your phone safe.  Another drawback is that the protective screen is something to get used to at first.  Its not a big deal but at first we found it annoying that you have to put a little more pressure to press the buttons on the screen then you do without the case but we got used to it within the week.

    Cody's Rating for this phone cover is 3 1/2 schnauzers. Its a great cover but the price is a bit high and it is a cover that limits what you can do with you phone unless you are willing to pay for the extras but if you are prone to dropping your phone or have a loved one that is or just don't feel like paying for a new phone when you drop it in the rain and or toilet this is the case for you if not than I wouldn't suggest it

    Aimee's Rating is also 3 1/2 stars.  I'm constantly dropping (throwing, that's  what happened to Cody's iPhone) my phone.  I've dropped two iPhones in water, so I love the waterproof feature. And so far this has passed the test.  The only thing that really brings the rating down is the price. But like I said before if your paying phone insurance every month then the case will pay for itself after you cancel that. So if you are accident prone with your phones this is the case for you.

Read More

Python For Android (Py4A)

A better solution for cross-compiling Python for Android is to use the Py4A project which is made to be used together with SL4A (Scripting Layer For Android). If you are only interested in the Python interpreter and the runtime Python library, you can also use it standalone.
Get a local copy of the source code using  the following command:

   $ hg clone https://code.google.com/p/python-for-android/

Just focus on the python-build subdirectory and make sure the  python-build/python-src subdirectory is not present (remove it if it came with the Mercurial repository, or else the compilation will fail).
Set up your environment so that the python-for-android build script can pick up the ndk-build script from the Android NDK:

  $ export ANDROID_NDK_ROOT=/home/<your-directory>/android-ndk-r8
  $ export PATH=$ANDROID_NDK_ROOT:$PATH

Finally build Python for Android by issuing the following command:

  $ cd python-for-android/python-build

  $ rm -rf python-src
  $ bash build.sh

Note that on my Ubuntu 12.04 machine I had initially the following compilation error:

Traceback (most recent call last):
  File "build.py", line 161, in <module>
    os.path.join(pwd, 'output.temp', 'usr'))
  File "build.py", line 89, in zipup
    zip_file = zipfile.ZipFile(out_path, 'w', compression=zipfile.ZIP_DEFLATED)
  File "/home/danilo/python-for-android/python-build/host/lib/python2.6/zipfile.py", line 660, in __init__
    "Compression requires the (missing) zlib module"
RuntimeError: Compression requires the (missing) zlib module


I identified the problem in having the zlib library in my system installed under /lib/x86_64-linux-gnu/ instead of one of the traditional lib directories covered by the Python setup.py script. Also on my system I only had libz.so.1 and not libz.so. So to fix both problems I just created a symlink in the standard /usr/lib directory as follows:

  $ cd /usr/lib

  $ sudo ln -s /lib/x86_64-linux-gnu/libz.so.1 libz.so

With this fix the build.sh script was able to successfully build the zlib module for the host environment and create the following zipped files:

• python_extras_r14.zip
• python-lib_r16.zip
• python_r16.zip
• python_scripts_r13.zip

Of these I only used the python_r16.zip which contains the stripped python interpreter and the runtime libraries, and the python-lib_r16.zip which contains the include header files such as Python.h that can be used to compile Python bindings at development time.

Read More

Arduino and 7-segment LED counter driven by two tactile switches

I have posted on YouTube a couple of videos about a project I made with the Arduino prototype board. The circuit uses an Arduino mini and has a simple gear counter based on a 7-segment LED and controlled by two switches. It can be mounted on your bike and used for example to visualize which gear you are in at any time.

If you are interested in the schematics I can send you the PCB Artist version by email. The Arduino code is instead available below.

/*
  Blink
 
 Turns on an LED on for one second, then off for one second, repeatedly.
 
 The circuit:
 * LED connected from digital pin 13 to ground.
 
 * Note: On most Arduino boards, there is already an LED on the board
 connected to pin 13, so you don't need any extra components for this example.
 
 
 Created 1 June 2005
 By David Cuartielles
 
 http://arduino.cc/en/Tutorial/Blink
 
 based on an orginal by H. Barragan for the Wiring i/o board
 
 */

#define BUTTON_DOWN 10
#define BUTTON_UP 12

int ledPinA =  6;    // LED connected to digital pin 3
int ledPinB =  9;    // LED connected to digital pin 4
int ledPinC =  4;    // LED connected to digital pin 5
int ledPinD =  3;    // LED connected to digital pin 6
int ledPinE =  2;    // LED connected to digital pin 7
int ledPinF =  7;    // LED connected to digital pin 8
int ledPinG =  8;    // LED connected to digital pin 9
int ledPinDP =  5;   // LED connected to digital pin 10

int val_down = 0;
int old_val_down = 0;
int val_up = 0;
int old_val_up = 0;
int state = 0;
int gear = 1;

// The setup() method runs once, when the sketch starts

void setup()   {             
  pinMode(BUTTON_DOWN, INPUT);
  pinMode(BUTTON_UP, INPUT);
  
  // initialize the digital pin as an output:
  pinMode(ledPinA, OUTPUT);
  pinMode(ledPinB, OUTPUT);
  pinMode(ledPinC, OUTPUT);
  pinMode(ledPinD, OUTPUT);
  pinMode(ledPinE, OUTPUT);
  pinMode(ledPinF, OUTPUT);
  pinMode(ledPinG, OUTPUT);  
  pinMode(ledPinDP, OUTPUT);
  
  // initialize serial communication:
  Serial.begin(9600);
}

void led0()
{
  digitalWrite(ledPinA, LOW);
  digitalWrite(ledPinB, LOW);
  digitalWrite(ledPinC, LOW);
  digitalWrite(ledPinD, LOW);
  digitalWrite(ledPinE, LOW);  
  digitalWrite(ledPinF, LOW);  
  digitalWrite(ledPinG, HIGH); 
  digitalWrite(ledPinDP, HIGH);
}

void led1()
{
  digitalWrite(ledPinA, HIGH);
  digitalWrite(ledPinB, LOW);
  digitalWrite(ledPinC, LOW);
  digitalWrite(ledPinD, HIGH);
  digitalWrite(ledPinE, HIGH);  
  digitalWrite(ledPinF, HIGH);  
  digitalWrite(ledPinG, HIGH); 
  digitalWrite(ledPinDP, HIGH);
}

void led2()
{
  digitalWrite(ledPinA, LOW);
  digitalWrite(ledPinB, LOW);
  digitalWrite(ledPinC, HIGH);
  digitalWrite(ledPinD, LOW);
  digitalWrite(ledPinE, LOW);  
  digitalWrite(ledPinF, HIGH);  
  digitalWrite(ledPinG, LOW); 
  digitalWrite(ledPinDP, HIGH);
}

void led3()
{
  digitalWrite(ledPinA, LOW);
  digitalWrite(ledPinB, LOW);
  digitalWrite(ledPinC, LOW);
  digitalWrite(ledPinD, LOW);
  digitalWrite(ledPinE, HIGH);  
  digitalWrite(ledPinF, HIGH);  
  digitalWrite(ledPinG, LOW); 
  digitalWrite(ledPinDP, HIGH);
}

void led4()
{
  digitalWrite(ledPinA, HIGH);
  digitalWrite(ledPinB, LOW);
  digitalWrite(ledPinC, LOW);
  digitalWrite(ledPinD, HIGH);
  digitalWrite(ledPinE, HIGH);  
  digitalWrite(ledPinF, LOW);  
  digitalWrite(ledPinG, LOW); 
  digitalWrite(ledPinDP, HIGH);
} 

void led5()
{
  digitalWrite(ledPinA, LOW);
  digitalWrite(ledPinB, HIGH);
  digitalWrite(ledPinC, LOW);
  digitalWrite(ledPinD, LOW);
  digitalWrite(ledPinE, HIGH);  
  digitalWrite(ledPinF, LOW);  
  digitalWrite(ledPinG, LOW); 
  digitalWrite(ledPinDP, HIGH);
} 

void led6()
{
  digitalWrite(ledPinA, LOW);
  digitalWrite(ledPinB, HIGH);
  digitalWrite(ledPinC, LOW);
  digitalWrite(ledPinD, LOW);
  digitalWrite(ledPinE, LOW);  
  digitalWrite(ledPinF, LOW);  
  digitalWrite(ledPinG, LOW); 
  digitalWrite(ledPinDP, HIGH);
} 

void led7()
{
  digitalWrite(ledPinA, LOW);
  digitalWrite(ledPinB, LOW);
  digitalWrite(ledPinC, LOW);
  digitalWrite(ledPinD, HIGH);
  digitalWrite(ledPinE, HIGH);  
  digitalWrite(ledPinF, HIGH);  
  digitalWrite(ledPinG, HIGH); 
  digitalWrite(ledPinDP, HIGH);
} 

void led8()
{
  digitalWrite(ledPinA, LOW);
  digitalWrite(ledPinB, LOW);
  digitalWrite(ledPinC, LOW);
  digitalWrite(ledPinD, LOW);
  digitalWrite(ledPinE, LOW);  
  digitalWrite(ledPinF, LOW);  
  digitalWrite(ledPinG, LOW); 
  digitalWrite(ledPinDP, HIGH);
} 

void led9()
{
  digitalWrite(ledPinA, LOW);
  digitalWrite(ledPinB, LOW);
  digitalWrite(ledPinC, LOW);
  digitalWrite(ledPinD, LOW);
  digitalWrite(ledPinE, HIGH);  
  digitalWrite(ledPinF, LOW);  
  digitalWrite(ledPinG, LOW); 
  digitalWrite(ledPinDP, HIGH);
} 

void ledDP()
{
  digitalWrite(ledPinA, HIGH);
  digitalWrite(ledPinB, HIGH);
  digitalWrite(ledPinC, HIGH);
  digitalWrite(ledPinD, HIGH);
  digitalWrite(ledPinE, HIGH);  
  digitalWrite(ledPinF, HIGH);  
  digitalWrite(ledPinG, HIGH); 
  digitalWrite(ledPinDP, LOW);
} 

void setLed(int number)
{
  switch (number) {
    case 0:  
      ledDP();
      break;
    case 1:  
      led1();
      break;
    case 2:  
      led2();
      break;
    case 3:  
      led3();
      break;
    case 4:  
      led4();
      break;
    case 5:  
      led5();
      break;
    case 6:  
      led6();
      break;
    case 7:  
      led7();
      break;
    case 8:  
      led8();
      break;
    case 9:  
      led9();
      break;
  }
}
              
// the loop() method runs over and over again,
// as long as the Arduino has power

void oldloop()                     
{
  ledDP();
  delay(1000);                  // wait for a second
  led0();
  delay(1000);                  // wait for a second
  led1();
  delay(1000);                  // wait for a second
  led2();
  delay(1000);                  // wait for a second
  led3();
  delay(1000);                  // wait for a second
  led4();
  delay(1000);                  // wait for a second
  led5();
  delay(1000);                  // wait for a second
  led6();
  delay(1000);                  // wait for a second
  led7();
  delay(1000);                  // wait for a second
  led8();
  delay(1000);                  // wait for a second
  led9();
  delay(1000);                  // wait for a second
}

void loop()
{
    val_up = digitalRead(BUTTON_UP);
    if ((val_up == HIGH) && (old_val_up == LOW)) {
      gear += 1;
      Serial.print("gear number:  ");
      Serial.println(gear, DEC);
      delay(100);
    }
    old_val_up = val_up;
 
    val_down = digitalRead(BUTTON_DOWN);
    if ((val_down == HIGH) && (old_val_down == LOW)) {
      gear -= 1;
      Serial.print("gear number:  ");
      Serial.println(gear, DEC);
      delay(100);
    }
    old_val_down = val_down;
    
    if (gear >= 6) {
      gear = 6;
    }
    if (gear <= 1) {
      gear = 1;
    }
    
    setLed(gear);
}

Read More

How to cross-compile Python for Android

When it comes to cross-compiling Python for Android, I've followed Gabriel's blog post @ http://mdqinc.com/blog/2011/09/cross-compiling-python-for-android/ and I was successful in creating an Arm-based Python executable (and related libraries) in little or no time.
Gabriel has a lot of the initial steps just verbally described, but I've come up with a shell script that allows you to automate the entire process. Of course you need to replace <path-to-android-ndk> with the directory where you have installed the NDK.
Here it goes.

ANDROID_NDK=<path-to-android-ndk>
ANDROID_ABI="armeabi-v7a"
ANDROID_NATIVE_API_LEVEL="android-8"
PYTHON_VERSION="2.6.2"

output_dir=$1
mkdir -p $output_dir
cd $output_dir
# get Python source tarball
wget http://www.python.org/ftp/python/$PYTHON_VERSION/Python-$PYTHON_VERSION.tgz

# create Python Host version
tar zxvf Python-$PYTHON_VERSION.tgz
mv Python-$PYTHON_VERSION Host-Python-$PYTHON_VERSION-src
cd Host-Python-$PYTHON_VERSION-src
./configure --prefix=$output_dir/Host-Python-$PYTHON_VERSION
make
make install

cd $output_dir
# create Python Cross-compiled version for Android
tar zxvf Python-$PYTHON_VERSION.tgz
mv Python-$PYTHON_VERSION Android-Python-$PYTHON_VERSION-src
cd Android-Python-$PYTHON_VERSION-src

# get and apply Python patch
wget -o Python-2.6.2-android.patch https://sites.google.com/site/dgtechblogscripts/Python-2.6.2-android.patch
patch -p0 < Python-2.6.2-android.patch
# fix setup.py
mv setup.py setup.py.orig
cat setup.py.orig | awk '{ if (NR==316) {print "    " $0} else {print $0}}' > setup.py

MY_HOSTPYTHON=$output_dir/Host-Python-$PYTHON_VERSION/bin/python
MY_HOSTPGEN=$output_dir/Host-Python-$PYTHON_VERSION-src/Parser/pgen

export ANDROID_NDK
export PATH="$ANDROID_NDK/toolchains/arm-linux-androideabi-4.4.3/prebuilt/linux-x86/bin/:$ANDROID_NDK:$ANDROID_NDK/tools:/usr/local/bin:/usr/bin:/bin"
export ARCH=$ANDROID_ABI
export CFLAGS="-DANDROID -mandroid -fomit-frame-pointer --sysroot $ANDROID_NDK/platforms/$ANDROID_NATIVE_API_LEVEL/arch-arm"
export CXXFLAGS="$CFLAGS"
export CC="arm-linux-androideabi-gcc $CFLAGS"
export CXX="arm-linux-androideabi-g++ $CXXFLAGS"
export AR="arm-linux-androideabi-ar"
export RANLIB="arm-linux-androideabi-ranlib"
export STRIP="arm-linux-androideabi-strip --strip-unneeded"
export MAKE="make -j4 install HOSTPYTHON=$MY_HOSTPYTHON HOSTPGEN=$MY_HOSTPGEN CROSS_COMPILE=arm-eabi- CROSS_COMPILE_TARGET=yes"

./configure LDFLAGS="-Wl,--allow-shlib-undefined" CFLAGS="-mandroid -fomit-frame-pointer --sysroot $ANDROID_NDK/platforms/$ANDROID_NATIVE_API_LEVEL/arch-arm" HOSTPYTHON=$MY_HOSTPYTHON HOSTPGEN=$MY_HOSTPGEN --host=arm-eabi --build=i686-pc-linux-gnu --enable-shared --prefix="$output_dir/Android-Python-$PYTHON_VERSION"
sed -i "s|^INSTSONAME=\(.*.so\).*|INSTSONAME=\\1|g" Makefile
$MAKE
 

Read More

Installing the Android NDK

These instructions refer to a Ubuntu 12.04.1 LTS system running on an Intel processor.

• Head to the http://developer.android.com/tools/sdk/ndk/index.html web site and download the latest version of the Android NDK for Linux (release r8b for example):
  

  $ wget http://dl.google.com/android/ndk/android-ndk-r8b-linux-x86.tar.bz2

  
  
• Unzip and untar the downloaded file in your preferred directory:

  $ bunzip2 android-ndk-r8b-linux-x86.tar.bz2
  $ tar zxvf android-sdk_r20.0.3-linux.tgz

You should now have a directory called  android-ndk-r8b containing release 8b of the Android NDK.

Read More

Process Attribution In Network Traffic

Author: Phil -at- DigitalOperatives

Overview

Digital Operatives recently completed a DARPA Cyber Fast Track (CFT) contract called Process Attribution in Network Traffic (PAINT). The goal of this project was to build an easy to use software product that is capable of attributing originating and receiving Process IDs (PIDs) and Process Names for TCP/IP packets on a Windows system in real-time. We chose Wireshark as the implementation platform since it is a very popular and one of the most useful open-source network analysis tools available today.

Our challenge in designing a packet-to-process attribution scheme was to take process-related metadata available at the TCP/IP layer and correlate it with discrete frames of network activity available at the bottom of the network stack (the NDIS layer). We considered several potential approaches to solving this problem, including implementing kernel-mode drivers, but we ultimately found that it was possible using a novel application of Event Tracing for Windows (ETW). Beginning with Windows 7, the various components in the network stack are able to generate trace messages via ETW that provide a way to collect correlated end-to-end network stack activity.

Motivation

We believe network traffic analysis and visualization are regarded as fundamental pillars of cyber defense. Wireshark is one of the most well-known and widely used network analysis tools. It’s useful for dynamic malware analysis and reverse engineering due to its powerful system of filters that allow the analyst to focus on network packets between selected hosts or using only certain protocols. However, due to the way it traces network traffic, it cannot determine the process on the host system that is responsible for sending or receiving that traffic. Thus, malware is able to hide its network communications semi-anonymously in the noise of legitimate network activity using similar protocols and data flow patterns. By PAINT-ing Wireshark, we are able to attribute all TCP/IP traffic to responsible processes and allow human and machine analysts to detect anomalies and potential malware traffic easily.

Comparison to Other Process Attribution Software Products

We believe PAINT/Wireshark is one of a kind but there are a couple software products that partially achieve PAINT/Wireshark’s real-time TCP/IP process attribution and packet capture functionalities on the Windows platform: Network Monitor and Process Monitor.

• Microsoft Network Monitor (NetMon) is a free network packet capturing software from Microsoft. It looks up the TCB (TCP Control Block) in semi-real-time to attribute network packets to processes. It can, however, only attribute TCP traffic and not UDP traffic. Another NetMon limitation is that it only periodically queries the TCB due to performance constraints. It’s possible for a TCP connection to exist between the TCB polls and cause a false-negative.

• Process Monitor is another Microsoft (SysInternals) tool. It logs virtually all attributable application activities including network activities. However, it can only attribute network connection activity and does not capture the traffic content like PAINT/Wireshark or Network Monitor.

• On Linux, there is a tool that partially achieves what we are doing with PAINT, which is a program called NetHogs. It can attribute network traffic usage totals to individual processes, but it lacks the ability to attribute data at a per-packet level, and is limited to TCP only.

• On the Mac OS X platform there is Private Eye. It is a simplified and user-friendlier tool similar to the Process Monitor. It does not attribute traffic at a per-packet level.

Event Tracing for Windows

Event Tracing for Windows (ETW) is a logging mechanism provided by Windows. It enables any user or kernel processes to log an event and lets any user or kernel processes subscribe to and receive events as broadly or as selectively as desired. Each ETW event contains an Activity ID that is used to perform a call trace within a single thread of control. ETW was first introduced in Windows 2000 and has been improving with subsequent Windows releases as more components of the system provide tracing information via ETW. PAINT/Wireshark requires the end-to-end ETW tracing information from the network stack components, which was first introduced in Windows 7.

Technical Overview

We identified 3 ETW providers built-in to Windows that gave us raw network packet capture, TCPIP events with PID, and a way to correlate the two: Microsoft-Windows-NDIS-PacketCapture (referred to as “ETW-NDIS” henceforth for brevity), Microsoft-Windows-TCPIP (referred to as “ETW-TCPIP” henceforth), and Microsoft-Windows-Networking-Correlation (referred to as “ETW-Correlation” henceforth), respectively.

While both the ETW-TCPIP and ETW-NDIS events contain the Activity ID field, these fields cannot be correlated in the traditional ETW event correlation fashion because they occur in different OS threads. Thankfully the ETW-Correlation provider sends out Activity Transfer events that correlates the ETW-TCPIP Activity IDs to the ETW-NDIS Activity IDs. Correlating these events in real-time proved to be non-trivial as it originally seemed, and we believe there’s at least a small room for improvement in the correlation state-machine for both attribution and run-time performance.

We modified Wireshark 1.6.5 to introduce PID and process name columns. We introduced a new binary file (.process) that pairs with the .pcap file. The current version of PAINT looks for the .process file whenever a .pcap file is opened and reads the process information to display (functions normally when it’s not found). We created our own dumpcap.exe implementation that replaces the original dumpcap.exe to provide the packet captures and the .process file using the ETW-NDIS provider.

The Result

As you can see the result looks great! Process information seamlessly integrates into Wireshark 1.6.5 in real-time and file-open operation modes.

Performance wise, we believe we achieve 0% false-positive (no wrongly attributed traffic) and 0% false-negative (no missing correct attribution) rates for UDP traffic and 0% false-positive and ~20% false-negative rates for TCP traffic. Currently, we can attribute about 100 packets per second on a typical Core2 machine.

We plan on making our custom Wireshark code available so that other pcap/PID providers can follow the same design paradigm enabling network traffic process attribution in Wireshark. Wireshark is not affected by our code if the original dumpcap.exe is used.

Please inquire at contact -at- digitaloperatives -dot- com for more information. Also stay tuned for details on PAINT Enterprise, an enterprise tool enabling easy-to-manage whole network process attribution.

Read More