Blocking Flash Games Software restriction Policies... Hash

[peterp]

Dirty, but you could shell out to pskill?

 

The problem isnt killing a process, its finding out which process has the file locked.

[EJWill]

When I was browsing through the FileSystemWatcher library I never found anything that might signify OnAccess. How wrong I was, I apologise for the unintentional misdirection

 

However surely if the file is a registered game in the hashlist. One could also save the deletion until the resource becomes available to do so? With the previous release of your programme, we tested out a few logging ideas. Such as recording every instance a SWF file was loaded. Builds up a nice history to show to their form tutors.

 

What I have done to those I have caught via a remote session, is change the SWF file permissions to deny total access for students. As soon as they load the SWF again, the SAFlashPlayer just stays white and never loads.

 

I can't thank you enough peterp for giving a few of us hope, the battle might soon be over! Well until the next bright spark comes along...

[peterp]

Yes, the onaccess is really to do with a property change (last access time changing). This is triggered when the file is opened (and thus locked) and when the file is closed (and then, yes, you can delete it or change its permission or otherwise mess with it)

 

Ideally I want to stop them playing it in the 1st place, else they just bring in a load, and play each of them once. Or copy them back from laptop /memory sick/mp3 players etc.

 

But the more I look into the problem of unlocking a file, the more it looks like it will beat me.

[Danielbarron]

We block hash keys with a piece of software called Securus

 

Have you a URL to the software?

 

I know of Securus the company who do E-Safety software but this monitors and does not actually block.

[EJWill]

I can't see why it can't be done peterp.

 

Are you able to post a snippit of your code? One of us might come up with something ingenius!

[peterp]

Well, this is a bit like exposing myself, but here is a section of (badly written, badly commented code)

There are a couple of global variables used, and much of the code is commented out as it was put in for debugging purposes.

The actual deletion routine is currently commented out too.

 

The code will (with the correct test harness) scan any opened file for a specific string (which in this case identifies the presence of embedded swf in .xls files.)

 

The one that does MD5 hashing is very similar.

 

 

    
Private Sub FileSystemWatcher2_Changed(ByVal sender As System.Object, ByVal e As System.IO.FileSystemEventArgs) Handles FileSystemWatcher2.Changed

       ListBox1.Items.Add(e.FullPath & " : " & e.Name & " : " & e.ChangeType.ToString)
       If (e.FullPath.Equals(last)) Then
           'ListBox1.Items.Add("Ignoring that one")
       Else
           'ListBox1.Items.Add("Scanning...")
           Try
               If doRead(e.FullPath) Then
                   'ListBox1.Items.Add("Deleteing " & e.FullPath)
                   'File.Delete(e.FullPath)
'1st time this event is caught, the file has just been opened, and is thus locked
'the 2nd time the file is closed and can be deleted.
'Given the variable e.fullpath I need to find the handle of the process that has it locked.
               End If
               If (last.Equals("error")) Then
                   last = "none"
               Else
                   last = String.Copy(e.FullPath)
               End If

           Catch ex As Exception
               'ListBox1.Items.Add(ex.Message)
           End Try

       End If


   End Sub

   Private Function doRead(ByVal fn As String) As Boolean

       Dim c As Byte
       Dim ca(50) As Byte
       Dim st As String = ":"
       Dim fsReadable As Boolean = True
       Dim found As Boolean = False

       Dim oFile As System.IO.FileInfo

           oFile = New System.IO.FileInfo(fn)

           Dim fs As System.IO.FileStream = oFile.OpenRead()
           While fsReadable
           Try
               c = fs.ReadByte
           Catch ex As Exception
               c = 46
               fsReadable = False
           End Try


               If c = -1 Then
                   fsReadable = False
               Else
                   If c < 32 Or c > 126 Then
                       c = 46
                   End If
                   st = enqueueChar(c)
               'ListBox1.Items.Add(st)
               End If
           If st.ToLower.Contains("\.f.l.a.s.h...o.c.x") Then
               found = True
           End If
               st = Nothing
           End While
           fs.Close()
           fs = Nothing
           Return found
   End Function

   Private Function enqueueChar(ByVal c As Byte) As String
       Dim st As String = ""
       Dim squeue(50) As Byte
       Dim count As Integer = 0
       queue(qe) = c
       qe = qe + 1
       qs = qs + 1
       If qe > 49 Then
           qe = 0
       End If
       If qs > 49 Then
           qs = 0
       End If

       While Not qe = qs
           squeue(count) = queue(qs)
           count = count + 1
           qs = qs + 1
           If qs > 49 Then
               qs = 0
           End If
       End While
       count = 0
       qs = qs + 1
       st = Encoding.UTF8.GetString(squeue)
       Return st
   End Function

[EJWill]

What about if you take the application being used, as assumed.

 

For example, if the file type being opened has the extension .swf and/or the mimetype application/x-shockwave-flash.

 

Then closing SAFlashPlayer and/or any other media process as a given. This would then release the resource for you to delete?

[peterp]

Works to an extent with certain files. If they open a .xls spreadsheet then the only program they have that will open this is Excel, so I could close down all instances of excel (and if they loose work they had open in another window, thats a lesson that they shouldnt be playing games)

 

The .swf files themselves are slightly more tricky, in that they can do 'open with' and open them in a variety of programs that understand flash. (flash, flashplayer, media player classic and Internet Explorer are the ones I've caught them using.)

 

I had wanted a more generic approach so that one method could deal with multiple methods of gaming, or opening otherwise banned files. (we cant restrict them all, as various courses have them developing flash).

 

I think you are right though, without much more expertise than I have to delve into using ntdll.dll then I will have to settle for working out the filetype to default program. Or even be completely evil and close all processes that I identify as being able to play games without worrying which one was the process playing the game.

[EJWill]

Well, when I see them playing games through Internet Explorer, I close the whole instance.

 

They should not be playing games, and as such if there was any work on the other tabs, then hard luck.

 

As long as the programme doesn't make any false positives, it's well within acceptable policy control to shut down the whole lot. I know of one school that shuts down the computer if they're caught.

 

With regards to opening up SWF in other files, surely group policy already prohibits running and installing new programmes. The only programmes that need to be closed are those already installed.

 

Maybe a KILL list is needed for customisation, like your last build.

[peterp]

Yes, they cannot install new programs, but .swf can currently run in ...

Embedded in excel worksheets (we cannot disable vba or macros as these are needed by some of our courses)

Internet Explorer (easiest to kill, thats the purpose of gamekiller2, which is doing a great job here)

Media Player Classic (installed as part of a codec pack and used by some media students)

Flash cs3 (used by computing students)

 

I think the approach will have to be the evil one :-

 

On detection of ANY game file being opened, close down ALL instances of these programs to ensure the file is deleteable.

So, if the student has some research open in IE, his large flash project open in Flash, and then decides to open a game, he's going to loose all his sessions work too. Oh well. :-)

I can live with that, I think most of the teachers can too, will have to clear it with the SLT though.

 

I had wanted the elegant solution of being able to determine which process I should kill, but oh well :-)

 

ok, will start work in coding the new version in earnest in the next week or so (although I'm off on summer holiday end of the month). I aim to get it up and running in some form by the end of summer break, ready for the new intake!

 

Thanks for all the suggestions and help.

[EJWill]

It's all for the common cause!

 

Hopefully your release, plus a few more additions I'd like to make with logging (if you release the source that is!) should hit at the heart of the problem.

 

However a quick note about Externally hosted games. There are obviously thousands, even tens of thousands out there, and a blacklist against them would be folly as we could see that list expand to an unmanageable size. I still recommend using a firewall such as ISA, and then block SWF and the SWF MIME type, then use a whitelist to allow tutor requested sites.

 

Cheers peterp

[timbo343]

Sorry to bring up an on going thread, but, i have just looked at our student GPO and tested it to see if everything is still working ok, and there seems to be a problem with the software restriction policy.

 

We have a list of file extensions that we block and one of them is SWF. For some reason (on a test GPO) the software restriction is blocking the exe and MDB but i have added SWF, TXT, DOC and PPT and nothing is happening. The extensions still open as usual. There is nothing configured in the GPO apart from the software restictions.

 

Can anyone help.

 

Tim

[rehanahmeds]

try moving the policy higher in the list and then do gpupdate /force

[DrCheese]

Sorry to bring up an on going thread, but, i have just looked at our student GPO and tested it to see if everything is still working ok, and there seems to be a problem with the software restriction policy.

 

We have a list of file extensions that we block and one of them is SWF. For some reason (on a test GPO) the software restriction is blocking the exe and MDB but i have added SWF, TXT, DOC and PPT and nothing is happening. The extensions still open as usual. There is nothing configured in the GPO apart from the software restictions.

 

Can anyone help.

 

Tim

 

I've found this out today as well, it manages to block .exe's and other files properly but when you tell it to block .swf it does nothing. Whist it really is just a classroom control issue it'd be nice if I could stop it still.

[NeoPlosive]

I've been led to believe, by RM, that SR doesn't block the .swf even if explicitly specified.

 

Thus using GameKiller2.

[DrCheese]

Fair enough, It does seem incredibly stupid of it to ignore certain file types. Whist we could use gamekiller, It would feel like fighting a never ending battle, i.e banning every single game the students bring in.

 

The only other option is to ban certain students from using USB keys, but when it's pretty much every student, it's not possible

[peterp]

Well, things have been busy so the programming has slipped a little.

 

However, good news. I figured out the whole which process to kill thing.

It was obvious really. The program will fire an event as soon as a file is modified (ie. the user opens a game).

 

I bet that about a second or so later, the currently active window is the one with the game in it :-) I just kill that one, and Robert is some sort of relation, the file is unlocked and able to be deleted (if I so choose)

 

Started work in earnest on the new code yesterday, hoping to have a dirty version running in a couple of weeks.

 

We are doing a LOT of work over the summer holidays, so it may slip a little, but I will have something out ready for the september intake.

 

 

And thanks to the people who have expressed their thanks for the earlier incarnation of gamekiller2.

[NeoPlosive]

Sounding good... so GameKiller3? or going to be a little creative on the naming?

[peterp]

Well, the internal name of Gamekiller2 was MCP (Master Control Program) as a homage to Tron :-)

There was no Gamekiller1 (well, there was briefly but after messing up the very start of the project, I couldnt be bothered to delete it all, so the first version became 2 :-)

 

Ideas for names?

[EJWill]

Great news PeterP, I think most of us School Techies are going to be busy over the summer. We're hoping to be moving to blade systems and virtualisation over holidays period

 

I can't wait to too take a peek at what you've got!

 

How about calling it Game Monitor.

Edited June 17, 2009 by EJWill

[Danielbarron]

GameKiller3

 

If you switch names now you will lose the known brand name.

[dcwhitworth]

I've offered to host this. App is available: http://repository.neoplosive.co.uk/edugeek/packages/GameKiller2.zip

 

 

This download doesn't seem to be working. I get "500 Internal Server Error"

[peterp]

Seems he moved it....

 

GameKiller2 | NeoPlosive

[NeoPlosive]

Seems he moved it....

 

GameKiller2 | NeoPlosive

 

Really should update my error pages...

 

Did ask for a link edit on the original link but Admins never seem to have got to it...

[pinkerton]

First of all thanks for a gamekiller!

I'm trying to get it working on our network and have a problem.

We are on a vanilla 2003 network, I deployed gamekiller to some test clients OK, but cant get it to work with students. The problem seems to be that gamekillerapp.exe starts as a student logs in and the process runs as that user. Problem is we have our students pretty locked down via group policy, so the gamekiller app doesnt seem to have the priviledges to kill the saflashplayer.exe process or block the swf file from running in IE! very annoying!

I logon as admin with gamekiller running and it works fine!! Should be the other way round. I guess It needs to run gamekillerapp.exe as system or local admin account to work?? Or maybe I'm doing something wrong?

Help!