Fun with Hanayama Cast Puzzles

September 21, 2014 in puzzles

During my recent trip to Japan I came across a puzzle called Devil’s claw.

hanayama_puzzle_cast_devil

What followed was a moment (read: a very long moment) of struggle which ended up with a devastating and humiliating defeat of yours truly.

I was hooked.

And yes, I eventually cracked it :).

hanayama_puzzle_cast_devil_solved

After coming back home I looked around online and found out that it’s actually a very old puzzle (1906) which many people enjoy for its simplicity and ‘playability’. Even if you solve it once, solving it again is still challenging and it takes some practice to master the moves. It has been revived in 80s by a Japanese company Hanayama. Of course, I immediately started hunting and quickly found a HK-based company that is selling other Hanayama’s puzzles locally. A quick trip to their outlet & the sales girl’s near-heart attack experience concluded with her offering me a discount and me coming back home with over 20 different Hanayama puzzles.

If you are curious, these are a few places in Hong Kong where you can buy Hanayama puzzles:

  • Teen’s Channel in KITEC  (Kowloon Bay) – many different variants [this is the outlet shop I mentioned earlier]
  • Log On (Kowloon Tong, Causeway Bay, Tsim Sha Tsui, etc.) – quite a limited choice of puzzles though

The Hanayama products are also sold outside of Asia and it’s easy to find them on Amazon, Ebay and other shops. Just google around.

Some of the puzzles are relatively easy f.ex. the cast horse:

hanayama_puzzle_cast_horse

hanayama_puzzle_cast_horse_solved

Some are quite evil e.g. cast square:

hanayama_puzzle_cast_square

hanayama_puzzle_cast_square2

hanayama_puzzle_cast_square_solved

Solving them is a great fun and as I am slowly moving through my stack I can only say that if you like puzzles you will definitely enjoy the Cast series from Hanayama.

Here is the list of all available mechanical puzzles.

p.s. I am not sponsored by Hanayama and don’t take cut from their sales – they just make awesome puzzles and if you get bored with your smartphone games you will definitely have fun cracking these

p.s.2. I turns out Ange already explored this topic before and in great depth – his collection of puzzles is AMAZING !!!

anges_collection

Beyond good ol’ Run key, Part 17

August 31, 2014 in Anti-Forensics, Autostart (Persistence), Compromise Detection, Forensic Analysis, Malware Analysis

.NET components (a couple of DLLs loaded anytime .NET apps are executed) in the Windows 8.X have been somehow modified and when they are loaded they look for an environment variable called APPX_PROCESS. I am not sure what it is – googling around didn’t bring any results, but experimenting with it led me to a discovery of yet another phantom DLL called WinAppXRT.dll. If the environment variable is set anytime some .NET components are loaded they in turn will attempt to load the aforementioned DLL (e.g. launching powershell or any .NET app should be enough).

Since environment variables can be set via Registry we can use it to develop yet another persistence mechanism.

Adding the following:

[HKEY_CURRENT_USER\Environment]
"APPX_PROCESS"="1"

and dropping the WinAppXRT.dll in e.g. c:\windows\system32 (or any other location accessible via PATH) will ensure the WinAppXRT.dll is loaded everytime user launches an application using .NET.

WinAppXRT