Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/558 Thanks!
Hello and welcome, everybody, to
the next talk after the break.
It's so great that you're all here
to learn about your art.
And I'm so glad to introduce
to you who usually
speaks about security at Congress,
but this time he brought
to use some great tool he will
release and explain to you.
I hope you're all here to make a QR
codes better, more
beautiful, because nowadays
there are still many of the times
ugly. And next year at Congress, I
really want to see some great stickers
with great QR codes.
So give it up for Hendrickx.
Thank you.
Yeah, thank you for the introduction.
It's actually good that you said next
Congress because it's not quite finished,
but I will give you some building blocks
for Tool and I will
most of the talk will consist of me
explaining to you how a QR code
is constructed, which you will need
in order to manipulate, manipulate it,
as you might or might not know.
Before the talk, I've met a couple of
people who didn't even know what QR code
was that?
That is some kind of barcodes.
The QR stands for Quick Response
was developed in 1994
for the automotive industry in Japan
in order to store more data than a
conventional flat to the barcode.
It has since been standardized
as an international standard in
ISO eighteen or for
first anodized in 2000 and
updated in 2006.
The 2000 standard is no longer valid.
QR codes have a wide adoption in Asia.
They have been using this stuff for ages
now, but I've seen, especially in the
last year, the last two years have seen a
lot of codes in Europe and I was
especially glad to see so many QR
codes on this Congress
compared with last year where there were
basically none.
One of the reasons why
this is now getting more and more adopted
is that there are free Reede
applications for most smartphones,
even for Nonsuch smartphones.
My old Nokia, for example,
didn't have that many applications, but
there was one barcode reader built in and
I was always confused because this
thing wouldn't read any
and the two debacle that you
find on every product.
But it was called Barcode Reader, and it
turns out that this was a QR code reader
and it could read a QR code just fine.
Apart from the standard used there,
which I'm only
talking about, little people have been
using QR codes in a variety
of creative ways.
Most of you might be familiar with the
right one.
That is one of the first examples
for a QR code that isn't just
from machine consumption, but also
nice to look at for human.
That was 2008 for the BBC.
It turns out that this isn't actually a
very sophisticated mechanism, it
only looks like this because
the BBC let
us on. They are just overlayed
you could have drawn, I don't know,
a pony and unicorn in there.
And from a machinery perspective, from
the barcode reader perspective, that
would have been the same.
Those look like they belong to the court,
but they don't.
This example I got so I am always
citing my sources, this example I got
from the great Russ Cox, who has
a very similar project
that isn't as wide in scope.
I'm going to reference that later on.
Again, he also
referenced another blog entry
from 2009.
Like I said, the, uh,
people in Japan and Asia have been using
QR codes for quite some time now.
Those Disney advertisements,
which also have a perfectly
readable barcode that looks like
it might include
some of the Disney characters, but
they are not really part of the barcode.
This is the project from Biros, Cox,
Cox. Q Art, he calls
it, um, he
did really great things and is able to
encode pictures in most of the pixels.
Those two codes are readable.
They are fully valid QR codes.
There is no trickery, no
error correction involved.
Um, I'm not going
to explain fully how that works.
I'm just referencing that you can read up
on the first link.
For these examples, like I said,
these aren't properly integrated,
they are just over painted.
That works because the QR code can
handle a lot of damage
people might smudge on.
There might be coffee stains on the QR
code. That's why this error correction
in there. And if you look at this code
and this code, human might not be able
to see the difference that easily.
But I've invited a lot of the pixels,
which means they are damaged.
They don't encode what they should
encode. But a QR code reader,
if anyone has one, you can try can
read this one just fine.
It's encoded at the highest error
correction level.
And
at the IRS correction level, the
code can be damaged to up to a 30
percent.
This one might be a little bit easier.
This is where I instead of inverting
the area I over painted it, I
could have drawn a logo and egg just
made it black.
Of course. Now, it's not 30 percent
damage. It's only 15 percent damage
because on average, 15 percent of the
pixels already black
over a painting is in wide use.
One of the most recent examples I
particularly liked was a project called
Sandstorm. This is their logo already
looks like a code and this is
their QR code.
It does look like the court has the logos
and better that it's not.
It's just overpaint it.
With my tools.
You could see the original code
that was over painted on
another example.
I'm not showing too many examples because
most of them these are for advertisement
and I don't want to advertise.
I might advertise for this project
because it's cool.
They also have a code that is
using overprinting.
Like I said, the other
method to do
fun stuff is the
Project Q Art
Russ Kwok's, he has a different
trick. He noticed
that it's it doesn't matter if
you have a yellow and htp.
Well, it doesn't matter if there
is a very long hash that doesn't
really exist.
This so this is the actual
HTP oil and
this is a hash fragment identifier
which the browser is going to look
for but won't find and then
just ignores.
And the face you see in the
code below here is actually just encoded
in this number sequence.
He has done a lot of a lot
of math in order to calculate
the number sequence that will encode this
picture, this face
with this technique.
He can control both of the data and error
correction pixels, though not
particularly simultaneously.
He can only.
So if you are caught, for example, has 26
words and total sixteen bits of
those data, ten words
are error correction.
Of course, you can only control the data.
So you at most you can control 16 words
in total, like ten data
words and six error correction words.
Um.
So this was the introduction and
a little bit of motivation why I want to
be able to modify more than that,
because as you can see, there are still a
lot of structure and there that she can
control.
Turns out that QR code,
as you know and love it,
looks simple, but isn't.
Yeah, I call it deceptively simple.
The basic module or the basic unit
of a QR code is called a module that
that's simple enough.
A single pixel in in
Isel speak is called a module.
But a lot of the other stuff
also has some function.
Those big ones in the
corners are called the finder patterns.
Those actually need to be there in order
for the QR code reader to find the pen.
And what I didn't notice
before, I'm not sure if any of you have
noticed this.
There's a timing pattern over here.
Those pixels always alternate.
You usually don't notice that
even though a human normally is pretty
good at identifying
patterns.
I didn't see that before.
The ISO standard specifies the
encoding procedure.
Turns out that also what it
did not notice before is that there are
four different encoding modes, numeric
alphanumeric Árpád bytes and kanji.
Like I said this originally or
originates from Asia,
then you have to determine
the version. I'm telling you a little bit
about that later.
The same
is then encode it into a bitstream.
I'm betting
is that it edit,
as you will see later, all the encodings
switching is done, done in forward
units, everything is bid based.
Leong's sometimes nine bids long,
sometimes 11 bids long.
So everything after that, it has to be
split into code words.
The code words are then to
these code words then is an error
correction code based on Solomon or edit
afterwards, which is also very
confusing. And I didn't know before
the data and the error correction
words are interleaved.
So even though the code
is filled from one particular position,
you won't find your data at that position
incrementing, but your data is
split a scattered all over the
place. I'll show a picture later.
Then those special modules,
those special pixels are placed there
called function modules.
And another thing I didn't know before
is that a masking is applied.
There are seven different masks that are
overlaid over the code
in order to obscure deliberately
obscure features you would normally see
in the code.
Of course, if you know that beforehand,
you can adjust your data so that this
doesn't bother you like
Ross projected.
But if you would just encode, for
example, a sequence of spaces
you would normally expect, I'm not sure
if anyone has ever tried that.
You would normally expect to see some
pattern and no resulting code.
You don't because there's
masking applied
and at last
format and version informationis is edit
that so that the decoder can
find out what kind of code
he has.
Like I said, the data
has to be encoded, there are four basic
modes, the first, the most
obvious on the first one that was
originally in the in the automotive
application is the numeric encoding mode
where you can only encode numbers,
um, the way they do by
encoding three characters into ten bits.
They just use it as an integer from
one zero two thousand twenty three.
Ignore the last 23 and
have three digits.
Alphanumeric mode uses
substitution table, they have forty five
characters in this table
and they encode two entries in the table
into 11 bits.
Edward Bitts is just plain Edward Vides,
as you would expect, and there's a
country that I've never seen used,
um, which according to this bag,
uses 13 bids for two characters.
Um.
I've never I don't know how they met,
I don't speak Japanese,
it's also something fun.
It's called Extended Channel
Interpretation ECI.
With this you can switch between
different interpretations.
You use the same basic modes, you
can the same basic modes that encode
normally encode ASCII data or
normal characters a bit by
characters, but can
make them mean something different.
The most important mode for most
of you probably will be
UTF eight, which has
a number, but there are a couple of
different modes. I haven't explored them
at all.
I'm guessing you can also add some
degrees of freedom by just choosing a
different world than it might be
doubtful that any reader can read that
or that's going to be done.
There's another interesting feature
I have never seen use which is structured
append.
If all your data doesn't fit into a
code or your
encoding region isn't
quite erratic, you can
change multiple codes together
up to 16.
All of these codes, QR codes
will then have a checksum
and each of the codes
tells you that I am code one
out of five and code two out of
five and so on.
So your reader will then prompt you to
scan all the other courts and afterwards
chain the data together.
The most.
The reader that's most often used to,
which might be the barcode reader
for Android, doesn't support that.
I was somewhat shocked that my
old Nokia phone, for example, does that.
I have an example on the next slide and
another mode character is the
FMC and one
I'm not going to talk about that.
That's barcode stuff.
There's a lot of a lot of special stuff.
This is a structured append
example out right out of the spec.
If you want to try that with your reader.
The four codes on the bottom
have the same semantic meaning as the
one code at the top.
It's just an alphabet.
But for example, the Android reader
can read the four codes at the bottom,
it will just show you the
sequence, the part sequence that was
encoded in there,
if you try. That was an old Nokia phone.
The Nokia phone will happily tell
you that this is code one
out of four and will prompt you
to scan all the other codes.
So how much can you store in
a QR code?
Quite a lot.
The code size and storage capacity
depends on something called a version,
which was very confusing to me at first.
There are 40 versions, but they are not
versions like you would say
in software speaker.
They are not software versions.
A version is just the length of
the code.
Um, they do have something
that we would normally refer to as
Virgin. They are called models.
There's a model one model two code.
We are always using model to codes.
Model one codes are deprecated and not
in use anymore.
So this is the version one called it
Stars 152 data bits,
and some of these may be error correction
bits of the version to code.
As you can see, something happens when
going from Russian one to Russian to
another alignment pattern.
So those are the finer patterns in the
US
version. One only has these version.
Two has an alignment pattern,
then it just gets bigger and bigger
at some point here.
And version seven, additional alignment
pattern appears, patterns appear
and another change that you can
see that now version information is edit
version seven stars
to them, 200 bits, version ten,
two thousand bits, twenty
six thousand bits and goes up to version
forty, which can store
23000 data bits
at this error correction level,
which
this one just starts.
Yeah, you can, you can try this one just
starts to let us QR and the rest
is pitting.
I didn't need all those bits
from this back there.
There are pages, tables and pages and
pages of tables. One of these tables
tells you how much storage capacity is
in each version of the code word for for
example, like I said, 23000
bits, which
makes something like 7000
numbers or
almost 3000, eight bit
characters.
Um, like I said earlier, data
and error correction is interleaved.
There's another table from the
specification.
Um,
these are code words.
A code word is just an eight bit byte.
And the data
code words are arranged here, goes from
there to there. So if you had hello
world, this would be an h e
l l and so on.
And for each of these rows,
the error correction is calculated.
And then four, including into
the code, they go by Cullum's
They use go from here to then
and there those and so on.
Um on the next
slide I'll show on the side of
the follows the slide. I'll show an
example.
When laying out the data blocks the
code words, you will start at the
bottom. Right.
So this is the first one, the second one
third and so on goes up
then and it goes up
and down again and in a zigzag
pattern.
And this is another
Appley, another Dipak output from record
that tells you which code codewords,
which is the fast.
This is the second, as you can see,
this is the interleaving.
Um, I'm not sure how many of those
are, but this maybe one.
And there's maybe 11, 21, 31,
41 to 12
and so on.
So there's the interleaving in action.
Like I said before, something most people
don't know, there's masking involved,
this is so that a QR code reader that
looks for a QR code can just look for the
pin up hidden. That's why it's called
that and doesn't have to worry
about finding the find a pattern
in the data. Even if you encode some data
that would lead to a finer pattern
encoding appearing in the data,
you would not see it in the QR
code because there are seven
different masks that are
just export onto the code.
And there's an algorithm in the
specification that tells you that
you just just try all those seven masks
in order, then calculate how bad
the resulting quarters and then choose
the least bad on.
Um.
There's another Dibakar output from my
court, from my program tells
you whether you find a function,
we already saw the find out patterns and
these corners right next
to it is the format information.
Those are the F's.
It's here.
And there's a second copy down here and
over here. So even if you cut off
one of these corners, we'll be OK.
There's a virgin formation here
and here.
So even if you cut off one of those
corners, will it be OK?
And those are the line alignment patterns
and the timing pattern.
Um, to show you
how many degrees of freedom you have,
it's best to use an example.
I'm just encoding the text.
Hello, 23C 23
C3.
And using these
indicators, I would split this into
two different sections.
One has it bit by it's because
the normal alphanumeric doesn't have
lowercase characters.
So I'm using eight bit bytes
for those characters, alphanumeric for
those characters.
And then there's a Terminator.
This would be the resulting bitstream.
You start at the top, a
top left, and then just use
this as a bitstream
at padding and code
into eighty
eight bedmates, most
often if you look at the back, output
will start with 64.
If you look at the previous slide, that's
the eight bit bite indicator.
Um, and this would
be the structure that results if, uh,
OK, those are the data worlds, then
I calculated the Reid Solomont error
correction code. Luckily, I didn't have
to do that by myself because I suck
at math. And there was a Python library
already available to do that.
Yeah, open source.
And then encode this into into
the Matrix playset,
and this is the code that would result.
One of the possible causes that results
turns out that you can
create quite a lot of different
chords that are semantically equivalent,
but look nothing like each other,
which is the entire reason why I'm here.
All of these chords and chord, you can
try that with your guitar and code, the
exact same sequence.
Hello, 30
to see at three.
But they don't look anywhere near
close to each other and the encoded
version and they also
don't look particularly similar
in the dbag version.
So this at the top is with masking
applied and this is the bottom is without
masking applied.
Now, if you could control
all of these elements, you could make
the code look like whatever you want,
my grand
plan for the future is to have a
graphical user interface where you can
just click at a module and we'll tell you
what you have to change in order to
change this module.
I'm not not there yet,
but I have most of the
infrastructure behind that that is able
to tell you which of these modules
has a watch function and
can help you with decoding and encoding.
So that you can get your desired result
with this in
order to do this, you need something like
an assembler.
The interface for the assembly is not
quite ready yet, but
as you would do with a software assembly,
you would give it very low level
information about what it should do.
And then it will assemble the code
for you and you can
modify it on a very low level.
For this, those are the nonstandard
dimensions which you can customize, that
you can play with the encoding modes, you
can split
encoding modes within the text,
which will be semantically girland
you can insert extended channel
interpretation into it at
random points if you want to.
Um, what you also can do, I haven't
tried that before, is to add padding.
If you notice
before that a Terminator, the last
mode indicator is zero, which
means this is the end of the mode
indicators and afterwards comes panning
instead of encoding all the data,
all the picture as rusted into
the data, you could just encode
it into the padding. And I'm guessing
most decoders would
decode that just fine.
What you can also do this
is where rather standard would be
changing something non semantically
equivalent like
for you or else you can just try
lowercase and uppercase.
And the, uh,
cutest way, I think would be to just
paint what you want into the code,
see what it decodes tool, maybe fixing
the error correction.
And if it
decodes to something that is a valid
domain name, you can just read that
and have a redirect to your
actual site.
That's what I'm doing next.
Currently, my business card is a
pretty standard code, but I'm guessing
I will change that soon.
And you can combine all those
techniques with the existing techniques
by Russell, and
if you are close, as close as possible to
your desired code, you can just overpaint
what has left.
Everything has error correction.
Like I said, the data has
you can choose that 10 to 30 percent
error correction.
The function information
has that
30 percent error correction.
So there are five bits and code into 15
bits.
The information has a 30 percent
error correction. Those are six
bits and coded into 18 bits.
So you can change basically everything as
long as you don't change too much
and it will be just fine.
The code I've just pushed into GitHub,
it's not like I said, it's not very
useful yet.
I'm still working on it.
And that's I think
most of the time we have are four minutes
left.
Oh, yeah, you can try to scan that.
Thank you so much, Eric, that we still
have time for questions,
so if you have any questions,
please come to the microphones.
We have them here and
also in the back.
And we also have a signal angel.
And I'm checking whether we have some
questions from the Internet.
We have one. So please signal Angel.
Thank you.
So, one, you send the ISC
states that according to
Denso Wave and they
have an HQ on QR
code dot com, and it states that they may
decide to exercise patent rights
against Coatsworth
colors or illustrations.
I know that there is a variant of QR
codes that users can ask for information.
I'm not sure if they refer to that.
Um, but yeah, fake
patent law. I mean, it's Germany.
Thank you.
We have one question, a microphone, too.
I'm not exactly sure you talked about
them asking how can we decode the
message?
I mean, you said encoding works by
choosing the best, but how does it work
for decoding, for
sort of masking is encoded
into the function modules,
uh, over here.
So the first two bits and code, which
error correction ever we have,
I forgot what the mapping is, but those
first two bits and called the error
correct. And the next three bits
and code, which I'm asking is use those
bits are not masked.
So you just read these bits all as a
mirror. I think over here
you just read these bits and then
see what Meskin was used and unmask
it. It's all so you can just do it again.
Thank you. So I don't see
any further questions.
So thank you again, Hendrickx.
I hope you are activated to help
him with the project and make
Couleur Kuriakose.