How to customize VI Snippets

[Sparkette]

On this LabVIEW Wiki page, the following text can be found:

The capitalization of this chunkname makes sure the code is removed if someone alters the image, thus preventing the creation of malicious snippets.

I aim to show that this is not true. While most programs will remove the code if the image is altered, it's relatively simple to use a free tool called TweakPNG to put any VI into any PNG image.

First, download TweakPNG. Now, create a VI Snippet of whatever you want. I'll be using this as an example:

Run TweakPNG, and you'll see the following:

Next, open your VI Snippet in TweakPNG.

Select the item that's selected in that screenshot ("niVI") and then go to Edit->Export Chunk. Save the file wherever you want; you'll need it later.

Next, open whatever image you want to put the VI into in TweakPNG. I'll be using this image:

You'll see the following:

Once again, click the item I selected ("IEND"), but now go to Edit->Import Chunk. Remember the file you saved earlier? Select that. You'll see this:

Finally, go to File->Save in TweakPNG (or File->Save As if you don't want to overwrite the original image) and you'll now have a VI Snippet with a custom image.

Don't believe me? Here, save this image and drag it into LabVIEW:

I'm not encouraging anyone to make anything malicious as mentioned in the wiki article, but this does have legitimate uses. For instance, you may want to add some extra text to a VI Snippet explaining something, but don't want it to appear when it's dragged into LabVIEW. Or you may want to scale the image down a bit so it will fit somewhere on a web page. I'm sure there are many other uses.

[Ton Plomp]

On this LabVIEW Wiki page, the following text can be found:

Quote

The capitalization of this chunkname makes sure the code is removed if someone alters the image, thus preventing the creation of malicious snippets.

I aim to show that this is not true. While most programs will remove the code if the image is altered, it's relatively simple to use a free tool called TweakPNG to put any VI into any PNG image.

You are correct, the capitalization instructs editors to remove the chunk upon graphical editing. By using non-compliant tools (like Microsft Paintbrush or TweakPNG) you can bypass this.

So it's not a prevention of malicious snippets, but a precaution. NI could add info to the 'niVI' chunk that contains info about the containing file (like the complete or hashed IDAT chunk).

For instance, you may want to add some extra text to a VI Snippet explaining something, but don't want it to appear when it's dragged into LabVIEW.

The code capture tool does exactly that. It even inserts the tool name, and optionally some copyright info.

Ton

[Yair]

One thing to point out is that this isn't an actual security threat - you can embed malicious code in the snippet and hide it in any number of ways, but at least today LV doesn't execute the code when it's placed, so a cleanup should reveal the hidden code. There are some exceptions to the no execution rule, such as XNodes, but since those require additional files, they can't be folded into the snippet.

That said, I never studied the snippet or VI-stream techs closely. I assume there's no way to allow arbitrary code execution there, but that doesn't mean there isn't some roundabout way to do it by embedding special data in the stream.