# Lair Of The Multimedia Guru

## 2006-12-29

### A few days ago chkrootkit told me “Enye LKM found”

My first thought was, shit …, but there was something odd, it wasnt reproduceable, subsequent runs of chkrootkit found nothing, was it just a false positive?
Also mutt had died with on odd error message, “Real-time signal 24” to be precisse, was there a relation? I decided to look at the chkrootkit source to clarify all that, i found the following:

```   /* Check for Enye LKM */
if (kill (12345, 58) >= 0)
{
printf("Enye LKM found\n");
retdir+= errno;
}
```

chkrootkit simply sends a “random” signal to a “random” pid, no check if anything normal is running at that pid not to mention the likelyness that a intruder would leave the pid/signal id at the default

Filed under: Uncategorized — Michael @ 23:25

## 2006-12-12

In the last blog entry ive mentioned the hadamard transform, so its high time to dissuss it
the hadamard transform is a linear transform, and all linear transforms can be written as a vector-matrix multiplication, here the matrix is orthogonal, symmetric and all it elements are either a or -a. Actually this is commonly written as a matrix of 1 and -1 which is multiplied by a which is sqrt(size of the transform), you also might want to take a look at Wikipedia/Hadamard_transform.
The hadamard transform is also somewhat similar to the DCT but simpler, thats also why its used as part of a SATD motion estimation comparission function, the dct would be slightly better quality wise but significantly slower …

#### How to calculate it

Well there are many ways
a slow and simple one is:

```for(i=0; i<n; i++){
dst[i]=0;
for(j=0; j<n; j++){
int sign= parity(i&j) ? -1 : 1;
dst[i] += src[j] * sign;
}
}
```

a faster one is:

```void transform(int *data, int step, int n){
int i, j;
for(i=0; i<n; i+=2*step){
for(j=i; j<i+step; j++){
int a= data[j];
data[j]      = a + data[j+step];
data[j+step] = a - data[j+step];
}
}
if(2*step<n)
transform(data, 2*step, n);
}
```

You should of course not implement this recursively, but instead remove recursion, unroll the loops where cleanly possible and replace step and n by constants if you can.
Ive just written it like above as its IMHO easier to understand that way then 2 pages of unrolled loops

Filed under: Uncategorized — Michael @ 01:41

### Motion Estimation (1. comparission functions)

This months ;) Todays blog entry is about motion estimation for block based video encoders, more precissely integer pel style, no half pel or qpel to keep this reasonable simple. In practice the sub-pel motion estimation (hpel/qpel…) is normaly done after normal integer pel anyway so we can nicely ignore sub pel today

Now how do we estimate the motion of a square or rectangular block of pixels?
Nothing easier then that you will likely say just find the best matching block in the reference frame for each block we need to encode, but what is “best” and how to find it?

#### Compare functions

To find the best matching block we first need to give each pair of blocks a score, there are several popular ways to do that:

 SAD Sum of absolute differences ``` for(x=0; x

And the theoretical ideal comparission function is to completely encode the block and then use the weighted sum of the number of bits and the distortion be it SSD or a psychovissual one as score

And how to find the best block with such a comparssion function will be the subject of another blog entry, dont fear, iam just trying to keep the blog entries small, selfcontained and easy digestable

Filed under: Uncategorized — Michael @ 00:17