5 ms·

The go toolchain leaves a lot of metadata in a compiled binary, even if you supply `ldflags="-s -w"` - including full paths to source files. Although i apprecia

by mappu 10y ago

The go toolchain leaves a lot of metadata in a compiled binary, even if you supply `ldflags="-s -w"` - including full paths to source files. Although i appreciate struct member names are needed for reflection (e.g. json.Marshal if you're not using ffjson/equivalent). In this case, it helped to reverse engineer a malicious binary, but in $DAYJOB we have some concerns about more technical end users using this extra metadata to help patch out our license check code, to the point where we're considering commercial exe packers.

kuschku 10y ago
> In this case, it helped to reverse engineer a malicious binary, but in $DAYJOB we have some concerns about more technical end users using this extra metadata to help patch out our license check code, to the point where we're considering commercial exe packers. Considering that that’s a second semester excercise for students, I’m not sure anything can help with that. I mean, literally, the "bomblab", aka "Dr. Evil's Insidious Bomb, Version 1.1" is standard at every university’s computer science course, and teaches how to reverse engineer and bypass such checks in binaries.
- tormeh 10y ago
  Denuvo might work. Sure, someone can crack it, but it would raise the bar enormously.
  - deleted 10y ago
    [deleted]
- serf 10y ago
  > I mean, literally, the "bomblab", aka "Dr. Evil's Insidious Bomb, Version 1.1" is standard at every university’s computer science course, and teaches how to reverse engineer and bypass such checks in binaries. i've read the syllabus from such a class; do you happen to know of such an activity that can be participated in by a non-student? I would like to learn more about executable reverse engineering, and that sort of approach appeals to me.
  - kuschku 10y ago
    I’m not sure what I could do – I have a bomb here from such a class on my system, and could send you it, but I don’t have much of the teaching materials. What I can suggest to you is learning how to use GDB (if you want to get fancy, use the Radare2 bundle), and learning quite a bit of x86 ASM and calling conventions.
adrianN 10y ago
Why do you care about users patching out your licence check? If they don't want to pay for your stuff they aren't your users anyway. How do they hurt your business?
- zeta0134 10y ago
  There are fringe users who are compelled to purchase software by the difficulty of obtaining a cracked version. Especially for less popular software (which won't be cracked right away / at all) it's worth putting in a bit of effort to raise that bar. I realise some users won't pay regardless, but personally I was compelled to buy Finale and am strongly considering FL Studio due to cracks being difficult to track down during my youth. (Both software are much easier to pirate today, but that wasn't the case in high school, torrenting on dial up isn't pleasant when you share the line with your parents. Plus I can afford it now, and couldn't then.)

by mappu 10y ago

kuschku 10y ago

> In this case, it helped to reverse engineer a malicious binary, but in $DAYJOB we have some concerns about more technical end users using this extra metadata to help patch out our license check code, to the point where we're considering commercial exe packers. Considering that that’s a second semester excercise for students, I’m not sure anything can help with that. I mean, literally, the "bomblab", aka "Dr. Evil's Insidious Bomb, Version 1.1" is standard at every university’s computer science course, and teaches how to reverse engineer and bypass such checks in binaries.

tormeh 10y ago
Denuvo might work. Sure, someone can crack it, but it would raise the bar enormously.
- deleted 10y ago
  [deleted]
serf 10y ago
> I mean, literally, the "bomblab", aka "Dr. Evil's Insidious Bomb, Version 1.1" is standard at every university’s computer science course, and teaches how to reverse engineer and bypass such checks in binaries. i've read the syllabus from such a class; do you happen to know of such an activity that can be participated in by a non-student? I would like to learn more about executable reverse engineering, and that sort of approach appeals to me.
- kuschku 10y ago
  I’m not sure what I could do – I have a bomb here from such a class on my system, and could send you it, but I don’t have much of the teaching materials. What I can suggest to you is learning how to use GDB (if you want to get fancy, use the Radare2 bundle), and learning quite a bit of x86 ASM and calling conventions.

adrianN 10y ago

Why do you care about users patching out your licence check? If they don't want to pay for your stuff they aren't your users anyway. How do they hurt your business?

zeta0134 10y ago
There are fringe users who are compelled to purchase software by the difficulty of obtaining a cracked version. Especially for less popular software (which won't be cracked right away / at all) it's worth putting in a bit of effort to raise that bar. I realise some users won't pay regardless, but personally I was compelled to buy Finale and am strongly considering FL Studio due to cracks being difficult to track down during my youth. (Both software are much easier to pirate today, but that wasn't the case in high school, torrenting on dial up isn't pleasant when you share the line with your parents. Plus I can afford it now, and couldn't then.)