4 ms·

This is probably a dumb question: but how does someone look at the source code for a commercial product like Avast? Some sort of DLL decompiler or something? If

by skizm 9y ago

This is probably a dumb question: but how does someone look at the source code for a commercial product like Avast? Some sort of DLL decompiler or something? If that is the case are things like function and variable names conserved? This is probably super trivial, but reverse engineering / pen testing isn't my area.

userbinator 9y ago
In general you just disassemble, decompile, and then name things as you explore them and figure out what they do. Unless there are symbols available (which is rarely the case), the disassembler/decompiler will name things uniquely but not descriptively, e.g. func_117A508D or var_061B.
landave 9y ago
Thanks for the question, I probably should have made this clearer in the article. Just presenting some pseudocode and typedefs of structs may have given a wrong impression of how this works. So to be very clear: I reversed the functions and types without any symbols. All function names, type names, and variable names from the article are chosen by me. In the actual code, those names are most likely very different. For such a simple function as this, all you need is the control flow graph form of X86 disassembly as linked in footnote 4 of the article.
- kbart 9y ago
  Do you have description on the procedure of how you did all this by chance (especially, how did you get that graph[0])? I'm interested in reverse engineering, but can't find many good starting points to do it myself. And congrats on your achievement, we need more people like you, who put such shoddy programming practices in broad daylight, especially made by the companies that are supposed to make us safer. 0. https://landave.io/files/add_magicnum.png https://landave.io/files/add_magicnum.png
  - landave 9y ago
    The graph is generated by binary ninja [1] fully automatically, and this is just a screenshot of the tool. Any alternative reversing platform or disassembly tool like IDA Pro can generate you something very similar. [1] https://binary.ninja/ https://binary.ninja/

by skizm 9y ago

userbinator 9y ago

In general you just disassemble, decompile, and then name things as you explore them and figure out what they do. Unless there are symbols available (which is rarely the case), the disassembler/decompiler will name things uniquely but not descriptively, e.g. func_117A508D or var_061B.

landave 9y ago

Thanks for the question, I probably should have made this clearer in the article. Just presenting some pseudocode and typedefs of structs may have given a wrong impression of how this works. So to be very clear: I reversed the functions and types without any symbols. All function names, type names, and variable names from the article are chosen by me. In the actual code, those names are most likely very different. For such a simple function as this, all you need is the control flow graph form of X86 disassembly as linked in footnote 4 of the article.

kbart 9y ago
Do you have description on the procedure of how you did all this by chance (especially, how did you get that graph[0])? I'm interested in reverse engineering, but can't find many good starting points to do it myself. And congrats on your achievement, we need more people like you, who put such shoddy programming practices in broad daylight, especially made by the companies that are supposed to make us safer. 0. https://landave.io/files/add_magicnum.png https://landave.io/files/add_magicnum.png
- landave 9y ago
  The graph is generated by binary ninja [1] fully automatically, and this is just a screenshot of the tool. Any alternative reversing platform or disassembly tool like IDA Pro can generate you something very similar. [1] https://binary.ninja/ https://binary.ninja/