4 ms·

HN, where writing assembly shows an unbelievable amount of skill.

pmelendez 9y ago
It is indeed a lost art. I can count with just one hand the amount of colleagues that I know that are capable of doing this. Also this is not assembly, it is object code.
- icebraining 9y ago
  Also this is not assembly, it is object code. Disassemblers exist. You can take the binary, generate the assembly code, fix it and then re-compile to find the needed changes. I cracked a few sharewares with OllyDbg this way (just for fun, never distributed), and I'm no "leet coder".
  - pmelendez 9y ago
    Would the assembler maintain the same binary size and the exactly the same address module in the same order just like the article claims? What they said is they found evidence that the binary was modified manually. This is way more tedious that disassembling and reassembling a binary.
    - icebraining 9y ago
      A tool designed for reverse engineering like OllyDbg will maintain everything, yes.
    - porfirium 9y ago
      >This is way more tedious that dissembling and reassembling a binary. That's not the case.
      - bitexploder 9y ago
        To elaborate, you sketch out the assembly you need, assemble it and literally drop those new bytes in. Tools like IDA Pro, Binary Ninja, and Hopper make this quite easy. A good hex editor and knowing the file offsets is also fine. This is seen as magic because it is a bit of a lost art, but it turns out to be easy to learn. Check out "crackmes" if anyone has become interested in this topic of mangling binaries by hand. They are fun and you will get results quickly on the easier challenges. Also check out Microcorruption CTF.
    - userbinator 9y ago
      Yes, disassemblers will often write raw bytes directives (e.g. "db 72, 101, 108, 108, 111") if they can't disassemble the instruction, so you can get 1:1 by disassembling and reassembling; but I doubt this patch was done by doing that on the whole binary.
    - vidarh 9y ago
      > This is way more tedious that disassembling and reassembling a binary. It used to be stuff we did for fun. Back in the day we might not even load the entire program into memory - I remember manually patching disk sectors on the C64 with tools that'd let me disassemble arbitrary content to see if it happened to match code. I also spent a couple of years programming assembly directly in a "machine code monitor" - an assembler used to assemble/disassemble memory instruction by instruction rather than from a file. This was something several members of my primary school class would do for entertainment. The idea that this is particularly difficult just reflect that fewer developers have spent time getting familiar with assembly these days.
      - bonzini 9y ago
        > It used to be stuff we did for fun. We still do! When I added Retroarch to my HTPC I wanted it to use the "ok" and "power" buttons on my remote instead of "enter" and "escape" which are only found on a keyboard. While I did contribute a patch to the Retroarch project, which I tested using a laptop, binary patching was much easier on the Raspberry Pi ARM binaries than figuring out the build system for LibreELEC (the binary patch drops support for enter/escape, so it's literally changing two bytes for the two keycodes).
        vidarh 9y ago
        It stopped being fun for me when I moved to an x86 box, I'm afraid. Though I do get my share of asm thanks to my (very slow moving) Ruby compiler project, it's more painful than fun.
- erikbye 9y ago
  I wouldn't call it a lost art... Assembly is used many places, even for new projects. But it makes sense that assembly programming might seem impressive (or antiquated) to the HN crowd, which I have an impression is composed of a lot of newly grads, web developers, and comparatively few old hats.
- wruza 9y ago
  >Also this is not assembly, it is object code. It is a matter of hitting F4 in hiew.
pjmlp 9y ago
Well, when you have people calling Electron based apps native.....
dawnbreez 9y ago
Not just writing assembly, rewriting a compiled object file without letting any of the addresses change, without having the source to work with, and presumably with almost no documentation, to patch a program that has been left untouched for almost 20 years.
- bitexploder 9y ago
  I kind of agree with the sentiment. It isn't that crazy. We do this as a matter of course all the time. Patching a small handful of instructions is pretty easy. You could learn to do it on a week or less if you are a decent programmer. Do it well? Do it quickly? Do it idiomatically and in a short amount of time.... Takes real skill.
  - stevekemp 9y ago
    I used to patch games for infinite-lives, or to allow my serial numbers to be accepted. Doing this wasn't hard, as somebody who grew up writing assembly language on 8-bit machines in the 80s. One fun self-challenge was always to make my modifications as small as possible. e.g. one-byte changes were a lot more impressive than two-byte changes.
    - bitexploder 9y ago
      Your own personal game genie. It's interesting. I have observed if people learn on an 8 or 16 bit machine, like in Microcorruption, they tend to be able to pick up more complex ISAs much easier. It helps to know the first principles.
- wruza 9y ago
  It is easy to not let addresses change, because compilers without “-O2+“ do lots of extra stack ops. Documentation is not needed there, because it is overflow fix, it is catchable by debugger and both caller and callee are right in bt. And the fact that this program was not recompiled for 20 years actually adds to the possibility of what was done. Modern compilers are much less forgiving. Anyway, your points are pretty weak and oh-magic-driven, and I don’t see any reason gp comment to be gray or work to be called stellar. Though of course it was done by asm-skilled person.

It is indeed a lost art. I can count with just one hand the amount of colleagues that I know that are capable of doing this. Also this is not assembly, it is object code.

icebraining 9y ago
Also this is not assembly, it is object code. Disassemblers exist. You can take the binary, generate the assembly code, fix it and then re-compile to find the needed changes. I cracked a few sharewares with OllyDbg this way (just for fun, never distributed), and I'm no "leet coder".
- pmelendez 9y ago
  Would the assembler maintain the same binary size and the exactly the same address module in the same order just like the article claims? What they said is they found evidence that the binary was modified manually. This is way more tedious that disassembling and reassembling a binary.
  - icebraining 9y ago
    A tool designed for reverse engineering like OllyDbg will maintain everything, yes.
  - porfirium 9y ago
    >This is way more tedious that dissembling and reassembling a binary. That's not the case.
    - bitexploder 9y ago
      To elaborate, you sketch out the assembly you need, assemble it and literally drop those new bytes in. Tools like IDA Pro, Binary Ninja, and Hopper make this quite easy. A good hex editor and knowing the file offsets is also fine. This is seen as magic because it is a bit of a lost art, but it turns out to be easy to learn. Check out "crackmes" if anyone has become interested in this topic of mangling binaries by hand. They are fun and you will get results quickly on the easier challenges. Also check out Microcorruption CTF.
  - userbinator 9y ago
    Yes, disassemblers will often write raw bytes directives (e.g. "db 72, 101, 108, 108, 111") if they can't disassemble the instruction, so you can get 1:1 by disassembling and reassembling; but I doubt this patch was done by doing that on the whole binary.
  - vidarh 9y ago
    > This is way more tedious that disassembling and reassembling a binary. It used to be stuff we did for fun. Back in the day we might not even load the entire program into memory - I remember manually patching disk sectors on the C64 with tools that'd let me disassemble arbitrary content to see if it happened to match code. I also spent a couple of years programming assembly directly in a "machine code monitor" - an assembler used to assemble/disassemble memory instruction by instruction rather than from a file. This was something several members of my primary school class would do for entertainment. The idea that this is particularly difficult just reflect that fewer developers have spent time getting familiar with assembly these days.
    - bonzini 9y ago
      > It used to be stuff we did for fun. We still do! When I added Retroarch to my HTPC I wanted it to use the "ok" and "power" buttons on my remote instead of "enter" and "escape" which are only found on a keyboard. While I did contribute a patch to the Retroarch project, which I tested using a laptop, binary patching was much easier on the Raspberry Pi ARM binaries than figuring out the build system for LibreELEC (the binary patch drops support for enter/escape, so it's literally changing two bytes for the two keycodes).
      - vidarh 9y ago
        It stopped being fun for me when I moved to an x86 box, I'm afraid. Though I do get my share of asm thanks to my (very slow moving) Ruby compiler project, it's more painful than fun.
erikbye 9y ago
I wouldn't call it a lost art... Assembly is used many places, even for new projects. But it makes sense that assembly programming might seem impressive (or antiquated) to the HN crowd, which I have an impression is composed of a lot of newly grads, web developers, and comparatively few old hats.
wruza 9y ago
>Also this is not assembly, it is object code. It is a matter of hitting F4 in hiew.

pjmlp 9y ago

Well, when you have people calling Electron based apps native.....

dawnbreez 9y ago

Not just writing assembly, rewriting a compiled object file without letting any of the addresses change, without having the source to work with, and presumably with almost no documentation, to patch a program that has been left untouched for almost 20 years.

bitexploder 9y ago
I kind of agree with the sentiment. It isn't that crazy. We do this as a matter of course all the time. Patching a small handful of instructions is pretty easy. You could learn to do it on a week or less if you are a decent programmer. Do it well? Do it quickly? Do it idiomatically and in a short amount of time.... Takes real skill.
- stevekemp 9y ago
  I used to patch games for infinite-lives, or to allow my serial numbers to be accepted. Doing this wasn't hard, as somebody who grew up writing assembly language on 8-bit machines in the 80s. One fun self-challenge was always to make my modifications as small as possible. e.g. one-byte changes were a lot more impressive than two-byte changes.
  - bitexploder 9y ago
    Your own personal game genie. It's interesting. I have observed if people learn on an 8 or 16 bit machine, like in Microcorruption, they tend to be able to pick up more complex ISAs much easier. It helps to know the first principles.
wruza 9y ago
It is easy to not let addresses change, because compilers without “-O2+“ do lots of extra stack ops. Documentation is not needed there, because it is overflow fix, it is catchable by debugger and both caller and callee are right in bt. And the fact that this program was not recompiled for 20 years actually adds to the possibility of what was done. Modern compilers are much less forgiving. Anyway, your points are pretty weak and oh-magic-driven, and I don’t see any reason gp comment to be gray or work to be called stellar. Though of course it was done by asm-skilled person.