4 ms·
We've heard these claims ever since MS started releasing source to certain institutions/governments, and my reaction has always been the same: Reverse-engineeri
by daeken 16y ago
We've heard these claims ever since MS started releasing source to certain institutions/governments, and my reaction has always been the same: Reverse-engineering non-obfuscated code is absolutely trivial, and can be automated 99% of the way. If you can find vulnerabilities in source code, you can find vulnerabilities in a binary. For some reason, no one ever seems to understand this...
- tptacek 16y agoThe funny part of this is that a good chunk of the vanguard of vulnerability researchers aren't even bothering to piece through basic blocks anymore; they just capture a small library of inputs and throw bit-flipped variants of them at the target, like particles from a neutron gun, until something blows up. Why bother with the source code when you can find vulnerabilities with dumb fuzzer farms? (Hey, Cody, build one of those for us!)
- SkyMarshal 16y agoI always assumed Windows binaries are heavily obfuscated, is that not the case?
- daeken 16y agoSome are, but outside of DRM stuff, nothing in Windows itself. And even when obfuscation is in play, it's usually trivial.
- tptacek 16y agoThe opposite is mostly the case; Microsoft even makes the PDB debugging symbols available for many of its core components.
- daeken 16y agoEven for the bootloader, where the signature checks for the driver signing chain occurs. The MS symbols database is a goldmine.