9 ms·
But how do we find the offsets? What values do we give to ssl_read_offset and ssl_write_offset? [ REDACTED ] I had a nice little section on how to find the of
by sillysaurusx 6y ago
But how do we find the offsets? What values do we give to ssl_read_offset and ssl_write_offset?
[ REDACTED ]
I had a nice little section on how to find the offsets here. When I first wrote it I was convinced that publishing two addresses couldn't possibly get me sued for reverse engineering. Some of the people who read the draft of this post changed my mind about it though, and it is 2020 after all so it is not a good time to be optimistic.
So, how would you find these offsets? Anyone know?
It's probably the most interesting part of the post.
There's a "hypothetical" paragraph afterwards, but if anyone wants to actually do this with Zoom and post the results, you'd probably earn lots of cred.
In particular, the exact arguments to the objdump command would help.
- jdright 6y agoIt is sad they felt the need to do this. This step is not hard, but censuring it because of hypothetical legal issues speaks a lot about the state of affairs on computing. I miss the good old times where knowledge were freely published without fear.
- matheusmoreira 6y ago> Some of the people who read the draft of this post changed my mind about it though Details? Reverse engineering isn't even illegal.
- yconfiscator 6y agoSince the Zoom TOS explicitly forbid reverse engineering, sadly it isn't so easy.
- user5994461 6y agoTOS can't substitute to the law. Reverse engineering is legal by law depending on the jurisdiction.
- codezero 6y agoBut if you’re using Zoom for work, they can still ban your account and/or company.
- LargoLasskhyfv 6y agoThen use Jitsi, or something.
- codezero 6y agoSure, but if your 1000 person company uses Zoom and Zoom only bans your account I don’t think you can convince a company to switch clients. That said I find that specific scenario unlikely.
- user5994461 6y agoIt's no problem. The company can contact zoom support and get your account unlocked.
- R0b0t1 6y agoRandom companies can't make new law. If you violate their TOS the most they can do is refuse you service.
- 6y ago
- layoutIfNeeded 6y agoWe know the exact version of openssl they’re using, so we can just build the same version ourselves, get the address of the functions, and look for the same pattern of instructions in the Zoom binary. Not sure if LTO could break this or not though.
- kelnos 6y agoThat seems pretty unreliable. The specific version of the compiler used, as well as flags passed to the compiler, could easily change the instructions used, no?
- yconfiscator 6y agoThat was just the quick and naive way I went for because I didn't want to download new tools, but there's many other options. The easiest way if you have a capable debugger is probably to look for SSL strings/error codes in rodata and see where they're referenced. Or IDA can even output C code that is very close to the original.
- codezero 6y agoBased on how the OP described finding the offsets, it sounds like this is exactly what they did, perhaps there are some obvious sentinels that make it easy. I’m not a C expert, but I think a function call w/ args has a pretty standard way of being executed and if you know the types of the arguments it’s possibly even easier?
- virtue3 6y agoABI compatability baby. Those signatures gotta match up for sure. Once you have that, the underlying guts of the code wont matter so much. If this was 32 vs 64bit or some such you'd be pretty hosed at where everything was I imagine.
- codezero 6y agoBoom. ABI that’s the word I was thinking of. Thanks!
- saagarjha 6y agoGenerally it's a little bit more manual than "pass flags to objdump"–I'd look for strings and such used by the function in the open-source release and then cross-reference that.