5 ms·

Why do you assume the tools are pirated?

by VMG 15y ago

tommi 15y ago
The older IDA Pro 5.0 is licensed as freeware, free for non-commercial use. http://www.hex-rays.com/idapro/idadown.htm http://www.hex-rays.com/idapro/idadown.htm
- jcr 15y ago
  Yes, but the Hex-Rays decompiler is not. I can't touch the files, so I can't tell you what version was used, but in the comments here, there is a claim that the supposed source code is Hex-Rays output.
jcr 15y ago
I think you actually want two answers, the question you asked and "why report it?" The IDA Pro disassembler and the Hex-Rays decompiler are not only very expensive tools, but they are very difficult to purchase. Due to constant problems with piracy, these days they will only sell their products to three areas; (1) governments/law enforcement, (2) very well established corporations (typically well known security research people), (3) very well established university researchers. Typically, they refuse to sell to individuals, but there is a fourth class of customers who are individuals; very old customers like me who have a perfect track record of maintaining possession of their copy of the software. Every copy of the software is custom compiled and watermarked so it is traceable to a particular person. Every database created by the software is also watermarked, so when someone who is not a licensed customer publishes a database (.idb), the software can be traced and the account will be terminated (i.e. no further purchases allowed). When someone does something blatantly stupid like disassembling and decompiling skype then publicly making all of the files available, it is fairly certain that they are using a illegal copy of the software. They do not understand what they're doing. They do not understand the tool they are using. And they don't have any respect for either the tool or the work of others. --All of this loudly screams PIRATE! The pirates either don't know about or don't care about the watermarks in the databases they create. They don't realize that publishing a database is discouraged. I've never heard of a case where a database watermark was successfully forged (i.e. pin the blame on someone else), but a cracker named "Quine" once successfully removed the watermarking in IDA back in the late 90's. The "correct" method to publicly share the research work done in IDA is to dump the database to an IDC script (an internal language), then provide the IDC script and the target binary. Customers know this, or at least they should. With that said, friends do toss databases back and forth on occasion, but that's a matter of trust between friends where both of them are customers. Some people in the InfoSec and AntiVirus crowds exchange databases, even across competing corporate lines since they're all working together towards the same goal and they've known each other for years.
- prodigal_erik 15y ago
  Improving our tools is part of our birthright and responsibility; being able to modify and learn from software is a natural outgrowth of that. We of all people should not respect work intended to discourage collaboration by anyone who isn't "established" (granted the privilege of relating to software as a human being, not just a consumer). Thank you for the insight into your field. Now I'm sorely tempted to try my hand at decompilation.
- VMG 15y ago
  Thanks for your insight. The spelling errors in the blog posts aren't the hallmark of professionalism either, but what about the information in comment header? /*\ |*| |*| Skype 4142 Decompression v1.002 by Sean O'Neil. |*| Copyright (c) 2004-2009 by VEST Corporation. |*| All rights reserved. Strictly Confidential! |*| |*| Date: 29.10.2009 |*| \*/ is this just a special brand of stupid? edit: some info about this corporation and Sean O'Neil: http://en.wikipedia.org/wiki/VEST http://en.wikipedia.org/wiki/VEST the official web page points to beach resort?!? edit2: same guy: http://cryptolib.com/ciphers/skype/ http://cryptolib.com/ciphers/skype/
  - peterwwillis 15y ago
    yeah, the author of the blog post said the stuff he has came from VEST. so it's basically a POC based on the code released 2 years ago. if you google it there's a blog post by some other random guy who made a python plugin and some POC code from that stuff too
  - skeletonjelly 15y ago
    Don't pick on the spelling. Have you considered users who don't have English as their first language? I hear there a few is all ;)
- tptacek 15y ago
  What? This isn't true at all. Anyone can buy IDA. This copy of IDA was probably pirated for the same reason Photoshop is usually pirated: because it's expensive. But you don't know it was pirated. Also: by editing your comments to account for the responses, you make the thread incoherent. I'd appreciate it if you wouldn't do that, or, at least, if you must do it, to do so in corrections at the end of your comment. It's fine to be wrong. I'm wrong all the time.

Why do you assume the tools are pirated?

by VMG 15y ago

Why do you assume the tools are pirated?

tommi 15y ago

The older IDA Pro 5.0 is licensed as freeware, free for non-commercial use. http://www.hex-rays.com/idapro/idadown.htm http://www.hex-rays.com/idapro/idadown.htm

jcr 15y ago
Yes, but the Hex-Rays decompiler is not. I can't touch the files, so I can't tell you what version was used, but in the comments here, there is a claim that the supposed source code is Hex-Rays output.

jcr 15y ago

I think you actually want two answers, the question you asked and "why report it?" The IDA Pro disassembler and the Hex-Rays decompiler are not only very expensive tools, but they are very difficult to purchase. Due to constant problems with piracy, these days they will only sell their products to three areas; (1) governments/law enforcement, (2) very well established corporations (typically well known security research people), (3) very well established university researchers. Typically, they refuse to sell to individuals, but there is a fourth class of customers who are individuals; very old customers like me who have a perfect track record of maintaining possession of their copy of the software. Every copy of the software is custom compiled and watermarked so it is traceable to a particular person. Every database created by the software is also watermarked, so when someone who is not a licensed customer publishes a database (.idb), the software can be traced and the account will be terminated (i.e. no further purchases allowed). When someone does something blatantly stupid like disassembling and decompiling skype then publicly making all of the files available, it is fairly certain that they are using a illegal copy of the software. They do not understand what they're doing. They do not understand the tool they are using. And they don't have any respect for either the tool or the work of others. --All of this loudly screams PIRATE! The pirates either don't know about or don't care about the watermarks in the databases they create. They don't realize that publishing a database is discouraged. I've never heard of a case where a database watermark was successfully forged (i.e. pin the blame on someone else), but a cracker named "Quine" once successfully removed the watermarking in IDA back in the late 90's. The "correct" method to publicly share the research work done in IDA is to dump the database to an IDC script (an internal language), then provide the IDC script and the target binary. Customers know this, or at least they should. With that said, friends do toss databases back and forth on occasion, but that's a matter of trust between friends where both of them are customers. Some people in the InfoSec and AntiVirus crowds exchange databases, even across competing corporate lines since they're all working together towards the same goal and they've known each other for years.

prodigal_erik 15y ago
Improving our tools is part of our birthright and responsibility; being able to modify and learn from software is a natural outgrowth of that. We of all people should not respect work intended to discourage collaboration by anyone who isn't "established" (granted the privilege of relating to software as a human being, not just a consumer). Thank you for the insight into your field. Now I'm sorely tempted to try my hand at decompilation.
VMG 15y ago
Thanks for your insight. The spelling errors in the blog posts aren't the hallmark of professionalism either, but what about the information in comment header? /*\ |*| |*| Skype 4142 Decompression v1.002 by Sean O'Neil. |*| Copyright (c) 2004-2009 by VEST Corporation. |*| All rights reserved. Strictly Confidential! |*| |*| Date: 29.10.2009 |*| \*/ is this just a special brand of stupid? edit: some info about this corporation and Sean O'Neil: http://en.wikipedia.org/wiki/VEST http://en.wikipedia.org/wiki/VEST the official web page points to beach resort?!? edit2: same guy: http://cryptolib.com/ciphers/skype/ http://cryptolib.com/ciphers/skype/
- peterwwillis 15y ago
  yeah, the author of the blog post said the stuff he has came from VEST. so it's basically a POC based on the code released 2 years ago. if you google it there's a blog post by some other random guy who made a python plugin and some POC code from that stuff too
- skeletonjelly 15y ago
  Don't pick on the spelling. Have you considered users who don't have English as their first language? I hear there a few is all ;)
tptacek 15y ago
What? This isn't true at all. Anyone can buy IDA. This copy of IDA was probably pirated for the same reason Photoshop is usually pirated: because it's expensive. But you don't know it was pirated. Also: by editing your comments to account for the responses, you make the thread incoherent. I'd appreciate it if you wouldn't do that, or, at least, if you must do it, to do so in corrections at the end of your comment. It's fine to be wrong. I'm wrong all the time.