5 ms·

Can someone share cases/anecdotes of decompiling software to fix a bug? Never done it myself nor heard someone doing that. Unless you consider not being able to

by oytis 5y ago

Can someone share cases/anecdotes of decompiling software to fix a bug? Never done it myself nor heard someone doing that. Unless you consider not being able to run a program without license a bug :)

to11mtm 5y ago
I can't do one for Decompiling, but I reverse engineered a Pole-line drafting application in order to write utilities to fix the data corruption it sometimes caused.
niea_11 5y ago
GTA Online fix to reduce loading times [1]. Rockstar awarded the guy 10k$ [2] 1: https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times-by-70/ https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times... 2: https://www.pcgamer.com/rockstar-thanks-gta-online-player-who-fixed-poor-load-times-official-update-coming/ https://www.pcgamer.com/rockstar-thanks-gta-online-player-wh...
- xojoc 5y ago
  And there was some talk about that previously: On HN: https://news.ycombinator.com/item?id=26296339 https://news.ycombinator.com/item?id=26296339 (703 comments) On Lobsters: https://lobste.rs/s/jzj4q9 https://lobste.rs/s/jzj4q9 (25 comments) And Reddit: https://www.reddit.com/r/programming/comments/luq9oz https://www.reddit.com/r/programming/comments/luq9oz (1022 comments) P.S. these threads where found with a site I'm building: https://discussions.xojoc.pw/?url=https%3A%2F%2Fnee.lv%2F2021%2F02%2F28%2FHow-I-cut-GTA-Online-loading-times-by-70%2F https://discussions.xojoc.pw/?url=https%3A%2F%2Fnee.lv%2F202...
deleted 5y ago
[deleted]
yarcob 5y ago
I have decompiled AppKit on macOS occasionally to debug issues in my app. For example, in one case I discovered that double clicking a cell sometimes only selected part of the contents. With Hopper I was able to verify that the bug is that AppKit just selected the range from 0 to 32000, assuming that would be enough. I was able to work around the issue by manually selecting a bigger range. (I also reported the bug to Apple, they told me they won't fix it because it's a deprecated API. Doesn't matter that 100s of apps, including Apple's own, were still using it...) In another case, I found out that an obscure feature (text attachments with custom cells) was crashing because AppKit called -release too often, so it was impossible to use the feature. Apple had apparently broken it when implementing the force touch functionality for dictionary lookups. Another time Cornerstone, the SVN client, was broken on a prerelease version of macOS. I don't recall the details, I think they called -registerDefaults: too early. I was able to fix it by writing a dynamic library that changed the -registerDefaults: implementation so that it ignored the first call (today with hardened runtime this fix wouldn't be possible anymore without disabling system integrity protection).
bravetraveler 5y ago
I did a fair amount in the early 2000s, mostly unmaintained software that I wanted to return to life
EliRivers 5y ago
http://wonderfulcoding.blogspot.com/2015/10/crack-it-dont-break-it.html http://wonderfulcoding.blogspot.com/2015/10/crack-it-dont-br...
veidr 5y ago
In the 90s (or maybe 00s) the company I worked for had a self-hosted web app (they mostly all were self-hosted, then) that did various things, but was also supposed to be able to send email via whatever mail server you already had. But it didn't work for us. I forget the exact reason, but it was like some kind of text encoding issue where the mail server was expecting ASCII but the software was sending some weird non-ASCII character from EUC or SJIS that borked it. (It was a Japanese workflow app for internal company processes like calendaring, expense approvals, etc., so it had lots of user-entered strings that were in Japanese. UTF-8 existed, but... this product had legacy issues.) Unfortunately the vendor delivered that software (in part, but the significant part for this story) as compiled Perl modules. I think they maybe did that to make it harder for third parties to customize their shit, and therefore make it easier to get any related customization/integration contracts, but possibly it was just innocent performance enhancement. Regardless, though, a dude I worked with decompiled those modules and figured out how to fix the bug by doing some kind of text/encoding transform. And then it could send email.
ericbarrett 5y ago
It wasn't proprietary software, but I used to work with a sustaining engineer who ran Firefox in a gdb session. He was a "tab hoarder" and this was before the days it would save your session; when it reset he complained that he'd lose days of context. I watched him hand-repair a SIGSEGV from a null pointer dereference. As he was doing so he explained he'd reported this particular bug a few weeks ago but "Mozilla's triage was taking a while." A few keystrokes later he'd backed up a couple of frames, set a condition variable to avoid the bad code, and continued the process without interruption. Hugely impressive.
- e3bc54b2 5y ago
  Impressive indeed, but what is a sustaining engineer?
  - ericbarrett 5y ago
    An engineer dedicated to bugfixes and crash investigations, rather than feature development. Not a common title anymore, but you'll still find them attached to products that use their own kernel, like switches and network storage.
- MontyCarloHall 5y ago
  I’m surprised the performance overhead of running a whole web browser inside a debugger was remotely tolerable for daily use. Wouldn’t it have been easier (and way more performant) to just whip up a quick extension that dumps the list of open tabs to disk every time a tab is opened/closed? I recall session savers being some of the very first extensions available for Firefox.
  - alerighi 5y ago
    If you don't set breakpoints, it's not slower than running the software normally.
chris_overseas 5y ago
Many years ago I had a after school job working at the local newspaper office. They used some very expensive and somewhat quirky accounting software. It turned out to have a hard coded(!) percentage baked into the binary for the country's sales tax rate when issuing invoices. Of course the government eventually decided to change that rate, and it sounded like the vendor wasn't going to be able to get them upgraded to a corrected version in time. I overheard the discussion and offered to try and help by seeing if I could hack in a fix. Rather surprisingly they agreed, and after a bit of debugging I found the problem and patched the binary. It did the trick and they successfully used that patched version for a couple of weeks until they got their upgrade.
toast0 5y ago
A long time ago, I was building a payment integration between shopping cart software and a e-check processor. I was testing my half-done work, and got an inscrutible error; finding access to the server source (because IIS exposed the data fork of the VBS) made it a lot quicker to figure out what I did wrong. Not exactly the same scenario, but close enough.
nelgaard 5y ago
One of the first times I did it, was 15-20 years ago. I had a digital camera, a Canon IXUS S110, and wanted to have some pictures printed. There were some sites where you could upload pictures, but they all used som proprietary Windows program, and I had Linux. Except the supermarket chain Føtex which had a website with a Java applet. But it failed when I tried to use it throwing an exception about a missing directory. So I downloaded the JAR file, decompiled it with the JAD decompiler and found that they had hardcoded the file separator as backslash. So that was easy to fix. I compiled it, ran the JAR file and uploaded my pictures and picked up the prints a few days later.
dunham 5y ago
For one of the early iPhone jailbreaks, I made a patch for libtiff that fixed the bug that the jailbreak exploited. I didn't want to be pwned while browsing the web with my iTouch. I gave the patch to someone named "pumpkin" on IRC, and it got integrated into the jailbreak. Kinda fun to be part of that, even though I only contributed a few bytes of code. (And I got to learn a little arm assembly.) It's been a long time, but the tricky part was trying to shoehorn a if / return in there. I remember having to rewrite some existing code in a more efficient way (might have been jump table -> conditionals) to gain an extra couple of bytes. I've also reversed java class files a few times to patch issues for work, but those usually have source these days. The one I remember, years ago, was a bug in the ftp code that could cause hangs with some servers. Something about sockets being closed in the wrong order. The rest of my decompiling/disassembly has been for interoperability, trying to figure out stuff like the Notes.app or Numbers.app file formats.
- ineedasername 5y ago
  I didn't want to be pwned while browsing the web Oh I remember that bug. It was insane that a button on a web page could do that.
tyingq 5y ago
"Unless you consider not being able to run a program without license a bug" There are certainly cases where the license server quits working, even when the software isn't yet abandonware. I'd consider that a bug.
tibbetts 5y ago
My old Brother printer has an installation utility for OSX that doesn’t run under modern Java for a trivial reason. I recompiled it and swapped in a library to make it work. The only point of the tool is to configure the printer (over USB) to talk to the right wifi.
Wowfunhappy 5y ago
You may enjoy https://apple.stackexchange.com/questions/414688/how-can-i-run-newer-unity-games-on-os-x-10-9-mavericks https://apple.stackexchange.com/questions/414688/how-can-i-r..., in which I figured out what was keeping modern Unity games from working on a very outdated operating system, and got them to run. I'm really quite proud of the writeup! :)
ineedasername 5y ago
Could be useful in finding and confirming a bug in the first place. If you can decompile the code then you may be able to systematically find some types of bugs that would otherwise be opaque to easy discovery. Personally, I did it once on a very old game with DRM that no longer functioned, though the game ran fine. I wasn't about to trust a random crack download, so I decompiled and removed the DRM check.
foxfluff 5y ago
I've done it with games many times. Well, disassembling rather than decompilation, but close enough. For example, changing hardcoded key bindings to be more dvorak friendly in Touhou games. I've fixed many Quake engine based games that have the infamous OpenGL extension string overflow bug. There's another old game (possibly Soldier of Fortune 2: Double Helix?) that refuses to run if you have the string "generic" in your OpenGL driver name. This is common on Linux distros that ship a "generic" kernel. Painkiller crashes if your uptime is too high, due to overflow on division. That's another easy fix.
sellyme 5y ago
This is common in achievement-hunting communities - when a game is uploaded with bugs that prevent achievements from being possible and the developer/publisher can't be bothered to actually fix it, community members will decompile the game, write a patch for the bug, and then forward it to the developer so that it can actually get resolved.
no_time 5y ago
I bought a super cheap Goke SoC based security camera unware that it does not function without big brother connections to some chinese ip. A bit of looking around late it turns out someone cracked the password of the telnet server and some guy on a russian forum (4pda.ru i think) has already made a patched binary that works fully offline. I ran radiff2 on it and it was quite a few modifications to make it work. Without knowing much about ARM, would've taken me ages to figure out.

by oytis 5y ago

Can someone share cases/anecdotes of decompiling software to fix a bug? Never done it myself nor heard someone doing that. Unless you consider not being able to run a program without license a bug :)

to11mtm 5y ago

I can't do one for Decompiling, but I reverse engineered a Pole-line drafting application in order to write utilities to fix the data corruption it sometimes caused.

niea_11 5y ago

GTA Online fix to reduce loading times [1]. Rockstar awarded the guy 10k$ [2] 1: https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times-by-70/ https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times... 2: https://www.pcgamer.com/rockstar-thanks-gta-online-player-who-fixed-poor-load-times-official-update-coming/ https://www.pcgamer.com/rockstar-thanks-gta-online-player-wh...

xojoc 5y ago
And there was some talk about that previously: On HN: https://news.ycombinator.com/item?id=26296339 https://news.ycombinator.com/item?id=26296339 (703 comments) On Lobsters: https://lobste.rs/s/jzj4q9 https://lobste.rs/s/jzj4q9 (25 comments) And Reddit: https://www.reddit.com/r/programming/comments/luq9oz https://www.reddit.com/r/programming/comments/luq9oz (1022 comments) P.S. these threads where found with a site I'm building: https://discussions.xojoc.pw/?url=https%3A%2F%2Fnee.lv%2F2021%2F02%2F28%2FHow-I-cut-GTA-Online-loading-times-by-70%2F https://discussions.xojoc.pw/?url=https%3A%2F%2Fnee.lv%2F202...

deleted 5y ago

[deleted]

yarcob 5y ago

I have decompiled AppKit on macOS occasionally to debug issues in my app. For example, in one case I discovered that double clicking a cell sometimes only selected part of the contents. With Hopper I was able to verify that the bug is that AppKit just selected the range from 0 to 32000, assuming that would be enough. I was able to work around the issue by manually selecting a bigger range. (I also reported the bug to Apple, they told me they won't fix it because it's a deprecated API. Doesn't matter that 100s of apps, including Apple's own, were still using it...) In another case, I found out that an obscure feature (text attachments with custom cells) was crashing because AppKit called -release too often, so it was impossible to use the feature. Apple had apparently broken it when implementing the force touch functionality for dictionary lookups. Another time Cornerstone, the SVN client, was broken on a prerelease version of macOS. I don't recall the details, I think they called -registerDefaults: too early. I was able to fix it by writing a dynamic library that changed the -registerDefaults: implementation so that it ignored the first call (today with hardened runtime this fix wouldn't be possible anymore without disabling system integrity protection).

bravetraveler 5y ago

I did a fair amount in the early 2000s, mostly unmaintained software that I wanted to return to life

EliRivers 5y ago

http://wonderfulcoding.blogspot.com/2015/10/crack-it-dont-break-it.html http://wonderfulcoding.blogspot.com/2015/10/crack-it-dont-br...

veidr 5y ago

In the 90s (or maybe 00s) the company I worked for had a self-hosted web app (they mostly all were self-hosted, then) that did various things, but was also supposed to be able to send email via whatever mail server you already had. But it didn't work for us. I forget the exact reason, but it was like some kind of text encoding issue where the mail server was expecting ASCII but the software was sending some weird non-ASCII character from EUC or SJIS that borked it. (It was a Japanese workflow app for internal company processes like calendaring, expense approvals, etc., so it had lots of user-entered strings that were in Japanese. UTF-8 existed, but... this product had legacy issues.) Unfortunately the vendor delivered that software (in part, but the significant part for this story) as compiled Perl modules. I think they maybe did that to make it harder for third parties to customize their shit, and therefore make it easier to get any related customization/integration contracts, but possibly it was just innocent performance enhancement. Regardless, though, a dude I worked with decompiled those modules and figured out how to fix the bug by doing some kind of text/encoding transform. And then it could send email.

ericbarrett 5y ago

It wasn't proprietary software, but I used to work with a sustaining engineer who ran Firefox in a gdb session. He was a "tab hoarder" and this was before the days it would save your session; when it reset he complained that he'd lose days of context. I watched him hand-repair a SIGSEGV from a null pointer dereference. As he was doing so he explained he'd reported this particular bug a few weeks ago but "Mozilla's triage was taking a while." A few keystrokes later he'd backed up a couple of frames, set a condition variable to avoid the bad code, and continued the process without interruption. Hugely impressive.

e3bc54b2 5y ago
Impressive indeed, but what is a sustaining engineer?
- ericbarrett 5y ago
  An engineer dedicated to bugfixes and crash investigations, rather than feature development. Not a common title anymore, but you'll still find them attached to products that use their own kernel, like switches and network storage.
MontyCarloHall 5y ago
I’m surprised the performance overhead of running a whole web browser inside a debugger was remotely tolerable for daily use. Wouldn’t it have been easier (and way more performant) to just whip up a quick extension that dumps the list of open tabs to disk every time a tab is opened/closed? I recall session savers being some of the very first extensions available for Firefox.
- alerighi 5y ago
  If you don't set breakpoints, it's not slower than running the software normally.

chris_overseas 5y ago

Many years ago I had a after school job working at the local newspaper office. They used some very expensive and somewhat quirky accounting software. It turned out to have a hard coded(!) percentage baked into the binary for the country's sales tax rate when issuing invoices. Of course the government eventually decided to change that rate, and it sounded like the vendor wasn't going to be able to get them upgraded to a corrected version in time. I overheard the discussion and offered to try and help by seeing if I could hack in a fix. Rather surprisingly they agreed, and after a bit of debugging I found the problem and patched the binary. It did the trick and they successfully used that patched version for a couple of weeks until they got their upgrade.

toast0 5y ago

A long time ago, I was building a payment integration between shopping cart software and a e-check processor. I was testing my half-done work, and got an inscrutible error; finding access to the server source (because IIS exposed the data fork of the VBS) made it a lot quicker to figure out what I did wrong. Not exactly the same scenario, but close enough.

nelgaard 5y ago

One of the first times I did it, was 15-20 years ago. I had a digital camera, a Canon IXUS S110, and wanted to have some pictures printed. There were some sites where you could upload pictures, but they all used som proprietary Windows program, and I had Linux. Except the supermarket chain Føtex which had a website with a Java applet. But it failed when I tried to use it throwing an exception about a missing directory. So I downloaded the JAR file, decompiled it with the JAD decompiler and found that they had hardcoded the file separator as backslash. So that was easy to fix. I compiled it, ran the JAR file and uploaded my pictures and picked up the prints a few days later.

dunham 5y ago

For one of the early iPhone jailbreaks, I made a patch for libtiff that fixed the bug that the jailbreak exploited. I didn't want to be pwned while browsing the web with my iTouch. I gave the patch to someone named "pumpkin" on IRC, and it got integrated into the jailbreak. Kinda fun to be part of that, even though I only contributed a few bytes of code. (And I got to learn a little arm assembly.) It's been a long time, but the tricky part was trying to shoehorn a if / return in there. I remember having to rewrite some existing code in a more efficient way (might have been jump table -> conditionals) to gain an extra couple of bytes. I've also reversed java class files a few times to patch issues for work, but those usually have source these days. The one I remember, years ago, was a bug in the ftp code that could cause hangs with some servers. Something about sockets being closed in the wrong order. The rest of my decompiling/disassembly has been for interoperability, trying to figure out stuff like the Notes.app or Numbers.app file formats.

ineedasername 5y ago
I didn't want to be pwned while browsing the web Oh I remember that bug. It was insane that a button on a web page could do that.

tyingq 5y ago

"Unless you consider not being able to run a program without license a bug" There are certainly cases where the license server quits working, even when the software isn't yet abandonware. I'd consider that a bug.

tibbetts 5y ago

My old Brother printer has an installation utility for OSX that doesn’t run under modern Java for a trivial reason. I recompiled it and swapped in a library to make it work. The only point of the tool is to configure the printer (over USB) to talk to the right wifi.

Wowfunhappy 5y ago

You may enjoy https://apple.stackexchange.com/questions/414688/how-can-i-run-newer-unity-games-on-os-x-10-9-mavericks https://apple.stackexchange.com/questions/414688/how-can-i-r..., in which I figured out what was keeping modern Unity games from working on a very outdated operating system, and got them to run. I'm really quite proud of the writeup! :)

ineedasername 5y ago

Could be useful in finding and confirming a bug in the first place. If you can decompile the code then you may be able to systematically find some types of bugs that would otherwise be opaque to easy discovery. Personally, I did it once on a very old game with DRM that no longer functioned, though the game ran fine. I wasn't about to trust a random crack download, so I decompiled and removed the DRM check.

foxfluff 5y ago

I've done it with games many times. Well, disassembling rather than decompilation, but close enough. For example, changing hardcoded key bindings to be more dvorak friendly in Touhou games. I've fixed many Quake engine based games that have the infamous OpenGL extension string overflow bug. There's another old game (possibly Soldier of Fortune 2: Double Helix?) that refuses to run if you have the string "generic" in your OpenGL driver name. This is common on Linux distros that ship a "generic" kernel. Painkiller crashes if your uptime is too high, due to overflow on division. That's another easy fix.

sellyme 5y ago

This is common in achievement-hunting communities - when a game is uploaded with bugs that prevent achievements from being possible and the developer/publisher can't be bothered to actually fix it, community members will decompile the game, write a patch for the bug, and then forward it to the developer so that it can actually get resolved.

no_time 5y ago

I bought a super cheap Goke SoC based security camera unware that it does not function without big brother connections to some chinese ip. A bit of looking around late it turns out someone cracked the password of the telnet server and some guy on a russian forum (4pda.ru i think) has already made a patched binary that works fully offline. I ran radiff2 on it and it was quite a few modifications to make it work. Without knowing much about ARM, would've taken me ages to figure out.