5 ms·

This was an amazing write-up. It never ceases to amaze me how anyone can reason through decompiled code.

by dimgl 5y ago

robbedpeter 5y ago
One of the amazing things about doing stuff like this is the forum discussions, tutorials, irc logs, and mailing lists that detail every step and exploration and tool. Cracking a keygen, creating trainers, using hex editors, and so on down the game piracy, cheating, editing, and modding rabbit hole is incredibly rewarding and occasionally useful in the real world. It's worth doing at least once for anyone, but I think it will get harder for people as more content ends up ephemeral, unsearchable, or locked inside walled gardens.
- barbs 5y ago
  That does sound fascinating! Any particular posts you would recommend?
  - boppo1 5y ago
    I'm a layman at this but felt like I understood after reading this: https://wiki.skullsecurity.org/index.php?title=Fundamentals https://wiki.skullsecurity.org/index.php?title=Fundamentals also, that might be dated, so additionally search around for 'Ghidra'. Iirc, hackers at the NSA convinced their bosses the US would be more secure if the gen pop had access to their tools. Cool stuff.
csydas 5y ago
> It never ceases to amaze me how anyone can reason through decompiled code. How so? I'm very much so a nascent programmer, but I've learned the most by decompiling other's code and seeing what works and what doesn't. When I see good apps, I guess I make the (sometimes specious) assumption that whoever wrote it likely also knows how to write pretty well. I've also done a ton of troubleshooting at a past support position via decompiler since the Dev Team was sometimes...sparse with details :) It's one of the things I do like about programming, it's just a big logic puzzle to break down. Sometimes the logic harder to follow, but there is a way to understand it. My biggest mental growths have been just seeing how other people accomplish goals I want to accomplish, and understanding what does and doesn't work well. Especially with major developers, it's really interesting to see how/why they do the things they do as their needs are way different than in-house app needs.
- Noumenon72 5y ago
  I think you mean "debugger", not "decompiler". To me (who has never done it) "decompiling" is looking through a bunch of hex dumps and code skeletons with all the names replaced by "function_3" and "var_1", because you don't have access to the source or the ability to run a debugger -- only the compiled binary. That's obviously much harder than being able to debug or read the source code with comments (which is already hard).
  - csydas 5y ago
    Nope) I mean decompiler. Grab dotpeek from Jetbrains and see what I mean.
    - Noumenon72 5y ago
      I don't have any C# projects to decompile so let me ask you, do you typically use this with projects that have source available so you are essentially attaching a debugger to their source, or are you looking at a bunch of generically named, comment-stripped decompiled functions like I described above?
      - csydas 5y ago
        The latter. The code was very straight forward in most cases and I just saw the raw logic. Sometimes I was able to get on good terms enough with a Dev to get them to explain their logic, but usually the code stood on its own. But Generically named is not appropriate here, as at least with this job, we had really good devs, and they would get slapped pretty hard for non-intuitive naming. The Dev Leads were very careful about naming schemes and the end result was that it was pretty simple to understand what something was related to. DotPeek also makes a lot of this work __very__ convenient with things like the stack trace explorer and its navigation tooling.

This was an amazing write-up. It never ceases to amaze me how anyone can reason through decompiled code.

by dimgl 5y ago

This was an amazing write-up. It never ceases to amaze me how anyone can reason through decompiled code.

One of the amazing things about doing stuff like this is the forum discussions, tutorials, irc logs, and mailing lists that detail every step and exploration and tool. Cracking a keygen, creating trainers, using hex editors, and so on down the game piracy, cheating, editing, and modding rabbit hole is incredibly rewarding and occasionally useful in the real world. It's worth doing at least once for anyone, but I think it will get harder for people as more content ends up ephemeral, unsearchable, or locked inside walled gardens.

barbs 5y ago
That does sound fascinating! Any particular posts you would recommend?
- boppo1 5y ago
  I'm a layman at this but felt like I understood after reading this: https://wiki.skullsecurity.org/index.php?title=Fundamentals https://wiki.skullsecurity.org/index.php?title=Fundamentals also, that might be dated, so additionally search around for 'Ghidra'. Iirc, hackers at the NSA convinced their bosses the US would be more secure if the gen pop had access to their tools. Cool stuff.

csydas 5y ago

> It never ceases to amaze me how anyone can reason through decompiled code. How so? I'm very much so a nascent programmer, but I've learned the most by decompiling other's code and seeing what works and what doesn't. When I see good apps, I guess I make the (sometimes specious) assumption that whoever wrote it likely also knows how to write pretty well. I've also done a ton of troubleshooting at a past support position via decompiler since the Dev Team was sometimes...sparse with details :) It's one of the things I do like about programming, it's just a big logic puzzle to break down. Sometimes the logic harder to follow, but there is a way to understand it. My biggest mental growths have been just seeing how other people accomplish goals I want to accomplish, and understanding what does and doesn't work well. Especially with major developers, it's really interesting to see how/why they do the things they do as their needs are way different than in-house app needs.

Noumenon72 5y ago
I think you mean "debugger", not "decompiler". To me (who has never done it) "decompiling" is looking through a bunch of hex dumps and code skeletons with all the names replaced by "function_3" and "var_1", because you don't have access to the source or the ability to run a debugger -- only the compiled binary. That's obviously much harder than being able to debug or read the source code with comments (which is already hard).
- csydas 5y ago
  Nope) I mean decompiler. Grab dotpeek from Jetbrains and see what I mean.
  - Noumenon72 5y ago
    I don't have any C# projects to decompile so let me ask you, do you typically use this with projects that have source available so you are essentially attaching a debugger to their source, or are you looking at a bunch of generically named, comment-stripped decompiled functions like I described above?
    - csydas 5y ago
      The latter. The code was very straight forward in most cases and I just saw the raw logic. Sometimes I was able to get on good terms enough with a Dev to get them to explain their logic, but usually the code stood on its own. But Generically named is not appropriate here, as at least with this job, we had really good devs, and they would get slapped pretty hard for non-intuitive naming. The Dev Leads were very careful about naming schemes and the end result was that it was pretty simple to understand what something was related to. DotPeek also makes a lot of this work __very__ convenient with things like the stack trace explorer and its navigation tooling.