6 ms·

What surprises me about this stuff is that no one has ever tried to get a definitive answer to this sort of question with the help of reverse engineering. It's

What surprises me about this stuff is that no one has ever tried to get a definitive answer to this sort of question with the help of reverse engineering. It's always this guesswork for some reason. It does not have to be guesswork when the ground truth is right there inside your C:\Windows folder.

Kye 4y ago
I don't know why it's surprising. Reverse engineering an executable is quite a jump in skill level from guesswork.
- nneonneo 4y ago
  That, and Windows is *huge*. The best bet would probably be to reverse engineer the patch in question, but if it’s a typical combo patch then you’re probably looking at changes across a dozen system files. If you’re unlucky, the patch is just flipping a flag or something for a feature that already existed: it wouldn’t surprise me if Windows already had hacks specifically for “chrome.exe” (for compatibility or anti-compatibility reasons). In that case it becomes much more time consuming to isolate the one component that is responsible for the problem.
  - deleted 4y ago
    [deleted]
  - saagarjha 4y ago
    I’d reverse engineer the API they were calling. Generally this kind of thing yields good results quickly.
- userbinator 4y ago
  "Reverse engineering" is vague and means anywhere from "poke at it randomly to see what it does" to "read the binary".
  - justinclift 4y ago
    Isn't the more widely accepted meaning to de-compile it back to source code (of some form), and go from there?
762236 4y ago
Wow, drive letters in 2023.
- deleted 4y ago
  [deleted]
dacryn 4y ago
you act as if reverse engineering is easy. I guarantee you its not, especially something like edge is a rats nest of packages, assemblies, 3rd party components, config files, all neatly bundled in something unreadable for security reasons. Browsers are hard to reverse engineer
- JohnFen 4y ago
  I specialized in reverse-engineering binaries for a few years (it's shockingly common for companies to lose the source code for their own products), and I second this. Reverse-engineering is difficult and time-consuming. Reverse-engineering something as large and complex as a browser would be a huge project all by itself.
  - moremetadata 4y ago
    [dead]
  - gavinhoward 4y ago
    Currently writing a talk about loss of institutional knowledge. Can I quote you? Also, if you're comfortable, can you give me more background on yourself so I won't just be quoting a rando on the Internet?
    - bombcar 4y ago
      Raymond Chen has some about it, too, on his blog (also search Microsoft pinball).
      - gavinhoward 4y ago
        Ah, thank you!
  - andirk 4y ago
    What about getting ahold of the binary or whatever raw version of Windows you can get (C++, assembly?), and look at the diff from before this change and after. Would that drastically narrow down what you should look at? Moreover, if there is a literal CONSTANT that says "Chrome", is it possible that it's not obfuscated and sitting in the code in plain sight?

Kye 4y ago

I don't know why it's surprising. Reverse engineering an executable is quite a jump in skill level from guesswork.

nneonneo 4y ago
That, and Windows is *huge*. The best bet would probably be to reverse engineer the patch in question, but if it’s a typical combo patch then you’re probably looking at changes across a dozen system files. If you’re unlucky, the patch is just flipping a flag or something for a feature that already existed: it wouldn’t surprise me if Windows already had hacks specifically for “chrome.exe” (for compatibility or anti-compatibility reasons). In that case it becomes much more time consuming to isolate the one component that is responsible for the problem.
- deleted 4y ago
  [deleted]
- saagarjha 4y ago
  I’d reverse engineer the API they were calling. Generally this kind of thing yields good results quickly.
userbinator 4y ago
"Reverse engineering" is vague and means anywhere from "poke at it randomly to see what it does" to "read the binary".
- justinclift 4y ago
  Isn't the more widely accepted meaning to de-compile it back to source code (of some form), and go from there?

762236 4y ago

Wow, drive letters in 2023.

deleted 4y ago
[deleted]

dacryn 4y ago

you act as if reverse engineering is easy. I guarantee you its not, especially something like edge is a rats nest of packages, assemblies, 3rd party components, config files, all neatly bundled in something unreadable for security reasons. Browsers are hard to reverse engineer

JohnFen 4y ago
I specialized in reverse-engineering binaries for a few years (it's shockingly common for companies to lose the source code for their own products), and I second this. Reverse-engineering is difficult and time-consuming. Reverse-engineering something as large and complex as a browser would be a huge project all by itself.
- moremetadata 4y ago
  [dead]
- gavinhoward 4y ago
  Currently writing a talk about loss of institutional knowledge. Can I quote you? Also, if you're comfortable, can you give me more background on yourself so I won't just be quoting a rando on the Internet?
  - bombcar 4y ago
    Raymond Chen has some about it, too, on his blog (also search Microsoft pinball).
    - gavinhoward 4y ago
      Ah, thank you!
- andirk 4y ago
  What about getting ahold of the binary or whatever raw version of Windows you can get (C++, assembly?), and look at the diff from before this change and after. Would that drastically narrow down what you should look at? Moreover, if there is a literal CONSTANT that says "Chrome", is it possible that it's not obfuscated and sitting in the code in plain sight?