24 ms·
An Anti-Reverse Engineering Guide
- conductor 15y agoWell, nothing new. If it runs, it can be cracked. I say it as a reverser (legal) with more than 10 years of exp. So, instead of investing money/time into the protection mechanisms, it's better to use the resources to improve your software. Yet well-thought custom protection (i.e. not ASProtect, Armadillo, etc..) can be harder, but it's all the same crackable.
- jrkelly 15y agoWho are the best 'reversers' out there? I work in bioengineering which is largely a reverse-engineering discipline (i.e. we do a lot of tweaking natural organisms that we didn't design) -- just curious if there are overlapping ways of thinking / general approaches. Anyone do serious CS research on reverse engineering methodologies?
- CodeMage 15y agoI've been out of touch and out of practice for years now, so I'm curious to know the answer to this question. I was fascinated with reverse engineering back when Fravia[1] hadn't yet completely moved away from cracking to "search lore". [1] http://en.wikipedia.org/wiki/Fravia http://en.wikipedia.org/wiki/Fravia
- conductor 15y agoThere is the 0-day Scene, those groups which are pretty much closed/private (to name some, CORE, BliZZARD, EMBRACE, HERiTAGE, SSG, DiGERATi..), these are invitation only. And the Web scene groups like FFF, TSRh, RES, who often offer to solve some keygenme/crackme for newcomers to be accepted.
- mfdoom 15y agoI have talked about this with a friend of mine a few times. We have attempted to formulate a 'theory of reverse engineering' a few times but so far nothing concrete has come of it. My personal experience is that RE is as much a mindset as it is a deep well of technical knowledge. Without the crucial knowledge of the axioms of the framework you are reversing, you can often do nothing but guess. Without a strong understanding of the "RE methodology", even with the technical knowledge you stand a good chance of getting sidetracked or bogged in minutia. My personal belief is that although the subjects are different, the methodology is the same. I have no proof to back this up, it is just my belief based on experience. To answer your first question, the 'best' reverser's are often the silent, faceless crackers/hackers: they hunger for knowledge and are scattered all around the world, in basements, bedrooms and studios. Many move to anti-virus firms, or DRM/software protection companies. Others are hired by government agencies. Some move into hacking, bug and exploit discovery. A rare few move into academic research, like my friend Mr. Rolles.
- jdangu 15y agoNowadays, those techniques are mostly used by malware/viruses. Downloadable try-before-you-buy is dead.
- conductor 15y agoI wouldn't say it's dead, there are many shareware software out there. For example, Topic-Starter's PVS-Studio aka PVS-Studio.v4.56.Incl.Keygen-NOY ;)
- josephcooney 15y agoWhat method do you use to distribute commercial desktop software?
- tonyedgecombe 15y agoNo, my business is continuing to grow year on year. People seem to love installing my dead software on their dead PC's running that dead operating system Windows and they are quite happy to pay me for it.
- xtracto 15y agoTell that to the WinRar developer.
- timsally 15y agoIt is true the techniques in the article are nothing new. However, this comment is a knee jerk reaction and largely misleading. The notion that something being crackable is a failure is incorrect. The time a protection scheme needs to hold up varies depending on the industry, but the economics of DRM to not require it to last forever. For video games it's a month or two (Starcraft 2 sold 75% of total copies told to date within the first month). Also, there are several DRM schemes deployed in production today that are acknowledged by those in the field as quite effective, namely BD+ and DirecTV's scheme. Indeed, as far as I know there hasn't been a break in DirecTV for over half a decade. As far as malware goes, virtualization obfuscators are the current state of the art. They are a fundemental advancement in packing. Up until virtualization obfuscators, all other packers had the weakness where at some point the unprotected program would end up in memory. This weakness is easily exploitable (ala VxClass, see Recon 2010 for an easily digestible talk). Virtualization obfuscators are still beatable with manual reverse engineering (see Rolles WOOT 2009) and some effort has been made to automate the process (see Wenke Lee's group at Oakland 2009). But when a packing scheme forces you to hire reverse engineers who know what symbolic execution is, you know that you've substantially raised the bar.
- Estragon 15y ago> ...as far as I know there hasn't been a break in DirecTV > for over half a decade. Curious what you think of this commercial software which claims to break DirecTV's DRM. (I have no means to evaluate it, google found it for me.) http://drm-removal.com/features/DirecTV-Save-Download-Capture/DirecTV-Save-Download-Capture.htm http://drm-removal.com/features/DirecTV-Save-Download-Captur...
- bri3d 15y agoNote the instructions. It's just capturing the video stream via analog source, as far as I can tell. I believe your comment's parent was referring to their over-the-air stream DRM (i.e. the stream to the dish receiver), which hasn't been publicly broken.
- 15y ago
- wslh 15y agoWhere are you working on reversing?
- conductor 15y agoantivirus company, malware analysis
- kdb1 15y agoSorry to go off topic, but I have to ask. How did you get involved in that industry? Malware analysis seems like something I'd love to do. If you don't mind, could you share any tips or career advice you would give to someone who might want to pursue a career in malware analysis/antivirus industry?
- conductor 15y agoWell, in my case I was enjoying unpacking protected software (just for fun, I wasn't distributing cracked software, just writing tutorials on how to bypass protections and releasing tools/unpackers/unprotectors for common types of protectors). Then somebody contacted me and offered the job. What you can do? I would start from tuts4you.com, teach x86 assembly language, download a degugger and/or disassembler and dig something or follow tutorials.
- kdb1 15y agoThanks for your reply. I guess I tend to shy away from things like tuts4u and crackmes.de because it seems questionable legally, although I haven't looked into it much. I mostly "reverse" my own code in gdb just to understand whats going on in the assembly. These types of things are hard to show in a resume, so I'm not really sure how to make myself an attractive job candidate to some of these antivirus companies.
- conductor 15y agoI don't see anything illegal in disassembling shareware or any other type of software. Compare it with disassembling your smartphone/alarm clock/hand watch/.. to find out how it works. Why should it be illegal?
- mwexler 15y agoImpressive article by a current high school senior; I wish I wrote at this level in high school! Note that it is from 2008.
- Simucal 15y agoThe article blew me away when I read that he was a high school senior.
- tptacek 15y agoThere is something about high school seniors and low-level code like this. From numerous observations over the last 15 years or so. I think it might be because your first 5 years in the profession serves in part to teach you what technical issues to be "scared" of, and high school kids haven't learned that yet.
- marshray 15y agoI certainly did my lowest level stuff (building PC ISA hardware from scratch) in high school. Mainly it was out of necessity as I didn't have the money for the real hardware. Other folks I've known who have gotten into ASM in high school did so for game cracking/cheating/modding, also a form of necessity. Any* sane professional development organization is going to try to minimize the amount of time their developers spend writing ASM by hand. There's almost always a higher level tool that's more productive. * Actually, I worked at a place where the main DOS product had been hand written entirely in x86 ASM. The sanity of continuing such a practice into the 90's is an open question. Rumor had it that even the Windows versions of Wordperfect were written in ASM.
- femto 15y agoThe thing high school students have is time. Time to experiment, time to go deep, without external pressure. Once you are in University or the work force or have dependents, the pressure is on to get results, and you no longer have time. The irony is that the applied pressure probably doesn't produce a superior result to being left to your own devices.
- bri3d 15y ago
- mrcharles 15y agoAs someone who has decided to do all (or most of) his personal coding in public, I must say the idea of spending time and effort making sure no one reverse engineers your stuff is kind of funny.
- marshray 15y agoI agree. It seems like a big waste of time and energy. I suspect most of these techniques are defeated in one fell swoop by debugging the process from kernel mode and/or under virtualization. At best, you're only going to delay reversers who aren't as experienced as this high school senior (and can't find articles on codeproject.com).
- pbsd 15y agoThis has a lot to do with the time the article was written. 2008 was a time where ring0 had gone out of fashion (SoftIce dead, nothing usable to replace it), and virtual machines weren't quite that common yet for debugging. Today you'll find lots of anti-VM tricks, and if you go a few more years back, lots of ring0/SoftIce tricks. That said, they are what they are, tricks. Good protections can't simply rely on tricks, which simply temporarily inconvenience whoever is not aware of them.
- DanBC 15y agoTo be fair he does say clearly that all of these would be reasonably easy to bypass. Perhaps he needed a better, but less catchy, title. "Some tricks that will slightly delay reverse-engineering" or "What I know about making reverse engineering a little bit harder than it needs to be".
- jonl 15y agoIf you read past the title and into the article content, you'll see that he says "In this article, I plan to travel a bit deeper into the interesting world of reverse engineering and explore some more intermediate level techniques for annoying reverse engineers." He's right - these techniques basically just annoy any mildly competent reverse engineer.
- jtchang 15y agoAnd my all time favorite technique...an army of lawsuit happy lawyers!
- DrJokepu 15y agoThis is probably a very naive question but can't any of these measures be easily bypassed by running the observed software in a VM like KVM and just attaching a debugger like GDB directly to the VM?
- bri3d 15y agoThey absolutely can be. At the time this article was written (2008), VMs weren't as in vogue as they are today, VM-attached debugging wasn't as mature, and the leading "ring-0" / above-the-kernel debugger (SoftICE) had just been discontinued. Today, there are a host of new measures designed to thwart in-VM debugging, but the playing field differs substantially from the one present when this article was written, and your observation is a good one.
- Tipzntrix 15y agoWhat about the timer-based approach that he mentions? It seems that regardless of how you debug through a VM, it will still take additional time, unless you are altering the processor clock somehow.