6 ms·

Well, nothing new. If it runs, it can be cracked. I say it as a reverser (legal) with more than 10 years of exp. So, instead of investing money/time into the pr

Well, nothing new. If it runs, it can be cracked. I say it as a reverser (legal) with more than 10 years of exp. So, instead of investing money/time into the protection mechanisms, it's better to use the resources to improve your software. Yet well-thought custom protection (i.e. not ASProtect, Armadillo, etc..) can be harder, but it's all the same crackable.

jrkelly 15y ago
Who are the best 'reversers' out there? I work in bioengineering which is largely a reverse-engineering discipline (i.e. we do a lot of tweaking natural organisms that we didn't design) -- just curious if there are overlapping ways of thinking / general approaches. Anyone do serious CS research on reverse engineering methodologies?
- CodeMage 15y ago
  I've been out of touch and out of practice for years now, so I'm curious to know the answer to this question. I was fascinated with reverse engineering back when Fravia[1] hadn't yet completely moved away from cracking to "search lore". [1] http://en.wikipedia.org/wiki/Fravia http://en.wikipedia.org/wiki/Fravia
- conductor 15y ago
  There is the 0-day Scene, those groups which are pretty much closed/private (to name some, CORE, BliZZARD, EMBRACE, HERiTAGE, SSG, DiGERATi..), these are invitation only. And the Web scene groups like FFF, TSRh, RES, who often offer to solve some keygenme/crackme for newcomers to be accepted.
- mfdoom 15y ago
  I have talked about this with a friend of mine a few times. We have attempted to formulate a 'theory of reverse engineering' a few times but so far nothing concrete has come of it. My personal experience is that RE is as much a mindset as it is a deep well of technical knowledge. Without the crucial knowledge of the axioms of the framework you are reversing, you can often do nothing but guess. Without a strong understanding of the "RE methodology", even with the technical knowledge you stand a good chance of getting sidetracked or bogged in minutia. My personal belief is that although the subjects are different, the methodology is the same. I have no proof to back this up, it is just my belief based on experience. To answer your first question, the 'best' reverser's are often the silent, faceless crackers/hackers: they hunger for knowledge and are scattered all around the world, in basements, bedrooms and studios. Many move to anti-virus firms, or DRM/software protection companies. Others are hired by government agencies. Some move into hacking, bug and exploit discovery. A rare few move into academic research, like my friend Mr. Rolles.
jdangu 15y ago
Nowadays, those techniques are mostly used by malware/viruses. Downloadable try-before-you-buy is dead.
- conductor 15y ago
  I wouldn't say it's dead, there are many shareware software out there. For example, Topic-Starter's PVS-Studio aka PVS-Studio.v4.56.Incl.Keygen-NOY ;)
- josephcooney 15y ago
  What method do you use to distribute commercial desktop software?
- tonyedgecombe 15y ago
  No, my business is continuing to grow year on year. People seem to love installing my dead software on their dead PC's running that dead operating system Windows and they are quite happy to pay me for it.
- xtracto 15y ago
  Tell that to the WinRar developer.
timsally 15y ago
It is true the techniques in the article are nothing new. However, this comment is a knee jerk reaction and largely misleading. The notion that something being crackable is a failure is incorrect. The time a protection scheme needs to hold up varies depending on the industry, but the economics of DRM to not require it to last forever. For video games it's a month or two (Starcraft 2 sold 75% of total copies told to date within the first month). Also, there are several DRM schemes deployed in production today that are acknowledged by those in the field as quite effective, namely BD+ and DirecTV's scheme. Indeed, as far as I know there hasn't been a break in DirecTV for over half a decade. As far as malware goes, virtualization obfuscators are the current state of the art. They are a fundemental advancement in packing. Up until virtualization obfuscators, all other packers had the weakness where at some point the unprotected program would end up in memory. This weakness is easily exploitable (ala VxClass, see Recon 2010 for an easily digestible talk). Virtualization obfuscators are still beatable with manual reverse engineering (see Rolles WOOT 2009) and some effort has been made to automate the process (see Wenke Lee's group at Oakland 2009). But when a packing scheme forces you to hire reverse engineers who know what symbolic execution is, you know that you've substantially raised the bar.
- Estragon 15y ago
  > ...as far as I know there hasn't been a break in DirecTV > for over half a decade. Curious what you think of this commercial software which claims to break DirecTV's DRM. (I have no means to evaluate it, google found it for me.) http://drm-removal.com/features/DirecTV-Save-Download-Capture/DirecTV-Save-Download-Capture.htm http://drm-removal.com/features/DirecTV-Save-Download-Captur...
  - bri3d 15y ago
    Note the instructions. It's just capturing the video stream via analog source, as far as I can tell. I believe your comment's parent was referring to their over-the-air stream DRM (i.e. the stream to the dish receiver), which hasn't been publicly broken.
    - 15y ago
wslh 15y ago
Where are you working on reversing?
- conductor 15y ago
  antivirus company, malware analysis
  - kdb1 15y ago
    Sorry to go off topic, but I have to ask. How did you get involved in that industry? Malware analysis seems like something I'd love to do. If you don't mind, could you share any tips or career advice you would give to someone who might want to pursue a career in malware analysis/antivirus industry?
    - conductor 15y ago
      Well, in my case I was enjoying unpacking protected software (just for fun, I wasn't distributing cracked software, just writing tutorials on how to bypass protections and releasing tools/unpackers/unprotectors for common types of protectors). Then somebody contacted me and offered the job. What you can do? I would start from tuts4you.com, teach x86 assembly language, download a degugger and/or disassembler and dig something or follow tutorials.
      - kdb1 15y ago
        Thanks for your reply. I guess I tend to shy away from things like tuts4u and crackmes.de because it seems questionable legally, although I haven't looked into it much. I mostly "reverse" my own code in gdb just to understand whats going on in the assembly. These types of things are hard to show in a resume, so I'm not really sure how to make myself an attractive job candidate to some of these antivirus companies.
        conductor 15y ago
        I don't see anything illegal in disassembling shareware or any other type of software. Compare it with disassembling your smartphone/alarm clock/hand watch/.. to find out how it works. Why should it be illegal?

jrkelly 15y ago

Who are the best 'reversers' out there? I work in bioengineering which is largely a reverse-engineering discipline (i.e. we do a lot of tweaking natural organisms that we didn't design) -- just curious if there are overlapping ways of thinking / general approaches. Anyone do serious CS research on reverse engineering methodologies?

CodeMage 15y ago
I've been out of touch and out of practice for years now, so I'm curious to know the answer to this question. I was fascinated with reverse engineering back when Fravia[1] hadn't yet completely moved away from cracking to "search lore". [1] http://en.wikipedia.org/wiki/Fravia http://en.wikipedia.org/wiki/Fravia
conductor 15y ago
There is the 0-day Scene, those groups which are pretty much closed/private (to name some, CORE, BliZZARD, EMBRACE, HERiTAGE, SSG, DiGERATi..), these are invitation only. And the Web scene groups like FFF, TSRh, RES, who often offer to solve some keygenme/crackme for newcomers to be accepted.
mfdoom 15y ago
I have talked about this with a friend of mine a few times. We have attempted to formulate a 'theory of reverse engineering' a few times but so far nothing concrete has come of it. My personal experience is that RE is as much a mindset as it is a deep well of technical knowledge. Without the crucial knowledge of the axioms of the framework you are reversing, you can often do nothing but guess. Without a strong understanding of the "RE methodology", even with the technical knowledge you stand a good chance of getting sidetracked or bogged in minutia. My personal belief is that although the subjects are different, the methodology is the same. I have no proof to back this up, it is just my belief based on experience. To answer your first question, the 'best' reverser's are often the silent, faceless crackers/hackers: they hunger for knowledge and are scattered all around the world, in basements, bedrooms and studios. Many move to anti-virus firms, or DRM/software protection companies. Others are hired by government agencies. Some move into hacking, bug and exploit discovery. A rare few move into academic research, like my friend Mr. Rolles.

jdangu 15y ago

Nowadays, those techniques are mostly used by malware/viruses. Downloadable try-before-you-buy is dead.

conductor 15y ago
I wouldn't say it's dead, there are many shareware software out there. For example, Topic-Starter's PVS-Studio aka PVS-Studio.v4.56.Incl.Keygen-NOY ;)
josephcooney 15y ago
What method do you use to distribute commercial desktop software?
tonyedgecombe 15y ago
No, my business is continuing to grow year on year. People seem to love installing my dead software on their dead PC's running that dead operating system Windows and they are quite happy to pay me for it.
xtracto 15y ago
Tell that to the WinRar developer.

timsally 15y ago

It is true the techniques in the article are nothing new. However, this comment is a knee jerk reaction and largely misleading. The notion that something being crackable is a failure is incorrect. The time a protection scheme needs to hold up varies depending on the industry, but the economics of DRM to not require it to last forever. For video games it's a month or two (Starcraft 2 sold 75% of total copies told to date within the first month). Also, there are several DRM schemes deployed in production today that are acknowledged by those in the field as quite effective, namely BD+ and DirecTV's scheme. Indeed, as far as I know there hasn't been a break in DirecTV for over half a decade. As far as malware goes, virtualization obfuscators are the current state of the art. They are a fundemental advancement in packing. Up until virtualization obfuscators, all other packers had the weakness where at some point the unprotected program would end up in memory. This weakness is easily exploitable (ala VxClass, see Recon 2010 for an easily digestible talk). Virtualization obfuscators are still beatable with manual reverse engineering (see Rolles WOOT 2009) and some effort has been made to automate the process (see Wenke Lee's group at Oakland 2009). But when a packing scheme forces you to hire reverse engineers who know what symbolic execution is, you know that you've substantially raised the bar.

Estragon 15y ago
> ...as far as I know there hasn't been a break in DirecTV > for over half a decade. Curious what you think of this commercial software which claims to break DirecTV's DRM. (I have no means to evaluate it, google found it for me.) http://drm-removal.com/features/DirecTV-Save-Download-Capture/DirecTV-Save-Download-Capture.htm http://drm-removal.com/features/DirecTV-Save-Download-Captur...
- bri3d 15y ago
  Note the instructions. It's just capturing the video stream via analog source, as far as I can tell. I believe your comment's parent was referring to their over-the-air stream DRM (i.e. the stream to the dish receiver), which hasn't been publicly broken.
  - 15y ago

wslh 15y ago

Where are you working on reversing?

conductor 15y ago
antivirus company, malware analysis
- kdb1 15y ago
  Sorry to go off topic, but I have to ask. How did you get involved in that industry? Malware analysis seems like something I'd love to do. If you don't mind, could you share any tips or career advice you would give to someone who might want to pursue a career in malware analysis/antivirus industry?
  - conductor 15y ago
    Well, in my case I was enjoying unpacking protected software (just for fun, I wasn't distributing cracked software, just writing tutorials on how to bypass protections and releasing tools/unpackers/unprotectors for common types of protectors). Then somebody contacted me and offered the job. What you can do? I would start from tuts4you.com, teach x86 assembly language, download a degugger and/or disassembler and dig something or follow tutorials.
    - kdb1 15y ago
      Thanks for your reply. I guess I tend to shy away from things like tuts4u and crackmes.de because it seems questionable legally, although I haven't looked into it much. I mostly "reverse" my own code in gdb just to understand whats going on in the assembly. These types of things are hard to show in a resume, so I'm not really sure how to make myself an attractive job candidate to some of these antivirus companies.
      - conductor 15y ago
        I don't see anything illegal in disassembling shareware or any other type of software. Compare it with disassembling your smartphone/alarm clock/hand watch/.. to find out how it works. Why should it be illegal?