8 ms·
Reverse engineering a software crack
- smolsky 2y agoNice! P.S. who remembers the legendary Phrozen Crew cracks? They were minimal byte patches that often toggled a conditional jump in an MS-DOS app/game...
- brcmthrowaway 2y agoRazor1991 is the GOAT crew
- Ylpertnodi 2y agoThe "Mike Hunt" Cubase for atari hack.
- brcmthrowaway 2y agoStop this at once. Ableton folks are gonna go hungry
- pests 2y agoAll the swearing turned me off. I don't mind cussing and use them myself, but does every tweet need to drop the f bomb?
- tucnak 2y agoYes, it does
- silisili 2y agoSame, I'm far from a prude, but time and place. And reading about reverse engineering is neither. It reminds me of a really smart kid who doesn't want to be seen as a nerd, so writes nonchalantly and injects vulgarities into an otherwise brilliant project. Good Will Hunting vibes. It's not really offensive, it's just distracting.
- brcmthrowaway 2y agoyou just described 99% of anime avatar twitter
- lionkor 2y agoI found this pretty insufferable to read, and in good X fashion, the second comment from the top is "we should teach llama3 to do this stuff!". Thanks for sharing, it was interesting, but wow that's a bad format and bad writing.
- redbell 2y agoPretty interesting! I believe being successful in reverse engineering, cracking, bypassing security layers (e.g., unlocking cars without keys), and other hacks comes down to understanding the basics of how these systems are designed to work in the first place. Add to this, the possession of the right toolbox to do the job. Back in 2010, I took on the challenge of cracking paid/licensed POS software. I am, in no way, a cracker or hacker, but once I understood how this app works, I followed a simple logic based on these rules: a. The app had a trial version with a number of *runs* set, and with each launch of the app, the number will decrease by one. It was set to around 100, I believe. b. The app runs on a LAN, on multiple computers, with one being the server. To my surprise, there were no IP configurations, and it turned out that it worked on LAN by setting the app directory as a *shared folder* in Windows!! c. On each app launch, even from other computers (having access to the shared folder), the count will decrease. So, I started my investigation: 1. Since you have a shared folder, based on (c) above, I assumed the location where the count number is stored *must be inside* this shared folder, not in the Windows registry or other places. 2. I launched the app, wrote down the current count, and closed it. 3. I searched inside this shared folder for *.* (all files), then sorted them by last edited. 4. I picked the first one from the search result as it was the only one with the same time as *now*; it was in a binary format. 5. I opened it using a hex editor, converted (using calc.exe) to HEX the count I wrote down on (2), searched for it, and found it. I identified its position. 6. I closed the hex editor, repeated (2),(3) and (4), and got the same results. 7. Now, I typed 999 in calc.exe and converted it to HEX, and in the open HEX editor, I edited the count at its current position with the new value, saved, and closed the binary file. 8. Restarted the POS app, went to about, and.. booooom , it now thinks that you have 999 days remaining :) Although I never used this Point of Sale software, it was an exciting achievement for me. I felt like a real hacker.
- shiroiushi 2y agoYou were a real hacker. That's exactly how a real hacker would have done it, starting from the simplest method of reverse-engineering, and moving to more difficult methods or complicated tools only as necessary. Luckily for you, this POS app wasn't very well-designed from a security standpoint, but that's not unusual, especially for software that has a very limited market and is written by a very small team.
- lossolo 2y ago"downloaded torrent is a split rar. lol in 2024" That doesn't have anything to do with being old fashioned. It's about how racing works in scene FTPs. When you release something race begins starting from so called affil "sites" (group release to all their affil sites at the same time) from there it propagates to whole scene by couriers. Because of how FTP works you need to split the file into multiple files so it can be uploaded by multiple people from multiple sources making distribution fast. And rar is used for that, there are scene rules for it and it's not using compression option.
- pimlottc 2y agoFrom the 2021 scene release rules for games (ISO rips) [0]: > 1.7 The ISO file has to be packed into a RAR archive using the RAR4 or the RAR5 format and the old style volume naming scheme. e.g. grp-gamename.rar, grp-gamename.r00, grp-gamename.r01, ... 0: https://scenerules.org/html/2021_GAMEiSO.html https://scenerules.org/html/2021_GAMEiSO.html
- brcmthrowaway 2y agoYou know too much not to be a scene member
- SSLy 2y agoIt's all public knowledge by now.
- skilled 2y agohttps://nitter.poast.org/gf_256/status/1782656618015904103 https://nitter.poast.org/gf_256/status/1782656618015904103
- _aavaa_ 2y agoThank you! This really should be the link, the twitter link is unusable
- dewey 2y agoThis says „Tweet not found“ now.
- skilled 2y agoIt works fine but does lag sometimes. It’s the only public Nitter instance that is reliably up since nitter.net was shut down or whatever else happened to it. Your error has happened to me also but it does eventually work.
- littlestymaar 2y agoOh, a Nitter instance that still works? I guess it's going to die soon like the other as they run out of guest accounts from scrapping…
- doix 2y agoThis was a pretty long read and I didn't really get much from it. The format of a million tweets is awful. tl;dr it patches the executable by having a shim dll that does the patch when it gets loaded. Pretty common in the game modding community. It finds where it needs to patch by scanning for a byte pattern. What does the actual patch do? No idea, that's what I was waiting for and I never got it. I was expecting a disassembly comparison of the before and after. Someone please correct me if I'm wrong.
- fullspectrumdev 2y agoAs far as I can tell - and I could be wrong having spent about five minutes reading the thread - the shim DLL basically swaps out a public key used by the applications key verification system for a different one so the keygen can create a valid licence key. Without affecting any integrity checks in the target binary.
- doix 2y agoAh, that makes sense, thanks! I was pretty confused about the string copy and what that was doing. Normally I'd expect it to be writing a byte array. Now it all makes more sense.
- Agingcoder 2y agoSame here - I was interested in the mechanics of the crack, having spent a fair amount of time reverse engineering binaries back in the days. This is just a bunch of screenshots with ‘lol’ interspersed.
- carom 2y agoAgree, this was just a really long thread of someone creating structs in Ida.
- fullspectrumdev 2y agoThat’s about 75% of reverse engineering work in IDA or Ghidra, to be fair: labelling/annotating shit, adding types to shit, and making sense of structs and other data types. There’s extensions to both which automatically try detect such things from common libraries/known calls/etc which massively cuts down on the timesink.
- hruzgar 2y agothis is really interesting!
- msla 2y agoThreadreader: https://threadreaderapp.com/thread/1782656618015904103.html?utm_campaign=topunroll https://threadreaderapp.com/thread/1782656618015904103.html?... Archives: https://archive.ph/rpFft https://archive.ph/rpFft https://web.archive.org/web/20240423175847/https://threadreaderapp.com/thread/1782656618015904103.html https://web.archive.org/web/20240423175847/https://threadrea...
- WirelessGigabit 2y agoWhat is interesting here is that a signed piece of software can pick up an unsigned dll, execute it, and that execution causes a compromise of the system.
- speps 2y agoRaymond Chen has a ton of "being on the other side of the airtight hatchway" articles. Most relevant I found: https://devblogs.microsoft.com/oldnewthing/20200420-00/?p=103685 https://devblogs.microsoft.com/oldnewthing/20200420-00/?p=10... Probably in this case the installation of the crack requires admin privileges to modify files in "Program Files" folder. Boom, you've broken the rules ;)
- saagarjha 2y agoTurns out that building the airtight hatchway halfway through the crew’s sleeping quarters was a bad decision.
- Nextgrid 2y agoThis also raises a vulnerability. The author seems convinced this pirated copy is safe because the main binary is signed by Ableton, but there’s no guarantee if there’s a signature check on any of its dependent files (or that the check is not vulnerable or the parsing isn't vulnerable in some way which would allow hijacking the execution flow).
- mhh__ 2y agoShared libraries are a scam
- can16358p 2y agoWhy can't I see the rest but only the first title tweet? Is that the case or is it a bug?
- mimischi 2y agoTwitter requires an account for anything more than a single tweet nowadays. There’s a link with an unrolled thread in the comments here.
- lcnPylGDnU4H9OF 2y agoIt's been that way for a little while. I presume it's a compromise between requiring a log-in and full "guest" access.
- amatecha 2y ago"as designed", due to the gradual decrease in Twitter's functionality due to unknown reasons (probably trying to manipulate people into signing up to boost user count and ad revenue)
- 486sx33 2y agoBecause AI models kept trying to train on twitter for free.
- soonerroadie 2y agoOkay, Elon (jk).
- amatecha 2y agoAI models for... spam bots? There are way better sources for human writing. Is this a reasoning Melon Husk gave for closing off the so-called "town square"? Pretty poor reason, if so.
- deleted 2y ago[deleted]
- hermitcrab 2y agoIf anyone is interested in crackers and their motivation, you might find this interview interesting: https://successfulsoftware.net/2011/04/07/interview-with-a-cracker/ https://successfulsoftware.net/2011/04/07/interview-with-a-c...
- deleted 2y ago[deleted]
- tamimio 2y agoThe first software I cracked was in 2004 (some video converter software), the motivation was simply that I can’t afford it, but the “feeling” you get after is like a drug, then it’s more of a challenge knowing that it’s doable no matter what, just like lock picking, then that spark just dies and you stop cracking them.
- RetroTechie 2y agoCracked plenty software back in the day but mostly for personal use. For the challenge, and because I disliked software being tied to a specific storage medium. It was a sport to minimize changes. Like pad out a single assembly instruction with NOPs, change a conditional jump into unconditional one, etc.
- 3abiton 2y agoIn the android space, most app cracking is rather easy. Surprisingly.
- grishka 2y agoBecause Dalvik/ART (and regular JVM for that matter) bytecode is much less lossy than machine code. Most of the type information stays intact even after obfuscation, so you still get sensible output from a decompiler. This is in contrast with C/C++ where all struct and class usage gets converted into direct memory accesses.
- stong1 2y agoOh hey, this is my thread. Thanks for reading, yall! <3 I also do reverse engineering streams on YouTube: https://www.youtube.com/basteg0d69 https://www.youtube.com/basteg0d69
- ptsneves 2y agoA nice topic and insight if not for the way it is written. I could not finish it. It feels the author is unable to articulate his thoughts without interjecting curses and write incoherently. Is this how people communicate technically in the newer generations?
- deleted 2y ago[deleted]
- m0zzie 2y ago> Is this how people communicate technically in the newer generations? I suspect this question is in bad faith but I'll answer anyway: this live tweeted thread is more like someone's thought stream, it is not a technical report. Many humans are capable of both technical writing, free of cursing, and also of dumping a swear-filled thought stream right into their favourite medium - especially when excitedly reverse engineering, or doing anything they're passionate about. This has been happening for a long time and is not about "the newer generation". You could've found me writing in a similar way on IRC in the late 90s, also talking about reversing. FWIW your comment feels valid enough up until your final sentence, you just didn't need to attack "the newer generations".
- shiroiushi 2y ago>FWIW your comment feels valid enough up until your final sentence, you just didn't need to attack "the newer generations". Why not? He's exactly right, in my experience. It's definitely been my experience that the newer generations (of Americans) are much more likely to casually use swear words, usually the f-word, in regular conversation, even at work. I hear it all the time with my American colleagues. When I was their age, no one talked like that at work, or really in general except maybe in private with their closest friends. Another big difference is mass media: when I was their age, American TV did not allow swear words. But in the last 10-20 years, it's completely changed, and it's pretty common to hear the f-word on regular TV. So of course the "newer generations" are going to reflect this in their casual speaking.
- ptsneves 2y ago
- andrewmcwatters 2y ago[flagged]
- deleted 2y ago[deleted]
- alin23 2y agoIt’s done in a similar way on macOS: a dylib is added to the bundle and an LC_LOAD command is added to the app binary. The dylib is the first thing that runs because of using the constructor attribute, like this: https://notes.alinpanaitiu.com/Injecting%20a%20DYLIB%20into%20a%20macOS%20app https://notes.alinpanaitiu.com/Injecting%20a%20DYLIB%20into%... The nice thing is that a signed app will refuse to load a dylib that does not have the same signature. So crackers will be forced to change the whole app signature which can be easily detected in app code. I have that kind of protection in Lunar (https://lunar.fyi/ https://lunar.fyi/) and Clop (https://lowtechguys.com/clop https://lowtechguys.com/clop) and it seems to be good enough as they have no recent cracks.
- xyst 2y ago> ... it seems to be good enough as they have no recent cracks. challenge accepted
- eps 2y agoYeah, the GP should've not said that.
- bobmcnamara 2y agoSometimes fixing integrity checks can be as simple as replacing the failure case with nops :)
- doix 2y agoThis is different though, because it's modifying the executable to load the new lib, right? If you're modifying the executable anyway, why not just patch it directly instead of going through these hoops? The equivalent on Linux would be setting LD_PRELOAD and putting your .so file there. A quick Google search seems to imply that the OSX equivalent is DYLD_INSERT_LIBRARIES but I have no idea how similar they are.
- reactordev 2y agoWhile code signing and verification is the way, you should also include a step on your own and not rely on the OS to do that for you. Apple’s code signing has been bypassed a few times. Granted they patch it, however one can include a script that enables developer mode in a terminal process that can then disable code signing (enable in-secure apps via developer-mode AppleScript). It’s impossible to get past inspection on the Apple Store due to that extra script in the app bundle but a downloaded dmg off the web…
- cedws 2y agoVery interesting. I really should get back into RE. Selfish question for a project of my own: is there any way to magically gain early code execution in a process on Windows other than a shim DLL? I'm too lazy to write one to pass through the all exports (reflective shim DLL possible...?)
- chc4 2y agoCreateProcess the victim with CREATE_SUSPENDED, do whatever code patching, then ResumeThread it. Pretty sure you can even CreateRemoteThread into the victim for DLL injection, since it just suspends the primary thread, and then patch "yourself" in DllMain instead of having to do remote memory calls.
- reeeeaway 2y agoAlternatively, give frida a go. It handles all the hard parts for you magically and then you get to instrument the binary with Javascript :) mixing dynamic and static techniques is really powerful