5 ms·
This was a pretty long read and I didn't really get much from it. The format of a million tweets is awful. tl;dr it patches the executable by having a shim dll
by doix 2y ago
This was a pretty long read and I didn't really get much from it. The format of a million tweets is awful.
tl;dr it patches the executable by having a shim dll that does the patch when it gets loaded. Pretty common in the game modding community. It finds where it needs to patch by scanning for a byte pattern.
What does the actual patch do? No idea, that's what I was waiting for and I never got it. I was expecting a disassembly comparison of the before and after.
Someone please correct me if I'm wrong.
- fullspectrumdev 2y agoAs far as I can tell - and I could be wrong having spent about five minutes reading the thread - the shim DLL basically swaps out a public key used by the applications key verification system for a different one so the keygen can create a valid licence key. Without affecting any integrity checks in the target binary.
- doix 2y agoAh, that makes sense, thanks! I was pretty confused about the string copy and what that was doing. Normally I'd expect it to be writing a byte array. Now it all makes more sense.
- Agingcoder 2y agoSame here - I was interested in the mechanics of the crack, having spent a fair amount of time reverse engineering binaries back in the days. This is just a bunch of screenshots with ‘lol’ interspersed.
- carom 2y agoAgree, this was just a really long thread of someone creating structs in Ida.
- fullspectrumdev 2y agoThat’s about 75% of reverse engineering work in IDA or Ghidra, to be fair: labelling/annotating shit, adding types to shit, and making sense of structs and other data types. There’s extensions to both which automatically try detect such things from common libraries/known calls/etc which massively cuts down on the timesink.
- mrguyorama 2y agoI feel like this person is trying to copy Foone's voice but just doesn't get it
- archgoon 2y ago'This person' sounds like cts being cts doing cts things. Don't see why you'd think they're copying Foone.
- RockRobotRock 2y agoCybersec twitter is just awful. Everything has to be a call out or a dunk on someone/some company. It's all so negative.
- lmm 2y agoMuch like the rest of twitter then.
- RockRobotRock 2y agoyep
- toofy 2y agoAs a sibling already pointed out, this is pretty much all of twitter now. Infosec twitter moved over to Mastodon a while back, some are also trying out bluesky but Mastodon is where the community has mainly roosted.
- userbinator 2y agoAs the saying goes, there's a fine line between genius and insanity... and a lot of these people are sitting on it.
- kaladin-jasnah 2y agoIs this akin to using LD_PRELOAD on Linux to hook something like __libc_start_main and modifying specific data in one of the data sections of the ELF binary or something?
- rumdz 2y agoYes
- tamimio 2y agoBecause the whole article can be written in 2 tweets but you need that social media “interaction”, so the author goes on talking about non essential things. The crack itself is simple and smart to bypass the check by changing the public key, the only issue from what I have seen is there’s a lot of hardcoded stuff like the key and the functions numbers, so most likely it won’t work in future updates.
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]