Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Protecting Your Software Assets Using OpenGL

stealthy.io

Post reply on HN
Print view View original

11–20 of 21 posts

Re: Show HN: Protecting Your Software Assets Using OpenGL

#11

Post by datenwolf »

billconan wrote: post #10
datenwolf wrote: post #8

Earlier quoted context omitted.

You don't have to go so far. Just inject a little bit of code into the game process that calls a dumper function just before (or after, it doesn't really matter) calls to `glDraw…` to dump out all the data of the currently bound buffer objects and textures. glGetTexImage, glGetBufferData are your friends.

ya. this article doesn't make too much sense to me.

I think the people behind this come from a OpenGL-ES / WebGL background. Coaxing data back out of OpenGL-ES / WebGL is a bit tricker compared to original OpenGL. But only a little bit (you need a proxy FBO to retrieve texture data; you can't write to buffer objects with shaders in ES/WebGL so hooking glBufferData suffices).

Re: Show HN: Protecting Your Software Assets Using OpenGL

#12

Post by billconan »

datenwolf wrote: post #11
billconan wrote: post #10

Earlier quoted context omitted.

ya. this article doesn't make too much sense to me.

I think the people behind this come from a OpenGL-ES / WebGL background. Coaxing data back out of OpenGL-ES / WebGL is a bit tricker compared to original OpenGL. But only a little bit (you need a proxy FBO to retrieve texture data; you can't write to buffer objects with shaders in ES/WebGL so hooking glBufferData suffices).

I don't think it will be difficult. after all chromium and Angle are opensource, you can hack chromium source code to get everything. plus, javascript is already kinda open to steal. same to android. it is open.

on ios, it's harder. but shouldn't ios already encrypt all its apps?

Re: Show HN: Protecting Your Software Assets Using OpenGL

#13

Post by ryandrake »

The pirates will never pay for your software, and will always work around your countermeasures, no matter how complicated or expensive they were to develop. You're better off investing that money/effort into features that your actual paying customers will pay more for.

Re: Show HN: Protecting Your Software Assets Using OpenGL

#14

Post by astrange »

datenwolf wrote: post #7
malkia wrote: post #5

Earlier quoted context omitted.

Like this (and this is not done to harm anyone) - http://www.wadeb.com/eq/

Kind of, but more rather like this: https://github.com/mazzoo/ogldump Actually you'd not even need to inject a libGL.so at all. You could as well just modify the PLT/GOT entries for the glDraw… functions to a dumper function and then jmp to the actual glDraw… call. This could be done using the system debugging APIs.

Many OpenGL implementations use a "virtual function" pattern where you look up the driver's function pointers and call through that (AGL, CGL on OS X, WGL on windows, probably more). It saves indirection when there's more than one possible vendor but means you have to remember to wrap each of those when doing interception.

Re: Show HN: Protecting Your Software Assets Using OpenGL

#15

Post by microcolonel »

billconan wrote: post #12
datenwolf wrote: post #11

Earlier quoted context omitted.

I think the people behind this come from a OpenGL-ES / WebGL background. Coaxing data back out of OpenGL-ES / WebGL is a bit tricker compared to original OpenGL. But only a little bit (you need a proxy FBO to retrieve texture data; you can't write to buffer objects with shaders in ES/WebGL so hooking glBufferData suffices).

I don't think it will be difficult. after all chromium and Angle are opensource, you can hack chromium source code to get everything. plus, javascript is already kinda open to steal. same to android. it is open. on ios, it's harder. but shouldn't ios already encrypt all its apps?

Wouldn't matter, pretty sure you could just take the assets in the simulator.

Re: Show HN: Protecting Your Software Assets Using OpenGL

#16

Post by balls2you »

datenwolf wrote: post #7
malkia wrote: post #5

Earlier quoted context omitted.

Like this (and this is not done to harm anyone) - http://www.wadeb.com/eq/

Kind of, but more rather like this: https://github.com/mazzoo/ogldump Actually you'd not even need to inject a libGL.so at all. You could as well just modify the PLT/GOT entries for the glDraw… functions to a dumper function and then jmp to the actual glDraw… call. This could be done using the system debugging APIs.

This can easily be bypassed by the application itself if it checks that the DLLs or .so files loaded in memory are the approved and check-summed ones and only then progresses to doing anything. This is a non-issue. Applications that are worried about their IP already do this today. Many encrypt even their DLLs and only load then as necessary based on when they feel they are not under a debugger or a malicious DLL or .so is not loaded.

Re: Show HN: Protecting Your Software Assets Using OpenGL

#17

Post by balls2you »

microcolonel wrote: post #15
billconan wrote: post #12

Earlier quoted context omitted.

I don't think it will be difficult. after all chromium and Angle are opensource, you can hack chromium source code to get everything. plus, javascript is already kinda open to steal. same to android. it is open. on ios, it's harder. but shouldn't ios already encrypt all its apps?

Wouldn't matter, pretty sure you could just take the assets in the simulator.

You're assuming the application that wants to protect its assets and other IP will let you run it in a simulator which is not going to be the case.

Re: Show HN: Protecting Your Software Assets Using OpenGL

#18

Post by balls2you »

ryandrake wrote: post #13

The pirates will never pay for your software, and will always work around your countermeasures, no matter how complicated or expensive they were to develop. You're better off investing that money/effort into features that your actual paying customers will pay more for.

There are users who are pirates and then there are corporate pirates whose businesses are built on copying and pirating popular games and making them look professional. They are the real danger to indie devs not end users in their mother's basement with no money in their pockets.

Re: Show HN: Protecting Your Software Assets Using OpenGL

#19

Post by chii »

balls2you wrote: post #18
ryandrake wrote: post #13

The pirates will never pay for your software, and will always work around your countermeasures, no matter how complicated or expensive they were to develop. You're better off investing that money/effort into features that your actual paying customers will pay more for.

There are users who are pirates and then there are corporate pirates whose businesses are built on copying and pirating popular games and making them look professional. They are the real danger to indie devs not end users in their mother's basement with no money in their pockets.

> pirating popular games and making them look professional.

that's not pirating. you cannot own an idea (and i would say software patents aren't good, despite their current prevalence). If the market demands good looking games, i guess as an indie, you either just have to compete, or die out like any other business would.

Re: Show HN: Protecting Your Software Assets Using OpenGL

#20

Post by datenwolf »

astrange wrote: post #14
datenwolf wrote: post #7

Earlier quoted context omitted.

Kind of, but more rather like this: https://github.com/mazzoo/ogldump Actually you'd not even need to inject a libGL.so at all. You could as well just modify the PLT/GOT entries for the glDraw… functions to a dumper function and then jmp to the actual glDraw… call. This could be done using the system debugging APIs.

Many OpenGL implementations use a "virtual function" pattern where you look up the driver's function pointers and call through that (AGL, CGL on OS X, WGL on windows, probably more). It saves indirection when there's more than one possible vendor but means you have to remember to wrap each of those when doing interception.

Actually… no, unfortunately not (regarding the competence of the following I suggest you look at my profile over at StackOverflow).

So the problem is twofold:

There are the OS-ABI OpenGL functions (i.e. OpenGL functions that are exposed due to the ABI demands of the operating system) and there are the extended functions. The Windows ABI mandates OpenGL-1.1, Linux used to be OpenGL-1.2 but the recently released LSB bumped that to 2.1. These ABI level functions are expected (by the ABI) to be provided by the base system interface libraries in the form of regular, non-hooked symbols.

And then there is the extended functionality, i.e. everything not covered by the base system ABI, so modern OpenGL, and extension functions.

Windows and Linux treat the later case differently! In Windows extended functions (pointers) must be assumed to be depending on the context the've been gathered from. In Linux, namely the GLX specification it's explicitly stated that extended functions' pointers are not tied to the context, but rather the GLX interface.

Regarding OpenGL, or rather the typical implementations of it that leads to an interesting problem: Dispatch. Every OpenGL function eventually must be dispatched to the right driver. Using indirect GLX this is easy, since OpenGL calls are translated into GLX opcodes and transmitted via the GLX/X11 extension wire protocol; the X11 server then submits it to the graphics driver proper (and honstly IMHO transmitting command buffers to a server is the only proper way to do it: The benefits of direct GL stem mostly from the fact that the X11 protocol takes into account TCP transport; if we consider localhost-only connections highly efficient RPC and zero-copy-SHM protocols are possible).

But as soon as you hit direct GL it becomes a TLS context jump table indirection mess. And only because the first implementers of OpenGL (who also wrote the specification) were not fully aware of some of the leeway their own words would provide them: *Nowhere in the OpenGL specs it is stated that OpenGL functions shall reside in the global namespace. And nowhere in the OpenGL specification it is forbidden, that actual OpenGL implementations add a "context" 1st-parameter (akin to the implcit `this` of C++ class member function) to every function call.

Post reply on HN