Skypeopensource2 – Skype client based on reversing Skype 5.5 • Hacker News Board

Re: Skypeopensource2 – Skype client based on reversing Skype 5.5

#41

Post by Retr0spectrum » Sun, Sep 04, 2016, 12:27 PM UTC

0xmohit wrote: post #35

andwur wrote: post #8

I haven't spent much time browsing through the source but the code quality and security is pretty dismal so far. Not to mention the confusing project structure. Magic numbers, ... and strings, all over the place [0]. Memory leak galore (debug code?) [1]. Probably buffer overflows all over the place, here's one I noticed [2]. I suspect others given the proliferation of opaque pointers and memcpy usage. [0] https://git…

You didn't mention the inconsistent (and somewhat weird) formatting of the source code. https://github.com/skypeopensource/skypeopensource2/blob/mas... https://github.com/skypeopensource/skypeopensource2/blob/mas... I cannot specify more examples.

I think part of it is caused by the tab-width setting. The developer appears to have been using a tab-width of 4, and there are some instances where they used spaces for indentation without realising.

The only explains some of the wierdness though. That second link is completely inexplicable.

Re: Skypeopensource2 – Skype client based on reversing Skype 5.5

#42

Post by sargun » Sun, Sep 04, 2016, 12:28 PM UTC

PieterH wrote: post #38

My guess at the origins of this project... Firm somewhere far away where Microsoft's lawyers cannot reach (China?) wanted Skype capability in their product and paid this smart Russian guy to reverse-engineer the Skype client. Smart guy gets permission to open source it and publishes it with commercial license option with hopes of finding more such clients. Personally I'd not touch this with a 3-meter bargepole, becau…

I doubt it. What prevents a Chinese citizen from installing Skype? Nothing. It's the payment and protocol that are blocked.

Looks useful for command and control type applications though.

Re: Skypeopensource2 – Skype client based on reversing Skype 5.5

#43

Post by jacquesm » Sun, Sep 04, 2016, 12:29 PM UTC

PieterH wrote: post #38

My guess at the origins of this project... Firm somewhere far away where Microsoft's lawyers cannot reach (China?) wanted Skype capability in their product and paid this smart Russian guy to reverse-engineer the Skype client. Smart guy gets permission to open source it and publishes it with commercial license option with hopes of finding more such clients. Personally I'd not touch this with a 3-meter bargepole, becau…

Telecommunications products should be based around open protocols. That Skype keeps their protocols to themselves should not be reason enough to send lawyers after software implementing interoperability after reverse engineering.

Re-using the reverse engineered code is the problem, he should have simply used it to spec out the protocol and then use that spec to re-implement it.

Re: Skypeopensource2 – Skype client based on reversing Skype 5.5

#44

Post by contingencies » Sun, Sep 04, 2016, 12:30 PM UTC

sargun wrote: post #42

PieterH wrote: post #38

My guess at the origins of this project... Firm somewhere far away where Microsoft's lawyers cannot reach (China?) wanted Skype capability in their product and paid this smart Russian guy to reverse-engineer the Skype client. Smart guy gets permission to open source it and publishes it with commercial license option with hopes of finding more such clients. Personally I'd not touch this with a 3-meter bargepole, becau…

I doubt it. What prevents a Chinese citizen from installing Skype? Nothing. It's the payment and protocol that are blocked. Looks useful for command and control type applications though.

It's not blocked. However, if you download in China you get a version specifically compromised for Chinese government surveillance.

Re: Skypeopensource2 – Skype client based on reversing Skype 5.5

#45

Post by EugeneOZ » Sun, Sep 04, 2016, 12:31 PM UTC

babuskov wrote: post #27

EugeneOZ wrote: post #18

Earlier quoted context omitted.

My words are true. Our (russians) colloquial lexicon have tremendous amount of words from thieves jargon. Constitution in Russia have less meaning than thieves' laws. Our users, even programmers/hackers are trying to get free any software - it's kind of snobbery to use paid software in Russia. Maybe it's something wild for you, but it's reality in Russia.

> it's kind of snobbery to use paid software in Russia Perhaps there's a big percentage of people who feel the same, but there are also many people who pay for software: http://www.pcgamer.com/gabe-newell-on-piracy-and-steams-succ...

I'm not saying it's good, of course, I regret about such level of evolution. I use paid licenses :)

Re: Skypeopensource2 – Skype client based on reversing Skype 5.5

#46

Post by Iv » Sun, Sep 04, 2016, 12:32 PM UTC

PieterH wrote: post #38

My guess at the origins of this project... Firm somewhere far away where Microsoft's lawyers cannot reach (China?) wanted Skype capability in their product and paid this smart Russian guy to reverse-engineer the Skype client. Smart guy gets permission to open source it and publishes it with commercial license option with hopes of finding more such clients. Personally I'd not touch this with a 3-meter bargepole, becau…

> because I live in a country where people use copyright

I live in a EU country where interoperability is a law yet is almost never respected, so I say, fuck copyright in that case.

However, this is not the first successful reverse engineering of skype. Each time they broke compatibility with their next version.

Re: Skypeopensource2 – Skype client based on reversing Skype 5.5

#47

Post by showmustgoon » Sun, Sep 04, 2016, 12:32 PM UTC

sillysaurus3 wrote: post #10

andwur wrote: post #8

I haven't spent much time browsing through the source but the code quality and security is pretty dismal so far. Not to mention the confusing project structure. Magic numbers, ... and strings, all over the place [0]. Memory leak galore (debug code?) [1]. Probably buffer overflows all over the place, here's one I noticed [2]. I suspect others given the proliferation of opaque pointers and memcpy usage. [0] https://git…

"How dare you show your project when it has flaws!"

If these flaws are minor or inconsequential, then you might be right about your remark but if these flaws are flagrant or critical, then the OP had the right attitude to make concerns public.

Re: Skypeopensource2 – Skype client based on reversing Skype 5.5

#48

Post by fulafel » Sun, Sep 04, 2016, 12:32 PM UTC

viraptor wrote: post #23

andwur wrote: post #8

I haven't spent much time browsing through the source but the code quality and security is pretty dismal so far. Not to mention the confusing project structure. Magic numbers, ... and strings, all over the place [0]. Memory leak galore (debug code?) [1]. Probably buffer overflows all over the place, here's one I noticed [2]. I suspect others given the proliferation of opaque pointers and memcpy usage. [0] https://git…

The magic values look ok to me. I mean, some values are known, some aren't - it's still early days. Hopefully more will be labeled / split up into components with time. But I agree that it would be dangerous to use now. And the author isn't a skilled VCS user or open source dev either. (comments say all rights reserved)

Re: Skypeopensource2 – Skype client based on reversing Skype 5.5

#49

Post by Iv » Sun, Sep 04, 2016, 12:34 PM UTC

wolfgke wrote: post #31

justinlardinois wrote: post #25

>> whether or not it is a clean-room reverse-engineered code, like Wine/ReactOS > No. Not clean room, not chinese wall. If it's not clean room, then there's probably copyright violations. For reference: https://en.wikipedia.org/wiki/Clean_room_design Also, offering commercial licensing? That's a good way to get a lot worse than just a DMCA takedown.

> If it's not clean room, then there's probably copyright violations. This is the law in the United States. From the links given in the readme file the authors are probably from Russia.

As a non-US citizen, I can't wait to see a world where a whole IT industry will exist without caring much about merchandability in the US.

Re: Skypeopensource2 – Skype client based on reversing Skype 5.5

#50

Post by besselheim » Sun, Sep 04, 2016, 12:35 PM UTC

I remember seeing an earlier incarnation of this around five years ago; I'm very impressed with the author's dedication to this project.

I don't know if it is still the case now, but I recall that earlier versions of Skype were quite heavily obfuscated and contained anti-debugging mechanisms. So it would have been quite an intricate reversing effort to get past these, on top of figuring out the protocol.

Over time, Microsoft has changed the Skype protocol significantly since version 5.5 so I do wonder how applicable this work is to the current crop of clients.