Alex Ionescu - Reversing Without Reversing
https://www.youtube.com/watch?v=2D9ExVc0G10
A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”
111–120 of 291 posts
Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”
#112Earlier quoted context omitted.
> Consider that the name of local variables is never part of the binaries, only public symbols are. "Never" and "only public" are wrong in the statement above, because non public symbols were indeed released by Microsoft. I guess you are young enough not to know that Microsoft accidentally did release some NT builds with the names of the internal variables, and such builds were intentionally made with less compiler o…
Microsoft does not release the kernel’s private symbols, trust me on that. But yes there was some leaks in the past, small portions of NT4 and W2K were leaked, I think I link to a Google query pointing to articles discussing the leaks in the Quora reply.
Well that's categorically untrue. Sure they don't release private symbols intentionally but they have done in the past accidentally. At that point it becomes a bit of a grey area, undoubtedly leaked/stolen source code is a no-no but reversing from private symbols when they do leak seem harder to quantify as you still need to reverse engineer the code, just structures/names etc are already known.
Private symbols are not the only way of gleaning more information, other examples I can think of are:
* Checked builds (prior to Win10). These builds shipped de-optimized kernels (e.g. no inlines) typically with copious debug strings which gave away important details. For example I gleaned a lot of knowledge of ALPC MSRPC from the checked build of rpcrt4.dll from Windows 8.
* SDK/DDK headers, especially in the brave new world of insider previews with preview SDK/DDKs there is sometimes information present which should not have been released including "private" information. Again bit of a grey area.
* The private symbols MS do ship. For example a significant proportion of the COM runtime has private symbols, intentionally. You can extract from those a surprising amount of system call structure information.
I'd recommend watching Alex Ionescu's talk at OffensiveCon about how he does reverse engineering on Windows to see many of these things in action. https://www.youtube.com/watch?v=2D9ExVc0G10
I'm not saying any of this would make it a clean-room re-implementation but to say ReactOS cannot possibly have been reverse engineered without just up and copying source isn't true.
edit: Formatting.
Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”
#113Earlier quoted context omitted.
I do not wish to view the leaked copies of Windows source code, unfortunately. It does have potential legal ramifications, in the United States. If someone who doesn't care can attempt to audit it, that would be absolutely great. That said, KiInitializeContextThread isn't 'secret' enough to not appear, it is a well-known bit of internals. Here you can find some docs about it on Microsoft's own website, albeit I have…
If Microsoft cared, they wouldn’t be hosting that on their very own servers. GitHub belongs to Microsoft. They could pull that down at any time just because they feel like it. But they haven’t. That’s a pretty solid sign that there’s not any legal consequence to viewing it.
Well, my paranoid 99% says that they could keep it online on purpose so that all people viewing it fall in a legal disadvantage position. Removing that code would achieve nothing in secrecy today compared to the legal leverage they can get tomorrow by keeping it online.
Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”
#114Earlier quoted context omitted.
So... doesn't that confirm what he's saying? How could you possibly "clean room reverse engineer" while you certainly are not in a clean room?
The guy in the article is talking about variable names from the source. You wouldn't get that from Alex's style of reversing.
I assume that writing about Windows internals requires knowledge of said internals? Or do you think he never had access to the source code and has never seen anything, not even ideas of algorithms?
Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”
#115ReactOS underwent a big audit years ago because people kept saying things like this, and AFAIK it's over and nothing exciting turned up. [1] - https://reactos.org/wiki/Audit
The author of post, Axel Rietschin at Microsoft, should remove this post and publicly apologize for his baseless defamation of ReactOS ("like a baby mosquito on the back of an giant elephant") if he cannot give authoritative evidence to back his claims. There may be copyright issues in some subroutines, but calling the entire project "a ripoff of the Windows Research Kernel" is an extraordinary, arrogant claim. If yo…
It’s my personal opinion and it’s based on my lecture of ReactOS code at the time I downloaded it (circa when I wrote my reply on Quora). I think anyone who can read C code can reach similar conclusions just by eyeballing the code in ReactOS and the code from the leaked Research Kernel, that can be found for example on GitHub. As a matter fact, someone on this thread did just that and it did not take that person very long (just minutes) to find some of the similarities that I, for one, qualify as troubling. It should not be a problem for anyone to repeat the experiment, all code is available for download. So why not go ahead and see that code with your own eyes? I think it’s highly improbable that a reimplementation of that magnitude came so close from the original in so many respects. I’ve been conducting interviews for years and screened some of the best and most promising future engineers coming from the best universities and I always ask the same coding questions. I was given many decent and correct answers, but never the actual implementation was similar to the level I can observe between ReactOS and the leaked Microsoft code. In fact every candidate wrote very different answers to the very same question, some even had very different approaches to the resolution of the same problems. I cannot explain how a team of people on a hyper-complex open source project can write nearly the same code - the source code looks very similar down to peculiar formatting idiosyncrasies - as a separate team of developers of the original closed-source project, just from observing the external behavior and/or reading the documentation, if available at all. I think this is impossible.
Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”
#116Earlier quoted context omitted.
The guy in the article is talking about variable names from the source. You wouldn't get that from Alex's style of reversing.
I assume that writing about Windows internals requires knowledge of said internals? Or do you think he never had access to the source code and has never seen anything, not even ideas of algorithms?
You can get knowledge of the internals and ideas of the algorithms from reverse engineering the released Windows binaries
Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”
#117Thanks for the link, o for a bunch of new followers on Quora today and was wondering why :) There are lots of good answers in this thread. In particular, someone took the time to look at the code, and that person wrote it only took them minutes to find similarities that make my opinion difficult to dismiss. About the lack of documentation, consider that only a tiny fraction of the kernel’s internals surface in the DD…
The more you write in these threads the more you sound like a fool.
https://youtu.be/2D9ExVc0G10
Start around the 9 minute mark.
Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”
#118Earlier quoted context omitted.
> Consider that the name of local variables is never part of the binaries, only public symbols are. "Never" and "only public" are wrong in the statement above, because non public symbols were indeed released by Microsoft. I guess you are young enough not to know that Microsoft accidentally did release some NT builds with the names of the internal variables, and such builds were intentionally made with less compiler o…
Microsoft does not release the kernel’s private symbols, trust me on that. But yes there was some leaks in the past, small portions of NT4 and W2K were leaked, I think I link to a Google query pointing to articles discussing the leaks in the Quora reply.
You chuckleheads “released” pretty much everything in the ASSERT statements of checked builds until Windows Vista.
Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”
#119Earlier quoted context omitted.
I assume that writing about Windows internals requires knowledge of said internals? Or do you think he never had access to the source code and has never seen anything, not even ideas of algorithms?
You can get knowledge of the internals and ideas of the algorithms from reverse engineering the released Windows binaries
Do you believe that is what Microsoft employees do while writing Windows Internals? I have serious trouble believing it. I'm not saying that it's not possible, just that it might not be the case there and these facts seem to confirm it.
Re: A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”
#120Earlier quoted context omitted.
The guy in the article is talking about variable names from the source. You wouldn't get that from Alex's style of reversing.
I assume that writing about Windows internals requires knowledge of said internals? Or do you think he never had access to the source code and has never seen anything, not even ideas of algorithms?
AFAIK, he never had privileged access while he was still commiting to ReactOS.