81–90 of 180 posts
> In Mach-O binaries, functions whose pointers are in the __mod_init_funcs run before main. Remember that obfuscation makes your code run slower. This specific one is part of the reason why the dyld team probably hates you.
This is an awesome write-up; I’m shocked at the level of effort that went into Snap’s obfuscation process. It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing more. Another comment mentioned that this effort is outsourced, so not only are there teams, but entire companies dedicated to this! What a blast that must be... though the immense am…
> though the immense amount of [invested|wasted] (take your pick depending on cynicism) effort spent on this game makes me a little sad that's an odd position to take. You seem to be ignoring the philosophy behind the cat&mouse game that is RE (and Security Engineering in general). What you call cosplaying Sisyphus is to me one of the most rewarding aspects of Tech. Breaking things especially is fun when somebody has…
Earlier quoted context omitted.
Yes that complicates things. But if you can find the cert in the binary's data section, maybe you can patch it with your own.
Assuming this is for Android, the APK would no longer be signed and would cause all login attempts to fail. Have a read about "SafetyNet Attestion API" for Android.
Philosophically I never gave much thought to securing app client code. Why not just track usage stats and ban clearly fake/high throughput users?
They have a vested interest in playing dumb to that fact. They can't really do so if the content escapes out into the wild and shows up in congressional hearings, lawsuits, FBI investigations, DOJ reports, etc.
I remember taking a reverse engineering course in the university where the professor didn't even bother to explain the basics, it was like black magic and left me frustrated, but I still feel amazed when I read blog posts like these.
I'm curious, can anyone recommend any techniques (or companies providing solutions) for attempting something similar with javascript in a browser calling an API? Obviously it's much more difficult to obfuscate an algorithm for generating a client token in JS than it would be in assembly, but I'm just curious if anyone has tried any form of "lock down my API so it's only callable from the web front end I provide" obfu…
Their approach is to make a blob of code which collects all kinds of details about its environment (for example, Object.keys(window) ). It then uses a hash/concat of those details (with some random too) to decode data to decide what else to collect, hashes or concatenates those in too. Repeat a few times. Then send the final data blob back to the server.
The server can then run a tiny emulator to run the code with the same seed random to check the results are the same on a whitelist of allowed environments.
a) outbound bots that send messages to users created in bulk messaging millions of users. b) inbound chatbots that answer messages c) when they had snapcash, they didnt want bots generated collecting cash.
spam is a multi million dollar industry.
@3eed i guess it's not considered obfuscation but you gotta pass the correct version # or you won't be able to connect either, old versions are immediately obsolete.
to answer everyone asking 'why do they do it????' its because of spam, that simple. they dont want: a) outbound bots that send messages to users created in bulk messaging millions of users. b) inbound chatbots that answer messages c) when they had snapcash, they didnt want bots generated collecting cash. spam is a multi million dollar industry. @3eed i guess it's not considered obfuscation but you gotta pass the corr…