Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering Snapchat: Obfuscation Techniques

hot3eed.github.io

Post reply on HN
Print view View original

131–140 of 180 posts

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#131

Post by novaleaf »

3eed wrote: post #117
underdeserver wrote: post #94

Earlier quoted context omitted.

Funny thing about things like that is that you can likely write tools to automatically deobfuscate, if you know the mechanisms. Of course, this takes time and effort, and is beyond most spammers' capabilities.

I'm gonna write about this in pt. 2. Basically you can use symbolic execution to recover the CFG[1] (using something like miasm), you can eliminate dead code, restore dynamic lib calls with an emulation, and whatever else. But the point is that it would take an incredible amount of work and co-operation between tools, and then you wouldn't have even begun understanding anything about the binary, which is a whole anot…

awesome write up, really engaging! I enjoy the cliff hanger at the last line... "one strange trick"....

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#132

Post by underdeserver »

3eed wrote: post #118
Andoryuuta wrote: post #115

Earlier quoted context omitted.

This not quite true, especially with current state-of-the-art tools like Ghidra, IDA pro (with Hex-rays), etc. In fact, Rolf Rolles wrote a wonderful guest post[1] for the Hex-Rays blog about automating the reversal of this exact obfusactor, though he wasnt aware of it's origins at the time. [1]: https://www.hex-rays.com/blog/hex-rays-microcode-api-vs-obfu...

All these are great programs, but none of them can understand that level of obfuscation so far. As stated in the post, both Ghidra and IDA interpret the very first block in any of the obfuscated functions, which ends with an indirect branch, as a complete function in and of its own. Because this is the usual case, indirect branches AKA tail calls terminate a function to start another, all with the same stack frame. E…

I think the idea is that Ghidra's and IDA's plugin systems allow for manipulation of binaries at a level that allows writing deobfuscators over them.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#133

Post by snazz »

RNCTX wrote: post #84
jayd16 wrote: post #23

Philosophically I never gave much thought to securing app client code. Why not just track usage stats and ban clearly fake/high throughput users?

Because Snapchat is ultimately an application designed to trade in porn of amateurs including (and perhaps especially) teenagers. They have a vested interest in playing dumb to that fact. They can't really do so if the content escapes out into the wild and shows up in congressional hearings, lawsuits, FBI investigations, DOJ reports, etc.

I think you wildly misunderstand how many people (teenagers included) who use Snapchat for PG-rated things exclusively. The end-to-end encryption (of snaps) and “disappearing” nature makes it work well for anything sensitive, but porn is certainly not the only thing people use it for.

Also, any party to a conversation can use the report button to send the unencrypted message to Snap for review. They employ actual content moderators as well, who have made reports to federal law enforcement before.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#135

Post by [deleted] »

RNCTX wrote: post #84
jayd16 wrote: post #23

Philosophically I never gave much thought to securing app client code. Why not just track usage stats and ban clearly fake/high throughput users?

Because Snapchat is ultimately an application designed to trade in porn of amateurs including (and perhaps especially) teenagers. They have a vested interest in playing dumb to that fact. They can't really do so if the content escapes out into the wild and shows up in congressional hearings, lawsuits, FBI investigations, DOJ reports, etc.

[deleted]

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#136

Post by meowface »

elevenoh wrote: post #58
just-ok wrote: post #27

This is an awesome write-up; I’m shocked at the level of effort that went into Snap’s obfuscation process. It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing more. Another comment mentioned that this effort is outsourced, so not only are there teams, but entire companies dedicated to this! What a blast that must be... though the immense am…

>What a blast that must be... though the immense amount of [invested|wasted] (take your pick depending on cynicism) effort spent on this game makes me a little sad. All of these brilliant minds just... cosplaying Sisyphus? And we wonder why such a high % of tech workers have a deep discontent & are desperately searching for meaning.

I would find that a very fulfilling and meaningful project, personally. I'd actually consider it way more fulfilling than working on the core product, which likely mostly involves trying to think of and implement clever ways to expose users to ads and sponsored content, and otherwise try to directly and indirectly monetize users.

Here, the goal is to prevent phishers, fraudsters, scammers, spammers, catfish, impersonators, malware spreaders, etc. from running amok in a somewhat unprecedented way by tricking users en masse into thinking they're really receiving photos/videos in real-time, using automated tooling. My understanding is this heavy degree of obfuscation (combined with other anti-tampering tactics) has gone a very long way to mitigate a huge amount of abuse.

From talking to people who've tried to bypass these mechanisms to do unauthorized and potentially risky things (like send things from a custom client in a way that could allow for mass automation), they describe this as an essentially intractable hurdle from their perspective. Of course, it isn't in actuality, but it is for most people when compared to lots of other social media apps, and I expect Snap to change things around not long after OP releases part 2. Cat-and-mouse never ends.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#137

Post by QuickReply »

Andoryuuta wrote: post #115
pfundstein wrote: post #114

Earlier quoted context omitted.

The point is that we cannot automate reversing these obfuscation mechanisms the same way we cannot automate reversing a binary file to a higher level than assembly.

This not quite true, especially with current state-of-the-art tools like Ghidra, IDA pro (with Hex-rays), etc. In fact, Rolf Rolles wrote a wonderful guest post[1] for the Hex-Rays blog about automating the reversal of this exact obfusactor, though he wasnt aware of it's origins at the time. [1]: https://www.hex-rays.com/blog/hex-rays-microcode-api-vs-obfu...

inside developer console:

Array.from(document.images).forEach(img => console.log(img.src= img.src.replace("http://hexblog.com", "https://hex-rays.com")));

to make the blog readable

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#138

Post by 3eed »

imtringued wrote: post #128
underdeserver wrote: post #94

Earlier quoted context omitted.

Funny thing about things like that is that you can likely write tools to automatically deobfuscate, if you know the mechanisms. Of course, this takes time and effort, and is beyond most spammers' capabilities.

Most obfuscation techniques are lossy. You lose information such as project structure, names of files, data types, variable names and so on. Decompilation and deobfuscation might give you a shadow of the original source code but the benefits are overstated because the advantages over working directly with assembly code aren't that big. Most of the time is spent finding the dozen relevant functions out of 10000. If yo…

Couldn't agree more.

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#139

Post by 3eed »

novaleaf wrote: post #131
3eed wrote: post #117

Earlier quoted context omitted.

I'm gonna write about this in pt. 2. Basically you can use symbolic execution to recover the CFG[1] (using something like miasm), you can eliminate dead code, restore dynamic lib calls with an emulation, and whatever else. But the point is that it would take an incredible amount of work and co-operation between tools, and then you wouldn't have even begun understanding anything about the binary, which is a whole anot…

awesome write up, really engaging! I enjoy the cliff hanger at the last line... "one strange trick"....

"Evan Spiegel Hates this Trick!"

Re: Reverse Engineering Snapchat: Obfuscation Techniques

#140

Post by [deleted] »

zelly wrote: post #6

Snapchat is notoriously difficult to automate/spam. The goal is to get the X-Snapchat token. The most elegant solution is to find the secret in the binary and reverse the algorithm to generate tokens. Wouldn't it be easier to MITM the endpoint; set up a dummy server (which collects tokens) in front of a proxy that spoofs the DNS and TLS certs (may be easier on rooted Android than iOS). In my last attempt I gave up an…

[deleted]
Post reply on HN