This is what the top 1% of MIT grads work on. Obfuscating IP for a user data company.
It’s clever, but man... I have to believe these talented folks were destined for something greater.
Reverse Engineering Snapchat: Obfuscation Techniques
171–180 of 180 posts
Re: Reverse Engineering Snapchat: Obfuscation Techniques
#172Earlier quoted context omitted.
I would find that a very fulfilling and meaningful project, personally. I'd actually consider it way more fulfilling than working on the core product, which likely mostly involves trying to think of and implement clever ways to expose users to ads and sponsored content, and otherwise try to directly and indirectly monetize users. Here, the goal is to prevent phishers, fraudsters, scammers, spammers, catfish, imperson…
> Here, the goal is to prevent phishers, fraudsters, scammers, spammers, catfish, impersonators, malware spreaders, etc. from running amok in a somewhat unprecedented way by tricking users en masse into thinking they're really receiving photos/videos in real-time, using automated tooling. My understanding is this heavy degree of obfuscation (combined with other anti-tampering tactics) has gone a very long way to miti…
>Which is STILL in the service of trying to expose users to ads and sponsored content.
I agree with you; hence one of many reasons why I personally wouldn't want to work at Snap, for example. I guess just relative to the other things going on there, this at least is for a good cause at the object level, so if I were somehow forced to work there, I'd probably prefer this over product development, and, more importantly, I'd consider the goal of it a lot more worthwhile and good.
>I find it sad that people in our industry are so easily distracted by the technical challenge du jour without looking at the bigger picture of what their work is in service of, which was OP's point.
No, I was specifically disagreeing with OP's point: I was saying the meaning comes from preventing the abuse, rather than the enjoyment of the tech parts. The technical challenge justification was what I was trying to counter, though I maybe didn't make it clear enough. It's not about the tech, but the bigger picture of what the tech is in service of, even if that particular bigger picture is smaller than the overall big picture of the app and company as a whole.
That is, preventing malevolent people, and, in many cases, criminals, from exploiting, harassing, stealing from, and abusing users (many of whom are very young) in various ways. I think even if it were a company that was a million times less ethical, that'd still be a worthy thing to do, given that the company is probably going to exist and have lots of potentially vulnerable users either way.
Of course, in the grand scheme of things, you're still helping the corporation and keeping it in existence, yes. But I also don't think they're some dystopian corporation or something in this case. I myself personally do very deeply hate advertising, advertisements, adtech, whatever, you name it, but your phrasing of "what their work is in service of" makes it sound like Monsanto or something. They're not even anywhere near Facebook's level of badness (as far I'm aware, at least).
They make a fun app with a fun new communication paradigm that lots of people enjoy using, and they're trying to monetize it with ads. I'm not a fan of the app or the business model, but there are tons of way worse things in the world.
Re: Reverse Engineering Snapchat: Obfuscation Techniques
#173Earlier quoted context omitted.
Personally I don’t see these as the same. These attempts to prevent RE are mostly moot as the machine needs to interpret the code, so therefore it must be valid code and some of this either bloats the binary or decreases performance. The user pays for these inefficiencies (and are therefore user hostile) and in the case of battery powered devices incur additional costs through premature battery wear.
Snap is not usually something the user scrolls through all day (akin to FB/Insta infinite scroll); it's typically send a message or nude/recieve a message or nude and then backgrounded. There is a rare case where people watch clickbait ads for hours but that's usually plugged in laying in bed with nothing better to do
I very much beg to differ. Spend some time around the younger generations and you’ll see that you will have a hard time getting them to look away long enough to realize you’re even there.
Re: Reverse Engineering Snapchat: Obfuscation Techniques
#174Earlier quoted context omitted.
Snap is not usually something the user scrolls through all day (akin to FB/Insta infinite scroll); it's typically send a message or nude/recieve a message or nude and then backgrounded. There is a rare case where people watch clickbait ads for hours but that's usually plugged in laying in bed with nothing better to do
I very much beg to differ. Spend some time around the younger generations and you’ll see that you will have a hard time getting them to look away long enough to realize you’re even there.
I am one of them - Snap is generally not a "browse forever nonstop" engagement tool that's typical and standard behaviour for TikTok/FB/IG, it's actually somewhat used as a messaging tool (not that it precludes an excessively high volume of messages and groupchats)
Re: Reverse Engineering Snapchat: Obfuscation Techniques
#175Earlier quoted context omitted.
Bytecode is not required for applications targeting iOS. And I will note that the latter is fairly difficult to actually check in principle, and it's mainly enforced (actually, in certain cases it's not ;) ) in practice by the threat of consequences if they catch you doing it rather than testing.
So providing bitcode is still optional for release on App Store?
As long as you are not targeting watchOS or tvOS.
Re: Reverse Engineering Snapchat: Obfuscation Techniques
#176Earlier quoted context omitted.
> the breakpoint infinite loop This is a fairly standard debugging technique. > in-house memmove You sure they didn't just statically link a libc?
> the breakpoint infinite loop Have seen multiple times in CTFs
Usually the good CTFs don't stoop to stupid tricks like these, to be fair.
Re: Reverse Engineering Snapchat: Obfuscation Techniques
#177Re: Reverse Engineering Snapchat: Obfuscation Techniques
#178Earlier quoted context omitted.
I very much beg to differ. Spend some time around the younger generations and you’ll see that you will have a hard time getting them to look away long enough to realize you’re even there.
I am one of them - Snap is generally not a "browse forever nonstop" engagement tool that's typical and standard behaviour for TikTok/FB/IG, it's actually somewhat used as a messaging tool (not that it precludes an excessively high volume of messages and groupchats)
Well then I guess the others I see non stop using it must be figments of my imagination then and that somehow this all means obfuscation is now efficient. Also go search google, a 2 second search disproves you.
Re: Reverse Engineering Snapchat: Obfuscation Techniques
#179Re: Reverse Engineering Snapchat: Obfuscation Techniques
#180Earlier quoted context omitted.
Funny thing about things like that is that you can likely write tools to automatically deobfuscate, if you know the mechanisms. Of course, this takes time and effort, and is beyond most spammers' capabilities.
That works if the obfuscating patterns are all straightforward like a regular grammar. But if it's not possible to distinguish an obfuscation from genuine code, that could quickly become intractable (NP).
Generally obfuscated code is easy to spot, if not easy to reverse.