Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering Snapchat (Part II): Debofuscating the Undeobfuscatable

hot3eed.github.io

Post reply on HN
Print view View original

21–30 of 63 posts

Re: Reverse Engineering Snapchat (Part II): Debofuscating the Undeobfuscatable

#21

Post by fingerlocks »

drudu wrote: post #15
hackernewsn00b wrote: post #10

Hey OP, since you're here: I find this pretty hard to follow. Would you be open to writing a longform version of this aimed at the tutorial level? Reading between the lines, I would guess you're trying to demonstrate that you really know what you're doing. Maybe as a proof of concept for possible employment opportunities. If so, that's great! Good luck. But if I were interested in reverse engineering some other app,…

Obviously not the OP but I think that a longform version of this would be an entire book/college level course. I wish I could learn how to reverse state of the art obfuscation in a single, long post but that's just not how it works.

I would pay for that book.

Re: Reverse Engineering Snapchat (Part II): Debofuscating the Undeobfuscatable

#22

Post by xmprt »

saltedonion wrote: post #20
wayne wrote: post #13

This level of API obfuscation reminds me of forever ago when MSN Messenger figured out AOL's AIM API, so MSN Messenger could send AIM messages, which annoyed AOL. AOL would make API changes to break MSN, but MSN would update the client and stay ahead. Eventually to make the API uncloneable, AOL changed their payload to exploit a buffer overrun in their own AIM clients that wouldn't be in the MSN clients. https://nplu…

Very interesting. I think this would likely lead to lawsuits today, under a complaint violating DMCA.

Is there legal precedent for copyrighting APIs?

Re: Reverse Engineering Snapchat (Part II): Debofuscating the Undeobfuscatable

#23

Post by djhaskin987 »

xmprt wrote: post #22
saltedonion wrote: post #20

Earlier quoted context omitted.

Very interesting. I think this would likely lead to lawsuits today, under a complaint violating DMCA.

Is there legal precedent for copyrighting APIs?

That's actually the central issue behind the Supreme Court case battle between Oracle and Google right now: whether or not you can copyright apis

Re: Reverse Engineering Snapchat (Part II): Debofuscating the Undeobfuscatable

#24

Post by KMag »

craftinator wrote: post #8
drfuchs wrote: post #2

“Debofuscating”???

Maybe you don't understand Latin root words as prefixes and suffixes, in which case I highly recommend doing a bit of research into it. It really makes the English language more understandable when you can parse words based on their roots rather than on rote memorization.

They were commenting on "bofuscate" vs. "obfuscate". I suspect they've got a healthy understanding of what the prefix "de" means here.

Re: Reverse Engineering Snapchat (Part II): Debofuscating the Undeobfuscatable

#26

Post by stjohnswarts »

djhaskin987 wrote: post #23
xmprt wrote: post #22

Earlier quoted context omitted.

Is there legal precedent for copyrighting APIs?

That's actually the central issue behind the Supreme Court case battle between Oracle and Google right now: whether or not you can copyright apis

That's going to be a really big decision in our world of software. I hope that SCOTUS doesn't side with the devil.

Re: Reverse Engineering Snapchat (Part II): Debofuscating the Undeobfuscatable

#28

Post by CobrastanJorji »

djhaskin987 wrote: post #23
xmprt wrote: post #22

Earlier quoted context omitted.

Is there legal precedent for copyrighting APIs?

That's actually the central issue behind the Supreme Court case battle between Oracle and Google right now: whether or not you can copyright apis

Indeed, an answer of "no, they're not copyrightable" would leave the world generally how it is today. An answer of "yes, all existing APIs are copyrightable" would be tremendously impactful in all sorts of ways I can't even imagine. Presumably someone would immediately sue somebody else because of a tenuous claim to ownership of, say, HTTP or some JavaScript extension.

Microsoft has filed an amibus brief for the "not copyrightable side," as has the EFF, IBM, Red Hat, and a team of 83 computer scientists.

You should probably note the folks on the "yes, copyrightable" side for future reference as well, including Dolby, the Motion Picture Alliance, SAS, the DoJ, the Recording Industry Association of America, and also 4 CS professors (Dr Spafford of Purdue, Dr. Ding of UC Davis, Dr Hollaar at Utah H, and Dr. Porter at maryland U).

Re: Reverse Engineering Snapchat (Part II): Debofuscating the Undeobfuscatable

#29

Post by worewood »

wayne wrote: post #13

This level of API obfuscation reminds me of forever ago when MSN Messenger figured out AOL's AIM API, so MSN Messenger could send AIM messages, which annoyed AOL. AOL would make API changes to break MSN, but MSN would update the client and stay ahead. Eventually to make the API uncloneable, AOL changed their payload to exploit a buffer overrun in their own AIM clients that wouldn't be in the MSN clients. https://nplu…

I think the most important, and this article left it out, is why exactly this makes the API uncloneable - why couldn't MSN just emulate the buffer overflow behavior like it was doing with everything so far?

As the article says, the client also responded with some code. What I think was happening: the client was responding with portions of its own executable memory, which could be checked by AOL servers.

That way for MSN to emulate that behavior, it would need to have the AIM client's executable code inside itself, which would be an easy win in a copyright lawsuit.

Re: Reverse Engineering Snapchat (Part II): Debofuscating the Undeobfuscatable

#30

Post by bluesign »

coolspot wrote: post #25

Shouldn’t you be able to find any code that scans for breakpoints easily and patch it to be blind?

Normally it is more like calculating hash from code piece, then xor result with constant and jump. (In general cases, never reversed snap)

So usually there is nothing to patch.

Post reply on HN