https://nitter.poast.org/gf_256/status/1782656618015904103
Oh, a Nitter instance that still works?
I guess it's going to die soon like the other as they run out of guest accounts from scrapping…
Reverse engineering a software crack
31–40 of 95 posts
Re: Reverse engineering a software crack
#32[flagged]
Re: Reverse engineering a software crack
#33It’s done in a similar way on macOS: a dylib is added to the bundle and an LC_LOAD command is added to the app binary. The dylib is the first thing that runs because of using the constructor attribute, like this: https://notes.alinpanaitiu.com/Injecting%20a%20DYLIB%20into%...
The nice thing is that a signed app will refuse to load a dylib that does not have the same signature. So crackers will be forced to change the whole app signature which can be easily detected in app code.
I have that kind of protection in Lunar (https://lunar.fyi/) and Clop (https://lowtechguys.com/clop) and it seems to be good enough as they have no recent cracks.
Re: Reverse engineering a software crack
#34[flagged]
[deleted]
Re: Reverse engineering a software crack
#35This was a pretty long read and I didn't really get much from it. The format of a million tweets is awful. tl;dr it patches the executable by having a shim dll that does the patch when it gets loaded. Pretty common in the game modding community. It finds where it needs to patch by scanning for a byte pattern. What does the actual patch do? No idea, that's what I was waiting for and I never got it. I was expecting a d…
[deleted]
Re: Reverse engineering a software crack
#36A nice topic and insight if not for the way it is written. I could not finish it. It feels the author is unable to articulate his thoughts without interjecting curses and write incoherently. Is this how people communicate technically in the newer generations?
[deleted]
Re: Reverse engineering a software crack
#37Why can't I see the rest but only the first title tweet? Is that the case or is it a bug?
[deleted]
Re: Reverse engineering a software crack
#38It’s done in a similar way on macOS: a dylib is added to the bundle and an LC_LOAD command is added to the app binary. The dylib is the first thing that runs because of using the constructor attribute, like this: https://notes.alinpanaitiu.com/Injecting%20a%20DYLIB%20into%... The nice thing is that a signed app will refuse to load a dylib that does not have the same signature. So crackers will be forced to change the…
While code signing and verification is the way, you should also include a step on your own and not rely on the OS to do that for you. Apple’s code signing has been bypassed a few times. Granted they patch it, however one can include a script that enables developer mode in a terminal process that can then disable code signing (enable in-secure apps via developer-mode AppleScript).
It’s impossible to get past inspection on the Apple Store due to that extra script in the app bundle but a downloaded dmg off the web…
Re: Reverse engineering a software crack
#39A nice topic and insight if not for the way it is written. I could not finish it. It feels the author is unable to articulate his thoughts without interjecting curses and write incoherently. Is this how people communicate technically in the newer generations?
> Is this how people communicate technically in the newer generations?
I suspect this question is in bad faith but I'll answer anyway: this live tweeted thread is more like someone's thought stream, it is not a technical report.
Many humans are capable of both technical writing, free of cursing, and also of dumping a swear-filled thought stream right into their favourite medium - especially when excitedly reverse engineering, or doing anything they're passionate about.
This has been happening for a long time and is not about "the newer generation". You could've found me writing in a similar way on IRC in the late 90s, also talking about reversing.
FWIW your comment feels valid enough up until your final sentence, you just didn't need to attack "the newer generations".
Re: Reverse engineering a software crack
#40This was a pretty long read and I didn't really get much from it. The format of a million tweets is awful. tl;dr it patches the executable by having a shim dll that does the patch when it gets loaded. Pretty common in the game modding community. It finds where it needs to patch by scanning for a byte pattern. What does the actual patch do? No idea, that's what I was waiting for and I never got it. I was expecting a d…
Agree, this was just a really long thread of someone creating structs in Ida.
That’s about 75% of reverse engineering work in IDA or Ghidra, to be fair: labelling/annotating shit, adding types to shit, and making sense of structs and other data types.
There’s extensions to both which automatically try detect such things from common libraries/known calls/etc which massively cuts down on the timesink.