Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering a software crack

twitter.com

Post reply on HN
Print view View original

51–60 of 95 posts

Re: Reverse engineering a software crack

#51

Post by chc4 »

cedws wrote: post #49

Very interesting. I really should get back into RE. Selfish question for a project of my own: is there any way to magically gain early code execution in a process on Windows other than a shim DLL? I'm too lazy to write one to pass through the all exports (reflective shim DLL possible...?)

CreateProcess the victim with CREATE_SUSPENDED, do whatever code patching, then ResumeThread it. Pretty sure you can even CreateRemoteThread into the victim for DLL injection, since it just suspends the primary thread, and then patch "yourself" in DllMain instead of having to do remote memory calls.

Re: Reverse engineering a software crack

#52

Post by fragmede »

internetter wrote: post #50
alin23 wrote: post #44

Earlier quoted context omitted.

For sure, it’s just a bit more effort to reverse the app binary and find that part of the code. Enough effort to deter most crackers apparently.

The macOS cracking scene is also much much weaker. It's 1. Mildly harder on a OS level 2. Less popular in countries that produce the most cracks 3. Less popular in general 4. Has an audience that is demonstrably more likely to pay for software 5. Has less strong reverse engineering software. Hopper was awful. Also, I just wanted to say I love your work. I've learned a lot from your blog, your free trial strategies ar…

ida pro has a Mac release

Re: Reverse engineering a software crack

#53

Post by lmm »

RockRobotRock wrote: post #26
mrguyorama wrote: post #14

Earlier quoted context omitted.

I feel like this person is trying to copy Foone's voice but just doesn't get it

Cybersec twitter is just awful. Everything has to be a call out or a dunk on someone/some company. It's all so negative.

Much like the rest of twitter then.

Re: Reverse engineering a software crack

#55

Post by toofy »

RockRobotRock wrote: post #26
mrguyorama wrote: post #14

Earlier quoted context omitted.

I feel like this person is trying to copy Foone's voice but just doesn't get it

Cybersec twitter is just awful. Everything has to be a call out or a dunk on someone/some company. It's all so negative.

As a sibling already pointed out, this is pretty much all of twitter now.

Infosec twitter moved over to Mastodon a while back, some are also trying out bluesky but Mastodon is where the community has mainly roosted.

Re: Reverse engineering a software crack

#56

Post by 486sx33 »

amatecha wrote: post #19
can16358p wrote: post #15

Why can't I see the rest but only the first title tweet? Is that the case or is it a bug?

"as designed", due to the gradual decrease in Twitter's functionality due to unknown reasons (probably trying to manipulate people into signing up to boost user count and ad revenue)

Because AI models kept trying to train on twitter for free.

Re: Reverse engineering a software crack

#57

Post by xyst »

alin23 wrote: post #33

It’s done in a similar way on macOS: a dylib is added to the bundle and an LC_LOAD command is added to the app binary. The dylib is the first thing that runs because of using the constructor attribute, like this: https://notes.alinpanaitiu.com/Injecting%20a%20DYLIB%20into%... The nice thing is that a signed app will refuse to load a dylib that does not have the same signature. So crackers will be forced to change the…

> ... it seems to be good enough as they have no recent cracks.

challenge accepted

Re: Reverse engineering a software crack

#58

Post by bobmcnamara »

alin23 wrote: post #33

It’s done in a similar way on macOS: a dylib is added to the bundle and an LC_LOAD command is added to the app binary. The dylib is the first thing that runs because of using the constructor attribute, like this: https://notes.alinpanaitiu.com/Injecting%20a%20DYLIB%20into%... The nice thing is that a signed app will refuse to load a dylib that does not have the same signature. So crackers will be forced to change the…

Sometimes fixing integrity checks can be as simple as replacing the failure case with nops :)

Re: Reverse engineering a software crack

#60

Post by soonerroadie »

486sx33 wrote: post #56
amatecha wrote: post #19

Earlier quoted context omitted.

"as designed", due to the gradual decrease in Twitter's functionality due to unknown reasons (probably trying to manipulate people into signing up to boost user count and ad revenue)

Because AI models kept trying to train on twitter for free.

Okay, Elon (jk).
Post reply on HN