71–80 of 95 posts
All the swearing turned me off. I don't mind cussing and use them myself, but does every tweet need to drop the f bomb?
It reminds me of a really smart kid who doesn't want to be seen as a nerd, so writes nonchalantly and injects vulgarities into an otherwise brilliant project. Good Will Hunting vibes.
It's not really offensive, it's just distracting.
Very interesting. I really should get back into RE. Selfish question for a project of my own: is there any way to magically gain early code execution in a process on Windows other than a shim DLL? I'm too lazy to write one to pass through the all exports (reflective shim DLL possible...?)
CreateProcess the victim with CREATE_SUSPENDED, do whatever code patching, then ResumeThread it. Pretty sure you can even CreateRemoteThread into the victim for DLL injection, since it just suspends the primary thread, and then patch "yourself" in DllMain instead of having to do remote memory calls.
Earlier quoted context omitted.
The macOS cracking scene is also much much weaker. It's 1. Mildly harder on a OS level 2. Less popular in countries that produce the most cracks 3. Less popular in general 4. Has an audience that is demonstrably more likely to pay for software 5. Has less strong reverse engineering software. Hopper was awful. Also, I just wanted to say I love your work. I've learned a lot from your blog, your free trial strategies ar…
> 4. Has an audience that is demonstrably more likely to pay for software The flip side of this is that I've noticed software written solely for macOS/iOS is often more polished than many of the most popular FOSS projects written for Linux. Obviously I don't have any expectation of software provided for free, but as someone who makes a living developing software I do find it funny how much reticence there is among ot…
Earlier quoted context omitted.
> 4. Has an audience that is demonstrably more likely to pay for software The flip side of this is that I've noticed software written solely for macOS/iOS is often more polished than many of the most popular FOSS projects written for Linux. Obviously I don't have any expectation of software provided for free, but as someone who makes a living developing software I do find it funny how much reticence there is among ot…
I have an aversion for paying for artificially scarce things. I am happy to "pay for software" if that software doesn't exist yet, and what I'm actually paying for is the labor to make it.
It’s done in a similar way on macOS: a dylib is added to the bundle and an LC_LOAD command is added to the app binary. The dylib is the first thing that runs because of using the constructor attribute, like this: https://notes.alinpanaitiu.com/Injecting%20a%20DYLIB%20into%... The nice thing is that a signed app will refuse to load a dylib that does not have the same signature. So crackers will be forced to change the…
> ... it seems to be good enough as they have no recent cracks. challenge accepted
I believe being successful in reverse engineering, cracking, bypassing security layers (e.g., unlocking cars without keys), and other hacks comes down to understanding the basics of how these systems are designed to work in the first place. Add to this, the possession of the right toolbox to do the job.
Back in 2010, I took on the challenge of cracking paid/licensed POS software. I am, in no way, a cracker or hacker, but once I understood how this app works, I followed a simple logic based on these rules:
a. The app had a trial version with a number of *runs* set, and with each launch of the app, the number will decrease by one. It was set to around 100, I believe.
b. The app runs on a LAN, on multiple computers, with one being the server. To my surprise, there were no IP configurations, and it turned out that it worked on LAN by setting the app directory as a *shared folder* in Windows!!
c. On each app launch, even from other computers (having access to the shared folder), the count will decrease.
1. Since you have a shared folder, based on (c) above, I assumed the location where the count number is stored *must be inside* this shared folder, not in the Windows registry or other places.
2. I launched the app, wrote down the current count, and closed it.
3. I searched inside this shared folder for *.* (all files), then sorted them by last edited.
4. I picked the first one from the search result as it was the only one with the same time as *now*; it was in a binary format.
5. I opened it using a hex editor, converted (using calc.exe) to HEX the count I wrote down on (2), searched for it, and found it. I identified its position.
6. I closed the hex editor, repeated (2),(3) and (4), and got the same results.
7. Now, I typed 999 in calc.exe and converted it to HEX, and in the open HEX editor, I edited the count at its current position with the new value, saved, and closed the binary file.
8. Restarted the POS app, went to about, and.. booooom , it now thinks that you have 999 days remaining :)
Pretty interesting! I believe being successful in reverse engineering, cracking, bypassing security layers (e.g., unlocking cars without keys), and other hacks comes down to understanding the basics of how these systems are designed to work in the first place. Add to this, the possession of the right toolbox to do the job. Back in 2010, I took on the challenge of cracking paid/licensed POS software. I am, in no way,…
A nice topic and insight if not for the way it is written. I could not finish it. It feels the author is unable to articulate his thoughts without interjecting curses and write incoherently. Is this how people communicate technically in the newer generations?
> Is this how people communicate technically in the newer generations? I suspect this question is in bad faith but I'll answer anyway: this live tweeted thread is more like someone's thought stream, it is not a technical report. Many humans are capable of both technical writing, free of cursing, and also of dumping a swear-filled thought stream right into their favourite medium - especially when excitedly reverse eng…
Why not? He's exactly right, in my experience. It's definitely been my experience that the newer generations (of Americans) are much more likely to casually use swear words, usually the f-word, in regular conversation, even at work. I hear it all the time with my American colleagues. When I was their age, no one talked like that at work, or really in general except maybe in private with their closest friends.
Another big difference is mass media: when I was their age, American TV did not allow swear words. But in the last 10-20 years, it's completely changed, and it's pretty common to hear the f-word on regular TV. So of course the "newer generations" are going to reflect this in their casual speaking.
Earlier quoted context omitted.
I have an aversion for paying for artificially scarce things. I am happy to "pay for software" if that software doesn't exist yet, and what I'm actually paying for is the labor to make it.
Quite convenient that you’d only pay software if developers contacted you years in advance, and none of them were clever enough to do so
Earlier quoted context omitted.
Quite convenient that you’d only pay software if developers contacted you years in advance, and none of them were clever enough to do so
My mechanic doesn't speculatively contact me about work I should do on my car. If I want new software that I can't write myself, I should reach out to developers, not the other way around.