Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering the obfuscated TikTok VM

github.com

Post reply on HN
Print view View original

91–100 of 131 posts

Re: Reverse engineering the obfuscated TikTok VM

#91

Post by like_any_other »

Scaevolus wrote: post #42
godelski wrote: post #3

This seems like quite a lot of work to hide the code. What would the legitimate reasons for this be? Because it looks like it would make the program less optimized and more complexity just leads to more errors. I understand the desire to make it harder for bots, but 1) it doesn't seem to be effective and bots seem to be going a very different route 2) there's got to be better ways that are more effective. It's not li…

Obfuscation is one part of defense in depth. Tiktok also has a variety of captchas to block scrapers, independent of this. None of it's perfect, and they can be worked around, but by providing a barrier you've restricted some of the bad actors (spambots, scrapers) from acting at all. It's easier to deal with 100 spambots than 1000!

Unless the scrapers are DDoSing the site, I refuse to consider the downloading of publicly posted data as malicious. It shows how captured the conversation has become by corporate interests, that viewing or storing data posted free of charge, publicly, by their users, in a way not approved by that corporation, is seen as malicious, and the only morally allowed way to view it is to use their spyware-laden client.

Re: Reverse engineering the obfuscated TikTok VM

#92

Post by yjftsjthsd-h »

Wowfunhappy wrote: post #57

...can I ask a really stupid question? What is a VM in this context? I've used VM's for years to run Windows on top of macOS or Linux on top of Windows or macOS on top of macOS when I need an isolated testing environment. I also know that Java works via the "Javascript Virtual Machine" which I've always thought of as "Java code actually runs in its own lightweight operating system on top of the host OS, which makes i…

Nit:

> I also know that Java works via the "Javascript Virtual Machine"

Java Virtual machine. That Java and JavaScript are named the way they are is... basically a historical accident of a cross-promotion gone too far, IMO. They aren't really related (at least, in the way that the name might imply).

Now to your real question. Virtual machines are anything that is one computer pretending to be another computer. Sometimes, that's an x86_64 PC pretending to be another x86_64 PC to run a different OS. Sometimes that's an x86_64 PC pretending to be a 50-year-old mainframe ( https://opensimh.org/ really shines there). Sometimes it's an ARM laptop running macOS pretending to be an x86_64 PC so it can run Windows. And, relevant here, sometimes it's a phone pretending to be a machine that has never actually existed in hardware. You can just make up an imaginary machine that has any old characteristics you want. Maybe it has a built-in high-level network card that magically turns HTTP requests into responses without programs having to implement HTTP themselves. Maybe it has an imaginary graphics card that directly renders buttons. Maybe you imagine a CPU that runs Java opcodes directly. Whatever it is, if you can imagine a system and then write a program that emulates it, you can make a virtual machine and run stuff in it.

Re: Reverse engineering the obfuscated TikTok VM

#93

Post by ngneer »

Wowfunhappy wrote: post #57

...can I ask a really stupid question? What is a VM in this context? I've used VM's for years to run Windows on top of macOS or Linux on top of Windows or macOS on top of macOS when I need an isolated testing environment. I also know that Java works via the "Javascript Virtual Machine" which I've always thought of as "Java code actually runs in its own lightweight operating system on top of the host OS, which makes i…

This is not a stupid question. I have seen other comments on the thread that confuse the two terms and run with it. Better to ask than assume. Especially since "VM" is the same label for two or three distinct yet related notions in security.

The VM you are familiar with indeed can run an OS, and is indeed not what TikTok does.

#1 VMM - hypervisor runs VMs

#2 JVM/.NET - efficient bytecode

#3 Obfuscation - obscure bytecode

The main thing is that for #2 and #3 the machine language changes.

With "virtualization" as used in most contexts, involving a virtual machine monitor, or hypervisor, one creates zero or more new (virtual) machines, to execute on multiple software recipes. All the recipes are written in the same (machine) language, for all the machines. This can help security by introducing isolation, for example, where one VM cannot read memory belonging to another VM unless the hypervisor allows it.

With the "virtual machine" used for obfuscation, the machine language changes. The system performs the same actions as it would without obfuscation, but now it is performing those actions using a different machine language. Behaviorally, the result is the same. But, the new language makes it harder to reverse engineer the behavior.

Stupid example:

Original instruction: MOV A,B

Under hypervisor virtualization, VM0 and VM1 will perform this same instruction.

Under obfuscation virtualization, software will perform instructions that amount to the same result, but are harder to figure out. So, the MOV instruction is redefined and mapped onto a new (virtual) machine. The new machine does not simply leverage the existing instruction, rather an obfuscated sequence. For example:

A A A Obviously, the above transformation is easy to understand and undo. Others are harder to understand and undo. Look up MOVfuscator to see how crazy things may get.

Re: Reverse engineering the obfuscated TikTok VM

#95

Post by fmxsh »

fidotron wrote: post #40
ronsor wrote: post #4

There is no legitimate reason for a social media platform to employ this much obfuscation.

If you believe this you underestimate how adversarial the software world really is. TikTok will be on the receiving end of botnets by everything from commercial entities, state backed groups and criminals. They won't be betting that this stops that entirely, but it adds a layer of friction that is easy for them to change on a continuous basis. These things are also very good for leaving honeypots in where if someone…

It's an excellent strategy for the reasons you mention. And a kind of "security by principle of least privilege".

Re: Reverse engineering the obfuscated TikTok VM

#96

Post by Loughla »

klabetron wrote: post #35
kleiba wrote: post #33

Earlier quoted context omitted.

I've tried different ones, they all seem to do a great job.

Out of curiosity (as someone disappointingly new to prompt engineering), what’s an example prompt you used with some success?

For help with prompt engineering, take a graduate level grant writing course. It teaches you how to ask the right questions to get answers from humans and how to break down complicated processes into bite size pieces; really useable for llm's.

Re: Reverse engineering the obfuscated TikTok VM

#97

Post by dmitrygr »

xfeeefeee wrote: post #2

The fascinating process of reverse engineering this VM is detailed here. TikTok uses a custom virtual machine (VM) as part of its obfuscation and security layers. This project includes tools to: Deobfuscate webmssdk.js that has the virtual machine. Decompile TikTok’s virtual machine instructions into readable form. Script Inject Replace webmssdk.js with the deobfuscated VM injector. Sign URLs Generate signed URLs whi…

What is the purpose of you posting a bad ChatGPT summary of the original post?

Re: Reverse engineering the obfuscated TikTok VM

#98

Post by 18172828286177 »

ImPostingOnHN wrote: post #82
wutwutwat wrote: post #73

Earlier quoted context omitted.

You can also install some trusted certs and MITM the requests, replacing the content with whatever you'd like Likely overkill for this use case, but no matter the client, you can in theory do whatever you want to any traffic up until the point it leaves your network.

what toolset do you use for on-the-fly translation? ad-hoc code, or something with a more structured workflow, maybe? this sounds like a fun thing to try, thanks for your time

See Burpsuite

Re: Reverse engineering the obfuscated TikTok VM

#99

Post by fmxsh »

Wowfunhappy wrote: post #57

...can I ask a really stupid question? What is a VM in this context? I've used VM's for years to run Windows on top of macOS or Linux on top of Windows or macOS on top of macOS when I need an isolated testing environment. I also know that Java works via the "Javascript Virtual Machine" which I've always thought of as "Java code actually runs in its own lightweight operating system on top of the host OS, which makes i…

It sounds more advanced than it is.

It's a function wrapping the functionality of its host environment. Then provides the caller with its own byte code language to execute instructions. The virtual machine translates those instructions to the corresponding real functionality of the host environment (Javascript) upon execution.

This particular case is sophisticated but the idea is simple.

Correct me if I'm wrong. I'm not knowledgeable in this. This is my current understanding of it.

Re: Reverse engineering the obfuscated TikTok VM

#100

Post by Scaevolus »

like_any_other wrote: post #91
Scaevolus wrote: post #42

Earlier quoted context omitted.

Obfuscation is one part of defense in depth. Tiktok also has a variety of captchas to block scrapers, independent of this. None of it's perfect, and they can be worked around, but by providing a barrier you've restricted some of the bad actors (spambots, scrapers) from acting at all. It's easier to deal with 100 spambots than 1000!

Unless the scrapers are DDoSing the site, I refuse to consider the downloading of publicly posted data as malicious. It shows how captured the conversation has become by corporate interests, that viewing or storing data posted free of charge, publicly, by their users, in a way not approved by that corporation, is seen as malicious, and the only morally allowed way to view it is to use their spyware-laden client.

What if the user has disabled downloads of a video? Should the creator (and copyright owner) of a piece of media not be allowed even token attempts to prevent copying?
Post reply on HN