Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Analysis of Obfuscation Techniques Found in Apple FairPlay

nicolo.dev

Post reply on HN
Print view View original

1–10 of 56 posts

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#2

Post by nicolodev »

Thanks for submitting the article! Let me know if anyone has any questions. If you are wondering how Apple obfuscate its software, the answer is simple: they built some extensions for LLVM that applies code transformation directly to LLVM IR. LLVM IR is an intermediate language to represent the code that will be copied in binary.

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#3

Post by jchw »

nicolodev wrote: post #2

Thanks for submitting the article! Let me know if anyone has any questions. If you are wondering how Apple obfuscate its software, the answer is simple: they built some extensions for LLVM that applies code transformation directly to LLVM IR. LLVM IR is an intermediate language to represent the code that will be copied in binary.

Thanks for taking the time to write about your reverse engineering experience. I'm more of a programmer than a reverse engineer, but I do like to dabble in RE and analysis and dealing with obfuscation and techniques like virtualization is always quite a challenge. There's probably a lot of learning material out there, but it feels difficult to digest at times, so articles like these are always helpful for getting some perspective on how these things work out in practice, and getting a feel for some of the approaches you can use when you run into a roadblock. Definitely makes me want to go mess around with some binary analysis after work.

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#4

Post by nicolodev »

jchw wrote: post #3
nicolodev wrote: post #2

Thanks for submitting the article! Let me know if anyone has any questions. If you are wondering how Apple obfuscate its software, the answer is simple: they built some extensions for LLVM that applies code transformation directly to LLVM IR. LLVM IR is an intermediate language to represent the code that will be copied in binary.

Thanks for taking the time to write about your reverse engineering experience. I'm more of a programmer than a reverse engineer, but I do like to dabble in RE and analysis and dealing with obfuscation and techniques like virtualization is always quite a challenge. There's probably a lot of learning material out there, but it feels difficult to digest at times, so articles like these are always helpful for getting som…

Thanks for your comment. This article was written in one go, and it could be way better than the actual state. However I do appreciate that you mean to consider my article as a nice example on how things work out in practice. Being a programmer and knowing a little bit of reverse engineering is important (well, I'm still a programmer too!). If you have any questions, please let me know.

Regarding the difficulty of learning material, I can feel you. It was the same for me when I started (I have a lot of stuff to dig into!), and it's still. Academy papers might be difficult to understand, but once you comprehend the formalisms it'll be easier. For sure, understanding the formal formulas is another challenge that I haven't resolved yet.

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#7

Post by nicolodev »

t8sr wrote: post #5

[flagged]

Thanks for your feedback. As I previously said in another comment, the article was written in one go and I probably have missed the point of "be minimal in the description". I felt that readers should know a little bit more about obfuscations techniques, their use and why these are deployed into prod. While I am writing, I tend more to be "story-teller" to immerge readers into the flow, but I do admit this article is really difficult to read. I even deleted some paragraphs because it was going to be huge.

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#8

Post by jks »

t8sr wrote: post #5

[flagged]

I think the trend may be because longwinded writing gets you authority points on Google, or at least because writers think it does. Recall the famous laser printer review from earlier this year:

https://www.theverge.com/23642073/best-printer-2023-brother-...

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#9

Post by t8sr »

nicolodev wrote: post #7
t8sr wrote: post #5

[flagged]

Thanks for your feedback. As I previously said in another comment, the article was written in one go and I probably have missed the point of "be minimal in the description". I felt that readers should know a little bit more about obfuscations techniques, their use and why these are deployed into prod. While I am writing, I tend more to be "story-teller" to immerge readers into the flow, but I do admit this article is…

Hello, and thank you for talking about your work. Real stories from the industry like this are awesome to have.

As a fellow infosec person, I also struggle with keeping things brief. (Especially since I started out in digital forensics, where you can be extremely verbose.) It's counter to the inclination we have to checking every detail, I think. But I've found that I get 10x more people engaging with a 2-pager than a 10-pager. One of the things that really helps me is http://plainlanguage.gov.

Post reply on HN