Slashdot Mirror

Guess they've not heard of IDA Pro.

Then it's IDA time. There's something quite enjoyable to just making the program behave the way you want it to. If you've done it, you know what I'm talking about :-)

To tag along - it's hard to tell data from code, and it helps the decompiling app to detect what is code vs. data if it knows which compiler created it.

It looks like the original blog used IDA Pro, which has library signatures for different compilers. It can identify functions and auto-comment the code, making disassembly easier. Auto-identify stack variables and keep track of them through lots of PUSH and POP and RETURN X statements, it's quite powerful.

In this case, IDA probably gave a lot of erroneous warnings or disassembled data or refused to disassemble code, requiring lots of manual work. The classes apparently were done inconsistently, making it hard to even write a plug-in to automatically detect them (scripts exist to identify MSVC objects through their RTTI properties, and do a decent job identifying non-RTTI classes, but this would not work with this code).

http://www.hex-rays.com/products/ida/index.shtml

When reverse engineering, and your tool basically says "WTF do I do with this?" it's one of those moments where you want to know how the attacker made it.

Is it hand-rolled? Or a new attack creation kit that script kiddies can cobble something together using?

And "unknown language" was not a really good way to describe it. "Unrecognized output" would have been better. The assumption is that a language like C would compile to a C-like syntax, C++ would do things differently. But it could have been just C++ with an unknown compiler.

Having watched the video, I highly doubt that this "visualization" is of much practical use. It may look nice, but it doesn't contain much useful information. There are already disassemblers which can visualize code in a 2D graph which is much more useful than this.

And to answer your second question: No, there is no such thing as a disassembler. Once the code is converted to binary, it's gone, baby, gone.

You are wrong. http://www.hex-rays.com/idapro/

There are also specific decompiler for programming languages. They can produce pretty readable code. I used one for Java and got nice compilable source code. You are losing all variable/procedure names of course which can be a problem for more complicated code.

DIAF.

DIAF.

Variables? Variables don't exist. You can capture function arguments, but other than that, generically separating an important memory location ("variable") from another actually is next to impossible.

this kind of hypocritical ignorance always confuses me. it's like i'm being baited.... but i'll bite

so just to be clear, you're saying that the memory blocks used to store information passed into functions can be captured and traced, but for magically unmentioned reasons, memory blocks used to store any other bounded data can not? where do you idiots come from?

here, i'll help you be a little less stupid... i'm sick of you retards saying i'm wrong. YOU ARE WRONG.

It's not even that.

It's far from cheap (let alone free) and it's not an assembler, but IDA Pro is indispensible for anyone who needs to develop, analyze, or debug code in assembler. It can't assemble code for you but it does everything else ( http://www.hex-rays.com/idapro/pix/idalarge.gif) you've thought of and many you haven't.

It's far from cheap (let alone free) and it's not an assembler, but IDA Pro is indispensible for anyone who needs to develop, analyze, or debug code in assembler. It can't assemble code for you but it does everything else ( http://www.hex-rays.com/idapro/pix/idalarge.gif) you've thought of and many you haven't.

any DRM scheme needs to be common to all publishers

While I sympathize with your idealistic dream, and wish myself that it could work, I can assure you that it is logically infeasible to create any methodology where you give a user an algorithm, a key to use that algorithm, and the content itself, and expect it not to be used/recombined in a way not envisioned by the writer of that algorithm. If the software runs on a general purpose CPU and I have your key, I can hand you your decoded content in a matter of hours. Any Geek with a copy of IDA Pro and some real patients can do this for any platform that the software supports http://www.hex-rays.com/idapro/idaproc.htm. And if it doesn't support it there are still other ways to attack the software system.

Even if you lock the decoding into a a special chip, on a board a closed and completely undocumented device, someone will eventually take the lid off of it, for fun, and reverse the logic on the chip http://www.flylogic.net/blog/. Unless you have the where-with-all of a Nation's State with vast resources able to be pored into advanced anti-tamper technology that self-destructs the core of the chip upon entry, then its just a matter of time. Piss off one capable Geek and your entire 'DRM dream of mass profits' will be history, with the work intentionally published on the Internet just to spite you. We have to face the facts that you can't rationalize/argue with a sick mind, and a pissed off Geek doesn't want to listen to the 'economics' or about what is good for someone's content delivery business. A pissed off Geek is a dangerous antagonist that won't be swayed by even the legal ramifications of what they do.

In my opinion, its a sad situation that so many people actually believe in the software equivalent of 'snake oil' (aka DRM).

PS Source code is available, you just need to unpack it.

http://www.hex-rays.com/idapro/idadownfreeware.htm

*readies his version of IDA*

For those who don't know what IDA is: it's a disassembler and debugger.

While browsing IDA Pro product
pages at http://www.hex-rays.com/idapro/idadown.htm
I noticed that there are downloads for two libraries that IDA seems to use:

  Linux TVision port for the IDA Interface - source code (updated 20/11/2007)

This download is password protected, but seems it is a copy of
Linux TVision - http://tvision.sourceforge.net/ which is under GPL.

Another and more obvious their problem is:

  Wingraph v 1.03: source code the Wingraph we use and modified (GPL).
(updated 25/08/2004)

Which is available for actual downloading and is nothing more than VCG library
A Visualization Tool for compiler graphs
Copyright (C) 1993--1995 by Iris Lemke, Georg Sander, and the Compare Consortium
Which is distributed under GPL v2

The sources also contain the following text:

  * WinGraph32 - Graph Visualization Program
  * Version 1.0
  * The WIN32 interface written by Ilfak Guilfanov. (ig@datarescue.com)
  *
  * This program is under GPL (GNU General Public License)
  * It is based on the VCG tool written by Georg Sander and Iris Lemke

Seems that IDA author (Ilfak Guilfanov) does not understand GPL terms.

I notified all related parties, as well as gpl-violations.org on March 21, 2008.
But nothing happened.

The only reply I got was from Linux TVision author, where he says IDA seem to use modified GPL code.

Here it is:

http://www.hex-rays.com/idapro/

Better note that with Hex-Ray plugin decompiler functionality can be added to IDA Pro.