I was the main analyst behind the application/binary analysis in the article - about 1/5 of the way down you'll see my first credit: "Ryan Thoryk (aka EventHorizon), a Unix and Network Specialist in Illinois, is the one who put all of the hard work into peeking around the original VX30 binaries"
>Does this mean that CherryOS has already lost their license to use the source code from PearPC?
Not just that, but they've also lost their own license to CherryOS (since CherryOS is a derivative work of PearPC, CherryOS is void since their PearPC license is void).
The problem is that MXS has already violated the GPL, and so their license was terminated - as far as I know, nothing they can do will every make CherryOS fully legal:
from the GPL v2:
"4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance."
5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it."
Also, about a half hour ago older binaries of MXS's main product, VX30 were contributed to me for use on the PearPC discussion forum. They can be found here, complete with analysis pics: http://www.tliquest.net/ryan/cherryos/vx30/oldvers ion
VX30 contains large amounts of XviD code (if not all of it), large amount of LAME code, and more. I was in contact with one of the XviD developers about that issue, and they are considering legal action against MXS in this matter, and want to possibly join PearPC's legal efforts.
From the VX30 Live (aka VX30 B-Cast) manual: "The VX30 codec is one of the most powerful in the world with an unmatched compression ratio of over 100 to 1"
Wow - the most powerful video codec in the world, with unmatched compression. Impressive. Sounds like XviD.
MXS also must release the code ASAP (all products), and not in June. Their delay tactics show that they are trying to do anything they can to "clean up" their code. It's possible that CherryOS would be legally owned by the PearPC group and affiliated parties from this situation, but I'm not totally sure on that.
VX30 has XVid code in it. I'm analyzing a memory dump of VX30's encoder demo app (the program's been packed using Petite. I'm about to upload screenshots of it, and also the memory dump itself (I'll analyze the second app too fairly soon) - the dump is 90mb and I'll try to compress it as much as I can. The new stuff will be in http://www.tliquest.net/ryan/cherryos/vx30/ in a few minutes.
Also a third product they have called PdfConv (hosted on their one-product "store" at http://www.mbloom.com/) was entirely taken from VeryPDF's PDF2HTML code, and some effort by PearPC developers was required to make MXS release the source for that. The problem though was that the source they released was entirely stripped of all VeryPDF's copyrights and authorship acknowledgements, and only contained one small reference to them on the webpage (just referencing "VeryPDF" - no links or anything). So even their source is in violation with the GPL (since all previous copyrights must remain intact) - I think they also stripped the XPdf copyrights (VeryPDF's PDF2HTML was based on XPdf).
I found only one reference in the code to verypdf:
Here's the diff file I made between VeryPDF's PDF2HTML code and Arben's PdfConv source: http://www.tliquest.net/ryan/cherryos/other/pdfcon v.patch That diff is proof enough. So with the way they treat the GPL, it seems as if everything they make is dirty.
You also have to remember that this company's primary product, the VX30 video codec system, has been suspected (and somewhat proved) to have taken code from other open source projects too - they admitted to taking code from JOrbis (and they're still in violation of the LGPL with that), and it's suspected that they also used XVid and maybe LAME.
Awesome disassembly analysis - I don't know why I'm not familiar with executable packing. I would have done some disassembly of the binaries if I was more familiar with x86 assembly, but I'm not:( oh well
The CherryOS executables seem to be compressed, to hide plaintext symbols (security through obscurity lol). They're trying to hide their tracks. I just put 3 versions of CherryOS on my site, the third being the latest one, for comparison purposes. This is just getting insane.
I originally posted material on the PearPC developer list right after CherryOS was released (including some of my own comparisons of the binaries and stuff). One hilarious thing is that CherryOS has dialogs that say they're formatting an HPFS volume (and more windows that mention the filesystem HPFS) - the funny thing is that MacOS X uses the HFS+ filesystem (OS 9 uses HFS), so right there you know that these people have no clue about the operating system they're supporting. They also claimed that the whole software app was developed by a single guy in 4 months... any person who's familiar with architecture emulators knows that a statement like that is insane - writing an entire software-based PowerPC cpu emulator, along with the hardware emulation layers all by one guy in 4 months?! That is similar to a person saying that Bill Gates wrote Windows 95 all by himself back in '95 lol.
I bought the game soon after it came out, mostly due to how much I liked 2. Originally the game was so resource intensive that it barely ran on any machine I had (only new machines at the time could run it). Now, with an Athlon 2600+ and a 128mb video card, the game runs nice and smooth, but crashes like crazy, has strange random lags, temporary freezes, etc (and none of these are hardware related - trust me). GTA3 would be an awesome game if it actually worked - but thousands of people already know it as one of the worst porting jobs in history.
The UN also has time and time again shown a growing anti-US sentiment, and many people (including myself) want the UN to get off US soil. The people who say that the UN and the US government are "best friends" or whatever, haven't been paying attention to anything UN related in the past 50 years.
For those who love the Internet but hate the US, there would be no Internet if there were no US.
Forgot something - The "my truth" and "your truth" should really be "my opinion" and "your opinion"; opinions vary, but truth doesn't, unless you think that both statements "the earth is round" and the "earth is flat" are both equally true somehow, with the second one not being simply an unproved opinion.
Everything you're describing sounds exactly like the atheist fundies that I've debated with. I'm extremely interested in their ideas, but they don't care at all about mine.
Also you said "my truth" - how can there possibly be multiple "truths"? Does 1+1 equal both 2 and 3?
The other posts sure show a lot of hot air coming from Slashdot today...
Some commercial operating systems release new stable versions every 2 years, which is what I consider the optimal release time for Debian (I've run Debian on production servers, and it's important to not have to worry about a system-wide upgrade every few months. I've already started the planning for the upgrade to Sarge on one machine, once it's released - my desktops run Testing).
For example, Sun releases Solaris every 2 years. Debian normally releases every 2 years also, but it's already 2 1/2 years since Woody's release. Even Windows is normally released every 2-3 years (Win2k came out in late '99, XP came out in late '01, but there's been no new desktop OS since then, except for the server OS Win Server 2003)
>Well, no one in the Bush Whitehouse listened to him about the threat from Al Quaeda before the 9/11 attacks, so why would Microsoft bother to listen to him.
>"In yet another example of innovation, Microsoft has invented a feature called Tabbed Web Surfing (tm) (r). Tabbed Web Surfing is a revolutionary user interface for web browsing that Microsoft as its inventor has received over 7,000 patents on."
"This just breaking... Microsoft is now reporting that IE7 will be renamed Microsoft Firefox, and the Firefox name will be a registered trademark to prevent confusion..."
You also have to remember that this is the same company that has their OS's GUI running at the kernel level (a ridiculous idea in the minds of us security folk). I'd pretty much expect MS to throw the IE HTML engine into the kernel too, as a loadable module (similar to their XP SP2 firewall module), and say it was done for "performance reasons" lol. So, find an exploit in the IE engine, and you have full control over the entire OS and hardware.
> I rememeber reading once that IE loads into memory at boot. That is, IE is substantially tied in as a portion of the operating system itself.
IE itself doesn't load, but the HTML rendering engine (mshtml.dll and dependencies) loads along with the system shell (explorer.exe). The IE "web brower" is just a simple gui wrapper on top of a rendering engine, similar to Mozilla's gui on top of the Gecko engine. On this Win2k box, IE6's mshtml file is 2.8 megs.
>If IE 7 has been decoupled from Windows that would be the one greatest security improvement Microsoft could perform.
The IE engine was integrated into Windows at version 4, before Win98 was released; the new enhanced windows shell was called the "Windows Shell Update", and basically turned the Win95/NT4 explorer shell into one similar to Win98's shell (with some features missing of course). To fully decouple the engine from the OS would be to remove all support of HTML rendering in the shell, which doesn't seem like something Microsoft would do (would be nice though). The only way to do that would be to use a replacement shell that doesn't depend on the HTML engine. Currently the only 2 Windows shells that meet that are the Win95 and NT4 shells.
Slashdot Mirror
If you want to mirror my analysis archive, get it here:
z
http://www.drunkenblog.com/mxs/mxs_evidence.tar.g
(i can't host it on my webserver yet due to legal issues - these originated from it though)
The archive can be browsed here:
http://www.drunkenblog.com/mxs/
Drunkenbatman said that there's over 20 mirrors of it, so I'll try to find out what those are.
-eventhorizon
I was the main analyst behind the application/binary analysis in the article - about 1/5 of the way down you'll see my first credit:
:)
"Ryan Thoryk (aka EventHorizon), a Unix and Network Specialist in Illinois, is the one who put all of the hard work into peeking around the original VX30 binaries"
Yay - finally my hard work is getting mindshare
-eventhorizon
Is there a miniinst ISO image for release 5.4? (it's the network install image). 5.3 had one, but there doesn't seem to be one available.
-eventhorizon
>Does this mean that CherryOS has already lost their license to use the source code from PearPC?
Not just that, but they've also lost their own license to CherryOS (since CherryOS is a derivative work of PearPC, CherryOS is void since their PearPC license is void).
-eventhorizon
The problem is that MXS has already violated the GPL, and so their license was terminated - as far as I know, nothing they can do will every make CherryOS fully legal:
s ion
from the GPL v2:
"4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance."
5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it."
Also, about a half hour ago older binaries of MXS's main product, VX30 were contributed to me for use on the PearPC discussion forum. They can be found here, complete with analysis pics:
http://www.tliquest.net/ryan/cherryos/vx30/oldver
VX30 contains large amounts of XviD code (if not all of it), large amount of LAME code, and more. I was in contact with one of the XviD developers about that issue, and they are considering legal action against MXS in this matter, and want to possibly join PearPC's legal efforts.
From the VX30 Live (aka VX30 B-Cast) manual:
"The VX30 codec is one of the most powerful in the world with an unmatched compression ratio of over 100 to 1"
Wow - the most powerful video codec in the world, with unmatched compression. Impressive. Sounds like XviD.
MXS also must release the code ASAP (all products), and not in June. Their delay tactics show that they are trying to do anything they can to "clean up" their code. It's possible that CherryOS would be legally owned by the PearPC group and affiliated parties from this situation, but I'm not totally sure on that.
-eventhorizon
Correction to that last post - It's MplayerC code, not Mplayer (MplayerC is an open-source Windows media player)
-eventhorizon
Just found Mplayer code and text references to Mplayer's CVS pages in the VX30 Live app...i s/vx30_live/
This is making me sick.
http://www.tliquest.net/ryan/cherryos/vx30/analys
-eventhorizon
VX30 has XVid code in it. I'm analyzing a memory dump of VX30's encoder demo app (the program's been packed using Petite. I'm about to upload screenshots of it, and also the memory dump itself (I'll analyze the second app too fairly soon) - the dump is 90mb and I'll try to compress it as much as I can.
The new stuff will be in http://www.tliquest.net/ryan/cherryos/vx30/ in a few minutes.
-eventhorizon
Also a third product they have called PdfConv (hosted on their one-product "store" at http://www.mbloom.com/) was entirely taken from VeryPDF's PDF2HTML code, and some effort by PearPC developers was required to make MXS release the source for that. The problem though was that the source they released was entirely stripped of all VeryPDF's copyrights and authorship acknowledgements, and only contained one small reference to them on the webpage (just referencing "VeryPDF" - no links or anything). So even their source is in violation with the GPL (since all previous copyrights must remain intact) - I think they also stripped the XPdf copyrights (VeryPDF's PDF2HTML was based on XPdf).
n v.patch
I found only one reference in the code to verypdf:
---
ryan@europa:/data/home/ryan/xpdf$ grep -ir verypdf pdfconv
pdfconv/src/MyReg.cpp: "Dear verypdf.com Inc:%0a"
---
Here's the diff file I made between VeryPDF's PDF2HTML code and Arben's PdfConv source:
http://www.tliquest.net/ryan/cherryos/other/pdfco
That diff is proof enough. So with the way they treat the GPL, it seems as if everything they make is dirty.
-eventhorizon
You also have to remember that this company's primary product, the VX30 video codec system, has been suspected (and somewhat proved) to have taken code from other open source projects too - they admitted to taking code from JOrbis (and they're still in violation of the LGPL with that), and it's suspected that they also used XVid and maybe LAME.
My whole info archive (with demo releases of CherryOS, VX30, etc) are all at
http://www.tliquest.net/ryan/cherryos
-eventhorizon
Awesome disassembly analysis - I don't know why I'm not familiar with executable packing. I would have done some disassembly of the binaries if I was more familiar with x86 assembly, but I'm not :( oh well
-eventhorizon
The CherryOS executables seem to be compressed, to hide plaintext symbols (security through obscurity lol). They're trying to hide their tracks. I just put 3 versions of CherryOS on my site, the third being the latest one, for comparison purposes. This is just getting insane.
Here's the site:
http://www.tliquest.net/ryan/cherryos
Go into the "app" directory
-eventhorizon
One point I forgot - HPFS is IBM's filesystem used in OS/2.
-eventhorizon
I originally posted material on the PearPC developer list right after CherryOS was released (including some of my own comparisons of the binaries and stuff). One hilarious thing is that CherryOS has dialogs that say they're formatting an HPFS volume (and more windows that mention the filesystem HPFS) - the funny thing is that MacOS X uses the HFS+ filesystem (OS 9 uses HFS), so right there you know that these people have no clue about the operating system they're supporting. They also claimed that the whole software app was developed by a single guy in 4 months... any person who's familiar with architecture emulators knows that a statement like that is insane - writing an entire software-based PowerPC cpu emulator, along with the hardware emulation layers all by one guy in 4 months?! That is similar to a person saying that Bill Gates wrote Windows 95 all by himself back in '95 lol.
0 0501.html
Here's my stash of comparisons; there's many other pages on other sites with info:
http://www.tliquest.net/ryan/cherryos
The in-depth article that features some of my research is here:
http://www.drunkenblog.com/drunkenblog-archives/0
-eventhorizon
I bought the game soon after it came out, mostly due to how much I liked 2. Originally the game was so resource intensive that it barely ran on any machine I had (only new machines at the time could run it). Now, with an Athlon 2600+ and a 128mb video card, the game runs nice and smooth, but crashes like crazy, has strange random lags, temporary freezes, etc (and none of these are hardware related - trust me). GTA3 would be an awesome game if it actually worked - but thousands of people already know it as one of the worst porting jobs in history.
-eventhorizon
>and the monopolisation of the news media by tycoons with vested interests
BBC anyone?
One corporation owning all...
-eventhorizon
The UN also has time and time again shown a growing anti-US sentiment, and many people (including myself) want the UN to get off US soil. The people who say that the UN and the US government are "best friends" or whatever, haven't been paying attention to anything UN related in the past 50 years.
For those who love the Internet but hate the US, there would be no Internet if there were no US.
-eventhorizon
Forgot something -
The "my truth" and "your truth" should really be "my opinion" and "your opinion"; opinions vary, but truth doesn't, unless you think that both statements "the earth is round" and the "earth is flat" are both equally true somehow, with the second one not being simply an unproved opinion.
-eventhorizon
" Also you said "my truth" - how can there possibly be multiple "truths"? Does 1+1 equal both 2 and 3? "
>because you apparently only see black and white.
I was implying that the idea of "multiple truths" is moral relativism. Also, I guess 1+1 does equal both 2 and 3 according to you.
-eventhorizon
Everything you're describing sounds exactly like the atheist fundies that I've debated with. I'm extremely interested in their ideas, but they don't care at all about mine.
Also you said "my truth" - how can there possibly be multiple "truths"? Does 1+1 equal both 2 and 3?
The other posts sure show a lot of hot air coming from Slashdot today...
-eventhorizon
Some commercial operating systems release new stable versions every 2 years, which is what I consider the optimal release time for Debian (I've run Debian on production servers, and it's important to not have to worry about a system-wide upgrade every few months. I've already started the planning for the upgrade to Sarge on one machine, once it's released - my desktops run Testing).
For example, Sun releases Solaris every 2 years. Debian normally releases every 2 years also, but it's already 2 1/2 years since Woody's release. Even Windows is normally released every 2-3 years (Win2k came out in late '99, XP came out in late '01, but there's been no new desktop OS since then, except for the server OS Win Server 2003)
-eventhorizon
>Well, no one in the Bush Whitehouse listened to him about the threat from Al Quaeda before the 9/11 attacks, so why would Microsoft bother to listen to him.
Well, considering that Microsoft donated 60% of their $3.1 million of political donations to the DNC last year, I'm sure that they'll listen to him, even if he's not really that competent in security.
-eventhorizon
>"In yet another example of innovation, Microsoft has invented a feature called Tabbed Web Surfing (tm) (r). Tabbed Web Surfing is a revolutionary user interface for web browsing that Microsoft as its inventor has received over 7,000 patents on."
"This just breaking...
Microsoft is now reporting that IE7 will be renamed Microsoft Firefox, and the Firefox name will be a registered trademark to prevent confusion..."
You also have to remember that this is the same company that has their OS's GUI running at the kernel level (a ridiculous idea in the minds of us security folk). I'd pretty much expect MS to throw the IE HTML engine into the kernel too, as a loadable module (similar to their XP SP2 firewall module), and say it was done for "performance reasons" lol. So, find an exploit in the IE engine, and you have full control over the entire OS and hardware.
-eventhorizon
> I rememeber reading once that IE loads into memory at boot. That is, IE is substantially tied in as a portion of the operating system itself.
IE itself doesn't load, but the HTML rendering engine (mshtml.dll and dependencies) loads along with the system shell (explorer.exe). The IE "web brower" is just a simple gui wrapper on top of a rendering engine, similar to Mozilla's gui on top of the Gecko engine. On this Win2k box, IE6's mshtml file is 2.8 megs.
>If IE 7 has been decoupled from Windows that would be the one greatest security improvement Microsoft could perform.
The IE engine was integrated into Windows at version 4, before Win98 was released; the new enhanced windows shell was called the "Windows Shell Update", and basically turned the Win95/NT4 explorer shell into one similar to Win98's shell (with some features missing of course). To fully decouple the engine from the OS would be to remove all support of HTML rendering in the shell, which doesn't seem like something Microsoft would do (would be nice though). The only way to do that would be to use a replacement shell that doesn't depend on the HTML engine. Currently the only 2 Windows shells that meet that are the Win95 and NT4 shells.
-eventhorizon