Skypeopensource2 – Skype client based on reversing Skype 5.5

https://github.com/skypeopensource/skypeopensource2

by EvgeniyZh • 10 years ago

250 102 10 years ago

github.com

mariuolo• 10 years ago

Interesting.

Any code commonalities with the pidgin skypeweb plugin?

marcv81• 10 years ago

IANAL but author should doublr check to stay clear of trademark infringements.

ars• 10 years ago

They should rename it to Sky.peOple

bdcravens• 10 years ago

"Commercial license also avaiable (sic) on request."

Seriously?

goldenkey• 10 years ago

I bet they used a cracked version of IDA too. Kind of sad to see the open culture of reversing violated.

Sephr• 10 years ago

I see absolutely nothing wrong with wanting to profit from this. You're not being forced to use a commercial license, and the LGPL is adequate for most open source use cases.

michaelmior3• 10 years ago

Reversing in the first place is almost certainly illegal if you were to check the Skype ToS. Making a profit off it is just asking for trouble. I could be wrong though.

andwur2• 10 years ago

I haven't spent much time browsing through the source but the code quality and security is pretty dismal so far. Not to mention the confusing project structure.

Magic numbers, ... and strings, all over the place [0]. Memory leak galore (debug code?) [1]. Probably buffer overflows all over the place, here's one I noticed [2]. I suspect others given the proliferation of opaque pointers and memcpy usage.

[0] https://github.com/skypeopensource/skypeopensource2/blob/mas...

[1] https://github.com/skypeopensource/skypeopensource2/blob/mas...

[2] https://github.com/skypeopensource/skypeopensource2/blob/mas...

sillysaurus3• 10 years ago

"How dare you show your project when it has flaws!"

andwur2• 10 years ago

"How dare you comment on the flaws found in someone's project!"

If issues are never brought to light then it's very unlikely they will ever be fixed. Would you rather everyone just stayed silent?

I have great respect for someone that can put in the time and effort to reverse engineer Skype, and brave Microsoft's legal team in doing so, but in its current state this code can't be used safely and is far from easy to understand either.

showmustgoon• 10 years ago

If these flaws are minor or inconsequential, then you might be right about your remark but if these flaws are flagrant or critical, then the OP had the right attitude to make concerns public.

adekok• 10 years ago

A technical review of code isn't a personal attack. Please learn to tell the difference.

mSparks2• 10 years ago

You sound like you expect something different from reversed Microsoft code.

amelius• 10 years ago

I know you are probably joking, but didn't MS buy the code?

viraptor2• 10 years ago

The magic values look ok to me. I mean, some values are known, some aren't - it's still early days. Hopefully more will be labeled / split up into components with time.

fulafel• 10 years ago

0xmohit2• 10 years ago

You didn't mention the inconsistent (and somewhat weird) formatting of the source code.

https://github.com/skypeopensource/skypeopensource2/blob/mas...

I cannot specify more examples.

Retr0spectrum• 10 years ago

I think part of it is caused by the tab-width setting. The developer appears to have been using a tab-width of 4, and there are some instances where they used spaces for indentation without realising.

The only explains some of the wierdness though. That second link is completely inexplicable.

fungos3• 10 years ago

To me this project looks like really a just reversed and mostly functional one and this is the quality of said projects, I've been there. He has disassembled, transcribed to a C project almost as-is and made it compile.

The developer may not have enough development experience to organize it decently or just rushed it online because of anxiety.

Anyway, very good resource for others if there still any interest at all at Skype compatibility or else, only missing the .idb with renamed subs and comments. :)

fungos3• 10 years ago

Old patched binaries and .idb are on his onion: http://gzscxpillagce2gf.onion/

skypeopensource6• 10 years ago

Yes :-)

elitistphoenix• 10 years ago

Downloading before M$ lawyers get to it

kxd• 10 years ago

IRC is leaking again...

mrwizrd• 10 years ago

For more context and commentary:

https://news.ycombinator.com/item?id=2611299

justinlardinois• 10 years ago

> whether or not it is a clean-room reverse-engineered code, like Wine/ReactOS
No. Not clean room, not chinese wall.

If it's not clean room, then there's probably copyright violations. For reference: https://en.wikipedia.org/wiki/Clean_room_design

Also, offering commercial licensing? That's a good way to get a lot worse than just a DMCA takedown.

wolfgke4• 10 years ago

If it's not clean room, then there's probably copyright violations.

This is the law in the United States. From the links given in the readme file the authors are probably from Russia.

Iv4• 10 years ago

As a non-US citizen, I can't wait to see a world where a whole IT industry will exist without caring much about merchandability in the US.

janoc2• 10 years ago

So his claim that he is a sole copyright owner is patently false - this code could be trivially attacked as a derivative work. No sane person would touch it by a 10 foot pole.

cmarschner• 10 years ago

I do hope that the Skype people see it as an opportunity to improve product rather than threat / opportunity to sue the hell out of this project. WhatsApp would not have been necessary if they had gotten their act together. But at the time they were seemingly too busy sorting out technical and political ramifications of the MS acquisition and overlap with Lync. A more open approach to clients could save it, especially in the light that people are looking for alternatives after facebook is now starting to monetize WhatsApp.

cjg• 10 years ago

Big problem, the code includes stuff ripped straight out of the original Skype client:

https://github.com/skypeopensource/skypeopensource2/issues/2

PieterH12• 10 years ago

My guess at the origins of this project...

Firm somewhere far away where Microsoft's lawyers cannot reach (China?) wanted Skype capability in their product and paid this smart Russian guy to reverse-engineer the Skype client.

Smart guy gets permission to open source it and publishes it with commercial license option with hopes of finding more such clients.

Personally I'd not touch this with a 3-meter bargepole, because I live in a country where people use copyright and trademark law to take people to court, yet it's an interesting project.

sargun• 10 years ago

I doubt it. What prevents a Chinese citizen from installing Skype? Nothing. It's the payment and protocol that are blocked.

Looks useful for command and control type applications though.

contingencies• 10 years ago

It's not blocked. However, if you download in China you get a version specifically compromised for Chinese government surveillance.

jacquesm2• 10 years ago

Telecommunications products should be based around open protocols. That Skype keeps their protocols to themselves should not be reason enough to send lawyers after software implementing interoperability after reverse engineering.

Re-using the reverse engineered code is the problem, he should have simply used it to spec out the protocol and then use that spec to re-implement it.

PieterH12• 10 years ago

One team documents the protocol as a spec. A second team takes the spec and writes implementations. The advantage of this for open source is that when the protocol changes, it's relatively simple for that first team to update the spec, and safe for the second team to update their code.

This is legal and safe. It is how the first clone PCs survived even IBM's lawyers.

Iv4• 10 years ago

because I live in a country where people use copyright

I live in a EU country where interoperability is a law yet is almost never respected, so I say, fuck copyright in that case.

However, this is not the first successful reverse engineering of skype. Each time they broke compatibility with their next version.

PieterH12• 10 years ago

As I said, people use copyright law to take other people to court, and then get money from them. Your "fuck copyright" statement is bold, and one I'd generally agree with, unfortunately it has zero relevance to the legal risks a business would take, using this code in a commercial product, in such a country.

martingxx• 10 years ago

If this is newly written code not based on Skype code then there is clearly no copyright issue. Trademark is a potential problem but easily solved by removing the Skype name from the project.

PieterH12• 10 years ago

Lawyers are paid to make cases. Here, it's quite simple. The author of this code saw the Skype code, indeed he admits it. Then he wrote new code. Same person. Your honor, it is unreasonable for him to claim that his new code was not heavily influenced by what he had seen. It is like me listening to a song and then writing a new one "heavily inspired by it", and then claiming I'm not committing copyright infringement.

Lawyers make such arguments all the time and it comes down to who has the time & money to take them to court, and defend against them, and then the judge is a human who decides, and is heavily influenceable.

martinko• 10 years ago

Personally I'd not touch this with a 3-meter bargepole, because I live in a country where people use copyright and trademark law to take people to court, yet it's an interesting project.

You feel using it would open you up to a copyright claim?

PieterH12• 10 years ago

If I used this in a commercial product, it would be trivial (absolutely trivial) for the owner of the original product to take me to court for illegal distribution of their copyrighted works, based on the argument that the code I was distributing (for profit!) was written by someone who (by own admission in public) had reverse-engineered the original product.

IANAL but I'd be willing to bet money on this.

The only questions would be (a) is the original product one that matters enough to protect in such a way and (b) does the owner of that original product have the money and lawyers to start such legal actions.

This isn't some random app. This is one of Microsoft's crown jewels we're talking about.

jacquesm2• 10 years ago

It is a derivation.

charlesdm5• 10 years ago

In Europe, reverse engineering a protocol + building a commercial product on it, is legal. You cannot copyright a protocol or an API, if you built something merely by studying how it works.

matheweis• 10 years ago

The issue here is this appears likely to have been created by disassembly rather than pure study of behavior.

Is that legal in Europe?

besselheim2• 10 years ago

I remember seeing an earlier incarnation of this around five years ago; I'm very impressed with the author's dedication to this project.

I don't know if it is still the case now, but I recall that earlier versions of Skype were quite heavily obfuscated and contained anti-debugging mechanisms. So it would have been quite an intricate reversing effort to get past these, on top of figuring out the protocol.

Over time, Microsoft has changed the Skype protocol significantly since version 5.5 so I do wonder how applicable this work is to the current crop of clients.

0xmohit2• 10 years ago

I remember seeing an earlier incarnation of this around five years ago

https://github.com/skypeopensource/skypeopensource

besselheim2• 10 years ago

The site I recall was Blogspot rather than Github: https://web.archive.org/web/20110602182718/http://skype-open...

skypeopensource6• 10 years ago

I remember seeing an earlier incarnation of this around five years ago

Yes, its still up here: https://skype-open-source2.blogspot.com/

znpy• 10 years ago

I Hope this is better than the web version of Skype: it doesn't do the only thing it is supposed to do: phone calls.

fungos3• 10 years ago

Developer is Efim Bushmanov, here an old interview about his first skupeopensource release: http://www.ewdn.com/2011/06/05/ewdn-exclusive-an-interview-w...

brownbat• 10 years ago

As a reminder: https://github.com/mumble-voip/mumble

https://en.wikipedia.org/wiki/Mumble_(software)

I'm surprised the gaming chat programs don't get more crossover use. Well, I'm not surprised that a commercial project has a larger userbase than something that requires you to find a server.

But I am surprised when, say, podcast hosts make jokes about lag or call quality on their Skype connections with guests. There are other applications that solve some of these problems, and I'd think if your main creative product relies on call quality for guests, you might look a few steps beneath the most ubiquitous option. (ie, If you're at the level where you're buying an uncommon specialist's mic, you could probably benefit from comparison shopping for voip implementations.)

cinch• 10 years ago

skype still has the best echo cancellation (that i've tried). you don't even need to wear headphones. according to a Tox developer: there aren't any comparable open source libraries.

eeZi3• 10 years ago

Can confirm that Jitsi Meet works fine without headphones in Google Chrome. Google spent a lot of time optimizing WebRTC.

eeZi3• 10 years ago

Another reminder: Jitsi Meet

https://github.com/jitsi/jitsi-meet

Try it here: https://meet.jit.si/

It's a modern, WebRTC-based replacement for Skype, Google Hangouts and other video/audio conferencing solutions.

And it's great. The company I work for is now using it exclusively for meetings and telepresence. The echo cancellation is outstanding and you can even connect it to a SIP server. No client is required besides Google Chrome or Firefox. There's nothing that comes close to it in terms of sophistication and quality.

It works well for one-on-one and audio calls.

giancarlostoro2• 10 years ago

I try to push Mumble over Skype, the main issue with Mumble is that it's not as easy to get into. You spend too much time configuring your client, finding a server, etc. Things that should be fairly trivial. Then you may spend more time figuring out why you're not being heard, or why nobody's hearing you. Mumble is great but there's too much friction involved. I prefer Discord[0] because it's so easy to use by comparison, to test it you don't even need an account, you just run it from your browser. I just wish Discord had a Linux Client.

[0] https://discordapp.com/

eeZi3• 10 years ago

Discord is just another centralized, closed platform.

jamick• 10 years ago

Discord do have an experimental canary release for Linux.

deb: https://discordapp.com/api/download/canary?platform=linux

.tar.gz: https://discordapp.com/api/download/canary?platform=linux&fo...

https://www.reddit.com/r/discordapp/comments/4bu7lm/discord_...

pbhjpbhj3• 10 years ago

Can you run your own server to save having try find one; should reduce the lag on one side too.

lootsauce• 10 years ago

Totally not negative on this but I'm not a Skype user so can someone please explain to me why anyone would want to go to all the effort to reverse engineer it? I get that its closed and should be open, I get that its security is in question but if you want a more secure communications platform I can't imagine Skype is the only way forward and must be reverse engineered. Why not contribute to an existing open source project?

Skypeopensource2 – Skype client based on reversing Skype 5.5

Related Stories