A Silly Anti-Disassembly Trick

https://alexomara.com/blog/a-silly-anti-disassembly-trick/

by diimdeep • 5 years ago

211 38 5 years ago

alexomara.com

mcphage• 5 years ago

I wonder what the actual Cryptic Lab’s response to this is.

breakingcups• 5 years ago

A giggle, I'd imagine.

comex• 5 years ago

This is only a limitation of the demo version of Hopper. The full version can disassemble itself, and it's not even prohibited by the EULA, unlike most software EULAs which have boilerplate no-reverse-engineering clauses.

This behavior, both the technical and legal aspects, originated with IDA. In fact, IDA's EULA has a clause explicitly permitting you to reverse engineer it (whereas Hopper's just doesn't mention reverse engineering).

userbinator• 5 years ago

In fact, IDA's EULA has a clause explicitly permitting you to reverse engineer it

That's funny. I guess they realised that trying to prevent that would both be ironic and not particularly enforceable.

(I remember that in the cracking scene, many years ago, it was considered a "rite of passage" to crack your own tools like SoftICE, IDA, etc.)

lmilcin• 5 years ago

Maybe some lawyer can correct me, but I don't think it is possible to legally prevent somebody from understanding how something works (unless it is an atomic bomb or other state secret).

If that was possible Apple would just put a label on their iPhones and say that you are not allowed to know or even try to know how it works and that would be the end of all repairability.

saagarjha• 5 years ago

Of course, if you point Hopper at itself it gives you a lot of lorem ipsum selectors and dummy code as part of its amusing anti-reversing.

paper743cut• 5 years ago

It does not make business sense. If i can not try out with a demo version why would i buy it.

woodruffw• 5 years ago

Reminds me of the "Don't Steal Mac OS X" kext[1].

[1] https://www.lightbulbone.com/posts/2016/10/dsmos-kext/

madars• 5 years ago

You might be interested in reading Judge Alsup's decision regarding Apple's sealing motion in Apple v. Psystar: https://www.rcfp.org/wp-content/uploads/imported/20120105_20... (Control-F for "haiku")

theginger• 5 years ago

I'm interested what precautions people take when searching for something like this they find in a binary. Seems like the sort of thing that could easily be a unique string that could drive you towards a particular website, or even the act of someone searching for it could have been enough to trigger a result in Google search manager.

alisonkisk2• 5 years ago

If you're investigating malware, you should be practicing good opsec in your browser/VM in general, since you're interacting with malicious code all day.

brucehoult• 5 years ago

Oh, I thought it was going to be something sneaky. Like .. oh I don't know ... sprinkling in a lot of conditional branches that actually can never fall through, and following them by a (never executed) instruction with a 64 bit literal, with the literal containing code that actually is jumped into from elsewhere. Possibly by using a runtime-calculated indirect jump that a disassembler won't be able to figure out because Entscheidungsproblem.

sudosysgen• 5 years ago

Wouldn't this be pretty easy to see through with a debugger?

alfiedotwtf2• 5 years ago

Checking for an `INT 3;` was the usual anti-dissassembly trick

innocenat• 5 years ago

Isn't that anti-debugger trick?

yalogin• 5 years ago

I would say it’s more a plea/encouragement by the software maker to buy the license rather than a anti disassembly mechanism because it’s too easy to get around.

jiveturkey• 5 years ago

yep. a cute one at that

Taniwha• 5 years ago

I once spent an inordinately long period of time crafting a copyright message that was also executable 68k code ....

alisonkisk2• 5 years ago

You'll love Tom7's ABC:

http://tom7.org/abc/

moron4hire2• 5 years ago

When I read the post you were replying to, I had to check the username to see it was not Tom7.

Aside: HN's deliberate design decision to de-emphasize post authorship really bugs me. I frequently end up reading long conversations, only to realize by the end that I recognize one or more of the people in the thread. It can sometimes change the internal voicing in which I read the posts. It obfuscates the ability for a user to build their own, internal sense of other users' reputation. Yet there is a karma points system in place to create a sense of reputation. So the end result is a clear statement from HN that the only user reputation they want you to care about is the one that they assign through their system.

rzzzt• 5 years ago

The EICAR Standard Antivirus Test File is also text-only and a valid .COM file: https://en.wikipedia.org/wiki/EICAR_test_file

pattusk• 5 years ago

Potentially silly question: is this trick really as silly as it sounds?

If you're writing malware you obviously can't have EULA that your victims would subscribe too.

But could placing such a message (or a better worded one forbidding reverse engineering) in the binaries open a window for legal action against the security researchers who disregard it and disassemble the executable anyways ?

pdonis• 5 years ago

I don't think so. It's malware, which means whatever it is doing, or trying to do, is not something anyone who has a copy of it agreed to in the first place, so it's impossible to argue, for example, that the security researchers are violating some kind of license or agreement that was voluntarily entered into in order to make use of the functions of the software.

moron4hire2• 5 years ago

There is a general concept in law that, when engaging in a criminal activity, one gives up any right to protection against other criminal activity. For example, if someone steals your supply of heroin, you can't file a complaint, have the police investigate your thief, and get your heroin back.

alfiedotwtf2• 5 years ago

Shout out to Buckaroo Banzai for their “Cracking 101” textfiles, and to those that found them useful :)

alasdair_• 5 years ago

This reminds me of looking at some Atari ST software in a hex editor around 1990. There were some strings that appeared next to the copy protection code that said “come work for us instead of cracking! Call <number> and Leave your name and address!”

The phone number belonged to the Federation Against Copyright Theft (FACT)

junon• 5 years ago

Was it a trap? Or did they actually intend to recruit this way? I could see both being true - companies have done stranger things, like Google's site that upon logging in and visiting told you if you got the interview or not based on your search history.

c3534l• 5 years ago

I'm pretty sure FACT is not recruiting developers on behalf of some random game company.

skunkworker• 5 years ago

I would be really interested to see how often malicious software utilized undocumented opcodes that disassemblers incorrectly interpret and thus lead a security researcher down a rabbit hole while the actual opcode does something different. Like the

66e9xxxxxxxx and 66e8xxxxxxxx opcodes in x86_64 [1]

If my understanding is correct, Stuxnet incorporated bytecode for the PLCs in S7comm, a protocol that was not open at the time. Though this is different then including undocumented opcodes for the system being targeted directly.

[1] https://youtu.be/KrksBdWcZgQ?t=1767

JamesAcorn• 5 years ago

Many years ago I was playing around with an Acorn Archimedes (RISC OS) anagram application. It wouldn't let me create anagrams of the programmer's name, William Tunstall-Pedoe.

A Silly Anti-Disassembly Trick

Related Stories