OffensiveCon19 - Alex Ionescu - Keynote - Reversing Without Reversing
OffensiveCon19 - Alex Ionescu - Keynote - Reversing Without Reversing on HackerTube: recommended by 1 Hacker News commenter across 1 month, 2019–2021.
Alex Ionescu's OffensiveCon 2019 keynote on how reverse engineering is done on Windows without conventional reversing. It covers legal ways to obtain names of variables, exported functions and structures.
What HN commenters said
5 Hacker News comments link this video. Each one links back to its thread.
tiraniddoJul 2019Recommends
Well that's categorically untrue. Sure they don't release private symbols intentionally but they have done in the past accidentally. At that point it becomes a bit of a grey area, undoubtedly leaked/stolen source code is a no-no but reversing from private symbols when they do leak seem harder to quantify as you still need to reverse engineer the code, just structures/names etc are already known. Private symbols are not the only way of gleaning more information, other examples I can think of are: * Checked builds (prior to Win10). These builds shipped de-optimized kernels (e.g. no inlines) typically with copious debug strings which gave away important details. For example I gleaned a lot of knowledge of ALPC MSRPC from the checked build of rpcrt4.dll from Windows 8. * SDK/DDK headers, especially in the brave new world of insider previews with preview SDK/DDKs there is sometimes information present which should not have been released including "private" information. Again bit of a grey area. * The private symbols MS do ship. For example a significant proportion of the COM runtime has private symbols, intentionally. You can extract from those a surprising amount of system call structure information. I'd recommend watching Alex Ionescu's talk at OffensiveCon about how he does reverse engineering on Windows to see many of these things in action. ▶ this video I'm not saying any of this would make it a clean-room re-implementation but to say ReactOS cannot possibly have been reverse engi
in “A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”” · View on HN
MikusRFeb 2021Cites it
It was by one "I am very smart. Nobody can be as smart as me" Microsoft programmer. Who completely dismissed this explanation ▶ this video
in “ReactOS Updates” · View on HN
dvfjsdhgfvOct 2020Cites it
> Last time ReactOS came up here some folks were concerned about legality too, and I think there even was a salty Microsoft employee ranting about stolen code from the source leaks. Link to the actual dicussion here with the comments of the MS employee: [link] ReactOS developer's explanation on how they work: ▶ this video
in “ReactOS (Free and Open Source Windows): Jérôme Gardou hired to work full-time” · View on HN
dingbyJul 2019Cites it
The more you write in these threads the more you sound like a fool. ▶ this video Start around the 9 minute mark.
in “A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”” · View on HN
jeditobeJul 2019Cites it
Well, now please re-read your statement Do you understand that internal data structures entirely from the NT kernel, including (why?) their names != verbatim code from NT in your source The program code is logic first of all. For the similarities of names and structures itself - the answer is in this already mentioned video ▶ this video from the 9:53 moment of time. TL:DW there are a lot of legal ways of obtaining names of variables, exported functions and structures
in “A Kernel Engineer at Microsoft's Answer to “What Do You Think about ReactOS?”” · View on HN