Kayaker
November 8th, 2002, 05:53
Hi
I tend to agree with you. Though I can see several possible sides/explanations to the issue. It's funny you ask that question because I've been thinking of exactly that the last few days. I'm in the process of coding a little RE app, unique but benign, nothing better or nothing worse than many floating around, which I was planning to release with source. I have learned much from studying other peoples sources and always appreciate it when they do release it, that I like to respond in kind.
I decided to look at another little lame-ass app that I knew might have some similarities and thought it was actually stupid that they went to such lengths to "hide" how they coded a fairly basic app. Nothing special, just calling all APIs with indirect calls to LoadLibrary/GetProcAddress. "What's the use?" I thought. On the other hand, coding something this way IS part of the mystique and fun of RCE. More likely however, it was done to raise the "l33tness" of their code ("Ooh, I have no idea how you did that, you must be a really good l33t coder. Phear me!"
, or they didn't want some "lamer" ripping off their code.
There are degrees of 'open-source' as well I feel, at least to any competent reverser. Simply not releasing the source, but not purposely trying to obfuscate or protect the code, I'd call 'partial' open-source. That depends on the complexity of the program of course. Then there's something like Icedump, the ultimate complex, ultimate open-source example. It doesn't need to 'hide' anything because it exposes nothing without serious study and gradual understanding.
Then there's the concept of wanting to hide how RCE apps work from the "bad" guys (that'd be the shareware programmers and protectionists). A questionable attitude at best, but I guess it's all part of the cat and mouse game that actually works in both directions. Good protection leads to good deprotection RCE app leads to modification in protection --> modification in RCE app -->..--> private plugins -->??
Another reason not to release source I can somewhat understand is that it takes a bit of work to release somewhat *useful* source with comments. Often you code things during a frenzied session and forget yourself what the hell you were thinking of at the time, but hey it works ;-) Some people may not want to release because it 'exposes' their shitty programming skills to the world at large (see 'raising the l33tness factor' above). Or maybe simply they just don't want to or just don't care, the app was written to do a job, nothing more, and telling people how you did it doesn't enter into the equation.
Whatever the reasons, I respect the decision, it IS their code after all and they can do what they want with it without justification. I know nothing about the attitudes in Linux programming, but it seems that it's more involved with the *development* of an OS + programs, and is a relatively new and expanding field. I can understand the attraction to those who crave for something new and exciting. A lot of RCE however, at least at this level, seems to be locked into the life and death struggle between shareware and those who want to crack shareware.
Open source is nice when it's there, and helps if you're trying to learn a new language (be it ASM, C or whatever). In terms of 'techniques' then you just have to work at it a bit more, often learning as much or more than if the answers were simply laid out in front of you.
Interesting question Neutrino.
Regards,
Kayaker
here are the sources for "First_Thunk", my dumped IAT repair tool.