After responding to a post in the newbies section, I have decided to pose these questions in the off topic section.

1: Is the current knowledge base becoming to constricted in the RE community ?

2: Are we ourselves making things too complecated for our own good ?

-----

1:
Cue Grandad Kilby,

When I started off I wanted to convert tape based games to microdrive or disk, there where very few apps to get interested in, and even less reason to actually own them.

Later game training turned up.

It was simple at first, load the file and save to disc.

Then came custom loaders, then SMC, encryption, passwords and even API redirection

All the same things that you are seeing these days.

The difference was that there was no processing power and almost no memory, you where happy if you had a few hundred bytes free to work on a target. You developed a lot of lateral thinking, such as hiding code in display ram, writing custom tape & disk routines, writing your own disc copiers. What I am trying to say is you had to have a very wide range of knowledge and abilitys.

Now it sems that many people get upset if there isn't a handy API to break on with a jnz right after it.

All the lateral thinking seems to have vanished.

Apart from Damn and tE! nobody really seems to look for holes in the publishers crypto implementation for example. It all seems to be a couple of nops or a game of hunt the API call.

I honestly think there needs to be a little more thinking as I have watched the departure of some of the "more interesting and able" scene members.

Yes there are interesting folk on the way, but there are less of them every year, for the first time I really think I see what Fravia truely intended.

It's all so bland & generic that I am in a quite withdrawn phase currently. It's simply not very interesting.

First there was visual programming, now it feels like visual reversing has arrived

For the most part the folk in the ripping scene are probably doing the most interesting stuff at the moment (when they start playing with bigfiles anyway).

-----

2:

This may not be fair as the original discussion was in the newbies section, but as we know much of the interesting 'work' happens there anyway.

What prompted this was regarding an app that terminated after 4 minutes of use.

There where replys there from folks who know more about packers, API redirection, code injection and stuff, than I know (and I suppose that wouldn't be hard either).

However what struck me was that although inteligent suggestions where being made but it was all so complicated, and it didn't have to be that way.

It's like the music scene in the 70s where any real innovation had turned into bands like Supertramp & Yes. Basically lots of clever people doing clever things, but losing sight of the fact that a 3 chord song with a decent 3 piece bvand, can be much more effective than a classicly trained 12 piece band with all the latest kit.

Only one other person really looked at the fact that ther ewas a counter, and that the value the counter started at (or indeed ended at) was unimportant and that was disavowed, but even he made issue more complex than it should have been.

The important fact is that there is a counter !

The API used to determine when to decrement that counter dosn't matter.

Step away from APIs, crypto functions, API redirection, IDT & SICE detection and think about what uses counters. Games use them, for lives, ammo and all that shit. So get a copy of gamehack and off you go. It's a small (and imperfect) example of the RE community ignoring simplicity, and making their own lives harder in the process.

This is not intended to criticize anybody, but are we actually patting ourselves on the back too much about how clever we are ?

I personally am always in danger of dissapearing up my own arse with some of the overly complex ideas I come up with.

After all Alexys cleverness in asprotect (for example) is undone by his own customers not using what he provides.

If Alexy dropped all the double dip, hiding of the OEP and API redirection, and his customers used his license manager and asprotect API properly, would asprotected apps be any harder to deal with ? TOO DAMN SURE IT WOULD.

Things would be much worse even if his customers used a new private key for each major update so there whern't loads of blacklisted serials carried around to make it easy to dump anyway. It costs nothing at all to email out updated serials to all your registered customers.

In reality it no great hassle to the customer (if done properly), als they also like to know that when they pay for an app, that everybody who uses the same app has had to pay the same price. Otherwise they think "well why should I be the only paying customer."

Yes we do have over complex systems before anybody thinks I am suggesting otherwise, but always keep the goal in mind. A few minutes thinking can save hours of work, especially if you work outside the accepted norm.

Sorry if this is overly long I may be a grumpy old bastard today, but I don't want to see talent wasted.

Kilby...

thanks for the backhanded complement

Kilby,

Thanks for the insight. I have always been a strong believer that there is always a simple way and hard way to do things. Not just RCE wise. It has been months since my last post to this forum, partially because I kind of lost interest in RCE and kind of because I now have a 9 month old and a very demanding job. Enough of my bull. Here is what I want to say.

I have lost interest in RCE because I did not want to become involved in the complexity of dealing with problems that take days to solve when I clearly did not have the time available. I also did not want to spend every waking moment thinking about the problems that I needed to overcome, life is too short. You are correct that people are not shown that there is more to this than, patch this, bxp that. Many times I have discussed the problems with the whole RCE "education" system and how it could be resolved but nothing ever came of it.

It is about time that those of us who do or dont do this sort of thing go back to basics. Learn to take things at face value and forget a little of the stuff we learned in the "other" applications we had a look at. I recently inspected an application that checked the serial against a database on the internet and returned a HTML result, STD, PRO or Platinum.

At first, my response was to try figure out a way to change the application to execute my own code and make changes to itself and do a bit of inline patching and blow me off and and and...

That would have taken me deep into the heart of the application and driven me mad. I went for a smoke, came back and sat down. I closed the debugger and opened the application in a HEX editor and changed every instance of "Platinum" to "Errorkey" and low and behold, the application has Own3d. A simple text change.

My point is that I whole heartedly agree with you that we often climb up our own arses thinking that we know the "best" way of doing something when often it is right in front of us. Time to teach the newbies that giving yourself extra lives or power in a game is just as important as creating the ultimate 5001 in 1 keygen. When you know how to play with the debugger, actualy play with it, the hard stuff becomes very easy.

Until December ;-)

Hoof

I agree with you Kilby!

Yes, there does become too much dependence on API's nowadays, but you have to admit, that is how the Windows OS works for almost all it does, so almost everthing uses an API somewhere - and when you're a newbie, there is so much to learn it's overwhelming. So they feel they need to start with something that is familiar.


Personally, I like to think out of the box, and reverse by thinking, not by examine what functions are called, because you can always find a hole somewhere that the programmer didn't think of. For example, I once had a program that had a similar time limit. So I tried searching for the hex code that equated to the time. I didn't find it of course, but after only a little more searching I found that section where he was doing the checking, and what the programmer did was simply get the time and ad FFF to it, and then check it. So lesson learned, another thing to keep an eye out for - to think out of the box.

That's why it's good to learn ASM and good to learn file formats and good to learn all that low level stuff. I gives you more power and creativity to do things in different ways than just using some middle - man code like API's.

I agree with you 100% Kilby, I myself have been impressed by the lateral thinking by groups like Damn and tE! -

A program is a life form, it breathes data. It takes in something, and outputs something. All you need to do is examine the inputs, and the outputs, and then glance at its digestive system, and you can usually tell how to mess with it already from there. That's what the "zen" stuff is all about (zen? whatever. It's called smarts!). All you have to do is outhink, outcreate the programmer.

Anyone can do that if they really want to, and you don't need tons of fancy tools, but practice helps. Newbies have to start somewhere until they learn all the ropes. Maybe it's just because newbies get good and then they leave this place. After all, when's the last post you've seen by Splaj or evaluator, etc.? They are masters of their art, and they are hardly seen.

So the quality of the posts you see is due more the fact, in my opinion, that the older wise quality ones don't come around anymore. They've solved their challenges already and now they are bored.


-nt20

The original title should have been Recent thoughts by a grumpy old man.

However Scent could be a better choice after all (though chosen by my crap typing).

Diavowed:

The complement wasn't supposed to be backhanded I'm just lazier than you

Hoof Arted:

Congrats on the 9 month old.
You have summed up what I have been feeling for a while but I just can't walk away from finding out how things work

nt:
A good question always provokes a good answer, though it may not be the one that you want.
Evaluator and Splaj had a way of doing that

Personally I like simple and clean, and to know what I don't need to look at before attempting any work on the actual code.

However I feel that I may have started a disgreement with somebody who want's it to be a complex black art

Only for experts who understand all the code and you arn't allowed to cheat by using tools

Anyway I have probably put my foot in it again.

love N hisses,

Kilby...

I'd really hate to ruin this nice philosophical moment and everything , but I still don't think that you will find a counter in that program if the programmer had half a brain (see my post in that thread).

Why are API:s so bad in this case? Breaking on the API that is used to sample the system clock (or the timer API:s) would be an excellent, not to mention simple and clean, method to pinpoint the time-checking code in such a situation. Having a good understanding of which API:s that are probable to be used in a certain situation is an unvaluable tool for reversing/cracking programs!?! Once you have pinpointed the correct position in the code through the API, you read it, understand it, and apply a graceful 1-byte patch to kill it. Can't think of a better way actually.

But sure, I'm guess some of the things you say are good and true and all, I just think the API thingy is quite unprovoked, that's all.

Later,
dELTA

Didn't see your reply in the newbie forum until now Kilby. Anyway, I just think your original post in the newbie forum was a bit easy to misunderstand, that's all. Now let's just all be friends, ok?

If I was hard to understand, sorry, my boss was wandering in and out so it's had to get a good train of thought.

I hate apis only because 90% of so called reverse engineers, bpx an api then look for the jnz straight afterwards.

In ye olde days you where aleays on a voyge of discovery as apps programmers tended to find their own solouion.

Back then the code woods really did exist.

Friends again ?

More like when was it any other way

Best wishes,

Kilby...

Just like you say, I don't remember being anything else than friends. Anyway, maybe just consider using less provocative language in future posts to avoid similar situations altogether, just a tip.


Later,
dELTA

PS.
A good way to stop your boss from coming into your room all the time is to engage in lengthy discussions about useless things with him everytime he comes. Then he will stop coming at all after a while.

I hope your not "flexing" on Kilby

Woodmann

Just trying to clear up a little misunderstanding in the newbie forum, and looking out for the good atmosphere of the board, that's all.

dELTA

Hey! I'm not sure Kilby is old enough YET to be grumpy. I though that was a dispensation reserved for me, or is my dementia just acting up again??

Regards.

Nope no flexing noticed ny me

However I just use provocative when I feel it is being used towards me (nope it wasnt delta who used it).

Kilby...