Hacker News Reader

Comment by kuschku | Hacker News Reader

It’s always funny how large developers – say, Google – still try to obfuscate their code when it’s so easy to reverse.

Even better, as in many legislations a derivate of manually deobfuscated code does not count as derivate of the original source, they even give up their copyright on their code, practically.

I’m surprised that this still happens. By now anyone should know that if you can run a piece of code, you can decompile, deobfuscate, and understand it. DRM and obfuscation only work to waste a week or two of the time of the person taking it apart.

View on HN

"DRM and obfuscation only work to waste a week or two of the time of the person taking it apart." Not only that, it also drastically decreases the amount of people in the world capable of reverse engineering your code. It also decreases the amount of people willing to. In the end, security is a game of effort vs gain. More effort -> might not be worth the gain.

Also - a lot of these techniques are used by malware to evade anti viruses and static code analysis.

> Not only that, it also drastically decreases the amount of people in the world capable of reverse engineering your code. It also decreases the amount of people willing to.

But with software and electronic media, only one person needs to care/be smart enough for everyone to reap the benefits.

Checkout denuvo. It's drm/reverse engineering protection, and it has prevented Just Cause 3 from being cracked since last December. Yes somebody will crack it eventually, but I would count this as a success(The game has already made the majority of it's money).

> Even better, as in many legislations a derivate of manually deobfuscated code does not count as derivate of the original source, they even give up their copyright on their code, practically.

I never heard that, source ? It's not really "clean room".

It’s not clean room, but the ECJ has allowed it one time already. Which did set an interesting precedent.

I'm guessing you're talking about this then: https://en.wikipedia.org/wiki/SAS_Institute_Inc_v_World_Prog...

I still don't see how it's a derivative of RE'd code (like https://news.ycombinator.com/item?id=3919250 was). It's just the classic "reverse engineering allowed for compatibility".

In that case they actually wrote their code while having the reversed code open side-by-side. That’s the interesting part of the case.

> DRM and obfuscation only work to waste a week or two of the time of the person taking it apart.

I don't think it's that simple. There's some distribution of time wasted that goes from 0 (already prepared tools for automated deobfuscation) to infinity (it's enough of a roadblock to stop the effort). If you automate the obfuscation and just stick it into the publishing pipeline, you effectively stopped >0 people with ~0 effort. So why not do it?

> If you automate the obfuscation and just stick it into the publishing pipeline, you effectively stopped >0 people with ~0 effort. So why not do it?

Because automated obfuscation can also be solved automatically. Heuristical deobfuscators like JSnice.org are already getting more popular.

> DRM and obfuscation only work to waste a week or two of the time of the person taking it apart.

I remember reading an article featured here that the latest PC video game needed something like 6 months to be cracked and the crackers (Chinese I think) almost abandoned.

Will try to find the link.

Found it for you (or at least I think you meant 3DM (cracking group) and Denuvo (anti-tamper)):

https://torrentfreak.com/no-more-pirate-games-in-two-years-g...

Additionally some fun facts for games released with the latest Denuvo iterations:

Rise of the Tomb Raider released 28th of January this year, not cracked to date.

Just Cause 3 released December 1st 2015, not cracked to date.

Thats a lot longer than a week or two :)

This is true, but it's primarily due to the fact that highly skilled reversers aren't really producing cracks anymore.

If the skilled reversers stopped producing cracks, isn't that the same thing? :P

Sure, but it's still noteworthy that this isn't due to DRM suddenly becoming better.

What are they doing instead?

Writing obfuscators.

Easy to reverse, but not trivial.

100% protection does not exist, which doesn't mean you shouldn't try to make it a bit difficult

(keeping honest people honest and all that)

> DRM and obfuscation only work to waste a week or two of the time of the person taking it apart.

For 90 percent of Play Store apps, that would be more effort than the initial development effort for the app (and with 90 percent, I'm being very, very generous).

Well, it’s very useful when you try to understand how a random app did their neat UI, though, and want to get inspiration on how they managed to have a list on top of a toolbar.

Or anything similar to that.

For getting inspiration like that, it’s super awesome.

Reply on news.ycombinator.com