Hacker News Reader

Comment by sillysaurusx | Hacker News Reader

But how do we find the offsets? What values do we give to ssl_read_offset and ssl_write_offset?
[ REDACTED ]

I had a nice little section on how to find the offsets here. When I first wrote it I was convinced that publishing two addresses couldn't possibly get me sued for reverse engineering. Some of the people who read the draft of this post changed my mind about it though, and it is 2020 after all so it is not a good time to be optimistic.

So, how would you find these offsets? Anyone know?

It's probably the most interesting part of the post.

There's a "hypothetical" paragraph afterwards, but if anyone wants to actually do this with Zoom and post the results, you'd probably earn lots of cred.

In particular, the exact arguments to the objdump command would help.

View on HN

It is sad they felt the need to do this. This step is not hard, but censuring it because of hypothetical legal issues speaks a lot about the state of affairs on computing.

I miss the good old times where knowledge were freely published without fear.

Do note that this is generally not something that would be a legal issue.

> Some of the people who read the draft of this post changed my mind about it though

Details? Reverse engineering isn't even illegal.

Since the Zoom TOS explicitly forbid reverse engineering, sadly it isn't so easy.

TOS can't substitute to the law. Reverse engineering is legal by law depending on the jurisdiction.

But if you’re using Zoom for work, they can still ban your account and/or company.

Then use Jitsi, or something.

Sure, but if your 1000 person company uses Zoom and Zoom only bans your account I don’t think you can convince a company to switch clients. That said I find that specific scenario unlikely.

It's no problem. The company can contact zoom support and get your account unlocked.

Random companies can't make new law. If you violate their TOS the most they can do is refuse you service.

Or sue you, which is likely with shady companies such as Zoom.

No idea why you're being downvoted but this is 100% factually correct in the US: you'll get sued by a company that has a very salaried legal team.

Even if Zoom is in the wrong/has no case, all it takes to "win" in the US is enough of a bankroll to troll someone via the legal system. It's pay-to-play here and Zoom likely has the budget to run an independent researcher into the ground financially with legal defense fees alone.

I get that HN wants to have it's "hacker" ideals and all, but, I would expect to cause myself legal troubles for publishing security details on such a service (unless done anonymously with reasonable opsec).

Thank you I can't believe this had to be said explicitly.

I might misunderstand the fundamental point, but zoom doesn’t seem to be making new laws. Existing contract law is perfectly capable of handling two adults agreeing to a mutually beneficial set of restrictions.

Lots of things that are legal we’ll be restricted in contract agreements - free speech is a fundamental right, but mutual non-disclosure agreements still exist and can result in (civil) legal action if reneged on to one party’s detriment.

What's the point of giving people rights when companies can just force you to relinquish them via contracts? That obviously leads to these "you can't exercise your rights" clauses becoming standard in every contract.

People should be able to do things that hurt a company's business interests, especially reverse engineering. They do not deserve any protection. Actually, it should be encouraged since it leads to better products for consumers.

When you sign a contract, very often you are waiving some of your rights. There are rights which cannot be waived by you—I’m not sure the right to reverse engineer is one of them

You never have to sign any TOS when reverse engineering, ergo no contract.

you probably sign TOS as part of the installation of the binaries

clicking a button != signing your name

> Existing contract law is perfectly capable of handling two adults agreeing to a mutually beneficial set of restrictions.

I think you'll find that most people - and a number of leading law experts - don't consider click through EULAs for valid binding contracts and clicking next is not the same as signing.

You'll also find that many (most? I stopped reading EULAs years ago) contains something about "the following might not be applicable in your jurisdiction".

Besides, just think of it: can a click on a button, placed in a way that makes it easy to click through for someone who accepts the defaults, can such a click really be considered a meeting of minds?

And do we really think people can be expected to read a number of pages of dense legalese? I remember one EULA filling 13 A4 pages with text in a small font after I gave up and printed it two decades ago when I was young and still believed they were valid.

Besides: Expecting non lawyers to read and understand legalese is as crazy as expecting non programmers to read basic Java or Python: within reach for many after basic self study, but still not something I'd bet much money on random people being able to do on the fly.

> I think you'll find that most people - and a number of leading law experts - don't consider click through EULAs for valid binding contracts and clicking next is not the same as signing.

If you feel like you're potentially a target of a lawsuit, the only opinion that should matter to you are your lawyer's and the the court's. Some EULA restrictions are not enforceable, but some definitely are. No US court has ruled on whether EULAs are binding, or not - so there is no precedence.

There is a certain asymmetry in it, but you can also sue and have shit like that declared illegal. Thing is it would threaten most bizniz-models of the bullshit economy, so it doesn't happen that much.

I'm expecting that this finally changes for the better, at least in some parts of the world, where the parts which don't adapt to that change spiral further down.

Rightly so!

These days that could actually be a significant problem, depending on your work.

ToS aren't important if they're not enforceable, which is the case with a prohibition on reverse engineering. That said, if I published something like this I'd do it under a pseudonym under a domain and a vps that I paid for using an untraceable currency. Companies are evil and even if you'll eventually win, they'll make your life miserable. Why take the chance?

We know the exact version of openssl they’re using, so we can just build the same version ourselves, get the address of the functions, and look for the same pattern of instructions in the Zoom binary. Not sure if LTO could break this or not though.

That seems pretty unreliable. The specific version of the compiler used, as well as flags passed to the compiler, could easily change the instructions used, no?

That was just the quick and naive way I went for because I didn't want to download new tools, but there's many other options.

The easiest way if you have a capable debugger is probably to look for SSL strings/error codes in rodata and see where they're referenced.

Or IDA can even output C code that is very close to the original.

Based on how the OP described finding the offsets, it sounds like this is exactly what they did, perhaps there are some obvious sentinels that make it easy. I’m not a C expert, but I think a function call w/ args has a pretty standard way of being executed and if you know the types of the arguments it’s possibly even easier?

ABI compatability baby. Those signatures gotta match up for sure. Once you have that, the underlying guts of the code wont matter so much.

If this was 32 vs 64bit or some such you'd be pretty hosed at where everything was I imagine.

Boom. ABI that’s the word I was thinking of. Thanks!

It's pretty reliable in reality, C compilers are actually quite predictible. The only meaningful changes compilation flags do is add/remove basic blocks.

That's also mainly how malware reverse manages to "hunt" APT families, by finding meaningful little patterns in the instructions and look for code reuse in other binaries :D

Generally it's a little bit more manual than "pass flags to objdump"–I'd look for strings and such used by the function in the open-source release and then cross-reference that.

Reply on news.ycombinator.com