Hacker News Reader

Comment by doix | Hacker News Reader

This was a pretty long read and I didn't really get much from it. The format of a million tweets is awful.

tl;dr it patches the executable by having a shim dll that does the patch when it gets loaded. Pretty common in the game modding community. It finds where it needs to patch by scanning for a byte pattern.

What does the actual patch do? No idea, that's what I was waiting for and I never got it. I was expecting a disassembly comparison of the before and after.

Someone please correct me if I'm wrong.

View on HN

Because the whole article can be written in 2 tweets but you need that social media “interaction”, so the author goes on talking about non essential things. The crack itself is simple and smart to bypass the check by changing the public key, the only issue from what I have seen is there’s a lot of hardcoded stuff like the key and the functions numbers, so most likely it won’t work in future updates.

As far as I can tell - and I could be wrong having spent about five minutes reading the thread - the shim DLL basically swaps out a public key used by the applications key verification system for a different one so the keygen can create a valid licence key.

Without affecting any integrity checks in the target binary.

Ah, that makes sense, thanks! I was pretty confused about the string copy and what that was doing. Normally I'd expect it to be writing a byte array. Now it all makes more sense.

Same here - I was interested in the mechanics of the crack, having spent a fair amount of time reverse engineering binaries back in the days.

This is just a bunch of screenshots with ‘lol’ interspersed.

Is this akin to using LD_PRELOAD on Linux to hook something like __libc_start_main and modifying specific data in one of the data sections of the ELF binary or something?

Yes

Agree, this was just a really long thread of someone creating structs in Ida.

That’s about 75% of reverse engineering work in IDA or Ghidra, to be fair: labelling/annotating shit, adding types to shit, and making sense of structs and other data types.

There’s extensions to both which automatically try detect such things from common libraries/known calls/etc which massively cuts down on the timesink.

I feel like this person is trying to copy Foone's voice but just doesn't get it

'This person' sounds like cts being cts doing cts things. Don't see why you'd think they're copying Foone.

Cybersec twitter is just awful. Everything has to be a call out or a dunk on someone/some company. It's all so negative.

Much like the rest of twitter then.

yep

As a sibling already pointed out, this is pretty much all of twitter now.

Infosec twitter moved over to Mastodon a while back, some are also trying out bluesky but Mastodon is where the community has mainly roosted.

As the saying goes, there's a fine line between genius and insanity... and a lot of these people are sitting on it.

Reply on news.ycombinator.com