Hacker News Reader

Comment by joelanders | Hacker News Reader

See links for a bit of reading about how hard it is to break DRM on Spotify or Netflix. They're doing a lot more than Snapchat. The difference between "you just need to reverse engineer the HTTP API to make a 3rd-party client" and "you need to run IDA Pro and PANDA and whatever else" is significant. The latter exploit would have far less reach.

[1] http://moyix.blogspot.de/2014/07/breaking-spotify-drm-with-p...

[2] https://www.usenix.org/node/182951

View on HN

I read through the Spotify article, and if I understood it correctly, you don't need to run QEMU+PANDA to get at the unencrypted stream. That was just the method the author chose to analyze the running code. He tracked every memory read and write made by the CPU, and looked for byte distributions that looked like encrypted data, and found the decryption function at address 00719b84. He then located that code inside the Spotify binary, at 0x0042e2ed.

Once you know that, you don't need to repeat the initial analysis every time. You can just set up a hook to record all the data that flows through that function after it's decrypted.

Yes, that's my understanding as well; my other comment was sloppy. I'm unsure what was meant by "hook," though. Is that something you set up with the target process running under a debugger? That much privilege wouldn't be available to apps in an app store, right?

I meant "hook" in the most vague, hand-wavy sense of the word… anything from attaching a debugger at runtime, to modifying the binary so it automatically saves every song on your desktop. Obviously if you did something like the latter, no extra privilege would be needed.

Reply on news.ycombinator.com