🚀 go-pugleaf

Eric Minso wrote:
> You didn't understand me.
>
> Do you really think I am crazy enough to compile source code I don't
> understand ?
>
> Do you really think I will stupidly copy-paste their code inside my
> application ?
>
> Sorry.
>
> What I'm trying to do is to understand how an application can add a
> "patch code" to another application.
>
> I _never_ compile untrusted source code.
> I _always_ _write_ each line of my code.
> I _always_ _understand_ each line of my code.
>
> Are you still anxious ?
> Are you still believing I will stupidly and accidentally release a
> virus ?

You still have to be _very careful_...virus writers are in the
business of duping people into doing stupid things...they are
extremely good at it and go to great lengths to fool and disguise
their intentions...a datafile or data in a program might look innocent
enough that you don't bother disassembling what you're supposing is
just some graphics data or whatever...and, oops, you missed that bit
where they exercised the slight of hand...just like you miss a
magician doing a card trick...

One piece of data slipped on the stack and a "call sp" instruction
(note, easily disguised as, say, a "call ax" instruction with an "xchg
ax, sp" miles and miles beforehand, which you easily
overlooked)...and, hey presto, the otherwise innocent-looking code is
now executing instructions hidden in filenames or carefully selected
data that looks like an innocent ASCII string but is actually valid
instruction code that does nasty things...really, it literally only
takes a single instruction or a single DWORD of disguised data to lose
complete control...and there's many, many ways to disguise these
things...

You _really_ have to know what _every single line_ does before you
execute it...and, simply, as there's a chance you could miss something
then the safest option is simply don't even go there...

The point here is, basically, it's a dangerous activity which you
don't, in fact, need to do...you could put on a bullet-proof vest to
prove that it works...but, oh dear, if it doesn't or you put it on
wrongly then you could end up dead...a totally stupid thing to do when
you could set-up a dummy to wear the vest and shoot that, then measure
the impact and work out whether you'd be dead or not had you been
wearing it...and if there's a big hole and the bullet has passed
straight through then you can be quite sure that it was very sensible
to use a dummy and not yourself for the tests...

On top of all this, the notion of "protection" is, I'm afraid,
unachievable, anyway...if it's software then it's utterly
crackable...for example, you might think having the executable pack
and encrypt your code is a good measure to take...but, just run the
code on an emulator like Bochs and then freeze the program at the
right point and then copy the unpacked, unencrypted code elsewhere for
examination...it could take you weeks to perfect this and they'll have
avoided your protections completely _within minutes_ and all using
nice, simple automated tools readily available...any protections
depending on instructions being executed won't work when they either
aren't executing the code (you can just read the bytes out of the EXE
as a data file and examine them without running a single item of code)
or they execute it on an emulator - which isn't the true machine - and
instruct it to tell them if the program tries to pull a fast one...

Whatever you attempt there's always a reverse process that'll crack
it...heck, these people can crack open _hardware_ and reverse engineer
silicon slivers...if hardware can't stand a chance against these
people then software is not even worth the effort...

Really, the only "protection" software has is the Berne Convention,
copyright law, Intellectual Property laws and software piracy
laws...and these people abide by none of those rules, anyway, as they
are criminals who are fine with the notion of breaking the law and
simply don't care...

Unsatisfactory? Yes...but welcome to the world...every lock can be
cracked...every measure you take to protect your property can be
circumvented...if someone wants to break into your house and they are
utterly determined then they eventually will...and with software, you
actually distribute that "house" to other's machines so they have as
much time as they like to crack into it...you're always absent and
away from this "house" that exists in every copy of your program...

Hence, you're contemplating a dangerous activity in order to do
something that, basically, won't work, anyway...understand why
everyone has concerns to advise you to another course of action...like
the bullet-proof vest, we _DON'T_ want the situation of seeing you
walking around with a big bullet hole in you...the satisfaction of
being able to say "I told you so" holds none of its usual smugness in
that situation...

Beth :)