OffensiveCon
1 HN recommender · recommended in 3 months, 2019–2021
33:41 · 20K views · Apr 10, 2019
Alex Ionescu's OffensiveCon 2019 keynote on how reverse engineering is done on Windows without conventional reversing. It covers legal ways to obtain names of variables, exported functions and structures.
Cited in ReactOS threads as an authoritative account of how Windows reverse engineering works and as a rebuttal to claims about ReactOS.
5 comments from Hacker News
Well that's categorically untrue. Sure they don't release private symbols intentionally but they have done in the past accidentally. At that point it becomes a bit of a grey area, undoubtedly leaked/stolen source code is a no-no but reversing from private symbols when they do leak seem harder to quantify as you still need to reverse engineer the code, just structures/names etc are already known. Private symbols are not the only way of gleaning more information, other examples I can think of are: * Checked builds (prior to Win10). These builds shipped de-optimized kernels (e.g. no inlines) typically with copious debug strings which gave away important details. For example I gleaned a lot of knowledge of ALPC MSRPC from the checked build of rpcrt4.dll from Windows 8. * SDK/DDK headers, especially in the brave new world of insider previews with preview SDK/DDKs there is sometimes information present which should not have been released including "private" information. Again bit of a grey area. * The private symbols MS do ship. For example a significant proportion of the COM runtime has private symbols, intentionally. You can extract from those a surprising amount of system call structure information. I'd recommend watching Alex Ionescu's talk at OffensiveCon about how he does reverse engineering on Windows to see many of these things in action. this video I'm not saying any of this would make it a clean-room re-implementation but to say ReactOS cannot possibly have been reverse engi
Well, now please re-read your statement Do you understand that internal data structures entirely from the NT kernel, including (why?) their names != verbatim code from NT in your source The program code is logic first of all. For the similarities of names and structures itself - the answer is in this already mentioned video this video from the 9:53 moment of time. TL:DW there are a lot of legal ways of obtaining names of variables, exported functions and structures
> Last time ReactOS came up here some folks were concerned about legality too, and I think there even was a salty Microsoft employee ranting about stolen code from the source leaks. Link to the actual dicussion here with the comments of the MS employee: [LINK] ReactOS developer's explanation on how they work: this video
It was by one "I am very smart. Nobody can be as smart as me" Microsoft programmer. Who completely dismissed this explanation this video
The more you write in these threads the more you sound like a fool. this video Start around the 9 minute mark.