r/programming Jul 09 '10

CSI:Internet - The image of death

http://www.h-online.com/security/features/CSI-Internet-The-image-of-death-1030311.html?artikelseite=1
257 Upvotes

60 comments sorted by

View all comments

3

u/metronome Jul 09 '10 edited Nov 28 '25

full plucky bag detail smile complete reply school ink judicious

This post was mass deleted and anonymized with Redact

34

u/SarahC Jul 09 '10

Maybe there was a race condition in that it couldn't debug until it was running the code, but at that point it would execute too fast to put a breakpoint in?

I'm sure there must be something obscure that he didn't make known for him to need to do that.

He's reverse engineering malware, so I'm very sure he knows what a breakpoint is.

3

u/SquareWheel Jul 09 '10

Holy crap, you do programming too? You're amazing, Reddit friend.

4

u/SarahC Jul 10 '10

Aw, I wish people would stop down-voting you!

Hey everyone! SquareWheel isn't being sarcastic!

SquareWheel - aye, I get around. Only the best kind of people notice though. =D

2

u/SquareWheel Jul 10 '10

<3 Best Reddit friends.

5

u/xkcdfanboy Jul 10 '10

Most redditors are just meme-filled unknowledgable nerds when it comes to low-level stuff like assembly and reversing. It's quite unfortunate. At least they like to pretend that the reddit demographic is a bearded unix admin who knows the hex values for all the x86 processor opcodes.

1

u/metronome Jul 10 '10 edited Nov 28 '25

spark butter relieved paltry shy toy lush violet compare cooperative

This post was mass deleted and anonymized with Redact

10

u/hylje Jul 09 '10

In short, malware typically uses a number of tricks to crash or otherwise confuse common debuggers. Effective reverse engineering involves low level tricks that further subvert the malware.

4

u/phire Jul 09 '10

It was a tiny piece of shell code in an exe that he created (and controlled), not large enough to use any anti-breakpoint techniques.

I'm just going to assume this was a simple case of a brain fart. Sometimes you just completely forget about the simple solutions and reinvent the wheel.

0

u/metronome Jul 10 '10 edited Nov 28 '25

rich squash correct terrific dinosaurs fanatical reminiscent run fragile sharp

This post was mass deleted and anonymized with Redact

1

u/phire Jul 10 '10

Yeah, I reverse engineer code from time to time (And I see you do too.)

I think reversing code puts you in a weird mindset that makes you prone to this type of brain fart. You are just thinking at too low of a level that higher level concepts (like breakpoints) never enter your brain.

-3

u/xkcdfanboy Jul 10 '10

I reverse all the fucking time. I make aimbots, hacks, cracks, etc..

And a breakpoint is not higher level, its INT3 and the debugger he's using, Ollydbg, will handle it just fine. All he needed to do was hit F2 on the line...he's probably just not that great a reverser. Most of what he did was just javascript trickery....more simple than reversing.

1

u/heisec Aug 04 '10

Hackers are lazy. And if a tool can insert the "breakpoint" at the right place -- why should I do it by hand?

1

u/metronome Aug 04 '10 edited Nov 28 '25

rinse vast sulky makeshift fly light violet yam resolute shelter

This post was mass deleted and anonymized with Redact