Hacking Livestream #82: Reverse engineering a VM-based protection (part 2)

[@artlkn]

Starts @ 23:00

[@ivartorr1469]

What OS do you use? i'd be very interested in your set up. Most importantly, how do you get that drawing pen with just a click?

[@GynvaelEN]

The "drawing pen" would be ZoomIt from sysinternals/microsoft. And that's Windows 10 with a Linux in a VM (and X server on Windows).

[@rongrundy7943]

Can you please demonstrate "Blind Association" from Google CTF 2019? OR direct us to a write-up. Thank you very much.

[@rongrundy7943]

bnv.web.ctfcompetition.com/

[@GynvaelEN]

@@rongrundy7943 I probably won't be, since I don't know that challenge, but please take a look at kzbin.info/www/bejne/qJTKomuCrrN3l7M

[@rongrundy7943]

@@GynvaelEN Thank you so much. I look forward to your next video. I have already learned so much from you.

[@alberthinkel1597]

When did you choose to go so low-level in computer science(knowing assembly code so well)? I find it kind of depressing to go so deep into detail loosing the bigger picture sometimes.

[@GynvaelEN]

That's a good point. I actually already had about 10-12 years of hobby programming experience before I started a deep dive into details. That being said, I wouldn't be afraid of loosing the big picture per se, but I do find myself having a heavy Not Invented Here syndrome due to a dislike of using available high-level programming libraries since they always have some details that I'm afraid were coded incorrectly - and most of the times I'm right, but that still slows down implementing a program/tool/app I'm writing. So I guess I've learnt through the years to segregate things between ones I do to be done and work asap (use libraries/frameworks/etc), and things that absolutely have to be done correctly (probably implement myself), and things I write to learn something (implement myself). That being said, learning the low-levels allows you to code better high-level code, so even if you don't want to focus on low-levels, DO learn them :)

[@alberthinkel1597]

@@GynvaelEN thanks for your long answer. I guess not everybody is meant to be a low-level programmer then(your skill level has to be insane) 😳. You wrote that some high-level programming libraries are incorrectly implemented. Is that because you find better algorithms (which means you have to be pretty talented in math) or you program the same algorith more efficiently? You dont have to answer of course. I know its a little rude to squeeze information out of people.

[@GynvaelEN]

@@alberthinkel1597 I don't think there is a rule for who can or cannot be a low-level programmer - just do what you like best. About the incorrectly implemented - it's usually a mix of small details and security/stability features (or lack of such). Sometimes it's also about larger algorithms too of course. And it's not really about being more or less talented, but about a different use-case. E.g. it's not a problem if a used algorithm is suboptimal unless that becomes a bottleneck for the overall speed.

[@sent4dc]

dude, it's like a freaking inception in asm

[@GynvaelEN]

Well, the name 'matryoshka' was there for a reason :D

[@sent4dc]

​@@GynvaelEN Thanks. I didn't know what that word meant. Also just curious, can you show how to reverse an actual example of a VM. Say, anything obfuscated with VMProtect? vmpsoft.com/support/user-manual/introduction/what-is-vmprotect/

[@onepiece9931]

09:21