Conversation

Notices

1. Embed this notice
   ✧✦Catherine✦✧ (whitequark@mastodon.social)'s status on Monday, 14-Apr-2025 22:51:37 JST ✧✦Catherine✦✧

   i found something called libEncryptorP.so in an Android binary and it uses an interesting method of obfuscation: it replaces a function with basically a CPU emulator for a fantasy CPU and then runs it on a program stored in .rodata or something

   it's quite cute, at first it looked incomprehensible but it has 32 registers, a 6-bit opcode field, and 16 bits of random stuff (flags, etc) which it extracts out of a 32-bit instruction word and dispatches in a loop

   made by ByteDance apparently

   • Embed this notice
     ✧✦Catherine✦✧ (whitequark@mastodon.social)'s status on Monday, 14-Apr-2025 22:52:36 JST ✧✦Catherine✦✧

     in reply to

     i reverse-engineered a significant chunk of it but then i realized it's only there to encrypt crash logs. then i decided to do literally anything else with my time

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Monday, 14-Apr-2025 22:52:36 JST Rich Felker

     in reply to

     @whitequark "Encrypt crash logs" sounds like a fancy way of saying "exfiltrate lots of private data with plausible deniability of malice".

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Tuesday, 15-Apr-2025 02:28:29 JST Rich Felker

     in reply to

     • Paul Khuong

     @pkhuong That's absolutely not okay. And one reason "crash reporter" should be a hard ban from walled garden app stores.

   • Embed this notice
     Paul Khuong (pkhuong@discuss.systems)'s status on Tuesday, 15-Apr-2025 02:28:30 JST Paul Khuong

     in reply to

     • Rich Felker

     @dalias @whitequark a lot of time devs don't want to tweak their crash reporter integration to filter out sensitive data, so the crash reporting server has to do it after the fact :/