[2000-03-11]

Reverse Engineering

 

Cyber Patrol v4.0

The third censorware to fall under my close scrutiny. This time I invited Matthew Skala to help me with the analysis of a hash function, and we wrote the essay jointly. We look at the product in general, what it can do, and what it filters. In addition, of course, we have all the usual technical stuff in there, we document the file formats and the encryption and hash functions.

You can read the original essay here, or download the essay and related software in one package from here.

 

NetNanny v3.10

This is the second largest of the essays, in which we apply a large set of different techniques to find out the truth about the censorware. Was it hiding anything? Sure it was. While this is essentially a technical essay, the last third or so lean more towards being a discussion in general terms, and thus readable by most anyone. The downloadable archive below includes key-recovery software for NetNanny with wish you can bypass it or disable it.

You can read the original essay here, or download the essay and related software in one small package from here.

 

CyberSitter'97

In 1998 we reversed the CyberSitter'97 censorware. This came to have a much larger impact than we had anticipated, as it just so happened that the crimesyndicate of Scientology launched their own campain to get censorware installed on their members computers, and this censorware happened to be based on CyberSitter. Their version came to be known in the community as ScienoSitter, and our earlier work with CS meant that the secret list of keywords and banned sites in SS could quickly be decrypted.

You can read the original essay here, or download the essay and related software in one small package from here.

 

Win32: Calling unnamed functions through the use of ordinals

You will - for the time being - find my code for calling unnamed functions here. This is a must if you are in need of calling undocumented functions of the Win32API for which Microsoft does not export a function-name. This file was last updated in 1999-08-10.