Suzanne Cook - Developing the CLR, Part II
- Posted: Feb 14, 2005 at 4:59 PM
- 122,551 Views
- 42 Comments
Loading User Information from Channel 9
Something went wrong getting user information from Channel 9
Loading User Information from MSDN
Something went wrong getting user information from MSDN
Loading Visual Studio Achievements
Something went wrong getting the Visual Studio Achievements
Right click “Save as…”
Comments have been closed since this content was published more than 30 days ago, but if you'd like to continue the conversation,
please create a new thread in our Forums,
or
Contact Us and let us know.
Follow the Discussion
Oops, something didn't work.
What does this mean?
Following an item on Channel 9 allows you to watch for new content and comments that you are interested in. You need to be signed in to Channel 9 to use this feature.What does this mean?
Following an item on Channel 9 allows you to watch for new content and comments that you are interested in and view them all on your notifications page.sign up for email notifications?
Does the tour continue in a Part III ?
http://www.cs.utah.edu/~scook/
Must be with all the geek stuff on it!
It was funny to see that video clip on the front page! I've seen it on TV many times, it was made here in Belgium (where I live).
Web stalker alert!
.NET has the equivalence in NGEN -- the Native Image Generator -- that compiles the entire .NET assembly right away to x86 code. If they can stick an optimized .NET compiler into NGEN, then it'd be darn close. Maybe that new Unified Compiler that Research is working on can be it.
OK, I'll let the Managed CPU idea go. How about a Managed Extension card. Maybe kind of like a Graphics Co-processor. Kinda like back in the days you'd buy Expanded Memory cards to run Lotus 1-2-3.
Hey! That kid is me! At least that is the way I was when I was small. (This what my mother alleges. Of course I have no recollection of it.)
Hmm... it seems I've misunderstood the function of NGEN.
Unfortunately, I don't have the time to commit to an entire new platform. For now, .NET is my koolaid.
There's a good reason MS doesn't support this kind of deployment. Applications deployed in this way won't get any hotfixes to the runtime or base class libraries. In fact people redistributing parts of the .NET framework using that tool are actually breaking the EULA.
It was interesting to hear Suzanne talk about how/why she got into programming. I've wondered if I have a girl whether there was any chance she would be as geeky as her dad or whether she would rebel and refuse to use computers for anything other than communications/art/lifestyle etc. Note that I'm assuming any sons would automatically be geeks
Oh, and another thing from the video: You mentioned Mono and it wasn't cut out by PR (do PR really review stuff posted by Microsofties?). That's as close to a public endorsement of the Mono project as I've seen yet
You're the one who's mistaken, who doesn't read other people's posts properly before spouting complete crap. I'd like to be nice about this but you are proving to be a complete arse. You're assuming that because people don't agree with you that they don't understand. Take your head out of your arse for a while and actually read this reply done in the finest Usenet line-by-line nit-pick fashion and then if you feel the need to continue your misinformation campaign, do it in the knowlege that I won't be reading any of it.
Right, your first mistake is that I didn't say gcj was re-distributing anything from Sun. I said that Salamander users were likely re-distributing parts of the .NET framework which is something MS doesn't want them to do and not just for copyright reasons.
What do you think ngen does? It compiles MSIL to actual platform dependant machine code and then puts it on disk just like gcj does. Now I know what you're thinking "but gcj really compiles it because it no longer needs a runtime present unlike ngen created executables". Well there's really nothing fundamentally different happening at all. Gcj's output requires a shared library to run. What do you think is in that library? All the same stuff as the ngen'd executables require from the .NET framework issthe answer. Code compiled by gcj still needs the use of a garbage collector as well other basic services mandated by the Java object model. It doesn't require a big framework to be present though because all the parts of the Java framework library that the program uses will have been compiled into the executable. Which is what salamander does for you. Between salamander and ngen you get exactly the same thing as you do with gcj.
No huge gaping difference, as explained above. Functionality doesn't just disappear from the .NET runtime. New versions are installed in parallel with old versions. If you're program requires a particular version of the framework it can be shipped with it or otherwise insist on it's presence. The only time the framework gets changed is for hotfixes - changes that do not affect functionality, generally only issued for security reasons.
Lets say that in 10 CLR verions time you're still running an app that hasn't been updated for the latest framework or any version of the framework inbetween. You still only need that one version of the framework present to run that app. To get in a situation where you need 10 different frameworks installed at once you'd need to have obsolescent software written using every single one of those versions. I feel pretty confident that by the time MS have released 10 complete versions of the CLR that nobody will be that bothered by the disk space used. The nice thing is that the CLR is shared between apps (that target the same version), therefore you're not dealing with hulking great executables that have had everything statically linked into them. But if you want a hulking great exe with everything it needs either linked in or contained in the same folder, salamander does that for you.
.NET doesn't have this problem as already explained. The right version of the CLR will load based on metadata in the executable.
A lecture on "The power of binary images" from an open source advocate. You've got to love the irony.
Don't kid yourself. The machine code generated by gcj is I'm willing to bet, very predictable. One thing that makes it much easier to decompile than C++ code is the presence of the class metadata needed to support garbage collection and late binding. Sure, it's an added layer of obscurity, but given that the sources of the compiler are available, I don't think it would take a decent programmer too long to write a decompiler for it. I was researching the decompilation of DOS binaries at university and there's plenty of stuff you can do even if you don't know the language the source was written in, never mind the compiler and the source for it.
trollpost a reply, press Alt+F4 to get to the "Reply" page faster. It's optimized for you.Everyone else, just use the regular UI.
Maybe we should take this offline, at least to let this thread go back on topic.
You have my weblog URL. Bring a few friends to carry you back home, man!
It's been suprising how few things they've asked me to remove. In fact, in this video we even joke around about it.
That's very good
You might not think it's possible, but these guys have it for sale.
http://www.dotnetcpu.com/
I love people who claim it's not possible. You people make smart people prove you wrong.
System.PlatformId in Whidbey also has a new enumeration for Unix; which is very telling. It didn't get added for sh!ts and giggles, iykwim.
http://blogs.aspadvice.com/pmurphy/archive/2004/08/11/1493.aspx
Beer28 raises very important point. Many companies want to protect their intellectual property (resources and time) that they put into making a software product, and it is a big issue, knowing that someone can take .NET DLL or EXE and quite easily decompile. I know there are tools that "obfuscate" the MSIL, but do not come close to ASM native image.
I am not with the latest buzz, but I would hope that next version of VS 2005 would have much better NGEN that not only could put .NET Native Image into GAC, but also produce standalone app, that could only be run on target platform that has compatible .NET libraries installed.
I know several people that just look at assembly code (even optimized) and tell you what it does. If you play with a debugger long enough, comparing assembler with the original source, in a few weeks you'll end up reverse engineering x86 assembler as well. Trust me on this one, the assumption that x86 asm is "safer" than MSIL is wrong. You can hack your way into anything if you're really determined.
While we're at it, the fears themselves are largely unfounded. On the one hand, a good developer can figure out how a feature works just by playing with it for a while and implement it on his own. On the other hand, I think that no company in the world would be willing to face the legal consequences, the PR losses and all other subsequent "blessings" associated with the uncovering of such practices.
Don't count on NGEN for obscurity. In v2, NGEN saves all metadata in the output file, so you get an executable file that's really easy to "understand". And in order to run NGEN-ed executables, you still need the original IL image.
Prove it. Download any of Dave's components, http://www.aspnetemail.com/ and modify please. Otherwise stop issueing blanket statements with no backing.
Win32Dasm is a piece of crap. If you *really* want to learn how to decompile code get a real tool like IDA. IDA can deconstruct anything, on any CPU, with any compiler. And FWIW, it is easy; it's just very time consuming and generally easier to write yourself if the purpose is to get code.
However, if you are trying to understand a virus or doing something blackhat like crack a piece of software it's relativly easy and something that can be done in an afternoon.
Once again you show you lack of skills dood. Anyone who has ever done anything other than crack a piece of shareware will tell you that Win32dasm is a piece of crap.
How about the distinct satisfaction of knowing that something you said is correct and you can prove it to a skeptic who has been there and done that.
Actually you can, it's just a case of replacing an instruction with a jump, then inserting your code (plus the now missing instruction) at the end.
Used to do that sort of thing all the time on the ZX Spectrum. Even modifying complex, self-modifying R register[1] decryptors became quite easy once you got into it.
For as long as the processor's instruction set is documented, it's possible to read a disassembly and understand exactly what is going on. The more you deal with asm, the quicker and easier this becomes.
Frankly I'm surprised that the resident open source guy is recommending security through obscurity.
[1] The R register, for non-z80 coders, was incremented by 1 (or sometimes 2) for every instruction executed. Encryption/decryption routines often used this fact to prevent code modification.
Decompiling code is legal under US law for educational purposes. If you would like I'd be happy to talk to Dave and ask him to explicitly authorize you to do this. I'm sure the .net community would appreciate your efforts in helping us make .net more secure if you can show us how you were able to get around commercial obfuscation technology.
However, I suspect the real reason is that your fingers overloaded your ability and you are now backing out.
You are batting 0 for 2. Just so you know. I'm keeping a record.
Don't take this the wrong way, but I am seriously fanatical about .net because after careful and thoughtful inspection I've concluded it's the best thing to hit the computer since BASIC; so once I started reading your drivel I actually became offended.
I don't know how long you've been posting hyperbole here, but I'm putting you on notice that the days of you issueing blatant falacies without any credible arguement are over.
Now to be fair, when you are right; I'll admit that you are right without any problem at all. But I must say you aren't getting off to a very good start.
How much would it take? FWIW, I own a couple of successfull businesses that basically run themselves. So playing with computers, and .net specifically, is like my hobby. I've got all the time in the world and if the money is right I'll gladly pay you to see it through.
So what's your number? How much would it take?
Translation, "I can't, but I don't have the balls to admit I'm just running my mouth with no real idea what I'm talking about".
Translation, "I'm going to fake the high road to try and save my credibility".
Sorry dude. I'm relentless and you are in the cross hairs. It's nothing personal, I just gotta call BS when I see BS especially with your history.
I got no problem with your point of view, just make sure it's accurate; cause as you can see from today - I'll eat you alive is a real debate.
<ORiellyStyle>I'll give you the final word.</OriellyStyle>
The instruction(s) don't have to be useless or even the same length, because you replicate them at the end of your code and then jmp back to after they would have executed.
And yes, you can effectively modify someone's code this way. Sure, you aren't likely to be doing large scale changes (who in their right mind would be making a large scale change using asm?) but you can make significant changes.
Actually I'm getting plenty of personal satisfaction from pointing out your inaccurate statements and subsequently watching you back away from them.
I, personally, have tried to turn obfuscated .net code into usable code and found it about as compelling as turning compiled x86 code back into usable code. Yes, it is technically possible; no, it's not worth the time or effort.
You were the one who said it was possible to turn obfuscation .net code into usable code. I've done everything I can do to assist you in backing up what I consider to be a rediculous remark, however you have done nothing but backpeddle from it.
Maybe you should go back and delete those comments so no one who wasn't watching this unfold will realize just who stupid you made yourself look today.
Just remember from now on, think twice about what you post cause I'm watching and am ready to make sure if you are wrong everyone knows it. If you are just shooting off your mouth be prepared to find your foot there.
Fair enough. I totally understand the value of time and I also understand if your schedule doesn't permit it right now. I'm a little confused as to where you get the time to read and respond to almost every post on these forums considering how busy you claim to be, but I suppose it's fair to let that pass.
Considering your vast knowledge of working with .net and obfuscated .net libraries, can you at least point me to one resource on the internet that shows how utilize code extracted from an obfuscated .net assembly? Surely you came to the statement
------
You are out of your league beer, either admit you made it up or produce a result.
lol. wow you really just shot yourself in the foot with that one. I'm done with this thread, you really just showed your ignorace.
That's not what we are talking about beer. We are talking about your statement stating that you can 'take' the source to an obfuscated .net assembly and recompile it as you see fit with your own enhancement. Everyone agrees C++ code is hard to reverse engineer.
For those who don't know, let me translate, "I just stuck my foot in my mouth big time, so I'm going to try and change the subject so no one notices".
Just to be clear, you didn't say this?
Do the peddles on your go-ped even go forward?
Sure. I'll send you something later today. I don't have a commercial obfuscator, as I'm not trying to hide any of my code from myself. Like I said before, this is a hobby for me. I don't actually sell anything. As soon as one of these component developers I know pop up on line, I'll get them to run a project of mine through thier tools.
I'm eager to know the end of the story!!!
How much would you be willing to pay to see it fully decompiled?
Translation - Paul is the one that does not really know what he is talking about. : ) No Offense. Just funny and kind of ironic.
There really is nothing that cannot be decompiled to a degree. Of course you are not going to get all the exact names of functions and variables, but if you know how to read the machine code, no reason you cannot figure out what the code is doing.
It's like all the stupid copy protection schemes and the companies that use them think they are actually working. Just harrassing their legal paying customers IMHO.
Remove this comment
Remove this thread
close