IT Hare on Soft.ware

Disclosure: On this site you won’t find specific advice on “how to call function xyz()”. Interpreting C++ ARM and #pragma dwim is also out of scope.

We’re treating our readers as intelligent beings who can use Google and/or StackOverflow, where all such specific questions were answered more than once.

What you will find is opinions, more opinions, and even more opinions on all the aspects of software development - and with a large chunk of them based on real-world experience too.

Your mileage may vary. Batteries not included.


Bot Fighting 201. Part 4. Obfuscating Protocols. Versioning.

Quote: “we can handle several Client versions (each with its own obfuscation) with the very same Server.”
Another Quote: “Then, if/when a zero-day bug is encountered in TLS – our obfuscation does provide additional protection even before the attacker can reach the code with that zero-day vulnerability”

Bot Fighting 201, part 3. ithare::obf: An Open Source Data+Source Randomized Obfuscation Library

Quote: “This is all what the-best-available-decompiler was able to do with our obfuscated code”
Another Quote: “Performance-wise, we can do A LOT of obfuscation per network tick”

Bot Fighting 201, Part 2: Obfuscating Literals

Quote: “However, we can (and SHOULD) do MUCH better than that”
Another Quote: “With our approach, each and every obfuscation has to be hacked individually..”

Bot Fighting 201: Declarative Data+Code Obfuscation with Build-Time Polymorphism in C++

Quote: “Technically, what we’re looking for here, is any kind of bijection; we’ll use this bijection to convert our data from one representation into another one (and as it is a bijection, we can revert it later).”
Another Quote: “As we’re not writing our obf<> classes manually (instead, we have a code generator doing it for us on each build), the sky is the limit to the obfuscations we can generate.”

Are Top C++ Developers Migrating to Mac?

Quote: As Mac laptops are indeed very visible, we can easily review all conference videos on YouTube, and calculate a share of Macs used by speakers

Bot Fighting 103. Code Integrity Checks, Code Scrambling

Quote: “Bingo! We’ve got an executable, which automagically performs TONS of integrity checks, which checks are spread all over the executable, and are extremely non-obvious too.”
Another Quote: “This approach of ‘not revealing code until attack costs are high’ is certainly not limited to payments.”

Bot Fighting 102: System-Specific Kinda-Protection. Anti-Debugger, Anti-DLL-Injection, VM Detection.

Quote: “it is fundamentally impossible to prevent (or detect) debugging, at least as long we’re staying on one single box.”
Another Quote: “DON’T spend more than 10% of your overall anti-bot-fighting time budget on system-specific protections.”