Breakthrough after breakthrough in the F4I case
 sp <foo bar com> |
Thursday, November 17 2005 03:55.49 CST |
Ladies and gentlemen, muzzy and I made whats maybe the most significant progress since we began our little examination of the F4I binaries a few days ago. Thanks to Halvar Flake of Sabre Security who provided us with results from newer versions of BinDiff than those that were available to us, I was able to positively identify several functions from the mpglib library in the F4I code. Whats significantly more important is that muzzy found actual GPL code in the files too! Yes, GPL, not LGPL! This opens up a completely different can of worms.
Lets start with the LGPL code from mpglib. Im only listing the found functions briefly because I think theres already enough disassembly on my website.
The function decodeMP3 from interface.c can be found at virtual offset 0x10059850 in ECDPlayerControl.ocx
The function decodeMP3_clipchoice from interface.c can be found at virtual offset 0x10059440 in ECDPlayerControl.ocx
The function addbuf from interface.c can be found at virtual offset 0x10059020 in ECDPlayerControl.ocx
The function sync_buffer from interface.c can be found at virtual offset 0x10059310 in ECDPlayerControl.ocx
...
I could go on like this for quite a while as the functions mentioned already contain so many function calls themselves that its probably possible to reconstruct large parts of mpglib from there (if not the complete library).
Im sure youre more interested in the GPL code than in a large list of LGPL functions and where they can be found in the F4I code though.
I just want to mention that the function that can be found at virtual offset 0x10089E00 in ECDPlayerControl.ocx is the function DoShuffle from a GPL-ed file called drms.c written by Jon Lech Johansen and Sam Hocevar (Google for it). Ill leave the rest of the explanation to muzzy for now.
Comments
| Posted: Wednesday, December 31 1969 18:00.00 CST | |