HackerTube.dev

OffensiveCon19 - Alex Ionescu - Keynote - Reversing Without Reversing

OffensiveCon · 19.5K views · 2019-04-10 · 33:41

Open on YouTube ↗

If playback is restricted in your region, try opening the original video. Use Mark watched to add it to your marked videos.

Overview

Alex Ionescu's OffensiveCon 2019 keynote on how reverse engineering is done on Windows without conventional reversing. It covers legal ways to obtain names of variables, exported functions and structures.

On Hacker News

Cited in ReactOS threads as an authoritative account of how Windows reverse engineering works and as a rebuttal to claims about ReactOS.

Recommended by 1 HN people across 1 months · HN mentions 2019–2021

Topics

Security & hackingOperating systems & kernels
Search by tags
reverse engineeringwindows internalsreactossecuritysymbols

What people said

tiraniddo · 2019-07 · Recommendation

Well that's categorically untrue. Sure they don't release private symbols intentionally but they have done in the past accidentally. At that point it becomes a bit of a grey area, undoubtedly leaked/stolen source code is a no-no but reversing from private symbols when they do leak seem harder to quantify as you still need to reverse engineer the code, just structures/names etc are already known. Private symbols are not the only way of gleaning more information, other examples I can think of are: * Checked builds (prior to Win10). These builds shipped de-optimized kernels (e.g. no inlines) typically with copious debug strings which gave away important details. For example I gleaned a lot of knowledge of ALPC MSRPC from the checked build of rpcrt4.dll from Windows 8. * SDK/DDK headers, especially in the brave new world of insider previews with preview SDK/DDKs there is sometimes information present which should not have been released including "private" information. Again bit of a grey area. * The private symbols MS do ship. For example a significant proportion of the COM runtime has private symbols, intentionally. You can extract from those a surprising amount of system call structure information. I'd recommend watching Alex Ionescu's talk at OffensiveCon about how he does reverse engineering on Windows to see many of these things in action. [VIDEO] I'm not saying any of this would make it a clean-room re-implementation but to say ReactOS cannot possibly have been reverse engi

Read the original HN comment ↗
MikusR · 2021-02 · Reference

It was by one "I am very smart. Nobody can be as smart as me" Microsoft programmer. Who completely dismissed this explanation [VIDEO]

Read the original HN comment ↗
dvfjsdhgfv · 2020-10 · Reference

> Last time ReactOS came up here some folks were concerned about legality too, and I think there even was a salty Microsoft employee ranting about stolen code from the source leaks. Link to the actual dicussion here with the comments of the MS employee: [LINK] ReactOS developer's explanation on how they work: [VIDEO]

Read the original HN comment ↗

Sources

Video by OffensiveCon, played through YouTube.

Data and selection notes

HN summaries and labels may contain AI errors. HN dates refer to discussions, not video publication.

HN Library: HackerTube export (2026-10-31) and open-index/hacker-news. Upstream summaries and classifications may contain AI errors.

Views, duration and playback status refresh separately from the published catalog. When an update fails, existing data remains visible.

Selection checks
  • SaaS & AI candidates: Topic keywords do not match
  • Editor-approved picks: Editorial review is required

Rule matches identify candidates. They do not guarantee video quality or financial results.

About the library and its sources