2

Let's say I have a specific target that I want to RE (for this question let's take a windows PE executable as an example). Would it be ok to post a piece of disassembly or perhaps pseudo code from eg hex rays with the purpose of help/assistance in RE?

If permitted, to what extent? Are we possibly violating copyrights and so on.

Or could we even put a binary online (somewhere) eg to assist in unpacking it?

What if the binary is malware? How do we safeguard it?

4

I think it's up to the poster to take the responsibility. Obviously, we can't talk too much about DRMs, protection scheme,... But posting disassembly or decompilation (hex-rays or anything) is OK - and actually expected, otherwise we can't really know the problem in many cases- for me.

To avoid any problem, better focus on the reversing part (asm, bytecode...), and not give any extra unnecessary details that could make one think "this is how you break XXX".

Putting the binary online is normal and expected for extra assistance (for example, like malware analysis, as you said)

  • if it's malware, just crypt the archive with infected password.
  • if it's not malware but still likely to be detected (crackme, ...), you might still want to crypt the archive (clean password in this case).
1

I agree with Ange that it should be allowed to post disassembly etc.

However, that said I disagree that it should be allowed to include "attachments". The reason being that these files are likely to go away and we have no service like the one SE uses for images to store arbitrary files. This is also why I write this up as an extra answer, because while I agree with (and upvoted) the other answer, I don't think it is good form to allow files "somewhere" to be referenced. Assuming this was allowed for some reason, a future reader may not even be able to reproduce the description outlined in the answer(s) because the file has long since gone.

Furthermore I think that for a Q&A site the relevance for the reader (and future internauts) needs to be considered as the prime aspect when decisions are made what to allow and what not. If you are disassembling a particular sample/target, it makes sense to ask on RE.SE for specific conceptual questions. I think it doesn't make sense to ask all kinds of questions you'd ask on kernelmode.info if you are stuck with a particular sample.

NB: my concern is not about the uploaded files being malicious per-se. That's a whole different story. My concern is about the fact that allowing this means that we would end up with the situation that the network-wide policy which stipulates that relevant parts of a linked resource be quoted is violated.


Edit #1

amccormack points to this meta.SO topic concerning arbitrary file upload.

There are more aspects to it:

  • Fairness: if the file goes away, people will later not even get the chance to answer a question based on a particular uploaded file that has since disappeared. So it's not just the "keeping a record" issue mentioned above. Keep in mind that the first answer isn't always the greatest. The communities grow at all times and hence new people with new expertise will join and be able to answer.
  • It makes questions less concise (aka too localized): yep, I side with Mehrdad here. It's a bad idea to make questions too specialized. We know that and it's what I meant by conceptual questions above versus all kinds of questions.
  • You raise a good concern about a file disappearing and that having a negative impact on the question and the site as a whole. However, I think we should emphasize that questions should be able to stand alone outside of a file, but a file could be provided but only as a 'for instance' case. If a technique is explained in one question for one file, it should be explained generally and not localized for that file. – amccormack Apr 16 '13 at 23:18
  • @amccormack: you have a point as well, there. The problem is, however, also one of fairness. While the reverser passing by within half a year of the question being asked may be able to get the file and write up something useful (or not), anyone stumbling over it later may just not be able to answer anymore, because the file is gone. What would you suggest in that case? Strictly speaking this requires that SE offers a solution similar to images also for other files, don't you think? – 0xC0000022L Apr 16 '13 at 23:36
  • This meta.SO provides some context on the hosting side. – amccormack Apr 16 '13 at 23:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .