To what extent is discussing a specific target for RE allowed

Question

Let's say I have a specific target that I want to RE (for this question let's take a windows PE executable as an example). Would it be ok to post a piece of disassembly or perhaps pseudo code from eg hex rays with the purpose of help/assistance in RE?

If permitted, to what extent? Are we possibly violating copyrights and so on.

Or could we even put a binary online (somewhere) eg to assist in unpacking it?

What if the binary is malware? How do we safeguard it?

Answer 1

I think it's up to the poster to take the responsibility. Obviously, we can't talk too much about DRMs, protection scheme,... But posting disassembly or decompilation (hex-rays or anything) is OK - and actually expected, otherwise we can't really know the problem in many cases- for me.

To avoid any problem, better focus on the reversing part (asm, bytecode...), and not give any extra unnecessary details that could make one think "this is how you break XXX".

Putting the binary online is normal and expected for extra assistance (for example, like malware analysis, as you said)

• if it's malware, just crypt the archive with infected password.
• if it's not malware but still likely to be detected (crackme, ...), you might still want to crypt the archive (clean password in this case).

Answer 2

I agree with Ange that it should be allowed to post disassembly etc.

However, that said I disagree that it should be allowed to include "attachments". The reason being that these files are likely to go away and we have no service like the one SE uses for images to store arbitrary files. This is also why I write this up as an extra answer, because while I agree with (and upvoted) the other answer, I don't think it is good form to allow files "somewhere" to be referenced. Assuming this was allowed for some reason, a future reader may not even be able to reproduce the description outlined in the answer(s) because the file has long since gone.

Furthermore I think that for a Q&A site the relevance for the reader (and future internauts) needs to be considered as the prime aspect when decisions are made what to allow and what not. If you are disassembling a particular sample/target, it makes sense to ask on RE.SE for specific conceptual questions. I think it doesn't make sense to ask all kinds of questions you'd ask on kernelmode.info if you are stuck with a particular sample.

NB: my concern is not about the uploaded files being malicious per-se. That's a whole different story. My concern is about the fact that allowing this means that we would end up with the situation that the network-wide policy which stipulates that relevant parts of a linked resource be quoted is violated.

---

Edit #1

amccormack points to this meta.SO topic concerning arbitrary file upload.

There are more aspects to it:

• Fairness: if the file goes away, people will later not even get the chance to answer a question based on a particular uploaded file that has since disappeared. So it's not just the "keeping a record" issue mentioned above. Keep in mind that the first answer isn't always the greatest. The communities grow at all times and hence new people with new expertise will join and be able to answer.
• It makes questions less concise (aka too localized): yep, I side with Mehrdad here. It's a bad idea to make questions too specialized. We know that and it's what I meant by conceptual questions above versus all kinds of questions.