Real Investigation

Hi, I've been checking out some of the RealAudio codecs. What I found 
out was abit interesting. Real has released alot of versions of its 
(in)famous media player. And over a wide range of platforms too. I 
thought maybe some version would reveal something that another one 
didn't. So I started tracing down every version they had released. They 
looked almost the same until I found Realplayer version 5. It's codec 
libs weren't stripped. They had LOTS of good information in them, 
function names, static table names, static constants, file names and 
lots of other info (look like they are compiled with -O2 and no 
-fomit-pointer flag, which is good). A copy of RealPlayer5 for linux can 
be found here:

http://tranquillity.campus.luth.se/~banan/real/legacy/rv50_linux20.tar.gz

This package has 2 codecs which has not been RE'rd (AFAIK). The 
(A)CELP-based sipro.net codec and the AC3 based dnet codec. I started 
looking at the CELP codec to see how it was structured.

After coding perl for a day this graph was generated:

http://tranquillity.campus.luth.se/~banan/real/siprographfull.ps

Quite alot of functions, after sorting out everything that didn't looked 
like it had to do with decoding I got this:

http://tranquillity.campus.luth.se/~banan/real/siprographdecode.ps

Much better, you can clearly see the programflow, the 3 different 
decoding functions, decoder init functions. From here you just need to 
decide from where to start. I started looking at interpol because that 
function didn't call any other function and I sort of could guess what 
it should do by the name of the function. A disassembly of that function 
didn't make any sense to my untrained eyes(no skillz). So I hacked up 
another monsterperl script and got this:

http://tranquillity.campus.luth.se/~banan/real/interpol.ps

Now this is something that would make sense to my untrained eyes and 
that is how far I've been able to get. With this I hope that more effort 
would be put into REing sipro and dnet. Drop me a mail if you feel that 
you could help with this. Coz I currently have no skillz.

MvH
Benjamin Larsson



-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com