Re: Real Investigation

Benjamin Larsson wrote:
> Hi, I've been checking out some of the RealAudio codecs. What I found 
> out was abit interesting. Real has released alot of versions of its 
> (in)famous media player. And over a wide range of platforms too. I 
> thought maybe some version would reveal something that another one 
> didn't. So I started tracing down every version they had released. They 
> looked almost the same until I found Realplayer version 5. It's codec 
> libs weren't stripped. They had LOTS of good information in them, 
> function names, static table names, static constants, file names and 
> lots of other info (look like they are compiled with -O2 and no 
> -fomit-pointer flag, which is good). A copy of RealPlayer5 for linux can 
> be found here:
> 
> http://tranquillity.campus.luth.se/~banan/real/legacy/rv50_linux20.tar.gz
> 
> This package has 2 codecs which has not been RE'rd (AFAIK). The 
> (A)CELP-based sipro.net codec and the AC3 based dnet codec. I started 
> looking at the CELP codec to see how it was structured.
> 
> After coding perl for a day this graph was generated:
> 
> http://tranquillity.campus.luth.se/~banan/real/siprographfull.ps
> 
> Quite alot of functions, after sorting out everything that didn't looked 
> like it had to do with decoding I got this:
> 
> http://tranquillity.campus.luth.se/~banan/real/siprographdecode.ps
> 
> Much better, you can clearly see the programflow, the 3 different 
> decoding functions, decoder init functions. From here you just need to 
> decide from where to start. I started looking at interpol because that 
> function didn't call any other function and I sort of could guess what 
> it should do by the name of the function. A disassembly of that function 
> didn't make any sense to my untrained eyes(no skillz). So I hacked up 
> another monsterperl script and got this:
> 
> http://tranquillity.campus.luth.se/~banan/real/interpol.ps
> 
> Now this is something that would make sense to my untrained eyes and 
> that is how far I've been able to get. With this I hope that more effort 
> would be put into REing sipro and dnet. Drop me a mail if you feel that 
> you could help with this. Coz I currently have no skillz.
> 
> MvH
> Benjamin Larsson
> 
> 

Can you publish your perl scripts as well.



-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com