This project reverse-engineered the obfuscated bytecode virtual machine used in the TikTok Android app to understand how it protects intellectual property like algorithms and business logic. By meticulously analyzing the VM's instructions and data structures, the author was able to reconstruct its inner workings, including the opcode format, register usage, and stack manipulation. This allowed them to develop a custom disassembler and deobfuscator, ultimately enabling analysis of the previously hidden bytecode and revealing the underlying application logic executed by the VM. This effort provides insight into TikTok's anti-reversing techniques and sheds light on how the app functions internally.
The blog post "Everything wrong with MCP" criticizes Mojang's decision to use the MCP (Mod Coder Pack) as the intermediary format for modding Minecraft Java Edition. The author argues that MCP, being community-maintained and reverse-engineered, introduces instability, obfuscates the modding process, complicates debugging, and grants Mojang excessive control over the modding ecosystem. They propose that Mojang should instead release an official modding API based on clean, human-readable source code, which would foster a more stable, accessible, and innovative modding community. This would empower modders with clearer understanding of the game's internals, streamline development, and ultimately benefit players with a richer and more reliable modded experience.
Hacker News users generally agreed with the author's criticisms of Minecraft's Marketplace. Several commenters shared personal anecdotes of frustrating experiences with low-quality content, misleading pricing practices, and the predatory nature of some microtransactions targeted at children. The lack of proper moderation and quality control from Microsoft was a recurring theme, with some suggesting it damages the overall Minecraft experience. Others pointed out the irony of Microsoft's approach, contrasting it with their previous stance on open-source and community-driven development. A few commenters argued that the marketplace serves a purpose, providing a platform for creators, though acknowledging the need for better curation. Some also highlighted the role of parents in managing children's spending habits within the game.
The Minecraft: Legacy Console Edition (LCE), encompassing Xbox 360, PS3, Wii U, and PS Vita versions, has been largely decompiled into human-readable C# code. This project, utilizing a modified version of the UWP disassembler Il2CppInspector, has successfully reconstructed much of the game's functionality, including rendering, world generation, and gameplay logic. While incomplete and not intended for redistribution as a playable game, the decompilation provides valuable insights into the inner workings of these older Minecraft versions and opens up possibilities for modding and preservation efforts.
HN commenters discuss the impressive nature of decompiling a closed-source game like Minecraft: Legacy Console Edition, highlighting the technical skill involved in reversing the obfuscated code. Some express excitement about potential modding opportunities this opens up, like bug fixes, performance enhancements, and restored content. Others raise ethical considerations about the legality and potential misuse of decompiled code, particularly concerning copyright infringement and the creation of unauthorized servers. A few commenters also delve into the technical details of the decompilation process, discussing the tools and techniques used, and speculate about the original development practices based on the decompiled code. Some debate the definition of "decompilation" versus "reimplementation" in this context.
Summary of Comments ( 82 )
https://news.ycombinator.com/item?id=43747921
HN users discussed the difficulty and complexity of reverse engineering TikTok's obfuscated VM, expressing admiration for the author's work. Some questioned the motivation behind such extensive obfuscation, speculating about anti-competitive practices and data exfiltration. Others debated the ethics and legality of reverse engineering, particularly in the context of closed-source applications. Several comments focused on the technical aspects of the reverse engineering process, including the tools and techniques used, the challenges faced, and the insights gained. A few users also shared their own experiences with reverse engineering similar apps and offered suggestions for further research. The overall sentiment leaned towards cautious curiosity, with many acknowledging the potential security and privacy implications of TikTok's complex architecture.
The Hacker News post "Reverse engineering the obfuscated TikTok VM" (https://news.ycombinator.com/item?id=43747921) has generated a modest number of comments, mostly focusing on the technical challenges and implications of reverse-engineering TikTok's code.
Several commenters discuss the complexity of reverse-engineering TikTok's bytecode, highlighting the "control flow flattening" technique used to obfuscate the code. They explain how this technique makes it difficult to understand the app's logic by obscuring the natural flow of execution. One commenter notes that this is a common tactic used in malware and other software seeking to protect against analysis. This commenter also mentions the challenges of renaming variables and functions during the deobfuscation process, adding to the complexity of understanding the code.
Another commenter points out the difficulty in tracing back the disassembled code to specific features or functionalities within the TikTok app. This is particularly relevant in a large and complex application like TikTok, where associating specific code sections with user-facing features can be a daunting task.
Some comments delve into the broader implications of this reverse-engineering effort. One commenter questions the ultimate goal of the project, speculating whether it's for security analysis, understanding TikTok's algorithms, or potentially developing modifications for the app. They also touch upon the legal and ethical considerations of reverse-engineering proprietary software. Another commenter expresses concern over TikTok's extensive data collection practices, suggesting that reverse-engineering efforts could shed light on how this data is collected and used.
A couple of comments discuss the broader trend of app obfuscation and the ongoing "cat and mouse game" between developers who obfuscate their code and security researchers who attempt to reverse-engineer it. They point out the constant evolution of obfuscation techniques and the challenges faced by researchers in keeping up with these advancements.
Finally, a comment mentions the practical challenges of reverse-engineering, including the time and effort required to analyze obfuscated code. This highlights the significant investment needed to unravel the inner workings of complex applications like TikTok. The thread lacks highly upvoted or controversial comments, keeping the discussion relatively focused on the technical aspects of reverse engineering and its implications for TikTok.