The DMZ

lynks

12:00 AM

@AdamMcKissock nah, keep your User.cs, but have a field public static User user in Program.cs

Adam McKissock

inside the main?

lynks

@AdamMcKissock standby one sec

Gilles

196

Reverse Engineering

Proposed Q&A site for security Researchers, Software and Hardware Developers

Currently in commitment.

TildalWave

what's the easiest way to declare a global in C#?

Gilles

I just saw that one

TildalWave

12:01 AM

@Gilles I'm promoting it on my site for a week and no1 even clicked on it :(

Gilles

what would it offer that Sec.SE and SO don't do?

TildalWave

@Gilles create a new discussion about this at the proposal, but personally I'd like to see those questions listed there in examples separate. maybe it's tastes thing

lynks

@AdamMcKissock pastebin.com/G98ZYX5L

Adam McKissock

@lynks pastebin.com/xHkq3KAT

like that?

lynks

@AdamMcKissock yeah that should work

Adam McKissock

12:09 AM

Awesome

lynks

@AdamMcKissock but you have to make sure you instantiate Program.user with something before trying to access it, otherwise you'll error out with a NullPointerException

so you need a Program.user = new User(fields...) somewhere

Or if you want to do it in Main you can just have user = new User(fields...); or even this.user = new User(fields...);

Adam McKissock

I want it to start with null values

lynks

@AdamMcKissock sure, so you just need a blank constructor, but you still have to assign something to the Program.user field, as that currently just points to null (rather than an empty User object, which is what you want)

@AdamMcKissock the easiest way to do that would be to change your declaration to;
`public static User user = new User();`

Adam McKissock

just did that :)

lynks

:)

Adam McKissock

12:13 AM

next up: c# crypto! yeeeeey! kills myself

lynks

@AdamMcKissock OO is hard to teach, because it only really starts to make sense when you have a fairly large project, and can really start putting together a nice class hierarchy, and leverage all the awesomeness.

Adam McKissock

@lynks This is my honors project :/

lynks

@AdamMcKissock just make sure you try to extend your own classes as often as possible, and you will start to see the advantages of a multi-layered class-space more quickly. just having a whole bunch of flat classes is less useful.

Gilles

0

Q: What would a Reverse Engineering site offer that existing sites don't?

There is already a Stack Exchange site about programming, including reverse engineering. There is already a Stack Exchange site about security, including reverse engineering. So it seems to me that reverse engineering is already fully covered on Stack Exchange, both from the concrete task-oriente...

technology

Adam McKissock

in what sense?

TildalWave

12:19 AM

@Gilles If you don't mind I won't be answering that as I'm not sure I'll be able to make much sense. But in a nutshell, I think there's more to reverse engineering than Sec.SE or SO are meant to address. I still think it's a valid question so I up-voted it for that

@Gilles Have you run through the proposed question?

lynks

@AdamMcKissock its hard to explain without a context, but say your program washed cars. you could have a Car.cs, Van.cs, Truck.cs etc, and then write a wash() function for each of them, but then when you came to wash a whole bunch of vehicles, it would be a real pain, there would be no concise way of doing it. Instead if you had each of the 3 extend Vehicle.cs, and have the wash() method in Vehicle, you could do it much more easily

(because, say you could just iterate over an array of type Vehicle, and not care whether each element was a Car or Truck or whatever, you would just call .wash() without worrying)

not to mention, then you only have 1 copy of the wash() code to maintain.

if Car extends Vehicle, and Vehicle has a wash() method, you can call Car.wash(), and you can also put Cars into a collection (array, hashtable, etc) of type Vehicle.

and if you want slightly different functionality (say, because it takes 2 people to wash a Truck), then in Truck.cs you just provide your own implementation of wash() and that will be used instead (this is called overriding a function)

ok I will stop giving a full blown OO tutorial in SE chat now...

Gilles

@TildalWave not exhaustively, but none of the ones I read were off-topic or even marginal on both SO and Sec.SE

Adam McKissock

@lynks Ahh you're talking about inheritance?

public class car:vehicle

lynks

@AdamMcKissock yeah exactly. use it, all the time. the more you do, the more sense OO will make.

Adam McKissock

You know, those 20 lines made more sense than a full twelve week module I did last year on inheritance.

TildalWave

12:29 AM

@Gilles I think SO needs a lot of offloading but that if it goes into beta a lot of questions will end up here anyway as it's a more mature site. Or who knows, maybe much the same ppl will end up being there and here at the same time? Anyway, if it won't make sense it won't make it past beta like many others before

lynks

@AdamMcKissock glad to hear it :P

Terry Chia

1:17 AM

@lynks Didn't Jeff or someone really disagree with inheritance being the main point of OO?

Frankly, very little of my code utilizes inheritance, yet OO makes it so much better.

Terry Chia

9:57 AM

Interesting, I got a comment by a member of the LastPass team for the review I did on my blog.

Pretty dead in here today.

Lucas Kauffman

11:06 AM

morning ^^

Terry Chia

11:22 AM

@LucasKauffman evening.

Rory McCune

11:33 AM

morning all

Lucas Kauffman

@TerryChia 2 against 1 !

democracy has decided it's mornign

Terry Chia

@LucasKauffman I'll ignore that since I had a great dinner.

Lucas Kauffman

@TerryChia breakfast.

Terry Chia

@LucasKauffman Dinner.

CodesInChaos

@TerryChia That response convinced me NOT to use LastPass, since it linked to a blog post demonstrating that their crypto is weak

Rory McCune

11:34 AM

@TerryChia ah but if you come over to the european side you can have a longer weekend :)

Lucas Kauffman

@CodesInChaos what response?

Rory McCune

@TerryChia link? Interested in last pass at the moment 'cause the missus has just started using it..

Terry Chia

infosecstudent.com/2013/02/…

Lucas Kauffman

@RoryMcCune I prefer keepass, but lastpass has its perks

Rory McCune

@LucasKauffman the thing that the missus was keen on is that lastpass has a windows phone app.

CodesInChaos

11:36 AM

I also posted a response detailing why I don't like their crypto, but it's awaiting moderation

Terry Chia

@CodesInChaos yep, just approved it.

Lucas Kauffman

@RoryMcCune keepass hasn't?

Terry Chia

@LucasKauffman They have a WP7 app. Don't think they have a WP8 one.

Rory McCune

I use password safe myself, but was trying to migrate the missus off her current strategy of different tiers of password and onto unique passwords per site, so lastpass looked like a good way of helping do that...

Terry Chia

@CodesInChaos Ahh, I just actually read the blog they linked to. Yeah, pretty weak crypto there.

Rory McCune

11:49 AM

@AviD The missus completed her collection, got the Pro from the states twitter.com/MarionMcCune/status/310355922453151745/photo/1/…

Terry Chia

@RoryMcCune Very nice!

Rory McCune

@TerryChia took a bit of doing (and the customs charges were heinous) but that's her happy now.

Thomas Pornin

1:28 PM

@lynks If I minded receiving emails, I would simply shut down my email server.

Terry Chia

@ThomasPornin Is that permission to spam? ;)

Thomas Pornin

@TerryChia Though I never gave permission to spam me, I got regularly spammed.

@TerryChia There are several distinct features of OO, all of which being useful in their own right.

Subtyping is ability to have some objects being of a type "compatible" with others.

Terry Chia

@ThomasPornin Yeah, I agree. Inheritance is just one part of it, which I use very little.

Thomas Pornin

Inheritance is about recycling implementations of a class into another which merely extends it with some patches and wrappers.

Terry Chia

I hate how people misuse inheritance though. Annoying to work with.

Thomas Pornin

1:37 PM

Data-code binding is about having objects come with their own code, so you call the method on the object rather than calling a given function which does its own per-type dispatch.

OOP as in C# and Java tends to merge these features and it gets people confused.

In Java, interface shows the distinction between subtyping and inheritance (interfaces do the former, not the latter).

If you do OOP in C (which is feasible), you get subtyping by making layout of structures "compatible" in memory. Data-code binding is with function pointers in your structures. Inheritance is done manually (you reuse the same functions when you put pointers to them in your structures).

Terry Chia

The only code I have written that I can honestly make sense to use OOP are GUI projects as they tend to blend very well with the OOP concept. The rest of the code I write I can honestly say is too simple to bother with OOP most of the time.

Then again, I'm not a programmer. Fuck programmers. ;)

TildalWave

4:02 PM

@Gilles - you made a really good argument there ;)

Ninefingers

4:45 PM

@TerryChia You might find as things get more complicated classes become more useful. I tend to use interfaces a lot (in C++, abstract classes) as a way to separate dependencies from each other. Calling code can then act on the interface and work versus that, and not know/care about the implementation.

This works well when you want to implement a callback to a GUI object of some sort. For these cases, I define an interface for an observer - not strictly the observer pattern, but whatever - and then the caller can pass an observing class, usually itself, which implements this interface.

Very handy.

Transcript for