Hello,

I am Efim Bushmanov skype reverse engineer with first publish of original work on reversing skype client at June of 2011. And i almost done work on create open source version of "Skype Network Compatible" client.

Some info about me: https://nakedsecurity.sophos.com/2011/06/03/skype-protocol-c... https://news.ycombinator.com/item?id=2611299 http://github.com/skypeopensource/

And now I need some help from community. Thats why i do donate call.

Feel free to ask question about current state and any tech question. But, i will be prefer, if possible, not disclosure much, for reason ms-skype dont ruin my work too early by do some changing protocol again. But you feel free to ask some technical details or general question at all of how skype work.

You can read more at: http://skype-open-source2.blogspot.ru/2016/03/call-to-donate...

This is a great idea, and I bet you could raise a lot more than 3000! Why not just put this on indiegogo or kickstarter or some other similar trusted platform instead of asking people to just paypal you money? I figure many people would feel much more comfortable that way, and you'd probably get a bunch of publicity from just being on the site.

I don't understand the point of the semi-secrecy. There's almost certainly hundreds of MS employees on this site which means you've lost that advantage already, and anyway you're going to have the same problem after you release the software.

Patreon is also an option, too.

Are there public code hosting (gitlab?) in other countries, where the dmca does not apply? maybe something in Europe, where reverse engineering might be less strict?

DMCA is not main problem, for now.

"Why not just put this on indiegogo or kickstarter"

I just dont sure, which is will ok with this kind of projects...

I would hope that crowdtilt might take it.

I would suggest asking.

I'm going to echo the sentiment about PayPal: they are notorious for freezing accounts and never releasing funds. They've even done this to people trying to raise funds to help natural disaster victims.

It might help to have multiple popular avenues for donation.

Paypal has stolen hundreds of dollars for me, with no option for recourse.

The only thing worse than them taking my money was talking to the ignorant assholes on the phone about it.

Wow, you got an actual person on the phone? You got further than me when I tried to get back the $200 they stole from me due to "suspicious activity". I gave up trying to collect it after spending a bunch of time on it.

They did eventually return it, more than a year later, with no explanation. Just suddenly my account balance increased. No interest payments for the time it was stolen though.

Why not take them to small claims court?

Yeah. We can still talking about paypal policy, instead of topic.

Huh. Similar story, about the same amount of money.

They claimed suspicious activity, when it was in fact a client trying to pay me. Go figure.

Is there any reason you can't set up an Indiegogo campaign? It's going to look a lot more trustworthy than this page.

Because kind of this project.

I must re-iterate what others have said, I'd feel much safer donating money to you if this was on a crowd-funding service like kickstarter.

I know it's petty but I'm telling you this for your own sake.

I dont sure, if will be ok to host some kind of this project.

I -might- be interested but I refuse to work with paypal.

Edit: Unfortunately, I also don't really do bitcoin and have never heard of the other two options.

Cash and credit card?

I suppose you could always try offering him some chickens or something?

:))

Chicken or pork are also appreciated!

So, I'd love to help but... there's nothing to show after initial work in 2011. And I found no plans to provide any updates.

Besides, this reverse engineering work should be simpler now that Skype was bought by Microsoft. For example, Microsoft no longer encrypts/destroys the executable's import table. And it seems they dumped the anti-debugger code too.

Let's also not forget Microsoft is pushing out new variants that should lend themselves to reverse engineering (e.g. web/plugin-free [0] and Universal Windows Platform [1] apps).

---

[0] https://support.skype.com/en/faq/FA12316/what-is-the-skype-w...

[1] http://blogs.skype.com/2016/03/24/skype-universal-windows-pl...

Yes...

You are clean right. But for now, we have worked:

1) login (get auth credentials)

2) get contact list

3) find vcard of the given user

4) do relay connect for it

5) send or recv message from it

Its buggy for some reasons, but its worked.

However, yes, its not released an its not public, to not ruin my work until release date.

What is the purpose nowadays, given the MSNP/Web gateways for IM control protocols and the JS-based 'call' client?

I've been working on a JavaScript API for Skype, https://github.com/oskarer/skype-js, utilizing the same endpoints as web.skype.com. Features currently working are login, receive and send messages. I have little time to work on it but it definitely shows potential.

This project sounds interesting! Would you consider reverse engineering the Chrome plugin to add calling? (https://chrome.google.com/webstore/detail/skype-calling/blak...) Not sure if the plugin uses native code, but it should be possible to grab the mic / play audio from terminal.

Yeah, I've planned to try this out in NW.js. They have support for the chrome.* API, which is used by the Skype plugin.

The web gateway is somewhat unreliable, and for IM purposes 'useless' compared to the MSNP gateway, which seems to be the main one used by official clients nowadays.

It has less documentation, but still is plaintext-over-TLS, unlike the legacy (and, arguably, less reliable as well) supernode protocol the poster has been reverse engineering for the past years.

Web use new proto. Which is not our aim at all.

Nice work, before all. Really. My respects.

Have you discussed this with a laywer?

The problem is, as you reverse-engineer Skype and release source code that is meant to be liberally licensed, it still could be that the code would be practically unusable, due to possible legal issues.

IANAL, but from my understanding of the law, this is even a gray area in Russia (local RE laws restrict on what you can do with the obtained knowledge, and the law's wording feels pretty vague to me), and even if legal here, an US or EU court may have a different idea.

Maybe that's not true and I'm just over-cautious, but... well... there's clean-room reverse engineering (where one engineer analyzes the product and writes comprehensive documentation suite and another, completely unrelated person, reads the documentation and writes actual code) for a reason.

IANAL either, but as far as I know a clean-room reverse engineering (like the Samba guys did) should be pretty safe. Of course, other reverse engineering techniques (e.g. disassembling or decompiling) are pretty illegal.

Also, the ToS for Skype may forbid the use of inofficial clients, and users using these might be locked out of the service if Skype finds out and cares.

EU law explicitly allow reversing for compatibility issues. Which exactly what i am doing.

People generally donate to a charitable cause after it starts providing a service, not before. Do you have something we can start using now?

No. But i have release from 2011 as proof.

I wonder how does this compare to skype4pidgin [1] -- this pidgin plugin is working very nicely already

[1] https://github.com/EionRobb/skype4pidgin

This looks like a really neat project that could really benefit me (Skype is a buggy piece of garbage but it's the place where 90% of my online friends congregate).

However, one big issue I forsee is issues with Skype changing their API/protocol and completely breaking the open source alternative. Updating would require a constant stream of development work which, if past projects of this type are anything to judge by, may be difficult or impossible to supply.

Skype currently has 3+ main gateways for connecting to the service - the poster is using the initial pre-Microsoft protocol which is mainly retained for devices that can not/will not get an update (like Skype phones, the original Linux client, ...).

Yes, your are right. Its kind of big risk. But we have some situation in past. It is ICQ vs Miranda case. And all still alive and usable.

My contact info in social networks, btw. And email.

[email protected] http://vk.com/efim.bushmanov https://www.facebook.com/efim.bushmanov

seems like the github repo got hit with a dmca take down?

Well one of the repo's

One repo and old blog was closed because I posted modified (patched, for reversing issues) skype binaries. Which is no-no stuff in any case.

And I move all my source files (except forbidden to publish skype patched binaries) to repo named Epycs (skype word in reversed letters).

I thought the issue was that there was some decompiled code in the repo? Maybe I'm misremembering.

"decompiled code" its hard to proof for DMCA. No, situation was simple, i upload hacked skype binaries in repo for easy distribution. And this is no-no clear case for DMCA takedown. So, it happens.

If you violate their license and use what you learned to make a profit, you're commiting commercial copyright violation. Which is a criminal offense. I don't agree with the law on this matter, but I'd seriously consider getting a lawyer before offering illegal services online.

Also, why not just work on a free software replacement for Skype? That way people could use your code without being threatened by patent suits and other legal arsenal wielded by Microsoft.

"and use what you learned to make a profit"

I am not. Problem was in different case. I should not post patched skype binaries, needed for reverse engineering. And its okay, what i will be shotdown for use it.

You're currently asking for money to be able to do something which is illegal. I'd consider that "making a profit". You may not be selling it directly, but crowd funding is a type of sale.

That is not entirely true for EU:

"...An objective of this exception is to make it possible to connect all components of a computer system, including those of different manufacturers, so that they can work together."

And the US: Sec. 103(f) of the DMCA (17 U.S.C. § 1201 (f)) says that a person who is in legal possession of a program, is permitted to reverse-engineer and circumvent its protection if this is necessary in order to achieve "interoperability" - a term broadly covering other devices and programs being able to interact with it, make use of it, and to use and transfer data to and from it, in useful ways. A limited exemption exists that allows the knowledge thus gained to be shared and used for interoperability purposes.

What did the binary do? Someone could actually publish this via tor + torrent protocol.

I post links on tor... But ints not help much. Against be DMCA'ed.

Then it's not really a free alternative to Skype, though.

At this moment i have:

Paypal:

50 USD

10 USD

4 GBP

10 USD

So, for now, only four people will be on about page in first ever skype network compatible client. Lucky guys!

+15 USD

+15 USD