Re:Reverse Engineering TikTok's VM Obfuscation (Part 1)
by neodymiumphish on Saturday December 24, 2022 @03:30PM
(#34120796)
I think the distinction in what's obfuscated is important. Casino apps are trying to hide their code that detects cheating, number generation, etc, while TikTok is trying to hide its data collection. Obfuscation itself isn't necessarily bad.
[ Parent
| on HN ]
Re:Reverse Engineering TikTok's VM Obfuscation (Part 1)
by im3w1l on Saturday December 24, 2022 @04:07PM
(#34121092)
> Number generation
Number generation is extremely important and it's also regulated. You don't put such a thing in the client obfuscated or not.
Re:Reverse Engineering TikTok's VM Obfuscation (Part 1)
by noduerme on Saturday December 24, 2022 @06:41PM
(#34122402)
Cheating detection was essentially all conducted on the back-end in my casino, but I do think there's a use case for obfuscating some front-end monitoring, e.g. for bot-like inputs. We didn't explicitly ban poker bots, but we didn't make the API guide public, either. The cheating we were most concerned with was poker collusion, which could be detected by combing the log files for certain patterns of play correlated between users or IP addresses.
Random numbers are never generated in the client. Ours were generated on dedicated server separate from anything else - in a different country, for legal reasons - whose sole purpose was to generate random numbers on demand.