yconfiscator
Re:Intercepting Zoom's encrypted data with BPF
on Friday September 11, 2020 @05:27PM (#24447501)
Thank you I can't believe this had to be said explicitly.
Re:Intercepting Zoom's encrypted data with BPF
on Thursday September 10, 2020 @10:44PM (#24438669)
Thank you! Mind I only tested on latest ubuntu and fedora so feel free to DM me on twitter if you run into issues.
Re:Intercepting Zoom's encrypted data with BPF
on Thursday September 10, 2020 @07:12PM (#24437563)
That was just the quick and naive way I went for because I didn't want to download new tools, but there's many other options.
The easiest way if you have a capable debugger is probably to look for SSL strings/error codes in rodata and see where they're referenced.
Or IDA can even output C code that is very close to the original.
Re:Intercepting Zoom's encrypted data with BPF
on Thursday September 10, 2020 @06:18PM (#24437129)
Since the Zoom TOS explicitly forbid reverse engineering, sadly it isn't so easy.
Re:Intercepting Zoom's encrypted data with BPF
on Thursday September 10, 2020 @05:29PM (#24436751)
I think what makes redbpf stands out is that the other libraries allow you to write the user-space code in Python or Lua etc, but then the kernel code must still be written in C and gets compiled with clang.
In redbpf we let you write the kernel code in Rust as well, and then we have our own LLVM based toolchain to compile that to BPF bytecode.
bpftrace is similar to redbpf in approach, in that it lets you use a DSL instead of C.
Re:Intercepting Zoom's encrypted data with BPF
on Thursday September 10, 2020 @05:14PM (#24436635)
Writing a toy ad blocker is actually on my todo list :)
There's just so many things you can so. The original goal of the post was to tamper with zoom's attention tracking for example (which was a field in one of their protobuf payloads).
Re:Intercepting Zoom's encrypted data with BPF
on Thursday September 10, 2020 @05:09PM (#24436596)
Glad you liked it!