<story><title>Breaking the Zyzzyva encryption</title><url>https://medium.com/@14domino/breaking-the-zyzzyva-encryption-f00360b695d1</url></story><parent_chain></parent_chain><comment><author>Hello71</author><text>&amp;gt; The real hackers will know that as soon as I found evidence of sqlite3_key_v2 in the Zyzzyva dylib file that getting the key was inevitable. I don’t actually know the steps for removing debug symbols from compiled code off the top of my head, but I bet if this had been done, this would have made my job much, much harder.&lt;p&gt;I&amp;#x27;m not entirely sure about OS X, but at least on Linux, system-assisted dynamic linking (i.e. not mmap(PROT_EXEC)) requires that all required symbols are exposed so that relocation can be done in the original executable; in other words, the OS needs to know where the functions in the library are so that it can tell the program how to call them.&lt;p&gt;Of course, you could obfuscate the function names, but then tracebacks wouldn&amp;#x27;t work properly and at that point you&amp;#x27;d be better off just statically linking the whole program.&lt;p&gt;Debug symbols are completely different; if you have those, you can simply do &amp;quot;frame variables&amp;quot; which shows the args with names.&lt;p&gt;&amp;gt; Yesss. Time to get out the x86 assembly hats.&lt;p&gt;You don&amp;#x27;t even really need to do that. Since you know the function signature, you can assume (since it is in a separate library) that the function uses the standard System V AMD64 ABI where &amp;quot;the first six integer or pointer arguments are passed in registers RDI, RSI, RDX, RCX, R8, and R9&amp;quot; [0], meaning that the pKey pointer is probably in RDX. I know that the author said that it was in RAX, but since that is caller-saved, there must have been some copying or processing done to it inside the function.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;X86_calling_conventions#System_V_AMD64_ABI&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;X86_calling_conventions#System...&lt;/a&gt;</text></comment>
<story><title>Breaking the Zyzzyva encryption</title><url>https://medium.com/@14domino/breaking-the-zyzzyva-encryption-f00360b695d1</url></story><parent_chain></parent_chain><comment><author>leecb</author><text>Isn&amp;#x27;t this a violation of the DMCA&amp;#x27;s anti-circumvention section? This seems to be explicitly describing how to circumvent protection measures for a copyrighted work.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.law.cornell.edu&amp;#x2F;uscode&amp;#x2F;text&amp;#x2F;17&amp;#x2F;1201&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.law.cornell.edu&amp;#x2F;uscode&amp;#x2F;text&amp;#x2F;17&amp;#x2F;1201&lt;/a&gt;</text></comment>