Rogue developers

Update: The issue has been resolved. See update at the bottom of the post.

In August 2004, I reverse engineered Apple’s AirTunes protocol and released JustePort, the first non-Apple application to enable streaming to the AirPort Express. Because of my work, Rogue Amoeba was able to develop their $25 AirFoil application – a much more user friendly tool for streaming to the AirPort Express. I didn’t have any problems with this – I released JustePort as open source so that others could build similar applications by learning from my source code. What I did not particularly like though was the product page for Airfoil, claiming “It’s not just for iTunes anymore”. This misleading statement, suggesting that Airfoil was the first tool of its kind and that Rogue Amoeba did the hard work to enable non-Apple streaming to the AirPort Express, has since been removed from the Airfoil product page.

I was reading Rogue Amoeba’s blog today and noticed that they’ve released a Linux version of their Airfoil Speakers application. Airfoil Speakers is a complimentary application to AirFoil that implements the server part of the AirTunes protocol. By installing Airfoil Speakers on a computer (e.g. your home theater PC) you can stream audio to it using Airfoil from another computer. The release of the Linux version of Airfoil Speakers piqued my curiosity so I downloaded it and had a look. It uses .NET and requires mono. I downloaded the Windows version as well and it shares the core with the Linux version.

I ran AirfoilSpeakers.exe (MD5: 82b7ef8c05958ccb6e24289c8b21a27c) from the Windows version through monodis to see if I could find anything interesting. I came across this:

.namespace AirfoilServer.AirTunes
.class private auto ansi beforefieldinit Utility
extends [mscorlib]System.Object

// method line 853
.method public static hidebysig
default void LeReverse (unsigned int8[] arr, int32 index, int32 length) cil managed
// Method begins at RVA 0x104b6
// Code size 16 (0x10)
.maxstack 8
IL_0000: ldsfld bool [mscorlib]System.BitConverter::IsLittleEndian
IL_0005: brfalse.s IL_000f

IL_0007: ldarg.0
IL_0008: ldarg.1
IL_0009: ldarg.2
IL_000a: call void class [mscorlib]System.Array::Reverse(class [mscorlib]System.Array, int32, int32)
IL_000f: ret
} // end of method Utility::LeReverse

// method line 854
.method public static hidebysig
default void LeReverse (unsigned int8[] arr) cil managed
// Method begins at RVA 0x104c7
// Code size 11 (0xb)
.maxstack 8
IL_0000: ldarg.0
IL_0001: ldc.i4.0
IL_0002: ldarg.0
IL_0003: ldlen
IL_0004: conv.i4
IL_0005: call void class AirfoilServer.AirTunes.Utility::LeReverse(unsigned int8[], int32, int32)
IL_000a: ret
} // end of method Utility::LeReverse

// method line 855
.method public static hidebysig
default void RijndaelDecrypt (unsigned int8[] Buf, int32 Offset, int32 Count, unsigned int8[] Key, unsigned int8[] IV) cil managed
// Method begins at RVA 0x104d4
// Code size 80 (0x50)
.maxstack 5
.locals init (
class [mscorlib]System.Security.Cryptography.Rijndael V_0,
class [mscorlib]System.IO.MemoryStream V_1,
class [mscorlib]System.Security.Cryptography.ICryptoTransform V_2,
class [mscorlib]System.Security.Cryptography.CryptoStream V_3)
IL_0000: call class [mscorlib]System.Security.Cryptography.Rijndael class [mscorlib]System.Security.Cryptography.Rijndael::Create()
IL_0005: stloc.0
IL_0006: ldloc.0
IL_0007: ldc.i4.1
IL_0008: callvirt instance void class [mscorlib]System.Security.Cryptography.SymmetricAlgorithm::set_Mode(valuetype [mscorlib]System.Security.Cryptography.CipherMode)
IL_000d: ldloc.0
IL_000e: ldc.i4.1
IL_000f: callvirt instance void class [mscorlib]System.Security.Cryptography.SymmetricAlgorithm::set_Padding(valuetype [mscorlib]System.Security.Cryptography.PaddingMode)
IL_0014: newobj instance void class [mscorlib]System.IO.MemoryStream::.ctor()
IL_0019: stloc.1
IL_001a: ldloc.0
IL_001b: ldarg.3
IL_001c: ldarg.s 4
IL_001e: callvirt instance class [mscorlib]System.Security.Cryptography.ICryptoTransform class [mscorlib]System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor(unsigned int8[], unsigned int8[])
IL_0023: stloc.2
IL_0024: ldloc.1
IL_0025: ldloc.2
IL_0026: ldc.i4.1
IL_0027: newobj instance void class [mscorlib]System.Security.Cryptography.CryptoStream::.ctor(class [mscorlib]System.IO.Stream, class [mscorlib]System.Security.Cryptography.ICryptoTransform, valuetype [mscorlib]System.Security.Cryptography.CryptoStreamMode)
IL_002c: stloc.3
IL_002d: ldloc.3
IL_002e: ldarg.0
IL_002f: ldarg.1
IL_0030: ldarg.2
IL_0031: ldc.i4.s 0x10
IL_0033: div
IL_0034: ldc.i4.s 0x10
IL_0036: mul
IL_0037: callvirt instance void class [mscorlib]System.IO.Stream::Write(unsigned int8[], int32, int32)
IL_003c: ldloc.3
IL_003d: callvirt instance void class [mscorlib]System.IO.Stream::Close()
IL_0042: ldloc.1
IL_0043: callvirt instance unsigned int8[] class [mscorlib]System.IO.MemoryStream::ToArray()
IL_0048: ldarg.0
IL_0049: ldc.i4.0
IL_004a: callvirt instance void class [mscorlib]System.Array::CopyTo(class [mscorlib]System.Array, int32)
IL_004f: ret
} // end of method Utility::RijndaelDecrypt

// method line 856
.method public hidebysig specialname rtspecialname
instance default void .ctor () cil managed
// Method begins at RVA 0x10530
// Code size 7 (0x7)
.maxstack 8
IL_0000: ldarg.0
IL_0001: call instance void object::.ctor()
IL_0006: ret
} // end of method Utility::.ctor

} // end of class AirfoilServer.AirTunes.Utility

That Utility class looks very familiar. Where have I seen those exact functions before? Oh, that’s right, it’s the Utility class licensed under the GPL from my DeDRMS and SharpMusique source code packages.

I can’t say I’m surprised. GPL’ed code is frequently used in violation of the license. MacTheRipper, a popular DVD ripper for MacOS X, has been violating the GPL for years by using libdvdcss and refusing to release the source code.

I’m not going to be too hard on Rogue Amoeba though. Unlike many Mac users, they are against closed platforms. See their blog post about the iPhone SDK as well as the future of code signing in MacOS X.

Update: Quentin from Rogue Amoeba got in touch via email. The code ended up in Airfoil Speakers due to an honest mistake. Quentin writes:

We use a lot of open source software in our products, could not make them as good as we do without it in fact. And as such, we do our best to make sure the licenses are followed. All our commercial software is GPL-free, some use LGPL’ed libraries, and some BSD/MIT code in places. We try to make sure all the code we use is correctly acknowledged, and give back when we can (,

So we’ve put together Utility.cs-less versions of Airfoil Speakers to fix our GPL compliance. The Linux version we are pushing out immediately (it’s still in beta technically) here: The Windows version will be officially pushed out this week after testing, but is available right now here:

Thanks Quentin!

6 thoughts on “Rogue developers

  1. Brian

    Kudos for applying the Reasonable Person Principle to this rather than going for the jugular. Your taking the high road seems to have inspired Rogue Amoeba to follow suit: see this comment on their blog, where they admit the mistake and mention the steps they’re taking to fix it.

  2. Grammar Geek

    Regardless of their stance on closed platforms, violating the GPL is something they should be taken to task for as it weakens the effectiveness of the GPL for others.

    Also, it’s "piqued", not "peaked"…

  3. pat

    I’m not trying to defend RA at all on this, but as I recall they outsource all non-mac programming. The real test will be to see how they react to this. I suppose that they have three options: 1. to release the source to their AirFoilSpeakers app or 2. to withdraw the application and rewrite the library, 3. give you some cash for a commercial license.

    Of course there is a fourth possibility. If they simply re-implemented your library themselves already, then they could just provide some sort of evidence to you, you can concede that you were mistaken and everyone will be happy. Not likely, but a possibility. They have some smarts, so it’s possible that they noticed this a while ago and chose option 2 before release. Again, probably not.

  4. Gb

    LibDVDCss was removed from MacTheRipper last year. It now links to an externally compiled version that is the same as any version currently on the net in source form.

    The library ( not handled by us ) can be acquired by the user from any location they choose.

    Thank you.

  5. JonLech Post author


    Anyone can download the mactheripper266.dmg file from your website and within a minute conclude that the included binary is statically linked to libdvdcss.

    Perhaps you’re referring to the 3.0 beta of MacTheRipper? That doesn’t change anything: dynamically linking instead of statically linking makes no difference as far as being bound by the GPL goes.

Comments are closed.