Alterra

We told you so

Helios finally released, roughly a year after SK started working on it. We downloaded it and looked inside. We'd encourage you to do the same.

Helios links OpenSSL, and the binary leaks the paths it was built from:

OPENSSLDIR: "/Users/norbel/Documents/Opiumware/dependencies/openssl/build/arm64/ssl"
ENGINESDIR: "/Users/norbel/Documents/Opiumware/dependencies/openssl/build/arm64/lib/engines-3"
MODULESDIR: "/Users/norbel/Documents/Opiumware/dependencies/openssl/build/arm64/lib/ossl-modules"
/Users/norbel/Documents/Opiumware/dependencies/openssl/build/arm64/ssl
/Users/norbel/Documents/Opiumware/dependencies/openssl/build/arm64/lib/engines-3
/Users/norbel/Documents/Opiumware/dependencies/openssl/build/arm64/lib/ossl-modules
/Users/norbel/Documents/Opiumware/dependencies/openssl/build/arm64/ssl/certs
/Users/norbel/Documents/Opiumware/dependencies/openssl/build/arm64/ssl/cert.pem

You might have noticed something strange. "norbel" and "Opiumware". norbel is norby's username, and Opiumware is his executor, so why does OpenSSL say it was compiled by norby, inside the Opiumware folder?

Well, it's because SK did exactly what he accused us of doing. He started building on top of the leaked Opiumware source code, "skidding" if we use his own words. That's enough proof on its own to confirm Helios is built on top of Opiumware, but it doesn't stop there. The dependencies match Opiumware too, all of them exactly the same as in the leaked source code: tinyhook, ixwebsocket, OpenSSL, zlib, lz4/zstd.

After opening the Helios dylib in IDA, I started seeing more similarities with Opiumware. The Helios scheduler hooks RenderStepped, same as Opiumware (Alterra doesn't touch RenderStepped at all). It's not out of the ordinary for a developer to do that, but with the build path leak and everything else it's enough evidence.

There are a lot of things he did replace. For example the decompiler, it just uses some random API because he couldn't bother slop-forking Medal like Opiumware or building one from scratch like us. He also took his time replacing the error strings, so none of them match up with Opiumware, but then again, all the evidence combined is enough.

You can verify all of this yourself. I've archived Helios and you can download it here, and you can download the leaked Opiumware source code here. If you just want the ten-second check, run strings ~/Downloads/helios/libHelios.dylib | grep -i opiumware and see for yourself.