Friday, May 3, 2019

Disabling Skype's Spellchecker

Long story short, Skype hasn't had an option to disable their spellchecker for aeons and yesterday this really got on my nerve and looked around to find out what it's doing;

The quick solution : Just go to

/Applications/Skype.app/Contents/Resources/app.asar.unpacked/node_modules/@paulcbetts/spellchecker/build/Release/

and remove spellchecker.node . Make a backup of the file, why not.

The explanation : Snooping around in /Applications/Skype.app/ you can find various libs, apparently electron, nodejs, etc were used (interesting) and one of them is suspiciously called 'spellchecker'. Running lsof | grep -i spell will show you that Skype is indeed using the node file ('spellchecker.node'). This file is apparently a nodejs lib from here : https://github.com/anaisbetts/node-spellchecker . Reading the page of the lib it seems that to use it you'd run 'SpellChecker.isMisspelled(word)', to check if a word is misspelled... soo if this is in that lib maybe you could just return a 0x0 and disable the spell checker. The main.cc of the project sets isMisspelled to IsMisspelled :

Nan::SetPrototypeMethod(tpl, "isMisspelled", Spellchecker::IsMisspelled);

So just in case we do a case-insensitive search on the symbol...

nm -gU spellchecker.node | grep -i ismisspelled
0000000000003334 T __ZN12spellchecker15MacSpellchecker12IsMisspelledERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEE

00000000000025c8 T __ZN12spellchecker20HunspellSpellchecker12IsMisspelledERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEE

And sure enough, there it is. Twice. Since spellchecker.node claims to provide 'Native bindings to NSSpellChecker', I went with the 'Mac' call at 0x3334.

objdump -d ./spellchecker.node --start-address=0x3334 | less

...so next, you just need to overwrite the call so it sets rax to 0x0, then ret back the hell out of there. Once you're done the squiggly red lines disappear and you can merrily type away again.

Personally I used radare2, because it's a great tool and a lot easier to just write asm code than come up with opcodes, but something like this will also work, after you cp spellchecker.node spellchecker_disabled.node :

perl -e "print pack('ccc', 0x31, 0xc0, 0xc3 );" | dd of=./spellchecker_disabled.node bs=1 count=3 conv=notrunc seek=$(nm -gU spellchecker.node  | grep MacSpellchecker12IsMisspelled | cut -d ' ' -f1 | perl -ne "printf '%d', hex($_)")

The cmd above will write the 3 opcodes as bytes to stdout, then pass it on to dd, which in turn will write it at the correct location inside the node lib. And yes, this is just zeroing eax (not rax) out, but maybe you want to do part of the work, huh? Note: this is macos, so the numbers returned by nm are the file offsets. And yeah, perl. I like perltles.

1 comment: