VLC Kill Bill: Easter Egg Reverse Engineering

This was a fun little project - hunting down an easter egg in the open source code of VLC.
I made this video in 2018.

-=[ ❤️ Support ]=-

-=[ 🐕 Social ]=-

-=[ 📄 P.S. ]=-

All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

#EasterEgg #ReverseEngineering

[playerguy]

"I stopped being dumb and looked for the image that was used..."
\*snaps singers\* and my stupidity was no longer.
Amazing!

[rubberbawlz]

I'd love to see more of these side tangents. I bet there are loads of hidden Easter eggs in everyday software.

[infreezydark]

Me to my brain : "Stop being stupid."
My brain : "Understandable have a nice day."

[hiburn]

The comments are just to make it look like Ki is referencing the term ‘kilobytes’ and Bi referencing ‘Bidirectional’.. just helped make the code look like it was doing something more useful than an egg to a glancing eye. nicely hidden.

[neintonine]

I like how above the if-condition is the comment: "don't ask" xD

[zsin]

Interviewer to vlc team: what’s your favourite movie
Vlc team: you are going to see that one day

[benchilcott]

Quick note - changing the file name *does* work, you just have to make sure the words are separated by a space: "kill bill.mp4" as opposed to "killbill.mp4"

[jamesflames]

"Ki-Bps" and "bi-directional" are probably intended a defence against anyone stripping punctuation from the source code and grepping that.

[krzysztof-wsog]

On linux i changed name to "kill bill.mp4" and it worked ...
EDIT: Both on windows and linux any sequence of <prefix> "kill" <any one byte linking character> "bill" <suffix> will work as filename
In the video you omitted the linking character

[kajikabis]

For those who wants to find it : the full path of the file is and it has been remove the 29th of May 2020 (commit so it is not on the master branch any more.

On Linux you just need "kill bill" to be in the file name (with any character instead of space between the 2 words like "killobill").

EDIT : found the commit when it was added : (Jan 4 2018)

[conanbdetective]

When it's more about the learning process rather than the Easter Egg. Love it.

[MTMguy]

0:45 You should have spaced out the name. I put "kill bill" as the name of a random video file (didn't even delete what was there before), and it worked normally for me.

[cheesypoohalo]

4:01
"Ki" /*Bps*/ "11"
"Bi" /*directional*/ "11"

Ki11
Bi11

Very nice!

[markm]

I thought they would hide it with an obscure regular expression.

[EXQEX]

Great video!

Regarding VideoLAN's comment at 4:09

"Also KiBps could be something valid"

I took this to mean that, because the string "KiBps" looks like a valid unit of measurement, for example, that it wouldn't set off any red flags for someone who wasn't specifically searching for the word "Kill" in the source code.

I think their intent was to clarify how this obfuscation approach simultaneously makes this Easter egg harder to spot by the casual observer as well as by an observer specifically trying to spot how the Easter egg was implemented.

[DBAWESOMESAUCE]

To add to this project: It would seem it not only looks for the movie's name, but also looks for the names of other media associated with it. I have a file called "Meiko Kaji - The Flower of Carnage.mp3" which is a soundtrack used for the film. Despite no mentions of the words or phrases "Ki", "Bi", "Kill", "Bill", "Kill Bill" in the metadata of the file, it gave me the Kill Bill stylized traffic cone at the end as well.

[QuickNETTech]

My first thought was maybe they hashed the strings but no, a simple comment was all. Always a good thing to remember, sometimes simple is just as effective.

[SageChaozu]

That's real nifty. I just tried to reproduce it with an audio file and it showed up the same way as the video file. I think its because they are reading the "Title" information for the file loaded.

Also, I did not know that VLC was open source even though I should have known this. I just simply used it because it was a better alternative.

[gentlevandal]

Huge code repos are scary! Is there a tool (static analyzer) where you can see call graph, structures, definitions etc.? Edit: for source code of course

[tsobf]

Yeah that's one thing I always do when a tool I use is broken (or there isn't documentation), search the error message in the source to see what triggers it, and start from there, rather than try to follow the code path from main.