Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://digipres.club/users/foone/statuses/113547862887763441">Foone🏳️‍⚧️ (foone@digipres.club)'s status on Sunday, 01-Dec-2024 21:20:25 JST</a><a href="https://digipres.club/@foone" title="foone@digipres.club"><img src="https://gnusocial.jp/avatar/37515-48-20221130021009.webp" width="48" height="48" alt="Foone🏳️‍⚧️" style="position: absolute; left: 0; top: 0;">Foone🏳️‍⚧️</a><div><a href="https://digipres.club/@foone/113547776155559392" rel="in-reply-to">in reply to</a></div></section><article><p>ah-ha! </p><p>see that?<br>They call GetVersion(), then no matter if it's below 4 or not, they jump to the SAME PLACE, and there's dead code below it.</p><p>This EXE has been patched after compilation!</p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/4065471#notice-8015571">In conversation</a><time datetime="2024-12-01T21:20:25+09:00" title="Sunday, 01-Dec-2024 21:20:25 JST">about 6 months ago</time> <span>from <span><a href="https://gnusocial.jp/notice/8015571" rel="external" title="Sent from gnusocial.jp via ActivityPub">gnusocial.jp</a></span></span><a href="https://gnusocial.jp/notice/8015571">permalink</a><h4>Attachments</h4><ol><li><label><a rel="external" href="https://gnusocial.jp/attachment/3605272">Screenshot of Ghidra. There's a call to Kernel32::GetVersion, then a sign-extend, a compare, and a jump-if-not-below, then an unconditional jump to the same address, then a bunch of dead code</a></label><br><a href="https://digipres.club/system/media_attachments/files/113/547/855/461/726/890/original/25d34390885284fd.png" rel="external">https://digipres.club/system/media_attachments/files/113/547/855/461/726/890/original/25d34390885284fd.png</a></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
Foone🏳️‍⚧️ (foone@digipres.club)'s status on Sunday, 01-Dec-2024 21:20:25 JST Foone🏳️‍⚧️
in reply to
ah-ha!
see that?
They call GetVersion(), then no matter if it's below 4 or not, they jump to the SAME PLACE, and there's dead code below it.
This EXE has been patched after compilation!
In conversationabout 6 months ago from gnusocial.jppermalink
Attachments
1. Screenshot of Ghidra. There's a call to Kernel32::GetVersion, then a sign-extend, a compare, and a jump-if-not-below, then an unconditional jump to the same address, then a bunch of dead code
  https://digipres.club/system/media_attachments/files/113/547/855/461/726/890/original/25d34390885284fd.png

Public

Embed Notice

HTML Code

Corresponding Notice