お知らせ：０７６はゲーム開発スタジオとなる為、４月２日をもって０７６萌ＳＮＳ及び０７６萌Mitraのサービスを終了致します。諏訪子様は、新しいスタッフ専用のMitraインスタンスで引き続きフォロー出来ます。

これまで０７６萌ＳＮＳ又は０７６萌Mitraをご利用頂き、誠に有難う御座いました。

Screenshot of Ghidra. There's a call to Kernel32::GetVersion, then a sign-extend, a compare, and a jump-if-not-below, then an unconditional jump to the same address, then a bunch of dead code - ０７６萌ＳＮＳ

お知らせ：０７６はゲーム開発スタジオとなる為、５月２日をもって０７６萌ＳＮＳ及び０７６萌Mitraのサービスを終了致します。諏訪子様は、新しいスタッフ専用ののMitraインスタンスで引き続きフォロー出来ます。これまで０７６萌ＳＮＳ又は０７６萌Mitraをご利用頂き、誠に有難う御座いました。

Public
- Public
- Network
- Groups
- Popular
- People

Screenshot of Ghidra. There's a call to Kernel32::GetVersion, then a sign-extend, a compare, and a jump-if-not-below, then an unconditional jump to the same address, then a bunch of dead code

Download link

Notices where this attachment appears

Foone🏳️‍⚧️ (foone@digipres.club)'s status on Tuesday, 26-Nov-2024 15:35:02 JST Foone🏳️‍⚧️
in reply to

ah-ha!
see that?
They call GetVersion(), then no matter if it's below 4 or not, they jump to the SAME PLACE, and there's dead code below it.
This EXE has been patched after compilation!

In conversation about 3 months ago from social.076.moe permalink

Public

Screenshot of Ghidra. There's a call to Kernel32::GetVersion, then a sign-extend, a compare, and a jump-if-not-below, then an unconditional jump to the same address, then a bunch of dead code

Notices where this attachment appears