Public
- Public
- Network
- Groups
- Popular
- People

Foone🏳️‍⚧️ (foone@digipres.club)'s status on Tuesday, 26-Nov-2024 15:35:02 JST

Foone🏳️‍⚧️ (foone@digipres.club)'s status on Tuesday, 26-Nov-2024 15:35:02 JST Foone🏳️‍⚧️
in reply to

ah-ha!
see that?
They call GetVersion(), then no matter if it's below 4 or not, they jump to the SAME PLACE, and there's dead code below it.
This EXE has been patched after compilation!
In conversation about 2 months ago from social.076.moe permalink
Attachments
1. Screenshot of Ghidra. There's a call to Kernel32::GetVersion, then a sign-extend, a compare, and a jump-if-not-below, then an unconditional jump to the same address, then a bunch of dead code
  https://digipres.club/system/media_attachments/files/113/547/855/461/726/890/original/25d34390885284fd.png

Feeds