4 ms·
Tldr: Binaries didn't match, here's some handwaving at the differences.
by eterm 13y ago
Tldr: Binaries didn't match, here's some handwaving at the differences.
- e40 13y agoI think that's inaccurate. The disassembly of them matched perfectly.
- PeterisP 13y agoWell then, what and why are the differences? I mean, if there's an arbitrary data block somewhere, then the "matching disassembly" can have wildly different behavior by simply copying & executing parts of that block.
- voltagex_ 13y agoIt's explained in the article. Timestamps, file paths, certificates and oddities of the PE format.
- hamburglar 13y agoI can't wait until the source audit uncovers a funny little subroutine that loads the certificate from the .EXE, decodes the public key into RAM, and then starts executing it. :) edit: not that this seems like a realistic method of injecting malicious code. If you could get away with that in an open source project, you could probably get away with just hiding the malicious code in the app directly.
- PeterisP 13y agoI got an impression from the article that disassembly was what he did to explain the binary differences that remained AFTER he corrected for timestamps/certificates/etc.
- Dylan16807 13y agoYour impression was wrong. He showed all of the differences in the screenshots. That's how few there were. Not a single bit of the code portions was different. Only a handful of metadata bytes, plus appended certificate. The disassembly was only there to be cute and emphasize the point.