You diff binaries and immediately find the single change that adds the overflow check.
I diff mpengine.dll and break all reversing tools out there.
We are not the same.
https://gist.github.com/v-p-b/513a8f70a32c62f3ab7bf0d6a90e0941
#bindiff #ghidriff
buherator
npub17w…gnag2
2025-01-26 15:24:11 UTC
Author Public Key
npub17wvr8uywpuzew2lqvprnt4g7cuq0kyvdf8gz57dlv3rsjvfcer3qqgnag2Published at
2025-01-26 15:24:11 UTCEvent JSON
{
"id": "4f1180d4fd63c0c055acd1a0ecc1323967299f07a2e3ae915802ced5a46e919c",
"pubkey": "f39833f08e0f05972be0604735d51ec700fb118d49d02a79bf6447093138c8e2",
"created_at": 1737905051,
"kind": 1,
"tags": [
[
"t",
"bindiff"
],
[
"t",
"ghidriff"
],
[
"proxy",
"https://infosec.place/objects/40215c89-ae1c-4f8c-ba87-083b2b34770f",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.place/objects/40215c89-ae1c-4f8c-ba87-083b2b34770f",
"pink.momostr"
],
[
"-"
]
],
"content": "You diff binaries and immediately find the single change that adds the overflow check.\r\n\r\nI diff mpengine.dll and break all reversing tools out there. \r\n\r\nWe are not the same.\r\n\r\nhttps://gist.github.com/v-p-b/513a8f70a32c62f3ab7bf0d6a90e0941\r\n\r\n#bindiff #ghidriff",
"sig": "b818e5460c98c8b7aaeb17bc58b3c9dc53f8c5d895713f32ff51af1b626262ee45c75652fa9266e554a740401d545e4f2d0600c7b7e6def5ef55265fc49654ff"
}