undefined | Better HN

0 pointsTheAnimus12y ago0 comments

As it tests if it it's equal to 0x23dc67e8 after XOR, I'm guessing this is a protection against some patching or similar.

It get's XOR'd once after the GetProcAddress, then XOR'd back before the STDCALL invocation.

This is done for both the GetProcAddress calls, so I'm going to just guess that this is some anti-patching anti-cheat shenanigans.

0 comments

yoha12y ago

That's just in-memory obfuscation. The value is xored with 0x23dc67e8 when set and the variable xored again whenever is used. Its first use is to check that the symbol was resolved correctly, that implies testing for NULL/0. The compiling-decompiling process made it so that it is actually just comparing the variable to the mask.

j / k navigate · click thread line to collapse

0 pointsTheAnimus12y ago0 comments

As it tests if it it's equal to 0x23dc67e8 after XOR, I'm guessing this is a protection against some patching or similar.

It get's XOR'd once after the GetProcAddress, then XOR'd back before the STDCALL invocation.

This is done for both the GetProcAddress calls, so I'm going to just guess that this is some anti-patching anti-cheat shenanigans.

0 comments

yoha12y ago

j / k navigate · click thread line to collapse