j0hnyl
Joined 4 years ago
Karma
795
Submissions
444
Member since
Jun 16
Joined 4 years ago
EDIT: it's also more rewarding if you delay looking under the hood for a while.
After loading the memory snapshot into Ghidra, I found that the function at 8c0334d8 reads this buffer. It performs a transformation on the buffer and then checks whether the transformed value is a list of six special ones. ---
How?