News for hackers. Stuff that matters.

A comment on Microsoft Has Manually Patched Their Equation Editor Executable. Parent comment

Re:Microsoft Has Manually Patched Their Equation Editor Exec... by dtech on Friday November 17, 2017 @06:41AM (#15721180)
Another reason could be that it has dependencies that link to specific addresses in the exe. It's very peculiar that they made the effort to keep all the original adresses.
[ Parent | on HN ]
Re:Microsoft Has Manually Patched Their Equation Editor Exec... by nostoc on Friday November 17, 2017 @09:18AM (#15722119)
It's not an effort, it's probably a side effect of simply patching the binary.

If you can't rebuild it, you have to manually edit it, and when you do that you can't really change the addresses, not without a lot of headache.

[ Parent | on HN ]
Re:Microsoft Has Manually Patched Their Equation Editor Exec... by ajnin on Friday November 17, 2017 @09:08AM (#15722022)
It's keeping the adresses that requires the least effort, changing them would have implied to also change all calls and jumps in the rest of the code, which could mean a very large number of addresses to change.
[ Parent | on HN ]
Re:Microsoft Has Manually Patched Their Equation Editor Exec... by breakingcups on Friday November 17, 2017 @07:04AM (#15721307)
That's a really good point.
[ Parent | on HN ]
Re:Microsoft Has Manually Patched Their Equation Editor Exec... by bearbearbear on Friday November 17, 2017 @07:34AM (#15721467)
The most likely reason is there's a heavy handed government agency that relies on all the base addresses to be the same, who buys lots of Microsoft licenses.
[ Parent | on HN ]
Re:Microsoft Has Manually Patched Their Equation Editor Exec... by ggg9990 on Friday November 17, 2017 @07:25PM (#15727078)
Yes, the NSA is surveilling the populace 24/7 through Microsoft Equation Editor.
[ Parent | on HN ]