Comment by dtech
9 years ago
Another reason could be that it has dependencies that link to specific addresses in the exe. It's very peculiar that they made the effort to keep all the original adresses.
9 years ago
Another reason could be that it has dependencies that link to specific addresses in the exe. It's very peculiar that they made the effort to keep all the original adresses.
It's not an effort, it's probably a side effect of simply patching the binary.
If you can't rebuild it, you have to manually edit it, and when you do that you can't really change the addresses, not without a lot of headache.
It's keeping the adresses that requires the least effort, changing them would have implied to also change all calls and jumps in the rest of the code, which could mean a very large number of addresses to change.
That's a really good point.
The most likely reason is there's a heavy handed government agency that relies on all the base addresses to be the same, who buys lots of Microsoft licenses.
Yes, the NSA is surveilling the populace 24/7 through Microsoft Equation Editor.