You are browsing the archive for Forensic Riddles.

Forensic Riddle #12

July 4, 2012 in Forensic Riddles

Most Windows APIs accepting strings as parameters are described on MSDN as FooBar and if they support ANSI/Unicode versions they refer to FooBarA, FooBarW e.g. CreateFile points to CreateFileA for ANSI and CreateFileW for Unicode (Wide).

Are there any functions out there that do not follow this pattern, or slightly derive from it or perhaps extend it?

Answer here

Forensic Riddle #11

April 27, 2012 in Forensic Riddles

It’s been a while since I posted a riddle, so here is a new one – this should be an easy one:

Two different Windows executables have been executed on the same version of Windows system and under identical (ideal) conditions. Dynamic analysis shown that each of them produces completely different artefacts  on a test system, but the in-depth code analysis shown that they have an identical source code. What files are these?

Answer here