July 4, 2012 in Forensic Riddles
Most Windows APIs accepting strings as parameters are described on MSDN as FooBar and if they support ANSI/Unicode versions they refer to FooBarA, FooBarW e.g. CreateFile points to CreateFileA for ANSI and CreateFileW for Unicode (Wide).
Are there any functions out there that do not follow this pattern, or slightly derive from it or perhaps extend it?
April 27, 2012 in Forensic Riddles
It’s been a while since I posted a riddle, so here is a new one – this should be an easy one:
Two different Windows executables have been executed on the same version of Windows system and under identical (ideal) conditions. Dynamic analysis shown that each of them produces completely different artefacts on a test system, but the in-depth code analysis shown that they have an identical source code. What files are these?