{"id":134,"date":"2011-11-21T12:12:56","date_gmt":"2011-11-21T12:12:56","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=134"},"modified":"2015-04-08T05:20:34","modified_gmt":"2015-04-08T05:20:34","slug":"forensic-riddle-1-answer","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2011\/11\/21\/forensic-riddle-1-answer\/","title":{"rendered":"Forensic Riddle #1 &#8211; Answer"},"content":{"rendered":"<p>The answer to Forensic Riddle #1 is pasted below. It&#8217;s BASE64 encoded, just in case you still didn&#8217;t have a chance to look at the riddle itself and maybe plan to give it a go w\/o spoilers.<\/p>\n<p>The OS is 64-bit. One window is created by a native 64-bit version of cmd.exe and another one by its 32-bit version &#8211; the directory listing shown on a screenshot is different in both windows due to Wow64 redirection mechanism redirecting 32<br \/>\n-bit application to &#8216;see&#8217; %systemroot%\\SysWOW64\\drivers as %systemroot%\\System32\\drivers.<\/p>\n<p>Thanks for trying &amp; next riddle on Friday!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The answer to Forensic Riddle #1 is pasted below. It&#8217;s BASE64 encoded, just in case you still didn&#8217;t have a chance to look at the riddle itself and maybe plan to give it a go w\/o spoilers. The OS is &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2011\/11\/21\/forensic-riddle-1-answer\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[11],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/134"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=134"}],"version-history":[{"count":13,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/134\/revisions"}],"predecessor-version":[{"id":310,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/134\/revisions\/310"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}