Skip to content

Comment on How I compiled TrueCrypt 7.1a for Win32 and matched the official binariesparent

Comments

It's possible that the difference is in the actual code: x86 machine code sometimes has multiple different encodings for the same assembler instruction. These would show up as single-byte differences in the binary. See http://www.strchr.com/machine_code_redundancy for some examples. Compilers might use this to stenographically hide additional data in the binary. Printer manufacturers already do something similar (https://en.wikipedia.org/wiki/Printer_steganography). I wouldn't be surprised if MS compilers embedded a hidden data in binaries -- it could be useful to track down malware authors; or identify software created with pirated MS tooling.

Perhaps this could even be used by an organization to differentiate official binaries of closed-source software from leaked binaries.

If you read the whole article, you'd see that every single bit difference is accounted for; none of the bit differences occur in the actual code.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.