In ntasn1.dll there is specialcasing on some specific guids that involve this. I dont think its like a nsa backdoor, but its weird to stumble upon this. Anyone know what it is about?pic.twitter.com/PM0x38jNAc
-
It's Abstract Syntax Notation backwards.
-
-
It's stored little-endian. If you mov rax, offset with that memory address it'll show up in the register as ASN1. This is how kernel pool page tags work too, you pass a DWORD with the tag stored little-endian as the argument and they come out right side out when you dump memory.
-
*mov eax, offset dammit
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.