Remix.run Logo
bastawhiz 2 hours ago

It's very strange that the same component exists in Windows without the issue, though. Like the author, I'm finding it difficult to come up with reasons why they'd be different.

bri3d an hour ago | parent [-]

WinRE ending up with a different version of fstx.dll in it seems like a pretty standard Microsoft (or any other big company) thing to have happen? Again, it all comes down to whether you think the drift was a malicious internal fork or a simple mistake. I will say that the functionality being different makes it an inferior backdoor in many ways; especially in Windows land vulnerability researchers are obsessed with binary diffing, and any delta internally would be more likely to be discovered as a backdoor in review too (ie - “hey maybe we should update fstx in winrt finally, let’s review the drift to make sure there’s not going to be a regression, wait a second why did xyz employee add this suspicious looking code”).

A fun next step would be to look at different fstx versions to see if it’s just something that was patched or refactored out at some point.