definitely changes in code in 1B module. I've gotta go to work shortly but here I had a quick look at both 1B of 0501 and 0601. This is just one example, seg address 00010d66, 00010d6e differ for example.
in 0501, 00010d66 is 0x05h, 00010d6e is 0x1Ch.
in 0601, 00010d66 is 0x06h, 00010d6e is 0x1Dh.
this is disassembly from 0501, just a small area covering those 2 bytes.
þ
seg000:00010D60 ; ---------------------------------------------------------------------------
seg000:00010D60 or al, 1
seg000:00010D62 add dh, al
seg000:00010D64 inc esp
seg000:00010D65 push cs
seg000:00010D66 add eax, 10F44C6h
seg000:00010D6B mov byte ptr [eax+edx+1Ch], 0C6h ; 'ã'
seg000:00010D70 inc esp
seg000:00010D71 adc [edx], eax
seg000:00010D73 mov edx, es:[esi]
seg000:00010D76 dec eax
seg000:00010D77 sub cl, [ecx-75D9EDACh]
seg000:00010D7D push ss
seg000:00010D7E dec edx
seg000:00010D7F sub cl, [eax+44C71C54h]
this is 0601.
seg000:00010D60 ; ---------------------------------------------------------------------------
seg000:00010D60 or al, 1
seg000:00010D62 add dh, al
seg000:00010D64 inc esp
seg000:00010D65 push cs
seg000:00010D66 push es
seg000:00010D67 mov byte ptr [edi+ecx+1], 0C6h ; 'ã'
seg000:00010D6C inc esp
seg000:00010D6D adc ds:21144C6h, bl
seg000:00010D73 mov edx, es:[esi]
seg000:00010D76 dec eax
seg000:00010D77 sub cl, [ecx-75D9EDACh]
seg000:00010D7D push ss
seg000:00010D7E dec edx
seg000:00010D7F sub cl, [eax+44C71C54h]
Now what It means, I dont have the faintest without analysing the whole binary roM, but at 10d6d, the add instruction is replaced by push ES, which I assume pushes whatever the contents of ES register is onto the stack in 0601. My asm isn't the best though, but it's enough to make sense of things i suppose.




Reply With Quote
Bookmarks