Antosha
Active Member
- Feb 28, 2018
- 723
- 1,289
- 347
Hmm. Fascinating.Well this is weird as shit. The images appear to contain hidden data that (I think) was placed there deliberately, but most of it is meaningless.
amisroomonefive25.webp was still normal in 0.39. Starting with 0.40, each full game version includes a new version of the image with different corruption. The data in the files is identical except for one block starting at offset 0x8000 that is exactly 0x1000 bytes (4KiB) long.
The modified bytes in the 0.40 image themselves contain an image file, specifically a tiny jpeg showing Singapore's ArtScience Museum. This is smaller than the 4KiB block, the rest of which is padded with zeros.
You don't have permission to view the spoiler content. Log in or register now.
The modified bytes in the 0.41 image are text that looks like it could be encoding for something, but I don't recognize the format.
You don't have permission to view the spoiler content. Log in or register now.
The 0.42 image is identical to the 0.40 one.
Here's where it gets even weirder. Each of 0.43 to 0.45 contains data that is at least partially meaningful when viewed as text, but they all seem to have to do with mundane windows services.
0.43 is an XML config file for windows update (with a bunch of zeroed bytes padding it out).
0.44 contains references to WaaSMedic, a service related to windows update. The meaningful part here is short, the rest is padded out with ones.You don't have permission to view the spoiler content. Log in or register now.
0.45 mostly isn't interpretable as text, but it does have "EBFGONED" near the start, which google suggests is part of the header for OneDrive log files.You don't have permission to view the spoiler content. Log in or register now.
You don't have permission to view the spoiler content. Log in or register now.
It's hard for me to imagine a mechanism by which this could have happened accidentally, especially when you consider that this one 4KiB block in one image out of thousands is the only thing being corrupted, the data in the corrupted block keeps changing, and two non-consecutive images (0.40 and 0.42) have the same complete jpeg inserted in them.
On the other hand, I can't imagine what this is supposed to accomplish if it is deliberate. Is it an elaborate troll? Is it setup for future DRM (but then why repeatedly edit the file instead of only once)? And why is the changed image not in the update patches?
I'll attach the original images and the extracted binary in case anyone else wants to play around with this.
You don't have permission to view the spoiler content. Log in or register now.
We know that Sel has screwed around by adding code inside images before. These additions, however, seem so random that I can't see them being intentional.
I'm imagining him writing a script to compile/compress each release—and inadvertently including a line to paste whatever's in his buffer into the middle of that file. So whatever's open when he runs the script gets dumped in there.
Or it could be some mad genius thing that we're just too stupid to understand.