Wrong OS version may be obtained in Compatibility Mode

[CthRio]

My discovery may not be very important.
When program is running in Compatibility Mode, the function RtlGetVersion(and GetVersionEx) will return incorrect OS version information. The reason is that in Compatibility Mode, Microsoft redirected the implementation of this function using IATHook. The most secure method to obtain version numbers is to use RtlGetNtVersionNumbers. In addition, it is possible to know which running programs are executing in Compatibility Mode through the registry 'HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers'.
It could also be in HKEY_LOCAL_MACHINE.

The function declaration can be obtained here.

typedef VOID(NTAPI* __RtlGetNtVersionNumbers)(
    _Out_opt_ PULONG NtMajorVersion,
    _Out_opt_ PULONG NtMinorVersion,
    _Out_opt_ PULONG NtBuildNumber);

But the obtained NtBuildNumber needs to be converted, using NtBuildNumber&=0x0ffff .

[pyrates999]

can you submit a patch for this? The source is available.