Maybe the LINK version in the dll header could give a clue about "version trickery".
ver32.exe:
include stdio.inc
include tchar.inc
include winbase.inc
.code
main proc
.if LoadLibrary("ntdll.dll")
mov edi,eax
mov ebx,[edi+0x3C]
movzx eax,[edi+ebx].IMAGE_NT_HEADERS.OptionalHeader.MajorLinkerVersion
movzx edx,[edi+ebx].IMAGE_NT_HEADERS.OptionalHeader.MinorLinkerVersion
printf("Link: %d.%d\n", eax, edx)
movzx eax,[edi+ebx].IMAGE_NT_HEADERS.OptionalHeader.MajorOperatingSystemVersion
movzx edx,[edi+ebx].IMAGE_NT_HEADERS.OptionalHeader.MinorOperatingSystemVersion
printf("Windows: %d.%d\n", eax, edx)
FreeLibrary(edi)
.else
printf("NTDLL not found..\n")
.endif
xor eax,eax
ret
main endp
end _tstart
ver64.exe:
include stdio.inc
include tchar.inc
include winbase.inc
.code
main proc
.if LoadLibrary("ntdll.dll")
mov rdi,rax
mov ebx,[rdi+0x3C]
movzx eax,[rdi+rbx].IMAGE_NT_HEADERS.OptionalHeader.MajorLinkerVersion
movzx edx,[rdi+rbx].IMAGE_NT_HEADERS.OptionalHeader.MinorLinkerVersion
printf("Link: %d.%d\n",rax,rdx)
movzx eax,[rdi+rbx].IMAGE_NT_HEADERS.OptionalHeader.MajorOperatingSystemVersion
movzx edx,[rdi+rbx].IMAGE_NT_HEADERS.OptionalHeader.MinorOperatingSystemVersion
printf("Windows: %d.%d\n",rax,rdx)
FreeLibrary(rdi)
.else
printf("NTDLL not found..\n")
.endif
xor eax,eax
ret
main endp
end _tstart
Win7-64
ver32:
Link: 9.0
Windows: 6.1
ver64:
Link: 9.0
Windows: 6.1