Version 2 is extremely similar to version 1, but with less articulation.
Version 3 had terrible proportion distribution.
The only difference between Version 4 and 4.5 is that my brother came up with a better solution to hold the waist/torso together in some of the pics, there is a rubber band around the waist, that is the true version 4
Both films are roughly adapted from stories in 1001 Arabian Nights. So how do these cinematic classics stack up against each other? How are they similar, and what are the differences? And, of course, we have to ask: Which one is more enjoyable for the modern audience?
The 1924 version of The Thief of Bagdad was clearly a labor of love for Douglas Fairbanks, and was reportedly his favorite film of his career. Not only did Fairbanks star in the title role as Ahmed the thief, he also produced the film and was one of the writers on the script. Raoul Walsh directed the film, and an interesting choice was made to tint the film with different colors depending on the mood of the scene; night scenes are typically tinted blue, day scenes in yellow, some exotic locales in red, a forest in green, and so on. In retrospect, this was a fairly obvious transition from black and white films to full color, but I had never seen the technique before, so it was particularly interesting.
The story is a classic adventure tale. Ahmed is a happy-go-lucky thief, who takes what he wants and thinks nothing of the consequences. After stealing a magic rope (of the climb to the sky variety), he and his associate (Snitz Edwards) hatch a plan to break into the palace and steal some jewels. But once inside, Ahmed spies the Princess (Julanne Johnston) and is instantly smitten. He returns with just her shoe, and then proceeds to draw up a plan to steal her. Not win her heart, steal her. By drugging her and kidnapping her.
The dialogue is worth noting as well. Although the romance plot is your standard pedestrian love-at-first-sight with few interesting lines, the rest of the film is pretty darned good. Of particular note is the way Sabu gets the majority of the witty lines, and he really has the most screen presence among the heroic cast; you have to look to Conrad Veidt as the villain to find someone to match him. And Sabu plays well off Veidt, off Justin, and particularly off of Rex Ingram. It all adds up to a very fun little film.
Version Verdict: If you have the patience for a two-and-a-half hour silent movie, the 1924 version can be very rewarding, but I suspect most modern movie watchers will have more fun with the 1940 film, with its technicolor cinematography, spoken dialogue, and playful attitude.
I've had this problem where I want to play POD Gold but the videos don't work because I have an install of Thief 1 & 2 (using the vanilla EXEs with dgVoodoo), which requires the latest version of Intel's Indeo codec. POD Gold's GOG installer installs an older version of Indeo that works fine with that game but then doesn't work with either of the Thief game's videos.
There is a "net-made" version of the Indeo codec that came out some years back. It came about because the codec was no longer available/compatible with new versions of Windows, so someone made their own to use with the old games/hardware that required it.
EDIT: So apparently there is a quirk with this: upon startup, if you play POD first, let the intros play, etc, then try to boot up Thief, Thief's cutscenes won't work until you restart again. If you start Thief first, both of them work fine. It's really weird.
There used to be downloads for it, but I haven't used it in ages, so I can't recall. The various versions of Indeo were reverse engineered and put into FFMPEG some years back, after the community had reverse engineered them to make their own release.
The NewDark changelog states:
"Replaced video player lib with an FFMpeg based one to play cutscenes. LGVid.ax or other codecs are no longer required"
So if you use NewDark itself or TFix\T2Fix which includes NewDark then you should be able to use Indeo for POD and NewDark for the thief games.
His biggest break came two decades after production began (already a long time, mind you), when he won two Oscars for his work on Who Framed Roger Rabbit. This feat caught the attention of Warner Bros. who agreed to fund Williams and allow him to release the film under their banner. But Williams, a perfectionist to the nth degree, used this time with the studio to continue tinkering rather than completing the film. While Williams was arguably a victim of the studio mucking with his project, that Warner Bros. was interested at all in funding this already decades-old project was miraculous enough, and it could be said that Williams squandered his time there.
By the time 1991 rolled around, Williams was well over budget and the film still unfinished. What he had managed to get together and show off to the studio execs did not impress. Warner Bros. grew tired of waiting and backed out of the production, leaving the film in the hands of The Completion Bond Company, which ousted Williams and had the film fast tracked to completion under Fred Calvert. In turn, Fred outsourced work to several other animation houses across the world, producing a final and Disney-influenced version within 18 months of being hired on. The film continued to flail about for a while more before finally securing a U.S. release some several months later under Miramax, which had ironically recently been bought by Disney. Miramax continued to further edit the already butchered film into their own version, releasing it to theatres under the title Arabian Knight in 1995 and featuring brand new celebrity voices by Matthew Broderick, Jennifer Beals, and Jonathan Winters, joining the deceased Vincent Price, the only remaining voice actor from the original version, as the villain.
FortiGuard Labs has been monitoring a new release of the malware known as Predator the Thief, labeled as version 3.3.4. After our last article about Predator the Thief, we have continued monitoring this malware family. There were small development differences between each minor version, making version 3.3.4 very different from version 3.0.8.
In early December 2019, we observed a new Predator the Thief malware campaign using version 3.3.3. We analyzed the new campaign, and found that it is both stealthier and more complicated than its predecessors. In addition, it was upgraded again to version 3.3.4 on Christmas Eve. In this report we will analyze its latest set of capabilities.
Firstly, we discovered that the campaign now uses multiple phishing documents designed to look like invoices, all pushing the same payload of Predator the Thief. Figure 1 shows the infection chain, and Figure 2 shows an example of the phishing document.
As is often the case, the authors use Telegram to promote their malware business, upgrading the panel and stealer almost every month. We checked the following channel, used for providing update notes for their customers:
We also found that it copies a portion of ntdll.dll into an allocated memory. It then hooks the copied portion with a simple shellcode to call the function NtQueryInformationProcess for anti-debug purposes. It also prevents analysts from hooking NtQueryInformationProcess to avoid being detected. Further, it checks the crc32 checksum of the allocated memory to prevent any changes.
In contrast with the previous version, 3.0.8, most of the junk code in the main routine of version 3.3.3 was removed. We can also observe that the assembly code is much shorter but more complicated. For example, all strings are decoded at runtime with XOR or SUB, and those string-decoding loops cause the flow to be more complicated.
We also found that the stolen information is sent as a zip file. However, those files are never generated in the file system. Instead, the malware allocates a memory space to locate the entire zip file structure, and then adds the zip file directly from memory to the request data.
This is an API used to get the configuration from C2 server. The configuration is more complex and detailed than previous versions, and is encrypted during the connection. One example returned the following base64-encoded-like data.
In fact, the string is encrypted using basic base64 and RC4 algorithms. The RC4 algorithm uses the C2 domain name as its key. After decoding the string shown in the previous figure, we found the following configuration string. Note that the IP information is masked.
4. The fourth part is a sub-configuration for running the download module or other malware. Interestingly, Predator the Thief has become a possible loader for other malware due to its ability to download other malware.
5. The fifth and final part is another configuration for downloading and executing modules. Different from the fourth part of the configuration, it defines an API list. Each API downloads files from [APIName].get and [APIName].post.
In this recent malware campaign, a simple but tricky way to abuse legitimate AutoIt software to execute the payload of Predator the Thief has been added. In addition, the whole program flow has been changed. More anti-analysis features are used, and the configurations are more detailed and complex. It is also able to collect information in a file-less manner and delete itself immediately after sending information to C2. This makes it more difficult for analysts to analyze its damage to the victim system. It also has added new features to execute its additional modules and second stage malware in different ways.