I mirrored it. I hashed it. I run it in a VM. I do not run it from the blog in 2026. Old tools are fine. Old hostin…
dumpstackMEMBERstarted 25 Aug 2026, 15:03
idtvecYesterday, 23:27
6 readingHID filters. A second mouse on the host. The guest gets a tablet or nothing. I am tired of HID stories. If you need…
ipreddisWednesday, 19:51
9 readingContainers share a kernel. Samples that talk to kernels are why we have VMs. Docker is for our tools, not for their…
ibrsfullWednesday, 10:45
1 readingNested virt, enough CPU, no random steal. It worked. It also failed until I pinned the vCPU count. If rr is flaky, …
mosesprimeSENIORvendorstarted 14 Nov 2025, 06:30
lviTuesday, 16:44
6 readingIf you DM me a script with no license, I will ask. If you say 'whatever', I will not run it. MIT or public domain. …
ubsanMEMBERstarted 9 Aug 2026, 02:33taaoffMonday, 09:09
8 readingQEMU for the weird ISAs. VMware for the Windows detonation VM I already have. Both. Stop asking me to pick a person…
watchdogMEMBERstarted 2 Aug 2026, 16:11wbnoinvdMonday, 00:4210 readingFLOSS is better. strings.exe is instant. Both live on the tools snapshot. Put it next to the fancy things. They are…
flushoptMEMBERstarted 23 Aug 2026, 09:06intel23 Aug 2026, 14:42
7 readingPE-sieve, hollows_hunter, some of the parsers. Default on the snapshot. Then Ghidra. Then opinions. Defaults beat o…
rundownGUESTstarted 24 Jul 2026, 08:09flushopt23 Aug 2026, 12:063 readingHost-only NIC, no shared folders, no drag-drop, snapshots before every detonation, time sync off, one-way logging o…
lfencetmrMEMBERstarted 27 Aug 2025, 15:20
icebreak20 Aug 2026, 07:32
2 readingTools snapshot updates weekly. Analysis VMs restore from last detonation snapshot and stay dirty until I throw them…
6 readingFLOSS for the encoded ones. strings for the rest. I do not run FLOSS on every PE in the drop folder. I run it when …
npagedGUESTstarted 7 Jul 2026, 04:25
i2cxfer9 Aug 2026, 09:38
5 readingThat is the SLA. If your tools take an hour, you will skip the restore and you will contaminate the box. 8 minutes …
iocompleteGUESTstarted 22 Jul 2026, 09:24
panicnt6 Aug 2026, 20:192 readingI freeze for trials that check the clock. I skew for certs. I real-time for ETW joins. Say which one the VM is on t…
dtdebugMEMBERstarted 29 Jul 2026, 01:18showregs6 Aug 2026, 03:4310 readingcapa first for the boring capabilities. Then I look. If you skip capa you will miss the boring ones and write about…
isrdpcGUESTstarted 23 Jul 2026, 03:13ubsan5 Aug 2026, 12:04
7 readingI removed half. It got faster. I did not miss them. Superstition is a plugin you cannot name the job of. If you can…
uninitMEMBERstarted 4 Aug 2026, 10:08
kprobe4 Aug 2026, 16:461 readingI stopped mixing them on one box. Preview is user-mode. Kernel is a serial or kdnet pair. Two VMs. If you kernel-de…
preemptMEMBERstarted 3 Aug 2026, 23:34
yama4 Aug 2026, 05:49
4 readingLicense, corpus tag, hash in the index. If it is not in the index it is not in the lab. I will not strings a file w…
lockupMEMBERstarted 3 Aug 2026, 09:08kvant3 Aug 2026, 15:173 readingName: date + hash-prefix + 'pre' or 'post'. Restore is grepping. Restore is not remembering. If your snapshots are …
softlockMEMBERstarted 2 Aug 2026, 18:09
bindnow2 Aug 2026, 23:34
7 readingDIE for the first five seconds. Hexdump for the rest. DIE is not a reverse. If your writeup is a DIE screenshot, it…
compactmemMEMBERstarted 1 Aug 2026, 09:57dtdebug1 Aug 2026, 15:132 readingPassword managers, shopping, anything that talks. The tools VM is not your laptop. If you need a password, use the …
ksmmergeMEMBERstarted 31 Jul 2026, 23:10cookiemon1 Aug 2026, 04:15
5 readingI write hashes and 'do not run this again' in a notebook that is not on the network. It has survived two disk death…
9 readingOnce. I have not done it again. Clipboard off between host and detonation VM. On between host and tools VM, maybe. …
dmitrire30 Jul 2026, 15:29
8 readingIt catches a thing we care about and also three of our tools. I keep it private with the suppressions. Public rules…
yukiuefi30 Jul 2026, 03:04Small firmware, I want a seek and a print. r2 is faster. Ghidra is the project I come back to in a week. Both. The …
amlparse29 Jul 2026, 22:09
4 readingWallpaper: NIC=host-only, shared=off, snapshot before run, no mail. It helped more than the wiki. Put the rules whe…
3 readingDNS, HTTP, HTTPS with our CA, SMTP that never leaves, IRC if the family needs it. Not 40 services 'because default'…
kfull28 Jul 2026, 16:597 readingWe needed a licensed dongle. We put it on a dedicated box, not on the detonation VM. Filter stayed on the detonatio…
syzbot28 Jul 2026, 00:022 readingOne trick, one VM, snapshot, no network. The trick still works on a class of old binaries. That is the whole post. …
dynsymMEMBERstarted 26 Jul 2026, 19:16startio26 Jul 2026, 22:146 readingbinwalk finds the FS. The hard part is the CPU and the load address. Ghidra after binwalk, not instead. If you stop…
bolt26 Jul 2026, 20:095 readingA looping regex on a huge section. I rewrote it as strings + a small loop in the condition. Core time dropped 40x. …
kiber_lisa26 Jul 2026, 08:149 readingRead-only ISO I build on the host from a hashed file. Not drag-drop. Not shared folders. Not email to myself. If yo…
plthookMEMBERstarted 25 Jul 2026, 20:56bootmgfw25 Jul 2026, 23:058 readingx64dbg for the clicky reverse. WinDbg for TTD and kernel. I install both. I am tired of the war. If you only have o…
fastmutex24 Jul 2026, 06:228 readingWe hashed the ISOs. One did not match the vendor. We threw it away. We did not 'just try it'. If the hash does not …
outstackGUESTstarted 24 Jul 2026, 00:38specpool24 Jul 2026, 02:284 readingCapture the sibling, not your mail. I have seen both in the same pcap. I was not kind about it. If the pcap has you…
dispatchGUESTstarted 23 Jul 2026, 08:19iretd23 Jul 2026, 09:4310 readingWe run our rules on our build outputs so we FP ourselves first. It is rude and useful. If your rules only run on 'm…
dsdtdumpMEMBERstarted 6 Oct 2025, 15:56lookaside7 Jul 2026, 10:354 readingCaps: size, entropy, format sniff, then YARA, then queue. The 4GB txt was a misnamed dump. The cap saved the box. C…
dseflagMEMBERstarted 4 Nov 2025, 12:51nminest7 Nov 2025, 11:019 readingSame image, same FID, same scripts. CI analyzes public crackmes as a regression of our scripts, not of the crackmes…
1 readingINetSim on Linux sibling. FakeNet when I am stuck on a Windows-only lab. Both need a host-only NIC or you are natti…
acpifacpMEMBERstarted 21 Sep 2025, 23:39disasm23 Sep 2025, 05:083 readingIt is a diff of what the process looks like vs what the PE said. I use it after a detonation, then I reverse the de…
sharedusr19 Sep 2025, 21:5510 reading