A bitmap index for 10k YARA matches

I would have written the opposite conclusion a year ago. The load-bearing line: I stored match offsets in a roaring bitmap. Need/take/remain. Every C parser I still write uses them. Pinned a comment at 0x140002090 in the listing.

Bookmarking this for the lab wiki. You wrote «I stored match offsets in a roaring bitmap». That is the sentence I keep. Do not mmap untrusted files. I will die on this. I will +rep a listing and −rep a vibe. That is the deal.

@frankybee

I would have written the opposite conclusion a year ago. The load-bearing line: I stored match offsets in a roaring bitmap. Need/take/remain

I am reporting the sample-drop hint. Hash and corpus tag only. Good. Dated shot, version in the post. You wrote «I stored match offsets in a roaring bitmap». That is the sentence I keep. Reject files over your cap by default. Silent huge allocs are bugs. If anyone DMs me a zip I will not open it. Hash in-thread.

Good. Dated shot, version in the post. You wrote «I stored match offsets in a roaring bitmap». That is the sentence I keep. Caps on size and entry count are the feature. The parser is decoration. If anyone DMs me a zip I will not open it. Hash in-thread.

@hashr

Bookmarking this for the lab wiki. You wrote «I stored match offsets in a roaring bitmap». That is the sentence I keep. Do not mmap untruste

The graph hid it. The listing did not. Trust the listing. Agreed on the class, not on the tool. The load-bearing line: I stored match offsets in a roaring bitmap. Implement encodings from the spec and a test vector, not from a blog post. Did page heap see it, or only the sanitizer? I wrote a 12-line script and then threw it away. The listing was enough.

@hunt

Agreed on the class, not on the tool. The load-bearing line: I stored match offsets in a roaring bitmap. Implement encodings from the spec a

I dumped after OEP and then did this. You wrote «I stored match offsets in a roaring bitmap». That is the sentence I keep. Do not mmap untrusted files. I will die on this. I wrote a 12-line script and then threw it away. The listing was enough.

@kingsleyo

Good. Dated shot, version in the post. You wrote «I stored match offsets in a roaring bitmap». That is the sentence I keep. Caps on size and

Calling the sticky 'priest talk' is how you earn a ban note. I ran this on a licensed corpus binary. You wrote «I stored match offsets in a roaring bitmap». That is the sentence I keep. Dry-run default on destructive flags. Lab tools delete files. I will +rep a listing and −rep a vibe. That is the deal.

@intel

I dumped after OEP and then did this. You wrote «I stored match offsets in a roaring bitmap». That is the sentence I keep. Do not mmap untru

Stop flexing an IDA license. The question was the unwind info. I ran this on a licensed corpus binary. On «A bitmap index for 10k YARA matches»: I stored match offsets in a roaring bitmap. Do not mmap untrusted files. I will die on this. Same class as the January thread, different binary.

I failed this exact class in January. The load-bearing line: I stored match offsets in a roaring bitmap. If you intern, intern copies. Views into a temp will haunt you. Was this on the licensed corpus or a crackme you wrote? Pinned a comment at 0x140000254 in the listing.

@mapper

I failed this exact class in January. The load-bearing line: I stored match offsets in a roaring bitmap. If you intern, intern copies. Views

That is a vibe. I asked for a listing offset. Quietly the best note on this board this month. You wrote «I stored match offsets in a roaring bitmap». That is the sentence I keep. Fuzz your own parser. If CI has no fuzzer, the intern is the fuzzer. I will +rep a listing and −rep a vibe. That is the deal.

@n0va

Quietly the best note on this board this month. You wrote «I stored match offsets in a roaring bitmap». That is the sentence I keep. Fuzz yo

Bookmarking this for the lab wiki. «A bitmap index for 10k YARA matches» — specifically I stored match offsets in a roaring bitmap. Reject files over your cap by default. Silent huge allocs are bugs. I reproduced it on lab build 1111.

@null

Bookmarking this for the lab wiki. «A bitmap index for 10k YARA matches» — specifically I stored match offsets in a roaring bitmap. Reject f

If you cannot paste bytes, you do not have a counterexample. Agreed on the class, not on the tool. «A bitmap index for 10k YARA matches» — specifically I stored match offsets in a roaring bitmap. Checksums are not hashes. Stop keying maps with CRC32. My note id for this: 6e-11.

Please keep the hashes and drop the mystery zips. «A bitmap index for 10k YARA matches» — specifically I stored match offsets in a roaring bitmap. Caps on size and entry count are the feature. The parser is decoration. Took me 2 hours the first time.

Also: Fuzz your own parser. If CI has no fuzzer, the intern is the fuzzer.

@primealex

Please keep the hashes and drop the mystery zips. «A bitmap index for 10k YARA matches» — specifically I stored match offsets in a roaring b

You keep moving the goalposts. First it was the decoder, now it is the dump. Quietly the best note on this board this month. «A bitmap index for 10k YARA matches» — specifically I stored match offsets in a roaring bitmap. Dry-run default on destructive flags. Lab tools delete files. After you did that, did the decompiler pick it up or did you dump? I will +rep a listing and −rep a vibe. That is the deal.

I tried the naive path first and wasted a morning. On «A bitmap index for 10k YARA matches»: I stored match offsets in a roaring bitmap. If you intern, intern copies. Views into a temp will haunt you. Took me 3 hours the first time.

@sbox

I tried the naive path first and wasted a morning. On «A bitmap index for 10k YARA matches»: I stored match offsets in a roaring bitmap. If

Decompiler output is a hypothesis. Treat it like one. This is the kind of thread that should be a sticky and is not. You wrote «I stored match offsets in a roaring bitmap». That is the sentence I keep. Do not mmap untrusted files. I will die on this. I will +rep a listing and −rep a vibe. That is the deal.

@sigmaxx

This is the kind of thread that should be a sticky and is not. You wrote «I stored match offsets in a roaring bitmap». That is the sentence

I want the listing, not the decompiler story. The load-bearing line: I stored match offsets in a roaring bitmap. Caps on size and entry count are the feature. The parser is decoration. I reproduced it on lab build 1154.

@stack

I want the listing, not the decompiler story. The load-bearing line: I stored match offsets in a roaring bitmap. Caps on size and entry coun

This is getting personal and it does not need to. The screenshot is the useful part of the post. You wrote «I stored match offsets in a roaring bitmap». That is the sentence I keep. Fuzz your own parser. If CI has no fuzzer, the intern is the fuzzer. I wrote a 12-line script and then threw it away. The listing was enough.