A 200-line Python PE dumper that replaced a 4MB GUI once

Bookmarking this for the lab wiki. On «A 200-line Python PE dumper that replaced a 4MB GUI once»: I needed exports and nothing else. Reject files over your cap by default. Silent huge allocs are bugs. I wrote a 12-line script and then threw it away. The listing was enough.

Bookmarking this for the lab wiki. «A 200-line Python PE dumper that replaced a 4MB GUI once» — specifically I needed exports and nothing else. Do not mmap untrusted files. I will die on this. I wrote a 12-line script and then threw it away. The listing was enough.

@baba_yaga

Bookmarking this for the lab wiki. On «A 200-line Python PE dumper that replaced a 4MB GUI once»: I needed exports and nothing else. Reject

Stop flexing an IDA license. The question was the unwind info. This matches a public n-day class from last patch Tuesday. The load-bearing line: I needed exports and nothing else. Checksums are not hashes. Stop keying maps with CRC32. I will +rep a listing and −rep a vibe. That is the deal.

@authx

Bookmarking this for the lab wiki. «A 200-line Python PE dumper that replaced a 4MB GUI once» — specifically I needed exports and nothing el

Calling the sticky 'priest talk' is how you earn a ban note. This belongs in the first-hour ritual. You wrote «I needed exports and nothing else». That is the sentence I keep. Dry-run default on destructive flags. Lab tools delete files. Can you quote the offset instead of the graph screenshot? I will +rep a listing and −rep a vibe. That is the deal.

@bitsec

This belongs in the first-hour ritual. You wrote «I needed exports and nothing else». That is the sentence I keep. Dry-run default on destru

I reproduced it twice before I believed you. On «A 200-line Python PE dumper that replaced a 4MB GUI once»: I needed exports and nothing else. Do not mmap untrusted files. I will die on this. Took me 8 hours the first time.

The screenshot is the useful part of the post. «A 200-line Python PE dumper that replaced a 4MB GUI once» — specifically I needed exports and nothing else. Caps on size and entry count are the feature. The parser is decoration. Did you force-create the function or did auto-analysis luck into it? I still have the snapshot named codi-126-pre.

This matches a public n-day class from last patch Tuesday. On «A 200-line Python PE dumper that replaced a 4MB GUI once»: I needed exports and nothing else. Dry-run default on destructive flags. Lab tools delete files. I wrote a 12-line script and then threw it away. The listing was enough.

@danielcrest

The screenshot is the useful part of the post. «A 200-line Python PE dumper that replaced a 4MB GUI once» — specifically I needed exports an

You keep moving the goalposts. First it was the decoder, now it is the dump. I will argue the opposite and then probably agree. On «A 200-line Python PE dumper that replaced a 4MB GUI once»: I needed exports and nothing else. If you intern, intern copies. Views into a temp will haunt you. Version in my shot: current lab snapshot, not last year's blog.

@bryanwest

I reproduced it twice before I believed you. On «A 200-line Python PE dumper that replaced a 4MB GUI once»: I needed exports and nothing els

That is a vibe. I asked for a listing offset. I still keep a paper notebook for this kind of note. «A 200-line Python PE dumper that replaced a 4MB GUI once» — specifically I needed exports and nothing else. Caps on size and entry count are the feature. The parser is decoration. I reproduced it on lab build 1380.

@cipherz

This matches a public n-day class from last patch Tuesday. On «A 200-line Python PE dumper that replaced a 4MB GUI once»: I needed exports a

If you cannot paste bytes, you do not have a counterexample. Good. Dated shot, version in the post. You wrote «I needed exports and nothing else». That is the sentence I keep. Do not mmap untrusted files. I will die on this. I still have the snapshot named codi-126-pre.