ELF RELRO / BIND_NOW: how much does it actually change reversing?

Did this on ARM64 last week — same shape, different pain. The load-bearing line: People talk about RELRO like it changes the reverse. I leave CET ops in the listing. They document that CET is on. Version in my shot: current lab snapshot, not last year's blog.

@johnflex

Did this on ARM64 last week — same shape, different pain. The load-bearing line: People talk about RELRO like it changes the reverse. I leav

I am not moving this to DMs so you can yell. Stay on the class. This belongs in the first-hour ritual. On «ELF RELRO / BIND_NOW: how much does it actually change reversing?»: People talk about RELRO like it changes the reverse. Listing first. The decompiler invented a cast last week that hid a signed compare. My note id for this: d-01.

I dumped after OEP and then did this. You wrote «People talk about RELRO like it changes the reverse». That is the sentence I keep. Vtable grouping without RTTI: xref clusters plus IUnknown shape. I reproduced it on lab build 1209.

@lawrencex

I dumped after OEP and then did this. You wrote «People talk about RELRO like it changes the reverse». That is the sentence I keep. Vtable g

That is not what the listing shows. You are arguing a vibe. Agreed on the class, not on the tool. The load-bearing line: People talk about RELRO like it changes the reverse. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Is the hang the incomplete patch, or a second bug? Version in my shot: current lab snapshot, not last year's blog.

@lukmanfresh

Agreed on the class, not on the tool. The load-bearing line: People talk about RELRO like it changes the reverse. I bookmark the decoder the

I ran this on a licensed corpus binary. On «ELF RELRO / BIND_NOW: how much does it actually change reversing?»: People talk about RELRO like it changes the reverse. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I reproduced it on lab build 1260.

@mosesprime

I ran this on a licensed corpus binary. On «ELF RELRO / BIND_NOW: how much does it actually change reversing?»: People talk about RELRO like

I read the patch. You read a tweet. Those are not the same source. The screenshot is the useful part of the post. You wrote «People talk about RELRO like it changes the reverse». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Took me 4 hours the first time.

I ran this on a licensed corpus binary. You wrote «People talk about RELRO like it changes the reverse». That is the sentence I keep. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I will +rep a listing and −rep a vibe. That is the deal.

@opzsec

I ran this on a licensed corpus binary. You wrote «People talk about RELRO like it changes the reverse». That is the sentence I keep. Recurs

Call-convention guess is not evidence. I ran this on a licensed corpus binary. «ELF RELRO / BIND_NOW: how much does it actually change reversing?» — specifically People talk about RELRO like it changes the reverse. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. I still have the snapshot named reve-13-pre.

The screenshot is the useful part of the post. «ELF RELRO / BIND_NOW: how much does it actually change reversing?» — specifically People talk about RELRO like it changes the reverse. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. After you did that, did the decompiler pick it up or did you dump? I still have the snapshot named reve-13-pre.

@reconx

The screenshot is the useful part of the post. «ELF RELRO / BIND_NOW: how much does it actually change reversing?» — specifically People tal

Do not call people skids because they use Ghidra. Agreed on the class, not on the tool. You wrote «People talk about RELRO like it changes the reverse». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Version in my shot: current lab snapshot, not last year's blog.

@samueljay

Agreed on the class, not on the tool. You wrote «People talk about RELRO like it changes the reverse». That is the sentence I keep. If it is

I dumped after OEP and then did this. «ELF RELRO / BIND_NOW: how much does it actually change reversing?» — specifically People talk about RELRO like it changes the reverse. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I still have the snapshot named reve-13-pre.

@shola_k

I dumped after OEP and then did this. «ELF RELRO / BIND_NOW: how much does it actually change reversing?» — specifically People talk about R

You are describing a live target. Stop. Patched class only. I dumped after OEP and then did this. On «ELF RELRO / BIND_NOW: how much does it actually change reversing?»: People talk about RELRO like it changes the reverse. Call-convention mass-correct with a script. Still too much clicking. I will +rep a listing and −rep a vibe. That is the deal.

I would have written the opposite conclusion a year ago. You wrote «People talk about RELRO like it changes the reverse». That is the sentence I keep. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I reproduced it on lab build 1217.

Also: I leave CET ops in the listing. They document that CET is on.

@sysx

I would have written the opposite conclusion a year ago. You wrote «People talk about RELRO like it changes the reverse». That is the senten

Take the telegram pitch to the bin. Market listing or nothing. I will argue the opposite and then probably agree. The load-bearing line: People talk about RELRO like it changes the reverse. I leave CET ops in the listing. They document that CET is on. Is the hang the incomplete patch, or a second bug? Took me 11 hours the first time.