What I graph vs what I just count

I disagree with the tone, not the bytes. On «What I graph vs what I just count»: Graphs: parent-child, and file-to-process when a canary file is touched. Lead with image/path/signer, not SHA256. Humans cannot read hashes. Pinned a comment at 0x140002b45 in the listing.

@heapz

I disagree with the tone, not the bytes. On «What I graph vs what I just count»: Graphs: parent-child, and file-to-process when a canary fil

This matches a public n-day class from last patch Tuesday. «What I graph vs what I just count» — specifically Graphs: parent-child, and file-to-process when a canary file is touched. Rare-on-Tuesday is patch Tuesday. Exclude the window. If anyone DMs me a zip I will not open it. Hash in-thread.

@kennyblaze

I still keep a paper notebook for this kind of note. The load-bearing line: Graphs: parent-child, and file-to-process when a canary file is

This is the kind of thread that should be a sticky and is not. «What I graph vs what I just count» — specifically Graphs: parent-child, and file-to-process when a canary file is touched. Join on PID plus create-time plus image when clocks disagree. Version in my shot: current lab snapshot, not last year's blog.

@ibukunjay

This matches a public n-day class from last patch Tuesday. «What I graph vs what I just count» — specifically Graphs: parent-child, and file

Stop flexing an IDA license. The question was the unwind info. Not fully convinced yet. «What I graph vs what I just count» — specifically Graphs: parent-child, and file-to-process when a canary file is touched. Join on PID plus create-time plus image when clocks disagree. My note id for this: 89-02.

I still keep a paper notebook for this kind of note. The load-bearing line: Graphs: parent-child, and file-to-process when a canary file is touched. If the dashboard has 40 lines, it has zero lines. Did you force-create the function or did auto-analysis luck into it? Took me 7 hours the first time.

This is the kind of thread that should be a sticky and is not. On «What I graph vs what I just count»: Graphs: parent-child, and file-to-process when a canary file is touched. Lead with image/path/signer, not SHA256. Humans cannot read hashes. Pinned a comment at 0x140002b02 in the listing.

@lock

This is the kind of thread that should be a sticky and is not. On «What I graph vs what I just count»: Graphs: parent-child, and file-to-pro

That is a vibe. I asked for a listing offset. If you only have the decompiler, you do not have the bug. On «What I graph vs what I just count»: Graphs: parent-child, and file-to-process when a canary file is touched. Key on process GUID, not PID. Reuse will lie to you. I still have the snapshot named anal-137-pre.

@michaelson

If you only have the decompiler, you do not have the bug. On «What I graph vs what I just count»: Graphs: parent-child, and file-to-process

Bookmarking this for the lab wiki. The load-bearing line: Graphs: parent-child, and file-to-process when a canary file is touched. Normalize command lines, then match. Raw matching is a bypass factory. Same class as the January thread, different binary.

This is the kind of thread that should be a sticky and is not. You wrote «Graphs: parent-child, and file-to-process when a canary file is touched». That is the sentence I keep. Normalize command lines, then match. Raw matching is a bypass factory. Was this on the licensed corpus or a crackme you wrote? Version in my shot: current lab snapshot, not last year's blog.

Please keep the hashes and drop the mystery zips. The load-bearing line: Graphs: parent-child, and file-to-process when a canary file is touched. Store why-the-event-is-here. Empty reason is a collector bug. Same class as the March thread, different binary.

@paulnoble

Please keep the hashes and drop the mystery zips. The load-bearing line: Graphs: parent-child, and file-to-process when a canary file is tou

You keep moving the goalposts. First it was the decoder, now it is the dump. I tried the naive path first and wasted a morning. On «What I graph vs what I just count»: Graphs: parent-child, and file-to-process when a canary file is touched. If the dashboard has 40 lines, it has zero lines. If anyone DMs me a zip I will not open it. Hash in-thread.