A 24h rolling graph of ImageLoad unsigned→signed

Same wall I hit last quarter. The load-bearing line: One counter, one sparkline, one threshold that pages a human. Join on PID plus create-time plus image when clocks disagree. Same class as the October thread, different binary.

I would have written the opposite conclusion a year ago. «A 24h rolling graph of ImageLoad unsigned→signed» — specifically One counter, one sparkline, one threshold that pages a human. Store why-the-event-is-here. Empty reason is a collector bug. I will +rep a listing and −rep a vibe. That is the deal.

@labsec

Same wall I hit last quarter. The load-bearing line: One counter, one sparkline, one threshold that pages a human. Join on PID plus create-t

If you cannot paste bytes, you do not have a counterexample. Came back to this after a coffee. Still hold. «A 24h rolling graph of ImageLoad unsigned→signed» — specifically One counter, one sparkline, one threshold that pages a human. Lead with image/path/signer, not SHA256. Humans cannot read hashes. Same class as the January thread, different binary.

@meshx

I would have written the opposite conclusion a year ago. «A 24h rolling graph of ImageLoad unsigned→signed» — specifically One counter, one

You keep moving the goalposts. First it was the decoder, now it is the dump. This is the kind of thread that should be a sticky and is not. You wrote «One counter, one sparkline, one threshold that pages a human». That is the sentence I keep. Parent to child is the detection. Image name is a label. Which build of the tool? I got burned mixing notes across versions. I reproduced it on lab build 1138.

@nexor

This is the kind of thread that should be a sticky and is not. You wrote «One counter, one sparkline, one threshold that pages a human». Tha

This is the kind of thread that should be a sticky and is not. The load-bearing line: One counter, one sparkline, one threshold that pages a human. Key on process GUID, not PID. Reuse will lie to you. I reproduced it on lab build 1075.

@olamidee

This is the kind of thread that should be a sticky and is not. The load-bearing line: One counter, one sparkline, one threshold that pages a

Decompiler output is a hypothesis. Treat it like one. Not fully convinced yet. You wrote «One counter, one sparkline, one threshold that pages a human». That is the sentence I keep. Join on PID plus create-time plus image when clocks disagree. Same class as the January thread, different binary.

I still keep a paper notebook for this kind of note. The load-bearing line: One counter, one sparkline, one threshold that pages a human. Rare-on-Tuesday is patch Tuesday. Exclude the window. I wrote a 12-line script and then threw it away. The listing was enough.

@pwned

I still keep a paper notebook for this kind of note. The load-bearing line: One counter, one sparkline, one threshold that pages a human. Ra

This is getting personal and it does not need to. I would have written the opposite conclusion a year ago. The load-bearing line: One counter, one sparkline, one threshold that pages a human. A 10-day baseline is a report. A 10-minute window is a detection. Say which. If anyone DMs me a zip I will not open it. Hash in-thread.

I disagree with the tone, not the bytes. You wrote «One counter, one sparkline, one threshold that pages a human». That is the sentence I keep. Join on PID plus create-time plus image when clocks disagree. Was this on the licensed corpus or a crackme you wrote? Pinned a comment at 0x140000af6 in the listing.

@secmod

I disagree with the tone, not the bytes. You wrote «One counter, one sparkline, one threshold that pages a human». That is the sentence I ke

That insult was not a technical point. I am reporting it. The screenshot is the useful part of the post. On «A 24h rolling graph of ImageLoad unsigned→signed»: One counter, one sparkline, one threshold that pages a human. Parent to child is the detection. Image name is a label. Same class as the October thread, different binary.

@sn0op

The screenshot is the useful part of the post. On «A 24h rolling graph of ImageLoad unsigned→signed»: One counter, one sparkline, one thresh

Did this on ARM64 last week — same shape, different pain. On «A 24h rolling graph of ImageLoad unsigned→signed»: One counter, one sparkline, one threshold that pages a human. Parent to child is the detection. Image name is a label. My note id for this: 8c-10.

@stagx

Did this on ARM64 last week — same shape, different pain. On «A 24h rolling graph of ImageLoad unsigned→signed»: One counter, one sparkline,

I am reporting the sample-drop hint. Hash and corpus tag only. I ran this on a licensed corpus binary. The load-bearing line: One counter, one sparkline, one threshold that pages a human. First-seen is first-seen-by-us. Name the column that way. Pinned a comment at 0x140006edd in the listing.