I pulled hashes from VT and I still needed the parent

Quietly the best note on this board this month. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent is a weather report. Join on PID plus create-time plus image when clocks disagree. If anyone DMs me a zip I will not open it. Hash in-thread.

@decodr

Quietly the best note on this board this month. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent i

You keep moving the goalposts. First it was the decoder, now it is the dump. I ran this on a licensed corpus binary. You wrote «Hash reputation without parent is a weather report». That is the sentence I keep. Key on process GUID, not PID. Reuse will lie to you. Version in my shot: current lab snapshot, not last year's blog.

@franklyn_

Good. Dated shot, version in the post. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent is a weath

Did this on ARM64 last week — same shape, different pain. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent is a weather report. Store why-the-event-is-here. Empty reason is a collector bug. I will +rep a listing and −rep a vibe. That is the deal.

@hubmaster

Please keep the hashes and drop the mystery zips. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation wit

That insult was not a technical point. I am reporting it. Same wall I hit last quarter. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation without parent is a weather report. Parent to child is the detection. Image name is a label. I reproduced it on lab build 1194.

@ghost

Did this on ARM64 last week — same shape, different pain. On «I pulled hashes from VT and I still needed the parent»: Hash reputation withou

This is getting personal and it does not need to. Please keep the hashes and drop the mystery zips. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation without parent is a weather report. Store why-the-event-is-here. Empty reason is a collector bug. If anyone DMs me a zip I will not open it. Hash in-thread.

Bookmarking this for the lab wiki. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent is a weather report. First-seen is first-seen-by-us. Name the column that way. I wrote a 12-line script and then threw it away. The listing was enough.

Please keep the hashes and drop the mystery zips. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation without parent is a weather report. Rare-on-Tuesday is patch Tuesday. Exclude the window. If anyone DMs me a zip I will not open it. Hash in-thread.

@femismart

Bookmarking this for the lab wiki. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent is a weather r

Decompiler output is a hypothesis. Treat it like one. Good. Dated shot, version in the post. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent is a weather report. Store why-the-event-is-here. Empty reason is a collector bug. Was this on the licensed corpus or a crackme you wrote? I wrote a 12-line script and then threw it away. The listing was enough.

I failed this exact class in January. You wrote «Hash reputation without parent is a weather report». That is the sentence I keep. First-seen is first-seen-by-us. Name the column that way. I will +rep a listing and −rep a vibe. That is the deal.

This belongs in the first-hour ritual. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation without parent is a weather report. Join on PID plus create-time plus image when clocks disagree. Which build of the tool? I got burned mixing notes across versions. Took me 8 hours the first time.

@johnnyace

This belongs in the first-hour ritual. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation without parent

I am reporting the sample-drop hint. Hash and corpus tag only. I still keep a paper notebook for this kind of note. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent is a weather report. Join on PID plus create-time plus image when clocks disagree. Took me 4 hours the first time.

@bitsec

If you only have the decompiler, you do not have the bug. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputa

If you only have the decompiler, you do not have the bug. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation without parent is a weather report. If the dashboard has 40 lines, it has zero lines. Which build of the tool? I got burned mixing notes across versions. Took me 5 hours the first time.

@kilo

I still keep a paper notebook for this kind of note. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without par

I still keep a paper notebook for this kind of note. The load-bearing line: Hash reputation without parent is a weather report. If the dashboard has 40 lines, it has zero lines. Version in my shot: current lab snapshot, not last year's blog.

@authx

I failed this exact class in January. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation without parent

That insult was not a technical point. I am reporting it. If you only have the decompiler, you do not have the bug. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation without parent is a weather report. First-seen is first-seen-by-us. Name the column that way. I will +rep a listing and −rep a vibe. That is the deal.

This is the kind of thread that should be a sticky and is not. You wrote «Hash reputation without parent is a weather report». That is the sentence I keep. Lead with image/path/signer, not SHA256. Humans cannot read hashes. I will +rep a listing and −rep a vibe. That is the deal.

@cipherz

This is the kind of thread that should be a sticky and is not. You wrote «Hash reputation without parent is a weather report». That is the s

The graph hid it. The listing did not. Trust the listing. This matches a public n-day class from last patch Tuesday. You wrote «Hash reputation without parent is a weather report». That is the sentence I keep. Rare-on-Tuesday is patch Tuesday. Exclude the window. Version in my shot: current lab snapshot, not last year's blog.

@ledger

I still keep a paper notebook for this kind of note. The load-bearing line: Hash reputation without parent is a weather report. If the dashb

The graph hid it. The listing did not. Trust the listing. Same wall I hit last quarter. You wrote «Hash reputation without parent is a weather report». That is the sentence I keep. Lead with image/path/signer, not SHA256. Humans cannot read hashes. Same class as the March thread, different binary.

I failed this exact class in January. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation without parent is a weather report. Normalize command lines, then match. Raw matching is a bypass factory. If anyone DMs me a zip I will not open it. Hash in-thread.

@baba_yaga

I failed this exact class in January. You wrote «Hash reputation without parent is a weather report». That is the sentence I keep. First-see

This is getting personal and it does not need to. Not fully convinced yet. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent is a weather report. Join on PID plus create-time plus image when clocks disagree. I will +rep a listing and −rep a vibe. That is the deal.

@bryanwest

If you only have the decompiler, you do not have the bug. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputa

I am reporting the sample-drop hint. Hash and corpus tag only. I still keep a paper notebook for this kind of note. The load-bearing line: Hash reputation without parent is a weather report. First-seen is first-seen-by-us. Name the column that way. My note id for this: 9e-29.

I tried the naive path first and wasted a morning. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation without parent is a weather report. Join on PID plus create-time plus image when clocks disagree. Took me 11 hours the first time.

Also: Key on process GUID, not PID. Reuse will lie to you.

@n0des

I tried the naive path first and wasted a morning. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation wi

Stop flexing an IDA license. The question was the unwind info. I failed this exact class in January. The load-bearing line: Hash reputation without parent is a weather report. Rare-on-Tuesday is patch Tuesday. Exclude the window. Did you snapshot before, or is this a restore-from-memory story? If anyone DMs me a zip I will not open it. Hash in-thread.

I tried the naive path first and wasted a morning. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation without parent is a weather report. Key on process GUID, not PID. Reuse will lie to you. I reproduced it on lab build 1213.

@orbit

I tried the naive path first and wasted a morning. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation wi

Calling the sticky 'priest talk' is how you earn a ban note. I still keep a paper notebook for this kind of note. The load-bearing line: Hash reputation without parent is a weather report. A 10-day baseline is a report. A 10-minute window is a detection. Say which. Same class as the October thread, different binary.

@pr1me

I still keep a paper notebook for this kind of note. The load-bearing line: Hash reputation without parent is a weather report. A 10-day bas

I will argue the opposite and then probably agree. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent is a weather report. Lead with image/path/signer, not SHA256. Humans cannot read hashes. Took me 9 hours the first time.

@redx

I will argue the opposite and then probably agree. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without paren

That is a vibe. I asked for a listing offset. This is the writeup I wanted when I was stuck. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent is a weather report. Rare-on-Tuesday is patch Tuesday. Exclude the window. Version in my shot: current lab snapshot, not last year's blog.

This is the kind of thread that should be a sticky and is not. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent is a weather report. Parent to child is the detection. Image name is a label. Did page heap see it, or only the sanitizer? I reproduced it on lab build 1298.

@sigint

This is the kind of thread that should be a sticky and is not. On «I pulled hashes from VT and I still needed the parent»: Hash reputation w

If you cannot paste bytes, you do not have a counterexample. Not fully convinced yet. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation without parent is a weather report. Normalize command lines, then match. Raw matching is a bypass factory. Took me 10 hours the first time.

Bookmarking this for the lab wiki. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent is a weather report. Rare-on-Tuesday is patch Tuesday. Exclude the window. I wrote a 12-line script and then threw it away. The listing was enough.

Also: First-seen is first-seen-by-us. Name the column that way.

@taiwoflex

Bookmarking this for the lab wiki. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent is a weather r

You keep moving the goalposts. First it was the decoder, now it is the dump. This matches a public n-day class from last patch Tuesday. On «I pulled hashes from VT and I still needed the parent»: Hash reputation without parent is a weather report. Lead with image/path/signer, not SHA256. Humans cannot read hashes. I will +rep a listing and −rep a vibe. That is the deal.

@urbanjay

This matches a public n-day class from last patch Tuesday. On «I pulled hashes from VT and I still needed the parent»: Hash reputation witho

I dumped after OEP and then did this. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation without parent is a weather report. Rare-on-Tuesday is patch Tuesday. Exclude the window. I will +rep a listing and −rep a vibe. That is the deal.

@vx-u

I dumped after OEP and then did this. «I pulled hashes from VT and I still needed the parent» — specifically Hash reputation without parent

Decompiler output is a hypothesis. Treat it like one. This is the kind of thread that should be a sticky and is not. You wrote «Hash reputation without parent is a weather report». That is the sentence I keep. First-seen is first-seen-by-us. Name the column that way. Did you force-create the function or did auto-analysis luck into it? Pinned a comment at 0x140004ebe in the listing.