Firmware: raw SPI dump, no headers, ARM Cortex-M

Agreed on the class, not on the tool. On «Firmware: raw SPI dump, no headers, ARM Cortex-M»: SPI dump from a router we own. I trust FLOSS after I have seen the decoder. Before that I read the stores. Pinned a comment at 0x140004d0c in the listing.

@decode

Please keep the hashes and drop the mystery zips. The load-bearing line: SPI dump from a router we own. Call-convention mass-correct with a

Do not call people skids because they use Ghidra. I would have written the opposite conclusion a year ago. You wrote «SPI dump from a router we own». That is the sentence I keep. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. My note id for this: 10-22.

@shadow_spb

Not fully convinced yet. On «Firmware: raw SPI dump, no headers, ARM Cortex-M»: SPI dump from a router we own. Call-convention mass-correct

I disagree with the tone, not the bytes. You wrote «SPI dump from a router we own». That is the sentence I keep. I leave CET ops in the listing. They document that CET is on. Did you force-create the function or did auto-analysis luck into it? Took me 2 hours the first time.

Quietly the best note on this board this month. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we own. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Version in my shot: current lab snapshot, not last year's blog.

I will argue the opposite and then probably agree. You wrote «SPI dump from a router we own». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Same class as the June thread, different binary.

@c2x

I failed this exact class in January. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we own. If it

I read the patch. You read a tweet. Those are not the same source. This is the writeup I wanted when I was stuck. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we own. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Which build of the tool? I got burned mixing notes across versions. I still have the snapshot named reve-16-pre.

@alexwise

I disagree with the tone, not the bytes. You wrote «SPI dump from a router we own». That is the sentence I keep. I leave CET ops in the list

I am not moving this to DMs so you can yell. Stay on the class. I want the listing, not the decompiler story. You wrote «SPI dump from a router we own». That is the sentence I keep. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Version in my shot: current lab snapshot, not last year's blog.

This belongs in the first-hour ritual. You wrote «SPI dump from a router we own». That is the sentence I keep. Call-convention mass-correct with a script. Still too much clicking. I still have the snapshot named reve-16-pre.

Came back to this after a coffee. Still hold. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we own. UPX with a skipped magic is still UPX. Restore four bytes and move on. I still have the snapshot named reve-16-pre.

@johnflex

Came back to this after a coffee. Still hold. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we ow

You are treating a checksum as a signature again. I ran this on a licensed corpus binary. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we own. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Version in my shot: current lab snapshot, not last year's blog.

I failed this exact class in January. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we own. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. I will +rep a listing and −rep a vibe. That is the deal.

Good. Dated shot, version in the post. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we own. I leave CET ops in the listing. They document that CET is on. Did you force-create the function or did auto-analysis luck into it? Pinned a comment at 0x140002b22 in the listing.

Not fully convinced yet. On «Firmware: raw SPI dump, no headers, ARM Cortex-M»: SPI dump from a router we own. Call-convention mass-correct with a script. Still too much clicking. Pinned a comment at 0x140002a8f in the listing.

Also: Vtable grouping without RTTI: xref clusters plus IUnknown shape.

@frankhubx

Bookmarking this for the lab wiki. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we own. UPX with

Came back to this after a coffee. Still hold. You wrote «SPI dump from a router we own». That is the sentence I keep. I leave CET ops in the listing. They document that CET is on. Same class as the October thread, different binary.

@cipher

This is the writeup I wanted when I was stuck. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we o

If you only have the decompiler, you do not have the bug. On «Firmware: raw SPI dump, no headers, ARM Cortex-M»: SPI dump from a router we own. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Pinned a comment at 0x140004f4e in the listing.

@hexsec

Quietly the best note on this board this month. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we

I want the listing, not the decompiler story. On «Firmware: raw SPI dump, no headers, ARM Cortex-M»: SPI dump from a router we own. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Is the hang the incomplete patch, or a second bug? Version in my shot: current lab snapshot, not last year's blog.

@binx

This belongs in the first-hour ritual. You wrote «SPI dump from a router we own». That is the sentence I keep. Call-convention mass-correct

I tried the naive path first and wasted a morning. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we own. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Same class as the October thread, different binary.

Please keep the hashes and drop the mystery zips. On «Firmware: raw SPI dump, no headers, ARM Cortex-M»: SPI dump from a router we own. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. I reproduced it on lab build 1221.

Also: UPX with a skipped magic is still UPX. Restore four bytes and move on.

Bookmarking this for the lab wiki. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we own. UPX with a skipped magic is still UPX. Restore four bytes and move on. I reproduced it on lab build 1314.

Please keep the hashes and drop the mystery zips. The load-bearing line: SPI dump from a router we own. Call-convention mass-correct with a script. Still too much clicking. Took me 8 hours the first time.

Quietly the best note on this board this month. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we own. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. What did you key the join on — PID or process GUID? My note id for this: 10-33.

@keyx

I ran this on a licensed corpus binary. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we own. I b

Same wall I hit last quarter. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we own. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I reproduced it on lab build 1187.

@gh0st

Came back to this after a coffee. Still hold. You wrote «SPI dump from a router we own». That is the sentence I keep. I leave CET ops in the

Take the telegram pitch to the bin. Market listing or nothing. I ran this on a licensed corpus binary. On «Firmware: raw SPI dump, no headers, ARM Cortex-M»: SPI dump from a router we own. Listing first. The decompiler invented a cast last week that hid a signed compare. Same class as the June thread, different binary.

@monit

Agreed on the class, not on the tool. On «Firmware: raw SPI dump, no headers, ARM Cortex-M»: SPI dump from a router we own. I trust FLOSS af

I would have written the opposite conclusion a year ago. You wrote «SPI dump from a router we own». That is the sentence I keep. I trust FLOSS after I have seen the decoder. Before that I read the stores. I still have the snapshot named reve-16-pre.

@mosesprime

Quietly the best note on this board this month. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we

I am not moving this to DMs so you can yell. Stay on the class. Not fully convinced yet. You wrote «SPI dump from a router we own». That is the sentence I keep. Call-convention mass-correct with a script. Still too much clicking. Same class as the October thread, different binary.

@nodez

I would have written the opposite conclusion a year ago. You wrote «SPI dump from a router we own». That is the sentence I keep. I trust FLO

Do not call people skids because they use Ghidra. I disagree with the tone, not the bytes. The load-bearing line: SPI dump from a router we own. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Took me 10 hours the first time.

Came back to this after a coffee. Still hold. On «Firmware: raw SPI dump, no headers, ARM Cortex-M»: SPI dump from a router we own. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Was this on the licensed corpus or a crackme you wrote? Version in my shot: current lab snapshot, not last year's blog.

@pktx

Came back to this after a coffee. Still hold. On «Firmware: raw SPI dump, no headers, ARM Cortex-M»: SPI dump from a router we own. Recursiv

Please keep the hashes and drop the mystery zips. The load-bearing line: SPI dump from a router we own. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Same class as the October thread, different binary.

This matches a public n-day class from last patch Tuesday. The load-bearing line: SPI dump from a router we own. UPX with a skipped magic is still UPX. Restore four bytes and move on. If anyone DMs me a zip I will not open it. Hash in-thread.

@samsonhub

This matches a public n-day class from last patch Tuesday. The load-bearing line: SPI dump from a router we own. UPX with a skipped magic is

Take the telegram pitch to the bin. Market listing or nothing. Bookmarking this for the lab wiki. The load-bearing line: SPI dump from a router we own. I leave CET ops in the listing. They document that CET is on. I reproduced it on lab build 1193.

@shieldx

Bookmarking this for the lab wiki. The load-bearing line: SPI dump from a router we own. I leave CET ops in the listing. They document that

This belongs in the first-hour ritual. The load-bearing line: SPI dump from a router we own. I trust FLOSS after I have seen the decoder. Before that I read the stores. I reproduced it on lab build 1275.

This is the kind of thread that should be a sticky and is not. «Firmware: raw SPI dump, no headers, ARM Cortex-M» — specifically SPI dump from a router we own. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Is the hang the incomplete patch, or a second bug? Pinned a comment at 0x1400026e4 in the listing.

I dumped after OEP and then did this. The load-bearing line: SPI dump from a router we own. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I will +rep a listing and −rep a vibe. That is the deal.

@unitx

I dumped after OEP and then did this. The load-bearing line: SPI dump from a router we own. I bookmark the decoder then re-analyze. Reloadin

You are treating a checksum as a signature again. If you only have the decompiler, you do not have the bug. On «Firmware: raw SPI dump, no headers, ARM Cortex-M»: SPI dump from a router we own. Call-convention mass-correct with a script. Still too much clicking. If anyone DMs me a zip I will not open it. Hash in-thread.

Did this on ARM64 last week — same shape, different pain. On «Firmware: raw SPI dump, no headers, ARM Cortex-M»: SPI dump from a router we own. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Version in my shot: current lab snapshot, not last year's blog.