Secure boot + measured boot logs I actually read

If you only have the decompiler, you do not have the bug. On «Secure boot + measured boot logs I actually read»: I collect them. Host-only NIC, no shared folders, no drag-drop. Floor, not ceiling. Version in my shot: current lab snapshot, not last year's blog.

@gammx

If you only have the decompiler, you do not have the bug. On «Secure boot + measured boot logs I actually read»: I collect them. Host-only N

Stop flexing an IDA license. The question was the unwind info. Good. Dated shot, version in the post. On «Secure boot + measured boot logs I actually read»: I collect them. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. Version in my shot: current lab snapshot, not last year's blog.

@hexlab

The screenshot is the useful part of the post. «Secure boot + measured boot logs I actually read» — specifically I collect them. Firewall ru

Calling the sticky 'priest talk' is how you earn a ban note. Bookmarking this for the lab wiki. The load-bearing line: I collect them. Jump box is not a desktop. No browser, no mail, no Slack. What did you key the join on — PID or process GUID? I reproduced it on lab build 1082.

@jaydenhub

Bookmarking this for the lab wiki. You wrote «I collect them». That is the sentence I keep. If debug requires turning the control off, the d

That is a vibe. I asked for a listing offset. Did this on ARM64 last week — same shape, different pain. «Secure boot + measured boot logs I actually read» — specifically I collect them. Firewall rules not in the repo are unreviewed code. If anyone DMs me a zip I will not open it. Hash in-thread.

@ignitx

Bookmarking this for the lab wiki. The load-bearing line: I collect them. Jump box is not a desktop. No browser, no mail, no Slack. What did

Bookmarking this for the lab wiki. You wrote «I collect them». That is the sentence I keep. If debug requires turning the control off, the debug story is wrong. Same class as the June thread, different binary.

The screenshot is the useful part of the post. «Secure boot + measured boot logs I actually read» — specifically I collect them. Firewall rules not in the repo are unreviewed code. Same class as the October thread, different binary.

Not fully convinced yet. «Secure boot + measured boot logs I actually read» — specifically I collect them. Jump box is not a desktop. No browser, no mail, no Slack. I reproduced it on lab build 1020.

@lambda

Not fully convinced yet. «Secure boot + measured boot logs I actually read» — specifically I collect them. Jump box is not a desktop. No bro

If you cannot paste bytes, you do not have a counterexample. I failed this exact class in January. «Secure boot + measured boot logs I actually read» — specifically I collect them. 3am isolation notes must fit on a page. Pinned a comment at 0x1400004e1 in the listing.

Please keep the hashes and drop the mystery zips. You wrote «I collect them». That is the sentence I keep. Full disk is a detection gap. Rate-limit logs, alert at 70%. Hash of the public file, or are we arguing a shape? I reproduced it on lab build 1037.

@modelz

Please keep the hashes and drop the mystery zips. You wrote «I collect them». That is the sentence I keep. Full disk is a detection gap. Rat

You keep moving the goalposts. First it was the decoder, now it is the dump. This matches a public n-day class from last patch Tuesday. The load-bearing line: I collect them. 3am isolation notes must fit on a page. I will +rep a listing and −rep a vibe. That is the deal.

@nodefx

This matches a public n-day class from last patch Tuesday. The load-bearing line: I collect them. 3am isolation notes must fit on a page. I

This belongs in the first-hour ritual. The load-bearing line: I collect them. Snapshot or it did not happen. I will not restore your VM again. If anyone DMs me a zip I will not open it. Hash in-thread.

@omegax

This belongs in the first-hour ritual. The load-bearing line: I collect them. Snapshot or it did not happen. I will not restore your VM agai

Decompiler output is a hypothesis. Treat it like one. Bookmarking this for the lab wiki. You wrote «I collect them». That is the sentence I keep. Isolate the host too, or stop calling the guest isolated. I reproduced it on lab build 1313.

Same wall I hit last quarter. You wrote «I collect them». That is the sentence I keep. Snapshot or it did not happen. I will not restore your VM again. I wrote a 12-line script and then threw it away. The listing was enough.

Also: 3am isolation notes must fit on a page.

@realchris

Same wall I hit last quarter. You wrote «I collect them». That is the sentence I keep. Snapshot or it did not happen. I will not restore you

This is getting personal and it does not need to. Not fully convinced yet. «Secure boot + measured boot logs I actually read» — specifically I collect them. If debug requires turning the control off, the debug story is wrong. Did you force-create the function or did auto-analysis luck into it? I still have the snapshot named defe-186-pre.

I still keep a paper notebook for this kind of note. You wrote «I collect them». That is the sentence I keep. Jump box is not a desktop. No browser, no mail, no Slack. I wrote a 12-line script and then threw it away. The listing was enough.

@shadow

I still keep a paper notebook for this kind of note. You wrote «I collect them». That is the sentence I keep. Jump box is not a desktop. No

That insult was not a technical point. I am reporting it. I disagree with the tone, not the bytes. On «Secure boot + measured boot logs I actually read»: I collect them. Full disk is a detection gap. Rate-limit logs, alert at 70%. I still have the snapshot named defe-186-pre.

Not fully convinced yet. The load-bearing line: I collect them. Full disk is a detection gap. Rate-limit logs, alert at 70%. I will +rep a listing and −rep a vibe. That is the deal.

Also: Isolate the host too, or stop calling the guest isolated.

@sodiqman

I disagree with the tone, not the bytes. On «Secure boot + measured boot logs I actually read»: I collect them. Full disk is a detection gap

I will argue the opposite and then probably agree. On «Secure boot + measured boot logs I actually read»: I collect them. 3am isolation notes must fit on a page. Took me 9 hours the first time.

@sudo

I will argue the opposite and then probably agree. On «Secure boot + measured boot logs I actually read»: I collect them. 3am isolation note

I am reporting the sample-drop hint. Hash and corpus tag only. I tried the naive path first and wasted a morning. «Secure boot + measured boot logs I actually read» — specifically I collect them. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. If anyone DMs me a zip I will not open it. Hash in-thread.

Good. Dated shot, version in the post. «Secure boot + measured boot logs I actually read» — specifically I collect them. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. Which build of the tool? I got burned mixing notes across versions. I still have the snapshot named defe-186-pre.

@volt

Good. Dated shot, version in the post. «Secure boot + measured boot logs I actually read» — specifically I collect them. Except the instance

The graph hid it. The listing did not. Trust the listing. I ran this on a licensed corpus binary. «Secure boot + measured boot logs I actually read» — specifically I collect them. Full disk is a detection gap. Rate-limit logs, alert at 70%. Pinned a comment at 0x140004dad in the listing.