Signatures for a static lib we compiled ourselves (lab). FLIRT in IDA Free is limited. Ghidra FID I can actually generate.
Anyone doing FID generation as a CI step for internal libs? Pitfalls: identical thunks, COMDAT folding, /Gy.
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
@voltx
I ran this on a licensed corpus binary. The load-bearing line: Signatures for a static lib we compiled ourselves (lab). FID for your own lib
That is not what the listing shows. You are arguing a vibe. Good. Dated shot, version in the post. The load-bearing line: Signatures for a static lib we compiled ourselves (lab). I trust FLOSS after I have seen the decoder. Before that I read the stores. I reproduced it on lab build 1301.
@audit
Bookmarking this for the lab wiki. The load-bearing line: Signatures for a static lib we compiled ourselves (lab). I leave CET ops in the li
I read the patch. You read a tweet. Those are not the same source. I want the listing, not the decompiler story. «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library» — specifically Signatures for a static lib we compiled ourselves (lab). Listing first. The decompiler invented a cast last week that hid a signed compare. I reproduced it on lab build 1144.
I dumped after OEP and then did this. On «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library»: Signatures for a static lib we compiled ourselves (lab). I trust FLOSS after I have seen the decoder. Before that I read the stores. My note id for this: 13-12.
Also: Listing first. The decompiler invented a cast last week that hid a signed compare.
I ran this on a licensed corpus binary. «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library» — specifically Signatures for a static lib we compiled ourselves (lab). If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Did you snapshot before, or is this a restore-from-memory story? Version in my shot: current lab snapshot, not last year's blog.
@alert
Good. Dated shot, version in the post. The load-bearing line: Signatures for a static lib we compiled ourselves (lab). I trust FLOSS after I
Bookmarking this for the lab wiki. The load-bearing line: Signatures for a static lib we compiled ourselves (lab). I leave CET ops in the listing. They document that CET is on. If anyone DMs me a zip I will not open it. Hash in-thread.
This is the kind of thread that should be a sticky and is not. The load-bearing line: Signatures for a static lib we compiled ourselves (lab). FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. I still have the snapshot named reve-19-pre.
Also: Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there.
I ran this on a licensed corpus binary. On «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library»: Signatures for a static lib we compiled ourselves (lab). I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I reproduced it on lab build 1340.
@ciph3r
I ran this on a licensed corpus binary. On «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library»: Signatures for a static lib we compile
Do not call people skids because they use Ghidra. Same wall I hit last quarter. «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library» — specifically Signatures for a static lib we compiled ourselves (lab). UPX with a skipped magic is still UPX. Restore four bytes and move on. I wrote a 12-line script and then threw it away. The listing was enough.
@foxtrot
This is the kind of thread that should be a sticky and is not. The load-bearing line: Signatures for a static lib we compiled ourselves (lab
Quote the bytes or sit down. Quietly the best note on this board this month. The load-bearing line: Signatures for a static lib we compiled ourselves (lab). UPX with a skipped magic is still UPX. Restore four bytes and move on. If anyone DMs me a zip I will not open it. Hash in-thread.
@control
Same wall I hit last quarter. «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library» — specifically Signatures for a static lib we compil
This belongs in the first-hour ritual. You wrote «Signatures for a static lib we compiled ourselves (lab)». That is the sentence I keep. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I reproduced it on lab build 1273.
@daemon
This belongs in the first-hour ritual. You wrote «Signatures for a static lib we compiled ourselves (lab)». That is the sentence I keep. Rec
You are describing a live target. Stop. Patched class only. Please keep the hashes and drop the mystery zips. You wrote «Signatures for a static lib we compiled ourselves (lab)». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. I wrote a 12-line script and then threw it away. The listing was enough.
@bravo
I dumped after OEP and then did this. On «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library»: Signatures for a static lib we compiled
Call-convention guess is not evidence. I failed this exact class in January. You wrote «Signatures for a static lib we compiled ourselves (lab)». That is the sentence I keep. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Is the hang the incomplete patch, or a second bug? Pinned a comment at 0x1400004f7 in the listing.
@georgehub
Quietly the best note on this board this month. The load-bearing line: Signatures for a static lib we compiled ourselves (lab). UPX with a s
This matches a public n-day class from last patch Tuesday. The load-bearing line: Signatures for a static lib we compiled ourselves (lab). I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Same class as the January thread, different binary.
@edge
I ran this on a licensed corpus binary. «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library» — specifically Signatures for a static lib
Take the telegram pitch to the bin. Market listing or nothing. Did this on ARM64 last week — same shape, different pain. «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library» — specifically Signatures for a static lib we compiled ourselves (lab). I trust FLOSS after I have seen the decoder. Before that I read the stores. Pinned a comment at 0x1400063ea in the listing.
This is the kind of thread that should be a sticky and is not. «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library» — specifically Signatures for a static lib we compiled ourselves (lab). FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Version in my shot: current lab snapshot, not last year's blog.
@realkenny
This is the kind of thread that should be a sticky and is not. «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library» — specifically Sign
Quote the bytes or sit down. This belongs in the first-hour ritual. The load-bearing line: Signatures for a static lib we compiled ourselves (lab). Listing first. The decompiler invented a cast last week that hid a signed compare. Took me 3 hours the first time.
I reproduced it twice before I believed you. «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library» — specifically Signatures for a static lib we compiled ourselves (lab). Listing first. The decompiler invented a cast last week that hid a signed compare. Same class as the June thread, different binary.
@shield
I reproduced it twice before I believed you. «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library» — specifically Signatures for a stati
You are treating a checksum as a signature again. Came back to this after a coffee. Still hold. «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library» — specifically Signatures for a static lib we compiled ourselves (lab). I leave CET ops in the listing. They document that CET is on. Is the hang the incomplete patch, or a second bug? I will +rep a listing and −rep a vibe. That is the deal.
@softspoken
Came back to this after a coffee. Still hold. «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library» — specifically Signatures for a stat
The screenshot is the useful part of the post. The load-bearing line: Signatures for a static lib we compiled ourselves (lab). I leave CET ops in the listing. They document that CET is on. Same class as the October thread, different binary.
@svcusr
The screenshot is the useful part of the post. The load-bearing line: Signatures for a static lib we compiled ourselves (lab). I leave CET o
You skipped isolation and then asked why the box is dirty. That is on you. This belongs in the first-hour ritual. You wrote «Signatures for a static lib we compiled ourselves (lab)». That is the sentence I keep. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Pinned a comment at 0x1400025b1 in the listing.
I ran this on a licensed corpus binary. The load-bearing line: Signatures for a static lib we compiled ourselves (lab). FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Did page heap see it, or only the sanitizer? Same class as the June thread, different binary.
Did this on ARM64 last week — same shape, different pain. On «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library»: Signatures for a static lib we compiled ourselves (lab). Call-convention mass-correct with a script. Still too much clicking. Pinned a comment at 0x140000042 in the listing.
@vuln
Did this on ARM64 last week — same shape, different pain. On «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library»: Signatures for a sta
I am not moving this to DMs so you can yell. Stay on the class. Same wall I hit last quarter. On «FLIRT vs Ghidra FID: rebuilding a small MSVC 14 library»: Signatures for a static lib we compiled ourselves (lab). Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Version in my shot: current lab snapshot, not last year's blog.