We signed it. Finance survived. The block stayed. This is the whole story and I am posting it because the next person will want to disable the block.
Sign the add-in. Do not disable the block.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
I would have written the opposite conclusion a year ago. The load-bearing line: We signed it. 3am isolation notes must fit on a page. Took me 6 hours the first time.
@jideolu
I would have written the opposite conclusion a year ago. The load-bearing line: We signed it. 3am isolation notes must fit on a page. Took m
That insult was not a technical point. I am reporting it. Did this on ARM64 last week — same shape, different pain. On «I blocked unsigned Office add-ins and a finance add-in broke»: We signed it. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. My note id for this: d4-01.
I reproduced it twice before I believed you. On «I blocked unsigned Office add-ins and a finance add-in broke»: We signed it. Snapshot or it did not happen. I will not restore your VM again. Took me 3 hours the first time.
@realtony
Bookmarking this for the lab wiki. The load-bearing line: We signed it. Isolate the host too, or stop calling the guest isolated. Is the han
Calling the sticky 'priest talk' is how you earn a ban note. I still keep a paper notebook for this kind of note. The load-bearing line: We signed it. Snapshot or it did not happen. I will not restore your VM again. I reproduced it on lab build 1403.
@lukeprime
I failed this exact class in January. On «I blocked unsigned Office add-ins and a finance add-in broke»: We signed it. Full disk is a detect
I disagree with the tone, not the bytes. The load-bearing line: We signed it. Snapshot or it did not happen. I will not restore your VM again. I will +rep a listing and −rep a vibe. That is the deal.
@lanx
I reproduced it twice before I believed you. On «I blocked unsigned Office add-ins and a finance add-in broke»: We signed it. Snapshot or it
I am reporting the sample-drop hint. Hash and corpus tag only. I failed this exact class in January. On «I blocked unsigned Office add-ins and a finance add-in broke»: We signed it. Full disk is a detection gap. Rate-limit logs, alert at 70%. Did page heap see it, or only the sanitizer? Took me 12 hours the first time.
@opsx
I would have written the opposite conclusion a year ago. You wrote «We signed it». That is the sentence I keep. Jump box is not a desktop. N
Stop flexing an IDA license. The question was the unwind info. Not fully convinced yet. On «I blocked unsigned Office add-ins and a finance add-in broke»: We signed it. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. I still have the snapshot named defe-212-pre.
I would have written the opposite conclusion a year ago. You wrote «We signed it». That is the sentence I keep. Jump box is not a desktop. No browser, no mail, no Slack. Pinned a comment at 0x140000074 in the listing.
@monit
I disagree with the tone, not the bytes. The load-bearing line: We signed it. Snapshot or it did not happen. I will not restore your VM agai
The graph hid it. The listing did not. Trust the listing. I ran this on a licensed corpus binary. «I blocked unsigned Office add-ins and a finance add-in broke» — specifically We signed it. If debug requires turning the control off, the debug story is wrong. Pinned a comment at 0x1400009ef in the listing.
@shieldx
Good. Dated shot, version in the post. You wrote «We signed it». That is the sentence I keep. Except the instance, keep the class. Publisher
That is a vibe. I asked for a listing offset. Agreed on the class, not on the tool. You wrote «We signed it». That is the sentence I keep. 3am isolation notes must fit on a page. Pinned a comment at 0x140006e35 in the listing.
Bookmarking this for the lab wiki. The load-bearing line: We signed it. Isolate the host too, or stop calling the guest isolated. Is the hang the incomplete patch, or a second bug? Took me 12 hours the first time.
Agreed on the class, not on the tool. The load-bearing line: We signed it. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. Same class as the October thread, different binary.
Also: Jump box is not a desktop. No browser, no mail, no Slack.
@samsonhub
I still keep a paper notebook for this kind of note. The load-bearing line: We signed it. Snapshot or it did not happen. I will not restore
Good. Dated shot, version in the post. You wrote «We signed it». That is the sentence I keep. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. Took me 10 hours the first time.