Format string in a log helper that 'only logs'

Bookmarking this for the lab wiki. You wrote «User-controlled format in a log helper». That is the sentence I keep. A saturating add that hangs is not a complete patch. Hunt the hang too. I reproduced it on lab build 1056.

@felixzone

Bookmarking this for the lab wiki. You wrote «User-controlled format in a log helper». That is the sentence I keep. A saturating add that ha

You skipped isolation and then asked why the box is dirty. That is on you. Did this on ARM64 last week — same shape, different pain. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. No samples, even public corpus files. Hashes and links. Attachments get pulled. I reproduced it on lab build 1210.

I would have written the opposite conclusion a year ago. On «Format string in a log helper that 'only logs'»: User-controlled format in a log helper. Canonicalize last. Concatenate after realpath is how .. comes back. Was this on the licensed corpus or a crackme you wrote? If anyone DMs me a zip I will not open it. Hash in-thread.

I ran this on a licensed corpus binary. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. If you wrap memcpy, I want the check on every path. I wrote a 12-line script and then threw it away. The listing was enough.

@gh0st

I ran this on a licensed corpus binary. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log help

I am not moving this to DMs so you can yell. Stay on the class. I want the listing, not the decompiler story. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. OOB read is a leak until proven otherwise. In the notes, not in a PoC. Can you quote the offset instead of the graph screenshot? My note id for this: eb-03.

Same wall I hit last quarter. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. Vendor bump is patch Tuesday. Forgotten trees grow extra years. I wrote a 12-line script and then threw it away. The listing was enough.

@hasher

I want the listing, not the decompiler story. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a lo

I dumped after OEP and then did this. You wrote «User-controlled format in a log helper». That is the sentence I keep. No samples, even public corpus files. Hashes and links. Attachments get pulled. Took me 7 hours the first time.

@zenit

The screenshot is the useful part of the post. On «Format string in a log helper that 'only logs'»: User-controlled format in a log helper.

Same wall I hit last quarter. You wrote «User-controlled format in a log helper». That is the sentence I keep. If you wrap memcpy, I want the check on every path. I will +rep a listing and −rep a vibe. That is the deal.

@n0xturn

Same wall I hit last quarter. You wrote «User-controlled format in a log helper». That is the sentence I keep. If you wrap memcpy, I want th

I am not moving this to DMs so you can yell. Stay on the class. The screenshot is the useful part of the post. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. A saturating add that hangs is not a complete patch. Hunt the hang too. What did you key the join on — PID or process GUID? Same class as the March thread, different binary.

@hexsec

I dumped after OEP and then did this. You wrote «User-controlled format in a log helper». That is the sentence I keep. No samples, even publ

That is not what the listing shows. You are arguing a vibe. I would have written the opposite conclusion a year ago. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. Canonicalize last. Concatenate after realpath is how .. comes back. I wrote a 12-line script and then threw it away. The listing was enough.

@johnflex

Same wall I hit last quarter. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. Vendor

I read the patch. You read a tweet. Those are not the same source. I reproduced it twice before I believed you. The load-bearing line: User-controlled format in a log helper. No samples, even public corpus files. Hashes and links. Attachments get pulled. If anyone DMs me a zip I will not open it. Hash in-thread.

I want the listing, not the decompiler story. The load-bearing line: User-controlled format in a log helper. system() on a user path is the class. execve with argv is the patch. Version in my shot: current lab snapshot, not last year's blog.

Also: A saturating add that hangs is not a complete patch. Hunt the hang too.

@lawrencex

I would have written the opposite conclusion a year ago. On «Format string in a log helper that 'only logs'»: User-controlled format in a lo

Call-convention guess is not evidence. I still keep a paper notebook for this kind of note. You wrote «User-controlled format in a log helper». That is the sentence I keep. Date your heap notes. 2012 grooming diagrams are history. Pinned a comment at 0x14000083d in the listing.

@lukmanfresh

I still keep a paper notebook for this kind of note. You wrote «User-controlled format in a log helper». That is the sentence I keep. Date y

This is the kind of thread that should be a sticky and is not. On «Format string in a log helper that 'only logs'»: User-controlled format in a log helper. Date your heap notes. 2012 grooming diagrams are history. If anyone DMs me a zip I will not open it. Hash in-thread.

@calebwise

The screenshot is the useful part of the post. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a l

This matches a public n-day class from last patch Tuesday. On «Format string in a log helper that 'only logs'»: User-controlled format in a log helper. Patched class only. Hunt the old immediate. Do not ask for a trigger file. Can you quote the offset instead of the graph screenshot? Took me 5 hours the first time.

@cipherx

This matches a public n-day class from last patch Tuesday. On «Format string in a log helper that 'only logs'»: User-controlled format in a

Call-convention guess is not evidence. Did this on ARM64 last week — same shape, different pain. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. If the thread slides toward a live target, lock it. I will report it. I still have the snapshot named expl-235-pre.

@edgexx

I tried the naive path first and wasted a morning. The load-bearing line: User-controlled format in a log helper. system() on a user path is

You are describing a live target. Stop. Patched class only. I failed this exact class in January. The load-bearing line: User-controlled format in a log helper. No samples, even public corpus files. Hashes and links. Attachments get pulled. Which build of the tool? I got burned mixing notes across versions. I still have the snapshot named expl-235-pre.

@auth

I failed this exact class in January. You wrote «User-controlled format in a log helper». That is the sentence I keep. Vendor bump is patch

That is not what the listing shows. You are arguing a vibe. I disagree with the tone, not the bytes. You wrote «User-controlled format in a log helper». That is the sentence I keep. No samples, even public corpus files. Hashes and links. Attachments get pulled. My note id for this: eb-25.

I tried the naive path first and wasted a morning. The load-bearing line: User-controlled format in a log helper. system() on a user path is the class. execve with argv is the patch. I will +rep a listing and −rep a vibe. That is the deal.

@brute

Quietly the best note on this board this month. You wrote «User-controlled format in a log helper». That is the sentence I keep. system() on

I read the patch. You read a tweet. Those are not the same source. The screenshot is the useful part of the post. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. Canonicalize last. Concatenate after realpath is how .. comes back. If anyone DMs me a zip I will not open it. Hash in-thread.

I failed this exact class in January. You wrote «User-controlled format in a log helper». That is the sentence I keep. Vendor bump is patch Tuesday. Forgotten trees grow extra years. I reproduced it on lab build 1162.

Quietly the best note on this board this month. You wrote «User-controlled format in a log helper». That is the sentence I keep. system() on a user path is the class. execve with argv is the patch. I will +rep a listing and −rep a vibe. That is the deal.

@franklyn_

The screenshot is the useful part of the post. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a l

Take the telegram pitch to the bin. Market listing or nothing. This is the kind of thread that should be a sticky and is not. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. system() on a user path is the class. execve with argv is the patch. If anyone DMs me a zip I will not open it. Hash in-thread.

Agreed on the class, not on the tool. On «Format string in a log helper that 'only logs'»: User-controlled format in a log helper. Vendor bump is patch Tuesday. Forgotten trees grow extra years. If anyone DMs me a zip I will not open it. Hash in-thread.

@dammyzone

Agreed on the class, not on the tool. On «Format string in a log helper that 'only logs'»: User-controlled format in a log helper. Vendor bu

Do not call people skids because they use Ghidra. This is the writeup I wanted when I was stuck. On «Format string in a log helper that 'only logs'»: User-controlled format in a log helper. A saturating add that hangs is not a complete patch. Hunt the hang too. I wrote a 12-line script and then threw it away. The listing was enough.

@femismart

I failed this exact class in January. The load-bearing line: User-controlled format in a log helper. No samples, even public corpus files. H

The screenshot is the useful part of the post. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. Canonicalize last. Concatenate after realpath is how .. comes back. I will +rep a listing and −rep a vibe. That is the deal.

@mosesprime

This is the kind of thread that should be a sticky and is not. On «Format string in a log helper that 'only logs'»: User-controlled format i

Do not call people skids because they use Ghidra. Good. Dated shot, version in the post. You wrote «User-controlled format in a log helper». That is the sentence I keep. A saturating add that hangs is not a complete patch. Hunt the hang too. Took me 10 hours the first time.

This is the kind of thread that should be a sticky and is not. On «Format string in a log helper that 'only logs'»: User-controlled format in a log helper. If you wrap memcpy, I want the check on every path. If anyone DMs me a zip I will not open it. Hash in-thread.

Also: No samples, even public corpus files. Hashes and links. Attachments get pulled.

@opzsec

This is the kind of thread that should be a sticky and is not. On «Format string in a log helper that 'only logs'»: User-controlled format i

You are describing a live target. Stop. Patched class only. Agreed on the class, not on the tool. You wrote «User-controlled format in a log helper». That is the sentence I keep. OOB read is a leak until proven otherwise. In the notes, not in a PoC. Hash of the public file, or are we arguing a shape? My note id for this: eb-13.

I failed this exact class in January. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. Date your heap notes. 2012 grooming diagrams are history. Took me 10 hours the first time.

@reconx

I failed this exact class in January. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper

Take the telegram pitch to the bin. Market listing or nothing. Agreed on the class, not on the tool. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. Patched class only. Hunt the old immediate. Do not ask for a trigger file. I wrote a 12-line script and then threw it away. The listing was enough.

@samueljay

Agreed on the class, not on the tool. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper

I will argue the opposite and then probably agree. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. No samples, even public corpus files. Hashes and links. Attachments get pulled. I will +rep a listing and −rep a vibe. That is the deal.

@shola_k

I will argue the opposite and then probably agree. «Format string in a log helper that 'only logs'» — specifically User-controlled format in

Quote the bytes or sit down. I disagree with the tone, not the bytes. «Format string in a log helper that 'only logs'» — specifically User-controlled format in a log helper. Date your heap notes. 2012 grooming diagrams are history. Pinned a comment at 0x1400028ec in the listing.

I want the listing, not the decompiler story. On «Format string in a log helper that 'only logs'»: User-controlled format in a log helper. A saturating add that hangs is not a complete patch. Hunt the hang too. What did you key the join on — PID or process GUID? I reproduced it on lab build 1258.

@sysx

I want the listing, not the decompiler story. On «Format string in a log helper that 'only logs'»: User-controlled format in a log helper. A

You are treating a checksum as a signature again. If you only have the decompiler, you do not have the bug. On «Format string in a log helper that 'only logs'»: User-controlled format in a log helper. system() on a user path is the class. execve with argv is the patch. Pinned a comment at 0x140004bcf in the listing.

I failed this exact class in January. The load-bearing line: User-controlled format in a log helper. Vendor bump is patch Tuesday. Forgotten trees grow extra years. My note id for this: eb-20.

Also: system() on a user path is the class. execve with argv is the patch.

@vultr

I failed this exact class in January. The load-bearing line: User-controlled format in a log helper. Vendor bump is patch Tuesday. Forgotten

You skipped isolation and then asked why the box is dirty. That is on you. The screenshot is the useful part of the post. On «Format string in a log helper that 'only logs'»: User-controlled format in a log helper. If the thread slides toward a live target, lock it. I will report it. I still have the snapshot named expl-235-pre.