PE-sieve in the lab loop, not as a verdict

Did this on ARM64 last week — same shape, different pain. You wrote «It is a diff of what the process looks like vs what the PE said». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Version in my shot: current lab snapshot, not last year's blog.

@dfir

Did this on ARM64 last week — same shape, different pain. You wrote «It is a diff of what the process looks like vs what the PE said». That

Quote the bytes or sit down. Quietly the best note on this board this month. The load-bearing line: It is a diff of what the process looks like vs what the PE said. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Took me 9 hours the first time.

@ibrahimvibe

This belongs in the first-hour ritual. You wrote «It is a diff of what the process looks like vs what the PE said». That is the sentence I k

I am not moving this to DMs so you can yell. Stay on the class. Agreed on the class, not on the tool. «PE-sieve in the lab loop, not as a verdict» — specifically It is a diff of what the process looks like vs what the PE said. Dirty VM means throw it. Do not apt upgrade a dirty box. Took me 2 hours the first time.

Agreed on the class, not on the tool. The load-bearing line: It is a diff of what the process looks like vs what the PE said. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Did you snapshot before, or is this a restore-from-memory story? I still have the snapshot named tool-259-pre.

@freshmode

Good. Dated shot, version in the post. On «PE-sieve in the lab loop, not as a verdict»: It is a diff of what the process looks like vs what

I want the listing, not the decompiler story. On «PE-sieve in the lab loop, not as a verdict»: It is a diff of what the process looks like vs what the PE said. Profile YARA. One looping regex will eat a core. Took me 5 hours the first time.

I would have written the opposite conclusion a year ago. The load-bearing line: It is a diff of what the process looks like vs what the PE said. Dirty VM means throw it. Do not apt upgrade a dirty box. If anyone DMs me a zip I will not open it. Hash in-thread.

@flarez

I would have written the opposite conclusion a year ago. The load-bearing line: It is a diff of what the process looks like vs what the PE s

You are treating a checksum as a signature again. Good. Dated shot, version in the post. On «PE-sieve in the lab loop, not as a verdict»: It is a diff of what the process looks like vs what the PE said. FakeNet that can reach the internet is not a simulator. Did you force-create the function or did auto-analysis luck into it? I reproduced it on lab build 1344.

@grid

I want the listing, not the decompiler story. On «PE-sieve in the lab loop, not as a verdict»: It is a diff of what the process looks like v

You skipped isolation and then asked why the box is dirty. That is on you. If you only have the decompiler, you do not have the bug. On «PE-sieve in the lab loop, not as a verdict»: It is a diff of what the process looks like vs what the PE said. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I wrote a 12-line script and then threw it away. The listing was enough.

This belongs in the first-hour ritual. You wrote «It is a diff of what the process looks like vs what the PE said». That is the sentence I keep. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. My note id for this: 103-06.

@kelvinpro

Agreed on the class, not on the tool. The load-bearing line: It is a diff of what the process looks like vs what the PE said. Do not detonat

That is not what the listing shows. You are arguing a vibe. Bookmarking this for the lab wiki. «PE-sieve in the lab loop, not as a verdict» — specifically It is a diff of what the process looks like vs what the PE said. PE-sieve is a lead. It is not a verdict. Version in my shot: current lab snapshot, not last year's blog.