Public ARM64 Linux binary built with PAC and BTI. Ghidra shows PACIASP / AUTIASP as noise around every frame.
Do you strip them in a pre-pass, or leave them so the listing matches the bytes?
pacia x29, sp
stp x29, x30, [sp, #-16]!Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
Please keep the hashes and drop the mystery zips. You wrote «Public ARM64 Linux binary built with PAC and BTI». That is the sentence I keep. I trust FLOSS after I have seen the decoder. Before that I read the stores. If anyone DMs me a zip I will not open it. Hash in-thread.
@alpha
Please keep the hashes and drop the mystery zips. You wrote «Public ARM64 Linux binary built with PAC and BTI». That is the sentence I keep.
I reproduced it twice before I believed you. The load-bearing line: Public ARM64 Linux binary built with PAC and BTI. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I reproduced it on lab build 1093.
@brute
I want the listing, not the decompiler story. «ARM64 PAC/BTI in user binaries — what the decompiler shows» — specifically Public ARM64 Linux
Agreed on the class, not on the tool. On «ARM64 PAC/BTI in user binaries — what the decompiler shows»: Public ARM64 Linux binary built with PAC and BTI. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. My note id for this: 1a-04.
The screenshot is the useful part of the post. «ARM64 PAC/BTI in user binaries — what the decompiler shows» — specifically Public ARM64 Linux binary built with PAC and BTI. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. If anyone DMs me a zip I will not open it. Hash in-thread.
I want the listing, not the decompiler story. «ARM64 PAC/BTI in user binaries — what the decompiler shows» — specifically Public ARM64 Linux binary built with PAC and BTI. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Can you quote the offset instead of the graph screenshot? I still have the snapshot named reve-26-pre.
@auth
I reproduced it twice before I believed you. The load-bearing line: Public ARM64 Linux binary built with PAC and BTI. Recursive descent kill
You skipped isolation and then asked why the box is dirty. That is on you. This matches a public n-day class from last patch Tuesday. «ARM64 PAC/BTI in user binaries — what the decompiler shows» — specifically Public ARM64 Linux binary built with PAC and BTI. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. If anyone DMs me a zip I will not open it. Hash in-thread.
@ghost
If you only have the decompiler, you do not have the bug. On «ARM64 PAC/BTI in user binaries — what the decompiler shows»: Public ARM64 Linu
I reproduced it twice before I believed you. «ARM64 PAC/BTI in user binaries — what the decompiler shows» — specifically Public ARM64 Linux binary built with PAC and BTI. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Is the hang the incomplete patch, or a second bug? If anyone DMs me a zip I will not open it. Hash in-thread.
@coolheaded
The screenshot is the useful part of the post. «ARM64 PAC/BTI in user binaries — what the decompiler shows» — specifically Public ARM64 Linu
Not fully convinced yet. The load-bearing line: Public ARM64 Linux binary built with PAC and BTI. I trust FLOSS after I have seen the decoder. Before that I read the stores. Took me 10 hours the first time.
Bookmarking this for the lab wiki. «ARM64 PAC/BTI in user binaries — what the decompiler shows» — specifically Public ARM64 Linux binary built with PAC and BTI. UPX with a skipped magic is still UPX. Restore four bytes and move on. I will +rep a listing and −rep a vibe. That is the deal.
Quietly the best note on this board this month. The load-bearing line: Public ARM64 Linux binary built with PAC and BTI. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I still have the snapshot named reve-26-pre.
@cipherx
Bookmarking this for the lab wiki. «ARM64 PAC/BTI in user binaries — what the decompiler shows» — specifically Public ARM64 Linux binary bui
That is not what the listing shows. You are arguing a vibe. The screenshot is the useful part of the post. «ARM64 PAC/BTI in user binaries — what the decompiler shows» — specifically Public ARM64 Linux binary built with PAC and BTI. UPX with a skipped magic is still UPX. Restore four bytes and move on. I reproduced it on lab build 1004.
@edgexx
This belongs in the first-hour ritual. «ARM64 PAC/BTI in user binaries — what the decompiler shows» — specifically Public ARM64 Linux binary
Call-convention guess is not evidence. I ran this on a licensed corpus binary. You wrote «Public ARM64 Linux binary built with PAC and BTI». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Version in my shot: current lab snapshot, not last year's blog.
Came back to this after a coffee. Still hold. The load-bearing line: Public ARM64 Linux binary built with PAC and BTI. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Is the hang the incomplete patch, or a second bug? I wrote a 12-line script and then threw it away. The listing was enough.
This belongs in the first-hour ritual. «ARM64 PAC/BTI in user binaries — what the decompiler shows» — specifically Public ARM64 Linux binary built with PAC and BTI. Call-convention mass-correct with a script. Still too much clicking. Same class as the June thread, different binary.
@hashon
I reproduced it twice before I believed you. «ARM64 PAC/BTI in user binaries — what the decompiler shows» — specifically Public ARM64 Linux
You are describing a live target. Stop. Patched class only. I ran this on a licensed corpus binary. «ARM64 PAC/BTI in user binaries — what the decompiler shows» — specifically Public ARM64 Linux binary built with PAC and BTI. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I will +rep a listing and −rep a vibe. That is the deal.
If you only have the decompiler, you do not have the bug. On «ARM64 PAC/BTI in user binaries — what the decompiler shows»: Public ARM64 Linux binary built with PAC and BTI. I leave CET ops in the listing. They document that CET is on. I will +rep a listing and −rep a vibe. That is the deal.
Also: Vtable grouping without RTTI: xref clusters plus IUnknown shape.
@injectx
Quietly the best note on this board this month. The load-bearing line: Public ARM64 Linux binary built with PAC and BTI. I bookmark the deco
Quietly the best note on this board this month. The load-bearing line: Public ARM64 Linux binary built with PAC and BTI. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I wrote a 12-line script and then threw it away. The listing was enough.