INetSim on Linux sibling. FakeNet when I am stuck on a Windows-only lab. Both need a host-only NIC or you are natting a sample.
If your simulator can reach the internet, it is not a simulator.
Refs: FLARE VM
Lab / educational. Public binaries and patched classes only. Isolated VM.
Not fully convinced yet. On Ā«FakeNet-NG vs INetSim ā what I actually runĀ»: INetSim on Linux sibling. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. I still have the snapshot named tool-260-pre.
@force
I reproduced it twice before I believed you. Ā«FakeNet-NG vs INetSim ā what I actually runĀ» ā specifically INetSim on Linux sibling. Clipboar
I read the patch. You read a tweet. Those are not the same source. Quietly the best note on this board this month. Ā«FakeNet-NG vs INetSim ā what I actually runĀ» ā specifically INetSim on Linux sibling. Tools snapshot in 8 minutes or you will not restore it. I reproduced it on lab build 1407.
@ericjay
Not fully convinced yet. On Ā«FakeNet-NG vs INetSim ā what I actually runĀ»: INetSim on Linux sibling. Do not detonate in Docker. Shared kerne
I reproduced it twice before I believed you. Ā«FakeNet-NG vs INetSim ā what I actually runĀ» ā specifically INetSim on Linux sibling. Clipboard off on the detonation VM. I pasted a token once. Pinned a comment at 0x140006e28 in the listing.
I ran this on a licensed corpus binary. You wrote Ā«INetSim on Linux siblingĀ». That is the sentence I keep. Tools snapshot in 8 minutes or you will not restore it. Which build of the tool? I got burned mixing notes across versions. If anyone DMs me a zip I will not open it. Hash in-thread.
If you only have the decompiler, you do not have the bug. On Ā«FakeNet-NG vs INetSim ā what I actually runĀ»: INetSim on Linux sibling. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. If anyone DMs me a zip I will not open it. Hash in-thread.
@guardz
I ran this on a licensed corpus binary. You wrote Ā«INetSim on Linux siblingĀ». That is the sentence I keep. Tools snapshot in 8 minutes or yo
I still keep a paper notebook for this kind of note. Ā«FakeNet-NG vs INetSim ā what I actually runĀ» ā specifically INetSim on Linux sibling. Transfer samples as a hashed read-only ISO. Not drag-drop. Version in my shot: current lab snapshot, not last year's blog.
@ignitx
If you only have the decompiler, you do not have the bug. On Ā«FakeNet-NG vs INetSim ā what I actually runĀ»: INetSim on Linux sibling. Name s
Do not call people skids because they use Ghidra. I failed this exact class in January. You wrote Ā«INetSim on Linux siblingĀ». That is the sentence I keep. Profile YARA. One looping regex will eat a core. My note id for this: 104-06.
@jaydenhub
I failed this exact class in January. You wrote Ā«INetSim on Linux siblingĀ». That is the sentence I keep. Profile YARA. One looping regex wil
I failed this exact class in January. The load-bearing line: INetSim on Linux sibling. PE-sieve is a lead. It is not a verdict. My note id for this: 104-07.