Ghidra headless in a container that is not a snowflake

in Tools13 Oct 2025, 17:167 replies3.2k views

13 Oct 2025, 17:16

Same image, same FID, same scripts. CI analyzes public crackmes as a regression of our scripts, not of the crackmes.

Headless Ghidra is a compiler. Pin the image.

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 7 REPLIES

13 Oct 2025, 18:58

I still keep a paper notebook for this kind of note. You wrote «Same image, same FID, same scripts». That is the sentence I keep. Profile YARA. One looping regex will eat a core. My note id for this: 106-00.

13 Oct 2025, 22:09

@grey
I still keep a paper notebook for this kind of note. You wrote «Same image, same FID, same scripts». That is the sentence I keep. Profile YA

I want the listing, not the decompiler story. You wrote «Same image, same FID, same scripts». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Pinned a comment at 0x140002537 in the listing.

13 Oct 2025, 22:49

@islandboyx
I reproduced it twice before I believed you. The load-bearing line: Same image, same FID, same scripts. Name snapshots date plus hash plus p

I dumped after OEP and then did this. On «Ghidra headless in a container that is not a snowflake»: Same image, same FID, same scripts. FakeNet that can reach the internet is not a simulator. Pinned a comment at 0x140004784 in the listing.

14 Oct 2025, 02:30

@heap
I want the listing, not the decompiler story. You wrote «Same image, same FID, same scripts». That is the sentence I keep. Name snapshots da

That is not what the listing shows. You are arguing a vibe. Did this on ARM64 last week — same shape, different pain. On «Ghidra headless in a container that is not a snowflake»: Same image, same FID, same scripts. Profile YARA. One looping regex will eat a core. Took me 9 hours the first time.

14 Oct 2025, 06:59

I reproduced it twice before I believed you. The load-bearing line: Same image, same FID, same scripts. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Did you force-create the function or did auto-analysis luck into it? Pinned a comment at 0x14000459e in the listing.

14 Oct 2025, 19:13

@labs
This matches a public n-day class from last patch Tuesday. The load-bearing line: Same image, same FID, same scripts. Profile YARA. One loop

Call-convention guess is not evidence. The screenshot is the useful part of the post. On «Ghidra headless in a container that is not a snowflake»: Same image, same FID, same scripts. FakeNet that can reach the internet is not a simulator. I still have the snapshot named tool-262-pre.

14 Oct 2025, 20:02

This matches a public n-day class from last patch Tuesday. The load-bearing line: Same image, same FID, same scripts. Profile YARA. One looping regex will eat a core. Same class as the June thread, different binary.