rr in a VM — the settings that did not lie

I still keep a paper notebook for this kind of note. On «rr in a VM — the settings that did not lie»: Nested virt, enough CPU, no random steal. FakeNet that can reach the internet is not a simulator. I still have the snapshot named tool-265-pre.

@kabirjay

I still keep a paper notebook for this kind of note. On «rr in a VM — the settings that did not lie»: Nested virt, enough CPU, no random ste

Do not call people skids because they use Ghidra. Did this on ARM64 last week — same shape, different pain. You wrote «Nested virt, enough CPU, no random steal». That is the sentence I keep. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Same class as the March thread, different binary.

I want the listing, not the decompiler story. «rr in a VM — the settings that did not lie» — specifically Nested virt, enough CPU, no random steal. Transfer samples as a hashed read-only ISO. Not drag-drop. I will +rep a listing and −rep a vibe. That is the deal.

@liveconnect

I want the listing, not the decompiler story. «rr in a VM — the settings that did not lie» — specifically Nested virt, enough CPU, no random

You are describing a live target. Stop. Patched class only. Agreed on the class, not on the tool. You wrote «Nested virt, enough CPU, no random steal». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Did page heap see it, or only the sanitizer? I still have the snapshot named tool-265-pre.

@matrx

Agreed on the class, not on the tool. You wrote «Nested virt, enough CPU, no random steal». That is the sentence I keep. Name snapshots date

Quietly the best note on this board this month. The load-bearing line: Nested virt, enough CPU, no random steal. FakeNet that can reach the internet is not a simulator. Pinned a comment at 0x140004750 in the listing.

@netrix

Quietly the best note on this board this month. The load-bearing line: Nested virt, enough CPU, no random steal. FakeNet that can reach the

Take the telegram pitch to the bin. Market listing or nothing. I disagree with the tone, not the bytes. On «rr in a VM — the settings that did not lie»: Nested virt, enough CPU, no random steal. Tools snapshot in 8 minutes or you will not restore it. I still have the snapshot named tool-265-pre.

Please keep the hashes and drop the mystery zips. On «rr in a VM — the settings that did not lie»: Nested virt, enough CPU, no random steal. Tools snapshot in 8 minutes or you will not restore it. Same class as the June thread, different binary.

@osinx

Please keep the hashes and drop the mystery zips. On «rr in a VM — the settings that did not lie»: Nested virt, enough CPU, no random steal.

Quote the bytes or sit down. Please keep the hashes and drop the mystery zips. «rr in a VM — the settings that did not lie» — specifically Nested virt, enough CPU, no random steal. Clipboard off on the detonation VM. I pasted a token once. Version in my shot: current lab snapshot, not last year's blog.

Good. Dated shot, version in the post. You wrote «Nested virt, enough CPU, no random steal». That is the sentence I keep. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. After you did that, did the decompiler pick it up or did you dump? Version in my shot: current lab snapshot, not last year's blog.

@richkiddo

Good. Dated shot, version in the post. You wrote «Nested virt, enough CPU, no random steal». That is the sentence I keep. Do not detonate in

You are treating a checksum as a signature again. Did this on ARM64 last week — same shape, different pain. You wrote «Nested virt, enough CPU, no random steal». That is the sentence I keep. FakeNet that can reach the internet is not a simulator. I will +rep a listing and −rep a vibe. That is the deal.

@secbit

Did this on ARM64 last week — same shape, different pain. You wrote «Nested virt, enough CPU, no random steal». That is the sentence I keep.

This is the kind of thread that should be a sticky and is not. On «rr in a VM — the settings that did not lie»: Nested virt, enough CPU, no random steal. PE-sieve is a lead. It is not a verdict. My note id for this: 109-10.

@slim_tony

This is the kind of thread that should be a sticky and is not. On «rr in a VM — the settings that did not lie»: Nested virt, enough CPU, no

You skipped isolation and then asked why the box is dirty. That is on you. I reproduced it twice before I believed you. «rr in a VM — the settings that did not lie» — specifically Nested virt, enough CPU, no random steal. Profile YARA. One looping regex will eat a core. I wrote a 12-line script and then threw it away. The listing was enough.

This is the writeup I wanted when I was stuck. You wrote «Nested virt, enough CPU, no random steal». That is the sentence I keep. FakeNet that can reach the internet is not a simulator. I still have the snapshot named tool-265-pre.

Also: PE-sieve is a lead. It is not a verdict.

@thndr

This is the writeup I wanted when I was stuck. You wrote «Nested virt, enough CPU, no random steal». That is the sentence I keep. FakeNet th

I am not moving this to DMs so you can yell. Stay on the class. Quietly the best note on this board this month. «rr in a VM — the settings that did not lie» — specifically Nested virt, enough CPU, no random steal. FakeNet that can reach the internet is not a simulator. Which build of the tool? I got burned mixing notes across versions. Pinned a comment at 0x1400007ad in the listing.

Bookmarking this for the lab wiki. You wrote «Nested virt, enough CPU, no random steal». That is the sentence I keep. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Took me 8 hours the first time.