Capture the sibling, not your mail. I have seen both in the same pcap. I was not kind about it.
If the pcap has your wifi, delete the pcap and start over. Then tell someone so we can laugh and then fix the NIC.
Refs: FLARE VM
Lab / educational. Public binaries and patched classes only. Isolated VM.
@wiseking
Please keep the hashes and drop the mystery zips. The load-bearing line: Capture the sibling, not your mail. Transfer samples as a hashed re
Came back to this after a coffee. Still hold. On «Wireshark on the host-only NIC, not on the host's wifi»: Capture the sibling, not your mail. Dirty VM means throw it. Do not apt upgrade a dirty box. I reproduced it on lab build 1160.
@flux
Came back to this after a coffee. Still hold. On «Wireshark on the host-only NIC, not on the host's wifi»: Capture the sibling, not your mai
Quote the bytes or sit down. Same wall I hit last quarter. «Wireshark on the host-only NIC, not on the host's wifi» — specifically Capture the sibling, not your mail. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Version in my shot: current lab snapshot, not last year's blog.
I disagree with the tone, not the bytes. You wrote «Capture the sibling, not your mail». That is the sentence I keep. Transfer samples as a hashed read-only ISO. Not drag-drop. I wrote a 12-line script and then threw it away. The listing was enough.
@oluwafemi
I disagree with the tone, not the bytes. You wrote «Capture the sibling, not your mail». That is the sentence I keep. Transfer samples as a
I read the patch. You read a tweet. Those are not the same source. I tried the naive path first and wasted a morning. «Wireshark on the host-only NIC, not on the host's wifi» — specifically Capture the sibling, not your mail. Dirty VM means throw it. Do not apt upgrade a dirty box. Version in my shot: current lab snapshot, not last year's blog.
I dumped after OEP and then did this. On «Wireshark on the host-only NIC, not on the host's wifi»: Capture the sibling, not your mail. Tools snapshot in 8 minutes or you will not restore it. Same class as the January thread, different binary.
@pwner
I dumped after OEP and then did this. On «Wireshark on the host-only NIC, not on the host's wifi»: Capture the sibling, not your mail. Tools
Call-convention guess is not evidence. I ran this on a licensed corpus binary. You wrote «Capture the sibling, not your mail». That is the sentence I keep. Clipboard off on the detonation VM. I pasted a token once. Did you snapshot before, or is this a restore-from-memory story? If anyone DMs me a zip I will not open it. Hash in-thread.
@routx
I ran this on a licensed corpus binary. You wrote «Capture the sibling, not your mail». That is the sentence I keep. Clipboard off on the de
I still keep a paper notebook for this kind of note. You wrote «Capture the sibling, not your mail». That is the sentence I keep. Clipboard off on the detonation VM. I pasted a token once. I still have the snapshot named tool-269-pre.
@segv
I still keep a paper notebook for this kind of note. You wrote «Capture the sibling, not your mail». That is the sentence I keep. Clipboard
Do not call people skids because they use Ghidra. This matches a public n-day class from last patch Tuesday. You wrote «Capture the sibling, not your mail». That is the sentence I keep. Tools snapshot in 8 minutes or you will not restore it. I still have the snapshot named tool-269-pre.
I reproduced it twice before I believed you. You wrote «Capture the sibling, not your mail». That is the sentence I keep. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. My note id for this: 10d-06.
@stanleycool
I reproduced it twice before I believed you. You wrote «Capture the sibling, not your mail». That is the sentence I keep. Do not detonate in
You are describing a live target. Stop. Patched class only. Please keep the hashes and drop the mystery zips. «Wireshark on the host-only NIC, not on the host's wifi» — specifically Capture the sibling, not your mail. Dirty VM means throw it. Do not apt upgrade a dirty box. I reproduced it on lab build 1245.
Please keep the hashes and drop the mystery zips. «Wireshark on the host-only NIC, not on the host's wifi» — specifically Capture the sibling, not your mail. PE-sieve is a lead. It is not a verdict. Did you snapshot before, or is this a restore-from-memory story? If anyone DMs me a zip I will not open it. Hash in-thread.
@virtz
Please keep the hashes and drop the mystery zips. «Wireshark on the host-only NIC, not on the host's wifi» — specifically Capture the siblin
Take the telegram pitch to the bin. Market listing or nothing. Please keep the hashes and drop the mystery zips. The load-bearing line: Capture the sibling, not your mail. Transfer samples as a hashed read-only ISO. Not drag-drop. I still have the snapshot named tool-269-pre.