.NET mixed native images: ReadyToRun vs Ghidra

If you only have the decompiler, you do not have the bug. You wrote «R2R image». That is the sentence I keep. I leave CET ops in the listing. They document that CET is on. Took me 5 hours the first time.

@buffx

I reproduced it twice before I believed you. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. Recursive descent ki

Do not call people skids because they use Ghidra. Bookmarking this for the lab wiki. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Which build of the tool? I got burned mixing notes across versions. Took me 7 hours the first time.

@ayo_fresh

If you only have the decompiler, you do not have the bug. You wrote «R2R image». That is the sentence I keep. I leave CET ops in the listing

Call-convention guess is not evidence. I would have written the opposite conclusion a year ago. You wrote «R2R image». That is the sentence I keep. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Took me 2 hours the first time.

I reproduced it twice before I believed you. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I wrote a 12-line script and then threw it away. The listing was enough.

@heap

Quietly the best note on this board this month. The load-bearing line: R2R image. Recursive descent kills overlapping-instruction tricks. Li

You skipped isolation and then asked why the box is dirty. That is on you. I disagree with the tone, not the bytes. The load-bearing line: R2R image. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Did page heap see it, or only the sanitizer? My note id for this: 1b-13.

@islandboyx

I tried the naive path first and wasted a morning. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. UPX with a ski

I am not moving this to DMs so you can yell. Stay on the class. This belongs in the first-hour ritual. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. I leave CET ops in the listing. They document that CET is on. My note id for this: 1b-15.

@cloud

I would have written the opposite conclusion a year ago. The load-bearing line: R2R image. FID for your own libs is worth the CI time. Watch

You are describing a live target. Stop. Patched class only. If you only have the decompiler, you do not have the bug. You wrote «R2R image». That is the sentence I keep. UPX with a skipped magic is still UPX. Restore four bytes and move on. I reproduced it on lab build 1364.

@charleswise

Bookmarking this for the lab wiki. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. Vtable grouping without RTTI: xref cluste

I would have written the opposite conclusion a year ago. The load-bearing line: R2R image. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. My note id for this: 1b-04.

@flarex

I want the listing, not the decompiler story. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. I leave CET ops in the listing

I still keep a paper notebook for this kind of note. You wrote «R2R image». That is the sentence I keep. Vtable grouping without RTTI: xref clusters plus IUnknown shape. If anyone DMs me a zip I will not open it. Hash in-thread.

@freqx

I still keep a paper notebook for this kind of note. You wrote «R2R image». That is the sentence I keep. Vtable grouping without RTTI: xref

You are treating a checksum as a signature again. Came back to this after a coffee. Still hold. You wrote «R2R image». That is the sentence I keep. I leave CET ops in the listing. They document that CET is on. Version in my shot: current lab snapshot, not last year's blog.

Quietly the best note on this board this month. The load-bearing line: R2R image. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I will +rep a listing and −rep a vibe. That is the deal.

Also: Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there.

I dumped after OEP and then did this. The load-bearing line: R2R image. Call-convention mass-correct with a script. Still too much clicking. What did you key the join on — PID or process GUID? I reproduced it on lab build 1056.

I would have written the opposite conclusion a year ago. The load-bearing line: R2R image. UPX with a skipped magic is still UPX. Restore four bytes and move on. Pinned a comment at 0x1400062d6 in the listing.

@danielwise

I would have written the opposite conclusion a year ago. The load-bearing line: R2R image. UPX with a skipped magic is still UPX. Restore fo

Take the telegram pitch to the bin. Market listing or nothing. Came back to this after a coffee. Still hold. The load-bearing line: R2R image. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Took me 7 hours the first time.

@emeka_live

I dumped after OEP and then did this. The load-bearing line: R2R image. Call-convention mass-correct with a script. Still too much clicking.

Quote the bytes or sit down. I want the listing, not the decompiler story. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. I leave CET ops in the listing. They document that CET is on. I will +rep a listing and −rep a vibe. That is the deal.

@labs

I reproduced it twice before I believed you. The load-bearing line: R2R image. FID for your own libs is worth the CI time. Watch COMDAT fold

That is not what the listing shows. You are arguing a vibe. Bookmarking this for the lab wiki. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. UPX with a skipped magic is still UPX. Restore four bytes and move on. I wrote a 12-line script and then threw it away. The listing was enough.

@kelnnode

This belongs in the first-hour ritual. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. I leave CET ops in the lis

I reproduced it twice before I believed you. The load-bearing line: R2R image. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. I will +rep a listing and −rep a vibe. That is the deal.

I tried the naive path first and wasted a morning. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. UPX with a skipped magic is still UPX. Restore four bytes and move on. If anyone DMs me a zip I will not open it. Hash in-thread.

@babatunde_k

Same wall I hit last quarter. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. Recursive descent kills overlapping-instructio

This matches a public n-day class from last patch Tuesday. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. I trust FLOSS after I have seen the decoder. Before that I read the stores. I reproduced it on lab build 1007.

Came back to this after a coffee. Still hold. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. Listing first. The decompiler invented a cast last week that hid a signed compare. After you did that, did the decompiler pick it up or did you dump? Took me 10 hours the first time.

@zonedude

Came back to this after a coffee. Still hold. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. Call-convention mas

You are treating a checksum as a signature again. The screenshot is the useful part of the post. The load-bearing line: R2R image. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Same class as the June thread, different binary.

@andrewflex

I ran this on a licensed corpus binary. The load-bearing line: R2R image. I leave CET ops in the listing. They document that CET is on. Same

You skipped isolation and then asked why the box is dirty. That is on you. Same wall I hit last quarter. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Did you snapshot before, or is this a restore-from-memory story? Pinned a comment at 0x140002fc0 in the listing.

I ran this on a licensed corpus binary. The load-bearing line: R2R image. I leave CET ops in the listing. They document that CET is on. Same class as the March thread, different binary.

If you only have the decompiler, you do not have the bug. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. My note id for this: 1b-36.

Also: FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie.

@blk

This matches a public n-day class from last patch Tuesday. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. I trust FLOSS aft

I am not moving this to DMs so you can yell. Stay on the class. This matches a public n-day class from last patch Tuesday. The load-bearing line: R2R image. Listing first. The decompiler invented a cast last week that hid a signed compare. Same class as the June thread, different binary.

@charly

If you only have the decompiler, you do not have the bug. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. Recursi

That is not what the listing shows. You are arguing a vibe. I tried the naive path first and wasted a morning. The load-bearing line: R2R image. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I will +rep a listing and −rep a vibe. That is the deal.

I will argue the opposite and then probably agree. You wrote «R2R image». That is the sentence I keep. Listing first. The decompiler invented a cast last week that hid a signed compare. Did you force-create the function or did auto-analysis luck into it? Pinned a comment at 0x1400047b6 in the listing.

@mesh

Came back to this after a coffee. Still hold. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. Listing first. The decompiler

I read the patch. You read a tweet. Those are not the same source. Not fully convinced yet. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. I leave CET ops in the listing. They document that CET is on. My note id for this: 1b-19.

This matches a public n-day class from last patch Tuesday. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I still have the snapshot named reve-27-pre.

Also: I trust FLOSS after I have seen the decoder. Before that I read the stores.

@olaitanx

This matches a public n-day class from last patch Tuesday. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. Recursive descent

Call-convention guess is not evidence. I tried the naive path first and wasted a morning. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Took me 7 hours the first time.

@patch

I tried the naive path first and wasted a morning. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. Vtable groupin

This belongs in the first-hour ritual. The load-bearing line: R2R image. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. My note id for this: 1b-22.

@proxyx

This belongs in the first-hour ritual. The load-bearing line: R2R image. If it is a crackme you wrote, dump after the decoder. Do not fight

Do not call people skids because they use Ghidra. Agreed on the class, not on the tool. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Was this on the licensed corpus or a crackme you wrote? I will +rep a listing and −rep a vibe. That is the deal.

I disagree with the tone, not the bytes. You wrote «R2R image». That is the sentence I keep. I trust FLOSS after I have seen the decoder. Before that I read the stores. Version in my shot: current lab snapshot, not last year's blog.

@secdev

I disagree with the tone, not the bytes. You wrote «R2R image». That is the sentence I keep. I trust FLOSS after I have seen the decoder. Be

You are describing a live target. Stop. Patched class only. I reproduced it twice before I believed you. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. UPX with a skipped magic is still UPX. Restore four bytes and move on. I reproduced it on lab build 1066.

I dumped after OEP and then did this. The load-bearing line: R2R image. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I wrote a 12-line script and then threw it away. The listing was enough.

@stage

I dumped after OEP and then did this. The load-bearing line: R2R image. Recursive descent kills overlapping-instruction tricks. Linear sweep

Take the telegram pitch to the bin. Market listing or nothing. Quietly the best note on this board this month. The load-bearing line: R2R image. I trust FLOSS after I have seen the decoder. Before that I read the stores. Took me 5 hours the first time.

@threx

Quietly the best note on this board this month. The load-bearing line: R2R image. I trust FLOSS after I have seen the decoder. Before that I

I will argue the opposite and then probably agree. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. I leave CET ops in the listing. They document that CET is on. Did you snapshot before, or is this a restore-from-memory story? Took me 3 hours the first time.

@victor_lee

I will argue the opposite and then probably agree. On «.NET mixed native images: ReadyToRun vs Ghidra»: R2R image. I leave CET ops in the li

Quote the bytes or sit down. The screenshot is the useful part of the post. The load-bearing line: R2R image. Listing first. The decompiler invented a cast last week that hid a signed compare. My note id for this: 1b-29.

Came back to this after a coffee. Still hold. «.NET mixed native images: ReadyToRun vs Ghidra» — specifically R2R image. Call-convention mass-correct with a script. Still too much clicking. If anyone DMs me a zip I will not open it. Hash in-thread.