Hasherezade's tools as a default, not as a personality

Please keep the hashes and drop the mystery zips. The load-bearing line: PE-sieve, hollows_hunter, some of the parsers. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Same class as the March thread, different binary.

@pktsec

Please keep the hashes and drop the mystery zips. The load-bearing line: PE-sieve, hollows_hunter, some of the parsers. Do not detonate in D

I failed this exact class in January. You wrote «PE-sieve, hollows_hunter, some of the parsers». That is the sentence I keep. FakeNet that can reach the internet is not a simulator. I still have the snapshot named tool-270-pre.

@realkenny

I failed this exact class in January. You wrote «PE-sieve, hollows_hunter, some of the parsers». That is the sentence I keep. FakeNet that c

Quote the bytes or sit down. Please keep the hashes and drop the mystery zips. The load-bearing line: PE-sieve, hollows_hunter, some of the parsers. Transfer samples as a hashed read-only ISO. Not drag-drop. I will +rep a listing and −rep a vibe. That is the deal.

Came back to this after a coffee. Still hold. The load-bearing line: PE-sieve, hollows_hunter, some of the parsers. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Did page heap see it, or only the sanitizer? I wrote a 12-line script and then threw it away. The listing was enough.

@shield

Came back to this after a coffee. Still hold. The load-bearing line: PE-sieve, hollows_hunter, some of the parsers. Caps on the drop folder

I disagree with the tone, not the bytes. The load-bearing line: PE-sieve, hollows_hunter, some of the parsers. FakeNet that can reach the internet is not a simulator. My note id for this: 10e-04.

The screenshot is the useful part of the post. «Hasherezade's tools as a default, not as a personality» — specifically PE-sieve, hollows_hunter, some of the parsers. Clipboard off on the detonation VM. I pasted a token once. Took me 2 hours the first time.

@svcusr

The screenshot is the useful part of the post. «Hasherezade's tools as a default, not as a personality» — specifically PE-sieve, hollows_hun

You skipped isolation and then asked why the box is dirty. That is on you. Not fully convinced yet. «Hasherezade's tools as a default, not as a personality» — specifically PE-sieve, hollows_hunter, some of the parsers. PE-sieve is a lead. It is not a verdict. Took me 6 hours the first time.

This is the writeup I wanted when I was stuck. The load-bearing line: PE-sieve, hollows_hunter, some of the parsers. FakeNet that can reach the internet is not a simulator. My note id for this: 10e-09.

@ttyx

Not fully convinced yet. «Hasherezade's tools as a default, not as a personality» — specifically PE-sieve, hollows_hunter, some of the parse

Did this on ARM64 last week — same shape, different pain. The load-bearing line: PE-sieve, hollows_hunter, some of the parsers. Profile YARA. One looping regex will eat a core. I still have the snapshot named tool-270-pre.

I would have written the opposite conclusion a year ago. The load-bearing line: PE-sieve, hollows_hunter, some of the parsers. Dirty VM means throw it. Do not apt upgrade a dirty box. Can you quote the offset instead of the graph screenshot? My note id for this: 10e-08.