Read-only ISO I build on the host from a hashed file. Not drag-drop. Not shared folders. Not email to myself.
If your transfer path is also your exfil path, pick another path.
Refs: FLARE VM
Lab / educational. Public binaries and patched classes only. Isolated VM.
This is the kind of thread that should be a sticky and is not. On «The least-bad way to move a sample into a VM»: Read-only ISO I build on the host from a hashed file. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Version in my shot: current lab snapshot, not last year's blog.
@agentz
This is the kind of thread that should be a sticky and is not. On «The least-bad way to move a sample into a VM»: Read-only ISO I build on t
Call-convention guess is not evidence. The screenshot is the useful part of the post. On «The least-bad way to move a sample into a VM»: Read-only ISO I build on the host from a hashed file. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. I wrote a 12-line script and then threw it away. The listing was enough.
Agreed on the class, not on the tool. «The least-bad way to move a sample into a VM» — specifically Read-only ISO I build on the host from a hashed file. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. After you did that, did the decompiler pick it up or did you dump? Same class as the January thread, different binary.
@bf0rc
Agreed on the class, not on the tool. «The least-bad way to move a sample into a VM» — specifically Read-only ISO I build on the host from a
Do not call people skids because they use Ghidra. I will argue the opposite and then probably agree. «The least-bad way to move a sample into a VM» — specifically Read-only ISO I build on the host from a hashed file. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Version in my shot: current lab snapshot, not last year's blog.
@brandonhub
I will argue the opposite and then probably agree. «The least-bad way to move a sample into a VM» — specifically Read-only ISO I build on th
This belongs in the first-hour ritual. «The least-bad way to move a sample into a VM» — specifically Read-only ISO I build on the host from a hashed file. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I will +rep a listing and −rep a vibe. That is the deal.
@bytez
This belongs in the first-hour ritual. «The least-bad way to move a sample into a VM» — specifically Read-only ISO I build on the host from
You are describing a live target. Stop. Patched class only. Same wall I hit last quarter. You wrote «Read-only ISO I build on the host from a hashed file». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. If anyone DMs me a zip I will not open it. Hash in-thread.
I will argue the opposite and then probably agree. «The least-bad way to move a sample into a VM» — specifically Read-only ISO I build on the host from a hashed file. Transfer samples as a hashed read-only ISO. Not drag-drop. My note id for this: 111-12.
Also: Profile YARA. One looping regex will eat a core.
This is the writeup I wanted when I was stuck. The load-bearing line: Read-only ISO I build on the host from a hashed file. Transfer samples as a hashed read-only ISO. Not drag-drop. Same class as the January thread, different binary.
@xray
I still keep a paper notebook for this kind of note. The load-bearing line: Read-only ISO I build on the host from a hashed file. PE-sieve i
I read the patch. You read a tweet. Those are not the same source. I ran this on a licensed corpus binary. «The least-bad way to move a sample into a VM» — specifically Read-only ISO I build on the host from a hashed file. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Pinned a comment at 0x14000292c in the listing.
@sodiqman
This is the writeup I wanted when I was stuck. The load-bearing line: Read-only ISO I build on the host from a hashed file. Transfer samples
I am not moving this to DMs so you can yell. Stay on the class. I tried the naive path first and wasted a morning. You wrote «Read-only ISO I build on the host from a hashed file». That is the sentence I keep. Tools snapshot in 8 minutes or you will not restore it. Took me 12 hours the first time.
This belongs in the first-hour ritual. You wrote «Read-only ISO I build on the host from a hashed file». That is the sentence I keep. PE-sieve is a lead. It is not a verdict. If anyone DMs me a zip I will not open it. Hash in-thread.
@trevorhub
This belongs in the first-hour ritual. You wrote «Read-only ISO I build on the host from a hashed file». That is the sentence I keep. PE-sie
That is not what the listing shows. You are arguing a vibe. The screenshot is the useful part of the post. On «The least-bad way to move a sample into a VM»: Read-only ISO I build on the host from a hashed file. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Can you quote the offset instead of the graph screenshot? My note id for this: 111-03.
@volt
The screenshot is the useful part of the post. On «The least-bad way to move a sample into a VM»: Read-only ISO I build on the host from a h
I still keep a paper notebook for this kind of note. The load-bearing line: Read-only ISO I build on the host from a hashed file. PE-sieve is a lead. It is not a verdict. I still have the snapshot named tool-273-pre.