YARA performance: the rule that ate a core

@zenith

I will argue the opposite and then probably agree. On «YARA performance: the rule that ate a core»: A looping regex on a huge section. Dirty

Came back to this after a coffee. Still hold. The load-bearing line: A looping regex on a huge section. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. If anyone DMs me a zip I will not open it. Hash in-thread.

@baba_yaga

Came back to this after a coffee. Still hold. The load-bearing line: A looping regex on a huge section. Name snapshots date plus hash plus p

I am reporting the sample-drop hint. Hash and corpus tag only. Good. Dated shot, version in the post. The load-bearing line: A looping regex on a huge section. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Version in my shot: current lab snapshot, not last year's blog.

I dumped after OEP and then did this. You wrote «A looping regex on a huge section». That is the sentence I keep. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I still have the snapshot named tool-274-pre.

@authx

I dumped after OEP and then did this. You wrote «A looping regex on a huge section». That is the sentence I keep. Caps on the drop folder sa

The graph hid it. The listing did not. Trust the listing. I tried the naive path first and wasted a morning. You wrote «A looping regex on a huge section». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. If anyone DMs me a zip I will not open it. Hash in-thread.

I failed this exact class in January. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge section. FakeNet that can reach the internet is not a simulator. Did you snapshot before, or is this a restore-from-memory story? I still have the snapshot named tool-274-pre.

@bryanwest

I failed this exact class in January. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge section. FakeNet

Stop flexing an IDA license. The question was the unwind info. The screenshot is the useful part of the post. You wrote «A looping regex on a huge section». That is the sentence I keep. Profile YARA. One looping regex will eat a core. My note id for this: 112-09.

@calmstan

The screenshot is the useful part of the post. You wrote «A looping regex on a huge section». That is the sentence I keep. Profile YARA. One

Came back to this after a coffee. Still hold. The load-bearing line: A looping regex on a huge section. Clipboard off on the detonation VM. I pasted a token once. I will +rep a listing and −rep a vibe. That is the deal.

@cipherz

Came back to this after a coffee. Still hold. The load-bearing line: A looping regex on a huge section. Clipboard off on the detonation VM.

Calling the sticky 'priest talk' is how you earn a ban note. I reproduced it twice before I believed you. The load-bearing line: A looping regex on a huge section. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Pinned a comment at 0x140002f18 in the listing.

Agreed on the class, not on the tool. You wrote «A looping regex on a huge section». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Same class as the January thread, different binary.

Also: Dirty VM means throw it. Do not apt upgrade a dirty box.

@danielcrest

Agreed on the class, not on the tool. You wrote «A looping regex on a huge section». That is the sentence I keep. Name snapshots date plus h

That is a vibe. I asked for a listing offset. I dumped after OEP and then did this. You wrote «A looping regex on a huge section». That is the sentence I keep. FakeNet that can reach the internet is not a simulator. Was this on the licensed corpus or a crackme you wrote? Took me 11 hours the first time.

Good. Dated shot, version in the post. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge section. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I will +rep a listing and −rep a vibe. That is the deal.

@edwardconnect

Good. Dated shot, version in the post. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge section. Caps o

If you cannot paste bytes, you do not have a counterexample. Good. Dated shot, version in the post. On «YARA performance: the rule that ate a core»: A looping regex on a huge section. Transfer samples as a hashed read-only ISO. Not drag-drop. I reproduced it on lab build 1363.

@fire

Good. Dated shot, version in the post. On «YARA performance: the rule that ate a core»: A looping regex on a huge section. Transfer samples

This belongs in the first-hour ritual. You wrote «A looping regex on a huge section». That is the sentence I keep. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Same class as the October thread, different binary.

@frankybee

This belongs in the first-hour ritual. You wrote «A looping regex on a huge section». That is the sentence I keep. Caps on the drop folder s

You keep moving the goalposts. First it was the decoder, now it is the dump. I failed this exact class in January. On «YARA performance: the rule that ate a core»: A looping regex on a huge section. Profile YARA. One looping regex will eat a core. I will +rep a listing and −rep a vibe. That is the deal.

If you only have the decompiler, you do not have the bug. You wrote «A looping regex on a huge section». That is the sentence I keep. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Did you force-create the function or did auto-analysis luck into it? I still have the snapshot named tool-274-pre.

@hashr

If you only have the decompiler, you do not have the bug. You wrote «A looping regex on a huge section». That is the sentence I keep. Do not

Decompiler output is a hypothesis. Treat it like one. This belongs in the first-hour ritual. You wrote «A looping regex on a huge section». That is the sentence I keep. Profile YARA. One looping regex will eat a core. Pinned a comment at 0x140006bbd in the listing.

Please keep the hashes and drop the mystery zips. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge section. PE-sieve is a lead. It is not a verdict. If anyone DMs me a zip I will not open it. Hash in-thread.

Also: Transfer samples as a hashed read-only ISO. Not drag-drop.

@intel

Please keep the hashes and drop the mystery zips. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge sect

This is getting personal and it does not need to. This belongs in the first-hour ritual. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge section. Transfer samples as a hashed read-only ISO. Not drag-drop. Version in my shot: current lab snapshot, not last year's blog.

@juniorfx

This belongs in the first-hour ritual. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge section. Transf

Same wall I hit last quarter. You wrote «A looping regex on a huge section». That is the sentence I keep. Profile YARA. One looping regex will eat a core. Took me 12 hours the first time.

@kingsleyo

Same wall I hit last quarter. You wrote «A looping regex on a huge section». That is the sentence I keep. Profile YARA. One looping regex wi

That insult was not a technical point. I am reporting it. Bookmarking this for the lab wiki. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge section. Profile YARA. One looping regex will eat a core. What did you key the join on — PID or process GUID? I will +rep a listing and −rep a vibe. That is the deal.

Quietly the best note on this board this month. On «YARA performance: the rule that ate a core»: A looping regex on a huge section. PE-sieve is a lead. It is not a verdict. Took me 12 hours the first time.

@mapper

Quietly the best note on this board this month. On «YARA performance: the rule that ate a core»: A looping regex on a huge section. PE-sieve

I am reporting the sample-drop hint. Hash and corpus tag only. This is the writeup I wanted when I was stuck. On «YARA performance: the rule that ate a core»: A looping regex on a huge section. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. I still have the snapshot named tool-274-pre.

Good. Dated shot, version in the post. The load-bearing line: A looping regex on a huge section. FakeNet that can reach the internet is not a simulator. Took me 12 hours the first time.

@zenx

I dumped after OEP and then did this. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge section. Dirty V

You keep moving the goalposts. First it was the decoder, now it is the dump. Quietly the best note on this board this month. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge section. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I reproduced it on lab build 1287.

@null

Good. Dated shot, version in the post. The load-bearing line: A looping regex on a huge section. FakeNet that can reach the internet is not

The graph hid it. The listing did not. Trust the listing. I failed this exact class in January. The load-bearing line: A looping regex on a huge section. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. My note id for this: 112-27.

@oscar

I failed this exact class in January. The load-bearing line: A looping regex on a huge section. Caps on the drop folder saved the box. The 4

I would have written the opposite conclusion a year ago. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge section. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Did you force-create the function or did auto-analysis luck into it? I wrote a 12-line script and then threw it away. The listing was enough.

@primealex

I would have written the opposite conclusion a year ago. «YARA performance: the rule that ate a core» — specifically A looping regex on a hu

Stop flexing an IDA license. The question was the unwind info. I still keep a paper notebook for this kind of note. You wrote «A looping regex on a huge section». That is the sentence I keep. Dirty VM means throw it. Do not apt upgrade a dirty box. I will +rep a listing and −rep a vibe. That is the deal.

Please keep the hashes and drop the mystery zips. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge section. Transfer samples as a hashed read-only ISO. Not drag-drop. My note id for this: 112-30.

@sbox

Please keep the hashes and drop the mystery zips. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge sect

Calling the sticky 'priest talk' is how you earn a ban note. I still keep a paper notebook for this kind of note. On «YARA performance: the rule that ate a core»: A looping regex on a huge section. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Version in my shot: current lab snapshot, not last year's blog.

I will argue the opposite and then probably agree. You wrote «A looping regex on a huge section». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Same class as the January thread, different binary.

Quietly the best note on this board this month. You wrote «A looping regex on a huge section». That is the sentence I keep. Transfer samples as a hashed read-only ISO. Not drag-drop. Version in my shot: current lab snapshot, not last year's blog.

@stack

I will argue the opposite and then probably agree. You wrote «A looping regex on a huge section». That is the sentence I keep. Name snapshot

That is a vibe. I asked for a listing offset. The screenshot is the useful part of the post. The load-bearing line: A looping regex on a huge section. Clipboard off on the detonation VM. I pasted a token once. Which build of the tool? I got burned mixing notes across versions. I wrote a 12-line script and then threw it away. The listing was enough.

@tango

The screenshot is the useful part of the post. The load-bearing line: A looping regex on a huge section. Clipboard off on the detonation VM.

Good. Dated shot, version in the post. You wrote «A looping regex on a huge section». That is the sentence I keep. FakeNet that can reach the internet is not a simulator. I reproduced it on lab build 1256.

@taiwoflex

Quietly the best note on this board this month. You wrote «A looping regex on a huge section». That is the sentence I keep. Transfer samples

This is getting personal and it does not need to. Quietly the best note on this board this month. You wrote «A looping regex on a huge section». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. I will +rep a listing and −rep a vibe. That is the deal.

@vectrx

Good. Dated shot, version in the post. You wrote «A looping regex on a huge section». That is the sentence I keep. FakeNet that can reach th

If you cannot paste bytes, you do not have a counterexample. Came back to this after a coffee. Still hold. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge section. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Pinned a comment at 0x14000292f in the listing.

Same wall I hit last quarter. On «YARA performance: the rule that ate a core»: A looping regex on a huge section. Transfer samples as a hashed read-only ISO. Not drag-drop. If anyone DMs me a zip I will not open it. Hash in-thread.

@vx-u

Same wall I hit last quarter. On «YARA performance: the rule that ate a core»: A looping regex on a huge section. Transfer samples as a hash

That insult was not a technical point. I am reporting it. I will argue the opposite and then probably agree. On «YARA performance: the rule that ate a core»: A looping regex on a huge section. Dirty VM means throw it. Do not apt upgrade a dirty box. After you did that, did the decompiler pick it up or did you dump? Version in my shot: current lab snapshot, not last year's blog.

I dumped after OEP and then did this. «YARA performance: the rule that ate a core» — specifically A looping regex on a huge section. Dirty VM means throw it. Do not apt upgrade a dirty box. Took me 4 hours the first time.

Also: Caps on the drop folder saved the box. The 4GB 'txt' was a dump.