>_0xFORUM
Sign in

I keep old Olly for one trick and I will not update that VM

in Tools11 replies380 views

One trick, one VM, snapshot, no network. The trick still works on a class of old binaries. That is the whole post.

Nostalgia is allowed if it is isolated.

Refs: FLARE VM

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 11 REPLIES

@zonedude

I failed this exact class in January. You wrote «One trick, one VM, snapshot, no network». That is the sentence I keep. Profile YARA. One lo

I am not moving this to DMs so you can yell. Stay on the class. This is the writeup I wanted when I was stuck. You wrote «One trick, one VM, snapshot, no network». That is the sentence I keep. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Hash of the public file, or are we arguing a shape? I reproduced it on lab build 1067.

@rr_or_gtfo

This is the writeup I wanted when I was stuck. You wrote «One trick, one VM, snapshot, no network». That is the sentence I keep. Caps on the

I ran this on a licensed corpus binary. The load-bearing line: One trick, one VM, snapshot, no network. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Version in my shot: current lab snapshot, not last year's blog.

@andrewflex

I ran this on a licensed corpus binary. The load-bearing line: One trick, one VM, snapshot, no network. Name snapshots date plus hash plus p

That is not what the listing shows. You are arguing a vibe. Did this on ARM64 last week — same shape, different pain. You wrote «One trick, one VM, snapshot, no network». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. My note id for this: 113-05.

Good. Dated shot, version in the post. On «I keep old Olly for one trick and I will not update that VM»: One trick, one VM, snapshot, no network. FakeNet that can reach the internet is not a simulator. Pinned a comment at 0x140004709 in the listing.

@blk

Good. Dated shot, version in the post. On «I keep old Olly for one trick and I will not update that VM»: One trick, one VM, snapshot, no net

I read the patch. You read a tweet. Those are not the same source. I tried the naive path first and wasted a morning. «I keep old Olly for one trick and I will not update that VM» — specifically One trick, one VM, snapshot, no network. Profile YARA. One looping regex will eat a core. I will +rep a listing and −rep a vibe. That is the deal.

I tried the naive path first and wasted a morning. The load-bearing line: One trick, one VM, snapshot, no network. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Hash of the public file, or are we arguing a shape? Version in my shot: current lab snapshot, not last year's blog.

@charly

I tried the naive path first and wasted a morning. The load-bearing line: One trick, one VM, snapshot, no network. Name snapshots date plus

Call-convention guess is not evidence. Please keep the hashes and drop the mystery zips. «I keep old Olly for one trick and I will not update that VM» — specifically One trick, one VM, snapshot, no network. Tools snapshot in 8 minutes or you will not restore it. My note id for this: 113-09.

@cloudx

Please keep the hashes and drop the mystery zips. «I keep old Olly for one trick and I will not update that VM» — specifically One trick, on

Bookmarking this for the lab wiki. On «I keep old Olly for one trick and I will not update that VM»: One trick, one VM, snapshot, no network. Transfer samples as a hashed read-only ISO. Not drag-drop. I wrote a 12-line script and then threw it away. The listing was enough.

Bookmarking this for the lab wiki. You wrote «One trick, one VM, snapshot, no network». That is the sentence I keep. FakeNet that can reach the internet is not a simulator. Version in my shot: current lab snapshot, not last year's blog.

@victor_lee

Bookmarking this for the lab wiki. You wrote «One trick, one VM, snapshot, no network». That is the sentence I keep. FakeNet that can reach

You skipped isolation and then asked why the box is dirty. That is on you. This matches a public n-day class from last patch Tuesday. The load-bearing line: One trick, one VM, snapshot, no network. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I wrote a 12-line script and then threw it away. The listing was enough.

I failed this exact class in January. You wrote «One trick, one VM, snapshot, no network». That is the sentence I keep. Profile YARA. One looping regex will eat a core. I still have the snapshot named tool-275-pre.

Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.