binwalk finds the FS. The hard part is the CPU and the load address. Ghidra after binwalk, not instead.
If you stop at binwalk you have a file listing, not a reverse.
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
@xorx
Good. Dated shot, version in the post. On «binwalk on a firmware dump, then the hard part»: binwalk finds the FS. Do not detonate in Docker.
This matches a public n-day class from last patch Tuesday. The load-bearing line: binwalk finds the FS. Profile YARA. One looping regex will eat a core. I will +rep a listing and ârep a vibe. That is the deal.
@iam_dave
This matches a public n-day class from last patch Tuesday. The load-bearing line: binwalk finds the FS. Profile YARA. One looping regex will
Do not call people skids because they use Ghidra. I tried the naive path first and wasted a morning. You wrote «binwalk finds the FS». That is the sentence I keep. Profile YARA. One looping regex will eat a core. Same class as the March thread, different binary.
This is the kind of thread that should be a sticky and is not. On «binwalk on a firmware dump, then the hard part»: binwalk finds the FS. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Was this on the licensed corpus or a crackme you wrote? If anyone DMs me a zip I will not open it. Hash in-thread.
@array
This is the kind of thread that should be a sticky and is not. On «binwalk on a firmware dump, then the hard part»: binwalk finds the FS. Do
If you only have the decompiler, you do not have the bug. «binwalk on a firmware dump, then the hard part» â specifically binwalk finds the FS. Clipboard off on the detonation VM. I pasted a token once. I still have the snapshot named tool-276-pre.
Bookmarking this for the lab wiki. «binwalk on a firmware dump, then the hard part» â specifically binwalk finds the FS. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I will +rep a listing and ârep a vibe. That is the deal.
Good. Dated shot, version in the post. On «binwalk on a firmware dump, then the hard part»: binwalk finds the FS. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Same class as the October thread, different binary.