A USB filter in the lab hypervisor, and the one dongle that needed it off

I still keep a paper notebook for this kind of note. «A USB filter in the lab hypervisor, and the one dongle that needed it off» — specifically We needed a licensed dongle. Profile YARA. One looping regex will eat a core. I will +rep a listing and −rep a vibe. That is the deal.

@n0xturn

I still keep a paper notebook for this kind of note. «A USB filter in the lab hypervisor, and the one dongle that needed it off» — specifica

You are treating a checksum as a signature again. Bookmarking this for the lab wiki. On «A USB filter in the lab hypervisor, and the one dongle that needed it off»: We needed a licensed dongle. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. I still have the snapshot named tool-277-pre.

Not fully convinced yet. You wrote «We needed a licensed dongle». That is the sentence I keep. Profile YARA. One looping regex will eat a core. Pinned a comment at 0x140002b39 in the listing.

@auth

Not fully convinced yet. You wrote «We needed a licensed dongle». That is the sentence I keep. Profile YARA. One looping regex will eat a co

You skipped isolation and then asked why the box is dirty. That is on you. Agreed on the class, not on the tool. You wrote «We needed a licensed dongle». That is the sentence I keep. Dirty VM means throw it. Do not apt upgrade a dirty box. Did you snapshot before, or is this a restore-from-memory story? Pinned a comment at 0x140004277 in the listing.

@bitlab

Agreed on the class, not on the tool. You wrote «We needed a licensed dongle». That is the sentence I keep. Dirty VM means throw it. Do not

I disagree with the tone, not the bytes. On «A USB filter in the lab hypervisor, and the one dongle that needed it off»: We needed a licensed dongle. Dirty VM means throw it. Do not apt upgrade a dirty box. I will +rep a listing and −rep a vibe. That is the deal.

@brute

I disagree with the tone, not the bytes. On «A USB filter in the lab hypervisor, and the one dongle that needed it off»: We needed a license

I am not moving this to DMs so you can yell. Stay on the class. Please keep the hashes and drop the mystery zips. «A USB filter in the lab hypervisor, and the one dongle that needed it off» — specifically We needed a licensed dongle. FakeNet that can reach the internet is not a simulator. I still have the snapshot named tool-277-pre.

I disagree with the tone, not the bytes. On «A USB filter in the lab hypervisor, and the one dongle that needed it off»: We needed a licensed dongle. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. I reproduced it on lab build 1221.

@cipherx

I disagree with the tone, not the bytes. On «A USB filter in the lab hypervisor, and the one dongle that needed it off»: We needed a license

That is not what the listing shows. You are arguing a vibe. Good. Dated shot, version in the post. You wrote «We needed a licensed dongle». That is the sentence I keep. Clipboard off on the detonation VM. I pasted a token once. Same class as the June thread, different binary.

This belongs in the first-hour ritual. The load-bearing line: We needed a licensed dongle. Transfer samples as a hashed read-only ISO. Not drag-drop. Did you force-create the function or did auto-analysis luck into it? If anyone DMs me a zip I will not open it. Hash in-thread.

@dammyzone

This belongs in the first-hour ritual. The load-bearing line: We needed a licensed dongle. Transfer samples as a hashed read-only ISO. Not d

I read the patch. You read a tweet. Those are not the same source. The screenshot is the useful part of the post. On «A USB filter in the lab hypervisor, and the one dongle that needed it off»: We needed a licensed dongle. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Version in my shot: current lab snapshot, not last year's blog.