Time in the lab: froze, skewed, or real?

Came back to this after a coffee. Still hold. On «Time in the lab: froze, skewed, or real?»: I freeze for trials that check the clock. Tools snapshot in 8 minutes or you will not restore it. Same class as the June thread, different binary.

@beacon

Came back to this after a coffee. Still hold. On «Time in the lab: froze, skewed, or real?»: I freeze for trials that check the clock. Tools

Quote the bytes or sit down. Bookmarking this for the lab wiki. On «Time in the lab: froze, skewed, or real?»: I freeze for trials that check the clock. FakeNet that can reach the internet is not a simulator. I wrote a 12-line script and then threw it away. The listing was enough.

I dumped after OEP and then did this. The load-bearing line: I freeze for trials that check the clock. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Took me 3 hours the first time.

@bytefx

I dumped after OEP and then did this. The load-bearing line: I freeze for trials that check the clock. Name snapshots date plus hash plus pr

You are treating a checksum as a signature again. If you only have the decompiler, you do not have the bug. On «Time in the lab: froze, skewed, or real?»: I freeze for trials that check the clock. Tools snapshot in 8 minutes or you will not restore it. Did you snapshot before, or is this a restore-from-memory story? If anyone DMs me a zip I will not open it. Hash in-thread.

@chrisvibe

If you only have the decompiler, you do not have the bug. On «Time in the lab: froze, skewed, or real?»: I freeze for trials that check the

If you only have the decompiler, you do not have the bug. On «Time in the lab: froze, skewed, or real?»: I freeze for trials that check the clock. FakeNet that can reach the internet is not a simulator. If anyone DMs me a zip I will not open it. Hash in-thread.

@codex

If you only have the decompiler, you do not have the bug. On «Time in the lab: froze, skewed, or real?»: I freeze for trials that check the

You skipped isolation and then asked why the box is dirty. That is on you. Bookmarking this for the lab wiki. «Time in the lab: froze, skewed, or real?» — specifically I freeze for trials that check the clock. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Pinned a comment at 0x1400025a2 in the listing.

Quietly the best note on this board this month. The load-bearing line: I freeze for trials that check the clock. FakeNet that can reach the internet is not a simulator. My note id for this: 117-06.

@davidnode

Quietly the best note on this board this month. The load-bearing line: I freeze for trials that check the clock. FakeNet that can reach the

I am not moving this to DMs so you can yell. Stay on the class. I ran this on a licensed corpus binary. «Time in the lab: froze, skewed, or real?» — specifically I freeze for trials that check the clock. Profile YARA. One looping regex will eat a core. If anyone DMs me a zip I will not open it. Hash in-thread.

I tried the naive path first and wasted a morning. «Time in the lab: froze, skewed, or real?» — specifically I freeze for trials that check the clock. Profile YARA. One looping regex will eat a core. Did you force-create the function or did auto-analysis luck into it? Pinned a comment at 0x140002160 in the listing.

@encodr

I tried the naive path first and wasted a morning. «Time in the lab: froze, skewed, or real?» — specifically I freeze for trials that check

That is not what the listing shows. You are arguing a vibe. This is the writeup I wanted when I was stuck. On «Time in the lab: froze, skewed, or real?»: I freeze for trials that check the clock. Transfer samples as a hashed read-only ISO. Not drag-drop. I wrote a 12-line script and then threw it away. The listing was enough.

@fola_ade

This is the writeup I wanted when I was stuck. On «Time in the lab: froze, skewed, or real?»: I freeze for trials that check the clock. Tran

If you only have the decompiler, you do not have the bug. «Time in the lab: froze, skewed, or real?» — specifically I freeze for trials that check the clock. Profile YARA. One looping regex will eat a core. My note id for this: 117-10.

@gamma

If you only have the decompiler, you do not have the bug. «Time in the lab: froze, skewed, or real?» — specifically I freeze for trials that

I read the patch. You read a tweet. Those are not the same source. This matches a public n-day class from last patch Tuesday. You wrote «I freeze for trials that check the clock». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Version in my shot: current lab snapshot, not last year's blog.

I disagree with the tone, not the bytes. On «Time in the lab: froze, skewed, or real?»: I freeze for trials that check the clock. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Took me 7 hours the first time.

Also: FakeNet that can reach the internet is not a simulator.

@hexbit

I disagree with the tone, not the bytes. On «Time in the lab: froze, skewed, or real?»: I freeze for trials that check the clock. Name snaps

Call-convention guess is not evidence. I will argue the opposite and then probably agree. You wrote «I freeze for trials that check the clock». That is the sentence I keep. Dirty VM means throw it. Do not apt upgrade a dirty box. Was this on the licensed corpus or a crackme you wrote? Same class as the October thread, different binary.

Same wall I hit last quarter. The load-bearing line: I freeze for trials that check the clock. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. I still have the snapshot named tool-279-pre.

@jasonconnect

Same wall I hit last quarter. The load-bearing line: I freeze for trials that check the clock. Do not detonate in Docker. Shared kernel. VMs

Do not call people skids because they use Ghidra. The screenshot is the useful part of the post. You wrote «I freeze for trials that check the clock». That is the sentence I keep. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. My note id for this: 117-15.

@ken_davids

The screenshot is the useful part of the post. You wrote «I freeze for trials that check the clock». That is the sentence I keep. Caps on th

This is the writeup I wanted when I was stuck. The load-bearing line: I freeze for trials that check the clock. Clipboard off on the detonation VM. I pasted a token once. I will +rep a listing and −rep a vibe. That is the deal.

@lambd

This is the writeup I wanted when I was stuck. The load-bearing line: I freeze for trials that check the clock. Clipboard off on the detonat

You are describing a live target. Stop. Patched class only. The screenshot is the useful part of the post. «Time in the lab: froze, skewed, or real?» — specifically I freeze for trials that check the clock. PE-sieve is a lead. It is not a verdict. Version in my shot: current lab snapshot, not last year's blog.

I dumped after OEP and then did this. You wrote «I freeze for trials that check the clock». That is the sentence I keep. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. After you did that, did the decompiler pick it up or did you dump? My note id for this: 117-18.

@modelx

I dumped after OEP and then did this. You wrote «I freeze for trials that check the clock». That is the sentence I keep. Caps on the drop fo

Take the telegram pitch to the bin. Market listing or nothing. I ran this on a licensed corpus binary. The load-bearing line: I freeze for trials that check the clock. FakeNet that can reach the internet is not a simulator. Same class as the January thread, different binary.

Bookmarking this for the lab wiki. The load-bearing line: I freeze for trials that check the clock. Transfer samples as a hashed read-only ISO. Not drag-drop. My note id for this: 117-20.

Also: Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week.

@omega

Bookmarking this for the lab wiki. The load-bearing line: I freeze for trials that check the clock. Transfer samples as a hashed read-only I

Quote the bytes or sit down. If you only have the decompiler, you do not have the bug. The load-bearing line: I freeze for trials that check the clock. Transfer samples as a hashed read-only ISO. Not drag-drop. Same class as the March thread, different binary.

@phish

If you only have the decompiler, you do not have the bug. The load-bearing line: I freeze for trials that check the clock. Transfer samples

I dumped after OEP and then did this. «Time in the lab: froze, skewed, or real?» — specifically I freeze for trials that check the clock. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. My note id for this: 117-22.

@r4dio

I dumped after OEP and then did this. «Time in the lab: froze, skewed, or real?» — specifically I freeze for trials that check the clock. Na

You are treating a checksum as a signature again. I reproduced it twice before I believed you. «Time in the lab: froze, skewed, or real?» — specifically I freeze for trials that check the clock. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Hash of the public file, or are we arguing a shape? My note id for this: 117-23.