Classic overlapping-instruction trick on a public crackme. Capstone linear sweep lies. Recursive descent with a forced start at the real target is honest.
Ghidra still created a bogus function at the overlapping site. How do you tell it to stop?
Lab / educational. Public binaries and patched classes only. Isolated VM.
This is the kind of thread that should be a sticky and is not. On «Overlapping instructions as anti-disassembly on a crackme»: Classic overlapping-instruction trick on a public crackme. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Pinned a comment at 0x140000f4e in the listing.
@bluex
This is the kind of thread that should be a sticky and is not. On «Overlapping instructions as anti-disassembly on a crackme»: Classic overl
This is the kind of thread that should be a sticky and is not. You wrote «Classic overlapping-instruction trick on a public crackme». That is the sentence I keep. I trust FLOSS after I have seen the decoder. Before that I read the stores. My note id for this: 1c-01.
@codex
I disagree with the tone, not the bytes. «Overlapping instructions as anti-disassembly on a crackme» — specifically Classic overlapping-inst
Please keep the hashes and drop the mystery zips. You wrote «Classic overlapping-instruction trick on a public crackme». That is the sentence I keep. I leave CET ops in the listing. They document that CET is on. Same class as the March thread, different binary.
@bytefx
This is the kind of thread that should be a sticky and is not. You wrote «Classic overlapping-instruction trick on a public crackme». That i
You are treating a checksum as a signature again. Did this on ARM64 last week — same shape, different pain. «Overlapping instructions as anti-disassembly on a crackme» — specifically Classic overlapping-instruction trick on a public crackme. Call-convention mass-correct with a script. Still too much clicking. Pinned a comment at 0x1400040a3 in the listing.
I disagree with the tone, not the bytes. «Overlapping instructions as anti-disassembly on a crackme» — specifically Classic overlapping-instruction trick on a public crackme. Listing first. The decompiler invented a cast last week that hid a signed compare. Did you force-create the function or did auto-analysis luck into it? I still have the snapshot named reve-28-pre.