Small firmware, I want a seek and a print. r2 is faster. Ghidra is the project I come back to in a week.
Both. The war is a waste of a thread, but here we are.
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
When to pick radare2 because Ghidra is too much
// 16 REPLIES
The screenshot is the useful part of the post. The load-bearing line: Small firmware, I want a seek and a print. Tools snapshot in 8 minutes or you will not restore it. I wrote a 12-line script and then threw it away. The listing was enough.
@chain
The screenshot is the useful part of the post. The load-bearing line: Small firmware, I want a seek and a print. Tools snapshot in 8 minutes
Take the telegram pitch to the bin. Market listing or nothing. I will argue the opposite and then probably agree. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a print. Clipboard off on the detonation VM. I pasted a token once. I still have the snapshot named tool-281-pre.
I tried the naive path first and wasted a morning. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a print. Tools snapshot in 8 minutes or you will not restore it. I will +rep a listing and −rep a vibe. That is the deal.
@crypt
I tried the naive path first and wasted a morning. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a
Quote the bytes or sit down. Please keep the hashes and drop the mystery zips. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a print. Dirty VM means throw it. Do not apt upgrade a dirty box. Hash of the public file, or are we arguing a shape? I still have the snapshot named tool-281-pre.
@danielrocks
Please keep the hashes and drop the mystery zips. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a
I dumped after OEP and then did this. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a print. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Same class as the October thread, different binary.
@deltafx
I dumped after OEP and then did this. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a print. Caps
You are treating a checksum as a signature again. This is the kind of thread that should be a sticky and is not. «When to pick radare2 because Ghidra is too much» — specifically Small firmware, I want a seek and a print. Tools snapshot in 8 minutes or you will not restore it. Took me 9 hours the first time.
I tried the naive path first and wasted a morning. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a print. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Same class as the March thread, different binary.
@flare
I tried the naive path first and wasted a morning. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a
You skipped isolation and then asked why the box is dirty. That is on you. Bookmarking this for the lab wiki. You wrote «Small firmware, I want a seek and a print». That is the sentence I keep. PE-sieve is a lead. It is not a verdict. If anyone DMs me a zip I will not open it. Hash in-thread.
Agreed on the class, not on the tool. The load-bearing line: Small firmware, I want a seek and a print. Tools snapshot in 8 minutes or you will not restore it. Which build of the tool? I got burned mixing notes across versions. Version in my shot: current lab snapshot, not last year's blog.
@grayx
Agreed on the class, not on the tool. The load-bearing line: Small firmware, I want a seek and a print. Tools snapshot in 8 minutes or you w
I am not moving this to DMs so you can yell. Stay on the class. I ran this on a licensed corpus binary. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a print. Profile YARA. One looping regex will eat a core. I wrote a 12-line script and then threw it away. The listing was enough.
@hassanwise
I ran this on a licensed corpus binary. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a print. Pro
I will argue the opposite and then probably agree. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a print. Clipboard off on the detonation VM. I pasted a token once. Took me 5 hours the first time.
@iamflex
I will argue the opposite and then probably agree. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a
That is not what the listing shows. You are arguing a vibe. Please keep the hashes and drop the mystery zips. You wrote «Small firmware, I want a seek and a print». That is the sentence I keep. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I still have the snapshot named tool-281-pre.
Not fully convinced yet. You wrote «Small firmware, I want a seek and a print». That is the sentence I keep. PE-sieve is a lead. It is not a verdict. My note id for this: 119-12.
Also: Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools.
@kabirjay
Not fully convinced yet. You wrote «Small firmware, I want a seek and a print». That is the sentence I keep. PE-sieve is a lead. It is not a
I read the patch. You read a tweet. Those are not the same source. This is the kind of thread that should be a sticky and is not. The load-bearing line: Small firmware, I want a seek and a print. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Can you quote the offset instead of the graph screenshot? Version in my shot: current lab snapshot, not last year's blog.
I will argue the opposite and then probably agree. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a print. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. I still have the snapshot named tool-281-pre.
@liveconnect
I will argue the opposite and then probably agree. On «When to pick radare2 because Ghidra is too much»: Small firmware, I want a seek and a
Call-convention guess is not evidence. I will argue the opposite and then probably agree. The load-bearing line: Small firmware, I want a seek and a print. FakeNet that can reach the internet is not a simulator. I wrote a 12-line script and then threw it away. The listing was enough.
Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.