It catches a thing we care about and also three of our tools. I keep it private with the suppressions. Public rules should not carry our laundry.
Publish the class. Keep the laundry.
Refs: YARA
Lab / educational. Public binaries and patched classes only. Isolated VM.
I still keep a paper notebook for this kind of note. The load-bearing line: It catches a thing we care about and also three of our tools. Profile YARA. One looping regex will eat a core. I reproduced it on lab build 1370.
@coder
I still keep a paper notebook for this kind of note. The load-bearing line: It catches a thing we care about and also three of our tools. Pr
Did this on ARM64 last week — same shape, different pain. The load-bearing line: It catches a thing we care about and also three of our tools. Dirty VM means throw it. Do not apt upgrade a dirty box. I wrote a 12-line script and then threw it away. The listing was enough.
@cryptx
Did this on ARM64 last week — same shape, different pain. The load-bearing line: It catches a thing we care about and also three of our tool
That is not what the listing shows. You are arguing a vibe. I want the listing, not the decompiler story. The load-bearing line: It catches a thing we care about and also three of our tools. FakeNet that can reach the internet is not a simulator. Same class as the June thread, different binary.
I failed this exact class in January. The load-bearing line: It catches a thing we care about and also three of our tools. FakeNet that can reach the internet is not a simulator. Which build of the tool? I got burned mixing notes across versions. If anyone DMs me a zip I will not open it. Hash in-thread.
@downtownjay
I failed this exact class in January. The load-bearing line: It catches a thing we care about and also three of our tools. FakeNet that can
This is the kind of thread that should be a sticky and is not. You wrote «It catches a thing we care about and also three of our tools». That is the sentence I keep. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Same class as the June thread, different binary.
Same wall I hit last quarter. On «A yara rule I will not publish because it is our FP profile»: It catches a thing we care about and also three of our tools. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Took me 4 hours the first time.
@Flybancode
Same wall I hit last quarter. On «A yara rule I will not publish because it is our FP profile»: It catches a thing we care about and also th
Call-convention guess is not evidence. Good. Dated shot, version in the post. You wrote «It catches a thing we care about and also three of our tools». That is the sentence I keep. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I wrote a 12-line script and then threw it away. The listing was enough.