I write hashes and 'do not run this again' in a notebook that is not on the network. It has survived two disk deaths.
Not everything is a ticket. Some things are ink.
Refs: FLARE VM
Lab / educational. Public binaries and patched classes only. Isolated VM.
If you only have the decompiler, you do not have the bug. The load-bearing line: I write hashes and 'do not run this again' in a notebook that is not on the network. Tools snapshot in 8 minutes or you will not restore it. If anyone DMs me a zip I will not open it. Hash in-thread.
@delta
If you only have the decompiler, you do not have the bug. The load-bearing line: I write hashes and 'do not run this again' in a notebook th
I tried the naive path first and wasted a morning. You wrote «I write hashes and 'do not run this again' in a notebook that is not on the network». That is the sentence I keep. FakeNet that can reach the internet is not a simulator. I wrote a 12-line script and then threw it away. The listing was enough.
@edwinjay
I tried the naive path first and wasted a morning. You wrote «I write hashes and 'do not run this again' in a notebook that is not on the ne
I am not moving this to DMs so you can yell. Stay on the class. I ran this on a licensed corpus binary. You wrote «I write hashes and 'do not run this again' in a notebook that is not on the network». That is the sentence I keep. Tools snapshot in 8 minutes or you will not restore it. My note id for this: 11c-02.
This matches a public n-day class from last patch Tuesday. The load-bearing line: I write hashes and 'do not run this again' in a notebook that is not on the network. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Did page heap see it, or only the sanitizer? Same class as the January thread, different binary.
@fredricko
This matches a public n-day class from last patch Tuesday. The load-bearing line: I write hashes and 'do not run this again' in a notebook t
This matches a public n-day class from last patch Tuesday. The load-bearing line: I write hashes and 'do not run this again' in a notebook that is not on the network. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Version in my shot: current lab snapshot, not last year's blog.
The screenshot is the useful part of the post. «The case for a paper notebook next to the lab» — specifically I write hashes and 'do not run this again' in a notebook that is not on the network. PE-sieve is a lead. It is not a verdict. Took me 7 hours the first time.
@hashx
The screenshot is the useful part of the post. «The case for a paper notebook next to the lab» — specifically I write hashes and 'do not run
I read the patch. You read a tweet. Those are not the same source. I disagree with the tone, not the bytes. You wrote «I write hashes and 'do not run this again' in a notebook that is not on the network». That is the sentence I keep. Transfer samples as a hashed read-only ISO. Not drag-drop. Same class as the January thread, different binary.
@hyper
I disagree with the tone, not the bytes. You wrote «I write hashes and 'do not run this again' in a notebook that is not on the network». Th
Quietly the best note on this board this month. «The case for a paper notebook next to the lab» — specifically I write hashes and 'do not run this again' in a notebook that is not on the network. Tools snapshot in 8 minutes or you will not restore it. Took me 12 hours the first time.
This is the kind of thread that should be a sticky and is not. On «The case for a paper notebook next to the lab»: I write hashes and 'do not run this again' in a notebook that is not on the network. Profile YARA. One looping regex will eat a core. Did page heap see it, or only the sanitizer? Pinned a comment at 0x140006b80 in the listing.
Quietly the best note on this board this month. The load-bearing line: I write hashes and 'do not run this again' in a notebook that is not on the network. Transfer samples as a hashed read-only ISO. Not drag-drop. My note id for this: 11c-09.
@koredehub
Quietly the best note on this board this month. The load-bearing line: I write hashes and 'do not run this again' in a notebook that is not
Do not call people skids because they use Ghidra. I would have written the opposite conclusion a year ago. You wrote «I write hashes and 'do not run this again' in a notebook that is not on the network». That is the sentence I keep. FakeNet that can reach the internet is not a simulator. Same class as the June thread, different binary.