Tools snapshot updates weekly. Analysis VMs restore from last detonation snapshot and stay dirty until I throw them away. Do not 'apt upgrade' a dirty VM.
Dirty means dirty. Throw it.
Refs: FLARE VM
Lab / educational. Public binaries and patched classes only. Isolated VM.
The screenshot is the useful part of the post. You wrote «Tools snapshot updates weekly». That is the sentence I keep. Transfer samples as a hashed read-only ISO. Not drag-drop. My note id for this: 11d-00.
@enc0de
The screenshot is the useful part of the post. You wrote «Tools snapshot updates weekly». That is the sentence I keep. Transfer samples as a
Do not call people skids because they use Ghidra. This matches a public n-day class from last patch Tuesday. You wrote «Tools snapshot updates weekly». That is the sentence I keep. Tools snapshot in 8 minutes or you will not restore it. If anyone DMs me a zip I will not open it. Hash in-thread.
I ran this on a licensed corpus binary. On «Updating tools without updating the analysis VM»: Tools snapshot updates weekly. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. I still have the snapshot named tool-285-pre.
@g4te
I ran this on a licensed corpus binary. On «Updating tools without updating the analysis VM»: Tools snapshot updates weekly. Name snapshots
You are describing a live target. Stop. Patched class only. Quietly the best note on this board this month. You wrote «Tools snapshot updates weekly». That is the sentence I keep. PE-sieve is a lead. It is not a verdict. Can you quote the offset instead of the graph screenshot? I reproduced it on lab build 1179.
@gridx
Quietly the best note on this board this month. You wrote «Tools snapshot updates weekly». That is the sentence I keep. PE-sieve is a lead.
Agreed on the class, not on the tool. On «Updating tools without updating the analysis VM»: Tools snapshot updates weekly. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. I wrote a 12-line script and then threw it away. The listing was enough.
@heapz
Agreed on the class, not on the tool. On «Updating tools without updating the analysis VM»: Tools snapshot updates weekly. Name snapshots da
Take the telegram pitch to the bin. Market listing or nothing. Agreed on the class, not on the tool. You wrote «Tools snapshot updates weekly». That is the sentence I keep. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. I will +rep a listing and −rep a vibe. That is the deal.
Came back to this after a coffee. Still hold. «Updating tools without updating the analysis VM» — specifically Tools snapshot updates weekly. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. My note id for this: 11d-06.
@iso
Came back to this after a coffee. Still hold. «Updating tools without updating the analysis VM» — specifically Tools snapshot updates weekly
Quote the bytes or sit down. This belongs in the first-hour ritual. On «Updating tools without updating the analysis VM»: Tools snapshot updates weekly. Dirty VM means throw it. Do not apt upgrade a dirty box. Version in my shot: current lab snapshot, not last year's blog.
Did this on ARM64 last week — same shape, different pain. «Updating tools without updating the analysis VM» — specifically Tools snapshot updates weekly. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Did you force-create the function or did auto-analysis luck into it? If anyone DMs me a zip I will not open it. Hash in-thread.
@labx
Did this on ARM64 last week — same shape, different pain. «Updating tools without updating the analysis VM» — specifically Tools snapshot up
You are treating a checksum as a signature again. This is the writeup I wanted when I was stuck. «Updating tools without updating the analysis VM» — specifically Tools snapshot updates weekly. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I still have the snapshot named tool-285-pre.
@lock
This is the writeup I wanted when I was stuck. «Updating tools without updating the analysis VM» — specifically Tools snapshot updates weekl
Did this on ARM64 last week — same shape, different pain. The load-bearing line: Tools snapshot updates weekly. Transfer samples as a hashed read-only ISO. Not drag-drop. Pinned a comment at 0x140002ad1 in the listing.
@michaelson
Did this on ARM64 last week — same shape, different pain. The load-bearing line: Tools snapshot updates weekly. Transfer samples as a hashed
You skipped isolation and then asked why the box is dirty. That is on you. I want the listing, not the decompiler story. The load-bearing line: Tools snapshot updates weekly. FakeNet that can reach the internet is not a simulator. Version in my shot: current lab snapshot, not last year's blog.
This is the kind of thread that should be a sticky and is not. On «Updating tools without updating the analysis VM»: Tools snapshot updates weekly. Transfer samples as a hashed read-only ISO. Not drag-drop. Same class as the March thread, different binary.
Also: PE-sieve is a lead. It is not a verdict.
@oluwafemi
This is the kind of thread that should be a sticky and is not. On «Updating tools without updating the analysis VM»: Tools snapshot updates
I am not moving this to DMs so you can yell. Stay on the class. Same wall I hit last quarter. The load-bearing line: Tools snapshot updates weekly. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Can you quote the offset instead of the graph screenshot? Version in my shot: current lab snapshot, not last year's blog.
Not fully convinced yet. The load-bearing line: Tools snapshot updates weekly. Tools snapshot in 8 minutes or you will not restore it. Same class as the June thread, different binary.
@pwner
Not fully convinced yet. The load-bearing line: Tools snapshot updates weekly. Tools snapshot in 8 minutes or you will not restore it. Same
That is not what the listing shows. You are arguing a vibe. I failed this exact class in January. «Updating tools without updating the analysis VM» — specifically Tools snapshot updates weekly. FakeNet that can reach the internet is not a simulator. Took me 4 hours the first time.
@routx
I failed this exact class in January. «Updating tools without updating the analysis VM» — specifically Tools snapshot updates weekly. FakeNe
Please keep the hashes and drop the mystery zips. On «Updating tools without updating the analysis VM»: Tools snapshot updates weekly. Transfer samples as a hashed read-only ISO. Not drag-drop. If anyone DMs me a zip I will not open it. Hash in-thread.
@segv
Please keep the hashes and drop the mystery zips. On «Updating tools without updating the analysis VM»: Tools snapshot updates weekly. Trans
I read the patch. You read a tweet. Those are not the same source. Bookmarking this for the lab wiki. On «Updating tools without updating the analysis VM»: Tools snapshot updates weekly. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Same class as the June thread, different binary.
This is the writeup I wanted when I was stuck. «Updating tools without updating the analysis VM» — specifically Tools snapshot updates weekly. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. Did you force-create the function or did auto-analysis luck into it? Took me 3 hours the first time.
@stanleycool
This is the writeup I wanted when I was stuck. «Updating tools without updating the analysis VM» — specifically Tools snapshot updates weekl
Call-convention guess is not evidence. This matches a public n-day class from last patch Tuesday. On «Updating tools without updating the analysis VM»: Tools snapshot updates weekly. Profile YARA. One looping regex will eat a core. Pinned a comment at 0x140006102 in the listing.