Detect-it-easy vs a hexdump I already understand

This matches a public n-day class from last patch Tuesday. «Detect-it-easy vs a hexdump I already understand» — specifically DIE for the first five seconds. PE-sieve is a lead. It is not a verdict. I still have the snapshot named tool-287-pre.

@golfx

This matches a public n-day class from last patch Tuesday. «Detect-it-easy vs a hexdump I already understand» — specifically DIE for the fir

Call-convention guess is not evidence. Bookmarking this for the lab wiki. On «Detect-it-easy vs a hexdump I already understand»: DIE for the first five seconds. PE-sieve is a lead. It is not a verdict. I still have the snapshot named tool-287-pre.

This belongs in the first-hour ritual. On «Detect-it-easy vs a hexdump I already understand»: DIE for the first five seconds. Tools snapshot in 8 minutes or you will not restore it. Same class as the January thread, different binary.

@hunt

This belongs in the first-hour ritual. On «Detect-it-easy vs a hexdump I already understand»: DIE for the first five seconds. Tools snapshot

Do not call people skids because they use Ghidra. I tried the naive path first and wasted a morning. «Detect-it-easy vs a hexdump I already understand» — specifically DIE for the first five seconds. PE-sieve is a lead. It is not a verdict. Did you force-create the function or did auto-analysis luck into it? I wrote a 12-line script and then threw it away. The listing was enough.

@intel

I tried the naive path first and wasted a morning. «Detect-it-easy vs a hexdump I already understand» — specifically DIE for the first five

If you only have the decompiler, you do not have the bug. You wrote «DIE for the first five seconds». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. My note id for this: 11f-04.

@juniorfx

If you only have the decompiler, you do not have the bug. You wrote «DIE for the first five seconds». That is the sentence I keep. Name snap

You are describing a live target. Stop. Patched class only. I reproduced it twice before I believed you. You wrote «DIE for the first five seconds». That is the sentence I keep. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Same class as the June thread, different binary.

Good. Dated shot, version in the post. The load-bearing line: DIE for the first five seconds. Tools snapshot in 8 minutes or you will not restore it. Took me 2 hours the first time.

@ledgr

Good. Dated shot, version in the post. The load-bearing line: DIE for the first five seconds. Tools snapshot in 8 minutes or you will not re

Take the telegram pitch to the bin. Market listing or nothing. Not fully convinced yet. On «Detect-it-easy vs a hexdump I already understand»: DIE for the first five seconds. Profile YARA. One looping regex will eat a core. I still have the snapshot named tool-287-pre.

I still keep a paper notebook for this kind of note. «Detect-it-easy vs a hexdump I already understand» — specifically DIE for the first five seconds. Profile YARA. One looping regex will eat a core. Which build of the tool? I got burned mixing notes across versions. I still have the snapshot named tool-287-pre.

@n0va

I still keep a paper notebook for this kind of note. «Detect-it-easy vs a hexdump I already understand» — specifically DIE for the first fiv

Quote the bytes or sit down. Came back to this after a coffee. Still hold. You wrote «DIE for the first five seconds». That is the sentence I keep. FakeNet that can reach the internet is not a simulator. Version in my shot: current lab snapshot, not last year's blog.

@null

Came back to this after a coffee. Still hold. You wrote «DIE for the first five seconds». That is the sentence I keep. FakeNet that can reac

I disagree with the tone, not the bytes. You wrote «DIE for the first five seconds». That is the sentence I keep. Profile YARA. One looping regex will eat a core. Pinned a comment at 0x140002bfe in the listing.