QEMU for the weird ISAs. VMware for the Windows detonation VM I already have. Both. Stop asking me to pick a personality.
Use the hypervisor that boots the guest you have.
Refs: FLARE VM
Lab / educational. Public binaries and patched classes only. Isolated VM.
I still keep a paper notebook for this kind of note. On «QEMU vs VMware for a firmware-ish lab»: QEMU for the weird ISAs. FakeNet that can reach the internet is not a simulator. I reproduced it on lab build 1255.
@ignitx
I still keep a paper notebook for this kind of note. On «QEMU vs VMware for a firmware-ish lab»: QEMU for the weird ISAs. FakeNet that can r
I read the patch. You read a tweet. Those are not the same source. I want the listing, not the decompiler story. The load-bearing line: QEMU for the weird ISAs. PE-sieve is a lead. It is not a verdict. Took me 11 hours the first time.
I ran this on a licensed corpus binary. On «QEMU vs VMware for a firmware-ish lab»: QEMU for the weird ISAs. FakeNet that can reach the internet is not a simulator. Version in my shot: current lab snapshot, not last year's blog.
@kernl
I ran this on a licensed corpus binary. On «QEMU vs VMware for a firmware-ish lab»: QEMU for the weird ISAs. FakeNet that can reach the inte
Call-convention guess is not evidence. Please keep the hashes and drop the mystery zips. You wrote «QEMU for the weird ISAs». That is the sentence I keep. Clipboard off on the detonation VM. I pasted a token once. Was this on the licensed corpus or a crackme you wrote? Version in my shot: current lab snapshot, not last year's blog.
@lambda
Please keep the hashes and drop the mystery zips. You wrote «QEMU for the weird ISAs». That is the sentence I keep. Clipboard off on the det
I failed this exact class in January. On «QEMU vs VMware for a firmware-ish lab»: QEMU for the weird ISAs. PE-sieve is a lead. It is not a verdict. Took me 12 hours the first time.
@logsec
I failed this exact class in January. On «QEMU vs VMware for a firmware-ish lab»: QEMU for the weird ISAs. PE-sieve is a lead. It is not a v
Do not call people skids because they use Ghidra. I reproduced it twice before I believed you. «QEMU vs VMware for a firmware-ish lab» — specifically QEMU for the weird ISAs. PE-sieve is a lead. It is not a verdict. I still have the snapshot named tool-289-pre.
Please keep the hashes and drop the mystery zips. You wrote «QEMU for the weird ISAs». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. I reproduced it on lab build 1173.
@nodefx
Please keep the hashes and drop the mystery zips. You wrote «QEMU for the weird ISAs». That is the sentence I keep. Name snapshots date plus
You are describing a live target. Stop. Patched class only. I dumped after OEP and then did this. You wrote «QEMU for the weird ISAs». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. My note id for this: 121-07.
Not fully convinced yet. You wrote «QEMU for the weird ISAs». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. After you did that, did the decompiler pick it up or did you dump? Same class as the October thread, different binary.
@pivotr
Not fully convinced yet. You wrote «QEMU for the weird ISAs». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'sna
Take the telegram pitch to the bin. Market listing or nothing. This is the writeup I wanted when I was stuck. The load-bearing line: QEMU for the weird ISAs. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Version in my shot: current lab snapshot, not last year's blog.
@realchris
This is the writeup I wanted when I was stuck. The load-bearing line: QEMU for the weird ISAs. Name snapshots date plus hash plus pre/post.
Not fully convinced yet. On «QEMU vs VMware for a firmware-ish lab»: QEMU for the weird ISAs. Tools snapshot in 8 minutes or you will not restore it. Version in my shot: current lab snapshot, not last year's blog.
@sadiqcrest
Not fully convinced yet. On «QEMU vs VMware for a firmware-ish lab»: QEMU for the weird ISAs. Tools snapshot in 8 minutes or you will not re
Quote the bytes or sit down. I want the listing, not the decompiler story. On «QEMU vs VMware for a firmware-ish lab»: QEMU for the weird ISAs. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Pinned a comment at 0x1400049ce in the listing.
I disagree with the tone, not the bytes. «QEMU vs VMware for a firmware-ish lab» — specifically QEMU for the weird ISAs. Clipboard off on the detonation VM. I pasted a token once. My note id for this: 121-12.
Also: FakeNet that can reach the internet is not a simulator.
@sodiqman
I disagree with the tone, not the bytes. «QEMU vs VMware for a firmware-ish lab» — specifically QEMU for the weird ISAs. Clipboard off on th
You are treating a checksum as a signature again. Bookmarking this for the lab wiki. «QEMU vs VMware for a firmware-ish lab» — specifically QEMU for the weird ISAs. Tools snapshot in 8 minutes or you will not restore it. Can you quote the offset instead of the graph screenshot? I wrote a 12-line script and then threw it away. The listing was enough.
This matches a public n-day class from last patch Tuesday. The load-bearing line: QEMU for the weird ISAs. Dirty VM means throw it. Do not apt upgrade a dirty box. If anyone DMs me a zip I will not open it. Hash in-thread.
@trevorhub
This matches a public n-day class from last patch Tuesday. The load-bearing line: QEMU for the weird ISAs. Dirty VM means throw it. Do not a
You skipped isolation and then asked why the box is dirty. That is on you. I reproduced it twice before I believed you. On «QEMU vs VMware for a firmware-ish lab»: QEMU for the weird ISAs. Transfer samples as a hashed read-only ISO. Not drag-drop. I will +rep a listing and −rep a vibe. That is the deal.