The plugin pile that made Ghidra slow and me superstitious

Not fully convinced yet. The load-bearing line: I removed half. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. If anyone DMs me a zip I will not open it. Hash in-thread.

@logic

Not fully convinced yet. The load-bearing line: I removed half. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. If

This belongs in the first-hour ritual. You wrote «I removed half». That is the sentence I keep. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Took me 11 hours the first time.

@modelx

This belongs in the first-hour ritual. You wrote «I removed half». That is the sentence I keep. Do not detonate in Docker. Shared kernel. VM

Take the telegram pitch to the bin. Market listing or nothing. I still keep a paper notebook for this kind of note. You wrote «I removed half». That is the sentence I keep. Clipboard off on the detonation VM. I pasted a token once. Took me 3 hours the first time.

Did this on ARM64 last week — same shape, different pain. «The plugin pile that made Ghidra slow and me superstitious» — specifically I removed half. FakeNet that can reach the internet is not a simulator. Was this on the licensed corpus or a crackme you wrote? My note id for this: 124-03.

@omega

Did this on ARM64 last week — same shape, different pain. «The plugin pile that made Ghidra slow and me superstitious» — specifically I remo

I want the listing, not the decompiler story. On «The plugin pile that made Ghidra slow and me superstitious»: I removed half. Profile YARA. One looping regex will eat a core. If anyone DMs me a zip I will not open it. Hash in-thread.

This belongs in the first-hour ritual. You wrote «I removed half». That is the sentence I keep. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Version in my shot: current lab snapshot, not last year's blog.

@xorx

I would have written the opposite conclusion a year ago. On «The plugin pile that made Ghidra slow and me superstitious»: I removed half. PE

Agreed on the class, not on the tool. On «The plugin pile that made Ghidra slow and me superstitious»: I removed half. FakeNet that can reach the internet is not a simulator. Was this on the licensed corpus or a crackme you wrote? Took me 8 hours the first time.

@iam_dave

Agreed on the class, not on the tool. On «The plugin pile that made Ghidra slow and me superstitious»: I removed half. FakeNet that can reac

I read the patch. You read a tweet. Those are not the same source. Good. Dated shot, version in the post. «The plugin pile that made Ghidra slow and me superstitious» — specifically I removed half. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. My note id for this: 124-14.

This belongs in the first-hour ritual. You wrote «I removed half». That is the sentence I keep. FakeNet that can reach the internet is not a simulator. Pinned a comment at 0x1400027f0 in the listing.

@array

This belongs in the first-hour ritual. You wrote «I removed half». That is the sentence I keep. FakeNet that can reach the internet is not a

This belongs in the first-hour ritual. You wrote «I removed half». That is the sentence I keep. Clipboard off on the detonation VM. I pasted a token once. If anyone DMs me a zip I will not open it. Hash in-thread.

This is the writeup I wanted when I was stuck. «The plugin pile that made Ghidra slow and me superstitious» — specifically I removed half. Dirty VM means throw it. Do not apt upgrade a dirty box. Took me 12 hours the first time.

@bolt

This is the writeup I wanted when I was stuck. «The plugin pile that made Ghidra slow and me superstitious» — specifically I removed half. D

Do not call people skids because they use Ghidra. I will argue the opposite and then probably agree. The load-bearing line: I removed half. Transfer samples as a hashed read-only ISO. Not drag-drop. What did you key the join on — PID or process GUID? I reproduced it on lab build 1338.

@byteon

I will argue the opposite and then probably agree. The load-bearing line: I removed half. Transfer samples as a hashed read-only ISO. Not dr

I failed this exact class in January. On «The plugin pile that made Ghidra slow and me superstitious»: I removed half. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Same class as the January thread, different binary.

I reproduced it twice before I believed you. On «The plugin pile that made Ghidra slow and me superstitious»: I removed half. Tools snapshot in 8 minutes or you will not restore it. My note id for this: 124-20.

Also: Tools snapshot in 8 minutes or you will not restore it.

This is the kind of thread that should be a sticky and is not. The load-bearing line: I removed half. Tools snapshot in 8 minutes or you will not restore it. Version in my shot: current lab snapshot, not last year's blog.

@ctrlx

This is the kind of thread that should be a sticky and is not. The load-bearing line: I removed half. Tools snapshot in 8 minutes or you wil

Take the telegram pitch to the bin. Market listing or nothing. The screenshot is the useful part of the post. The load-bearing line: I removed half. PE-sieve is a lead. It is not a verdict. If anyone DMs me a zip I will not open it. Hash in-thread.

@r4dio

This belongs in the first-hour ritual. You wrote «I removed half». That is the sentence I keep. Do not detonate in Docker. Shared kernel. VM

You are treating a checksum as a signature again. I dumped after OEP and then did this. The load-bearing line: I removed half. Tools snapshot in 8 minutes or you will not restore it. My note id for this: 124-06.

@rseclab

I dumped after OEP and then did this. The load-bearing line: I removed half. Tools snapshot in 8 minutes or you will not restore it. My note

This matches a public n-day class from last patch Tuesday. You wrote «I removed half». That is the sentence I keep. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Same class as the October thread, different binary.

I still keep a paper notebook for this kind of note. The load-bearing line: I removed half. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Was this on the licensed corpus or a crackme you wrote? If anyone DMs me a zip I will not open it. Hash in-thread.

I tried the naive path first and wasted a morning. On «The plugin pile that made Ghidra slow and me superstitious»: I removed half. Profile YARA. One looping regex will eat a core. Version in my shot: current lab snapshot, not last year's blog.

@streetwise

I tried the naive path first and wasted a morning. On «The plugin pile that made Ghidra slow and me superstitious»: I removed half. Profile

I am not moving this to DMs so you can yell. Stay on the class. This is the kind of thread that should be a sticky and is not. You wrote «I removed half». That is the sentence I keep. Tools snapshot in 8 minutes or you will not restore it. Same class as the June thread, different binary.

I will argue the opposite and then probably agree. On «The plugin pile that made Ghidra slow and me superstitious»: I removed half. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I still have the snapshot named tool-292-pre.

I would have written the opposite conclusion a year ago. On «The plugin pile that made Ghidra slow and me superstitious»: I removed half. PE-sieve is a lead. It is not a verdict. I wrote a 12-line script and then threw it away. The listing was enough.

Also: Transfer samples as a hashed read-only ISO. Not drag-drop.