When the tool is a 2014 blog post and it still works

This matches a public n-day class from last patch Tuesday. «When the tool is a 2014 blog post and it still works» — specifically I mirrored it. Transfer samples as a hashed read-only ISO. Not drag-drop. Same class as the June thread, different binary.

@softspoken

This matches a public n-day class from last patch Tuesday. «When the tool is a 2014 blog post and it still works» — specifically I mirrored

You skipped isolation and then asked why the box is dirty. That is on you. Not fully convinced yet. «When the tool is a 2014 blog post and it still works» — specifically I mirrored it. PE-sieve is a lead. It is not a verdict. I will +rep a listing and −rep a vibe. That is the deal.

The screenshot is the useful part of the post. On «When the tool is a 2014 blog post and it still works»: I mirrored it. FakeNet that can reach the internet is not a simulator. I still have the snapshot named tool-295-pre.

@ttyx

The screenshot is the useful part of the post. On «When the tool is a 2014 blog post and it still works»: I mirrored it. FakeNet that can re

I am not moving this to DMs so you can yell. Stay on the class. Agreed on the class, not on the tool. The load-bearing line: I mirrored it. PE-sieve is a lead. It is not a verdict. Which build of the tool? I got burned mixing notes across versions. My note id for this: 127-03.

If you only have the decompiler, you do not have the bug. «When the tool is a 2014 blog post and it still works» — specifically I mirrored it. Tools snapshot in 8 minutes or you will not restore it. Same class as the March thread, different binary.

@youngdave

If you only have the decompiler, you do not have the bug. The load-bearing line: I mirrored it. Do not detonate in Docker. Shared kernel. VM

That is not what the listing shows. You are arguing a vibe. Did this on ARM64 last week — same shape, different pain. «When the tool is a 2014 blog post and it still works» — specifically I mirrored it. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. I still have the snapshot named tool-295-pre.

@buffr

Came back to this after a coffee. Still hold. You wrote «I mirrored it». That is the sentence I keep. Caps on the drop folder saved the box.

Bookmarking this for the lab wiki. «When the tool is a 2014 blog post and it still works» — specifically I mirrored it. Profile YARA. One looping regex will eat a core. If anyone DMs me a zip I will not open it. Hash in-thread.

@analyst

If you only have the decompiler, you do not have the bug. «When the tool is a 2014 blog post and it still works» — specifically I mirrored i

I read the patch. You read a tweet. Those are not the same source. I will argue the opposite and then probably agree. «When the tool is a 2014 blog post and it still works» — specifically I mirrored it. Clipboard off on the detonation VM. I pasted a token once. I reproduced it on lab build 1326.

@bitwse

Same wall I hit last quarter. The load-bearing line: I mirrored it. Profile YARA. One looping regex will eat a core. Can you quote the offse

Call-convention guess is not evidence. Came back to this after a coffee. Still hold. You wrote «I mirrored it». That is the sentence I keep. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I will +rep a listing and −rep a vibe. That is the deal.

Same wall I hit last quarter. The load-bearing line: I mirrored it. Profile YARA. One looping regex will eat a core. Can you quote the offset instead of the graph screenshot? My note id for this: 127-08.

@vuln

Agreed on the class, not on the tool. The load-bearing line: I mirrored it. PE-sieve is a lead. It is not a verdict. Which build of the tool

If you only have the decompiler, you do not have the bug. The load-bearing line: I mirrored it. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. I will +rep a listing and −rep a vibe. That is the deal.