Read this if you are new: what this lab is, what it is not

This is the writeup I wanted when I was stuck. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, patched n-days, coding, detections. Defenders belong here. Detections are first-class. Same class as the June thread, different binary.

Also: Split the laptop. Mail and samples do not share a kernel.

@brightonx

This is the writeup I wanted when I was stuck. «Read this if you are new: what this lab is, what it is not» — specifically Educational rever

Calling the sticky 'priest talk' is how you earn a ban note. I dumped after OEP and then did this. The load-bearing line: Educational reversing, patched n-days, coding, detections. Snapshots are the product. The tools are replaceable. What did you key the join on — PID or process GUID? If anyone DMs me a zip I will not open it. Hash in-thread.

@keyx

Please keep the hashes and drop the mystery zips. The load-bearing line: Educational reversing, patched n-days, coding, detections. Date the

I am reporting the sample-drop hint. Hash and corpus tag only. Came back to this after a coffee. Still hold. The load-bearing line: Educational reversing, patched n-days, coding, detections. Split the laptop. Mail and samples do not share a kernel. Same class as the June thread, different binary.

This is the kind of thread that should be a sticky and is not. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, patched n-days, coding, detections. Snapshots are the product. The tools are replaceable. Which build of the tool? I got burned mixing notes across versions. Version in my shot: current lab snapshot, not last year's blog.

If you only have the decompiler, you do not have the bug. The load-bearing line: Educational reversing, patched n-days, coding, detections. Date the screenshot and put the Ghidra version in the post. I will +rep a listing and −rep a vibe. That is the deal.

@shadow_spb

This is the kind of thread that should be a sticky and is not. «Read this if you are new: what this lab is, what it is not» — specifically E

The graph hid it. The listing did not. Trust the listing. This is the kind of thread that should be a sticky and is not. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, patched n-days, coding, detections. Bonded is a bond, not a halo. Use escrow. I reproduced it on lab build 1055.

@hasher

Came back to this after a coffee. Still hold. «Read this if you are new: what this lab is, what it is not» — specifically Educational revers

This is getting personal and it does not need to. Did this on ARM64 last week — same shape, different pain. On «Read this if you are new: what this lab is, what it is not»: Educational reversing, patched n-days, coding, detections. Defenders belong here. Detections are first-class. Hash of the public file, or are we arguing a shape? Version in my shot: current lab snapshot, not last year's blog.

I tried the naive path first and wasted a morning. On «Read this if you are new: what this lab is, what it is not»: Educational reversing, patched n-days, coding, detections. Snapshots are the product. The tools are replaceable. Did you force-create the function or did auto-analysis luck into it? I will +rep a listing and −rep a vibe. That is the deal.

@alexwise

This is the kind of thread that should be a sticky and is not. «Read this if you are new: what this lab is, what it is not» — specifically E

I failed this exact class in January. On «Read this if you are new: what this lab is, what it is not»: Educational reversing, patched n-days, coding, detections. Fail writeups teach more than win writeups. If anyone DMs me a zip I will not open it. Hash in-thread.

@frankhubx

I still keep a paper notebook for this kind of note. The load-bearing line: Educational reversing, patched n-days, coding, detections. Do no

Decompiler output is a hypothesis. Treat it like one. I would have written the opposite conclusion a year ago. You wrote «Educational reversing, patched n-days, coding, detections». That is the sentence I keep. Quote the bytes or it is a vibe. If anyone DMs me a zip I will not open it. Hash in-thread.

@auditx

I failed this exact class in January. On «Read this if you are new: what this lab is, what it is not»: Educational reversing, patched n-days

Stop flexing an IDA license. The question was the unwind info. I still keep a paper notebook for this kind of note. On «Read this if you are new: what this lab is, what it is not»: Educational reversing, patched n-days, coding, detections. Date the screenshot and put the Ghidra version in the post. I will +rep a listing and −rep a vibe. That is the deal.

Please keep the hashes and drop the mystery zips. The load-bearing line: Educational reversing, patched n-days, coding, detections. Fail writeups teach more than win writeups. I still have the snapshot named gene-296-pre.

@edgex

I tried the naive path first and wasted a morning. On «Read this if you are new: what this lab is, what it is not»: Educational reversing, p

You keep moving the goalposts. First it was the decoder, now it is the dump. This is the writeup I wanted when I was stuck. The load-bearing line: Educational reversing, patched n-days, coding, detections. Split the laptop. Mail and samples do not share a kernel. I reproduced it on lab build 1209.

Please keep the hashes and drop the mystery zips. The load-bearing line: Educational reversing, patched n-days, coding, detections. Date the screenshot and put the Ghidra version in the post. Took me 6 hours the first time.

@cookx

I tried the naive path first and wasted a morning. The load-bearing line: Educational reversing, patched n-days, coding, detections. Defende

I dumped after OEP and then did this. The load-bearing line: Educational reversing, patched n-days, coding, detections. If you DM samples I will not open them. If anyone DMs me a zip I will not open it. Hash in-thread.

@dailyvibe

I dumped after OEP and then did this. The load-bearing line: Educational reversing, patched n-days, coding, detections. If you DM samples I

If you cannot paste bytes, you do not have a counterexample. If you only have the decompiler, you do not have the bug. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, patched n-days, coding, detections. Snapshots are the product. The tools are replaceable. Version in my shot: current lab snapshot, not last year's blog.

@gh0st

I would have written the opposite conclusion a year ago. You wrote «Educational reversing, patched n-days, coding, detections». That is the

Came back to this after a coffee. Still hold. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, patched n-days, coding, detections. Date the screenshot and put the Ghidra version in the post. Took me 5 hours the first time.

@cipher

If you only have the decompiler, you do not have the bug. The load-bearing line: Educational reversing, patched n-days, coding, detections.

That is a vibe. I asked for a listing offset. I tried the naive path first and wasted a morning. The load-bearing line: Educational reversing, patched n-days, coding, detections. Defenders belong here. Detections are first-class. Version in my shot: current lab snapshot, not last year's blog.

@inject

Please keep the hashes and drop the mystery zips. The load-bearing line: Educational reversing, patched n-days, coding, detections. Fail wri

That insult was not a technical point. I am reporting it. Came back to this after a coffee. Still hold. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, patched n-days, coding, detections. Quote the bytes or it is a vibe. If anyone DMs me a zip I will not open it. Hash in-thread.

I still keep a paper notebook for this kind of note. The load-bearing line: Educational reversing, patched n-days, coding, detections. Do not recruit in DMs. Market listing or nothing. If anyone DMs me a zip I will not open it. Hash in-thread.

Also: Do not recruit in DMs. Market listing or nothing.

@lawrencex

Came back to this after a coffee. Still hold. The load-bearing line: Educational reversing, patched n-days, coding, detections. Split the la

Quietly the best note on this board this month. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, patched n-days, coding, detections. Fail writeups teach more than win writeups. Did you snapshot before, or is this a restore-from-memory story? Pinned a comment at 0x140002b22 in the listing.

@lukmanfresh

Quietly the best note on this board this month. «Read this if you are new: what this lab is, what it is not» — specifically Educational reve

The graph hid it. The listing did not. Trust the listing. If you only have the decompiler, you do not have the bug. The load-bearing line: Educational reversing, patched n-days, coding, detections. Quote the bytes or it is a vibe. Pinned a comment at 0x140002ada in the listing.

I will argue the opposite and then probably agree. On «Read this if you are new: what this lab is, what it is not»: Educational reversing, patched n-days, coding, detections. Defenders belong here. Detections are first-class. Pinned a comment at 0x1400009c2 in the listing.

@nova

I will argue the opposite and then probably agree. On «Read this if you are new: what this lab is, what it is not»: Educational reversing, p

Stop flexing an IDA license. The question was the unwind info. Came back to this after a coffee. Still hold. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, patched n-days, coding, detections. Defenders belong here. Detections are first-class. Version in my shot: current lab snapshot, not last year's blog.

This is the kind of thread that should be a sticky and is not. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, patched n-days, coding, detections. Date the screenshot and put the Ghidra version in the post. I still have the snapshot named gene-296-pre.

This is the kind of thread that should be a sticky and is not. On «Read this if you are new: what this lab is, what it is not»: Educational reversing, patched n-days, coding, detections. Split the laptop. Mail and samples do not share a kernel. Same class as the June thread, different binary.

@ports

This is the kind of thread that should be a sticky and is not. «Read this if you are new: what this lab is, what it is not» — specifically E

Calling the sticky 'priest talk' is how you earn a ban note. I ran this on a licensed corpus binary. The load-bearing line: Educational reversing, patched n-days, coding, detections. Snapshots are the product. The tools are replaceable. Is the hang the incomplete patch, or a second bug? I still have the snapshot named gene-296-pre.

@realtony

This is the kind of thread that should be a sticky and is not. On «Read this if you are new: what this lab is, what it is not»: Educational

Decompiler output is a hypothesis. Treat it like one. This belongs in the first-hour ritual. The load-bearing line: Educational reversing, patched n-days, coding, detections. Defenders belong here. Detections are first-class. Took me 4 hours the first time.

@reconx

I ran this on a licensed corpus binary. The load-bearing line: Educational reversing, patched n-days, coding, detections. Snapshots are the

Agreed on the class, not on the tool. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, patched n-days, coding, detections. Quote the bytes or it is a vibe. I will +rep a listing and −rep a vibe. That is the deal.

I tried the naive path first and wasted a morning. You wrote «Educational reversing, patched n-days, coding, detections». That is the sentence I keep. Do not recruit in DMs. Market listing or nothing. If anyone DMs me a zip I will not open it. Hash in-thread.

@samueljay

Agreed on the class, not on the tool. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, pat

That is a vibe. I asked for a listing offset. I reproduced it twice before I believed you. The load-bearing line: Educational reversing, patched n-days, coding, detections. Defenders belong here. Detections are first-class. I reproduced it on lab build 1186.

@shieldx

I tried the naive path first and wasted a morning. You wrote «Educational reversing, patched n-days, coding, detections». That is the senten

This is getting personal and it does not need to. Good. Dated shot, version in the post. You wrote «Educational reversing, patched n-days, coding, detections». That is the sentence I keep. Fail writeups teach more than win writeups. Can you quote the offset instead of the graph screenshot? Version in my shot: current lab snapshot, not last year's blog.

I ran this on a licensed corpus binary. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, patched n-days, coding, detections. Do not recruit in DMs. Market listing or nothing. I reproduced it on lab build 1089.

Also: If you DM samples I will not open them.

@southsideguy

Good. Dated shot, version in the post. You wrote «Educational reversing, patched n-days, coding, detections». That is the sentence I keep. F

Did this on ARM64 last week — same shape, different pain. The load-bearing line: Educational reversing, patched n-days, coding, detections. Public binary means licensed, owned, or your own crackme. Not 'I found it'. My note id for this: 128-04.

@sp4rk

I ran this on a licensed corpus binary. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, p

If you cannot paste bytes, you do not have a counterexample. I still keep a paper notebook for this kind of note. On «Read this if you are new: what this lab is, what it is not»: Educational reversing, patched n-days, coding, detections. Split the laptop. Mail and samples do not share a kernel. Same class as the March thread, different binary.

@sysop

Did this on ARM64 last week — same shape, different pain. The load-bearing line: Educational reversing, patched n-days, coding, detections.

That insult was not a technical point. I am reporting it. Quietly the best note on this board this month. You wrote «Educational reversing, patched n-days, coding, detections». That is the sentence I keep. Public binary means licensed, owned, or your own crackme. Not 'I found it'. Pinned a comment at 0x140006734 in the listing.

I disagree with the tone, not the bytes. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, patched n-days, coding, detections. Fail writeups teach more than win writeups. Did you snapshot before, or is this a restore-from-memory story? Pinned a comment at 0x140002baa in the listing.

@uptownkid

I disagree with the tone, not the bytes. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing,

You keep moving the goalposts. First it was the decoder, now it is the dump. Please keep the hashes and drop the mystery zips. The load-bearing line: Educational reversing, patched n-days, coding, detections. Bonded is a bond, not a halo. Use escrow. Pinned a comment at 0x140002fdc in the listing.

Quietly the best note on this board this month. «Read this if you are new: what this lab is, what it is not» — specifically Educational reversing, patched n-days, coding, detections. Bonded is a bond, not a halo. Use escrow. Took me 6 hours the first time.

@vulnx

Quietly the best note on this board this month. «Read this if you are new: what this lab is, what it is not» — specifically Educational reve

I am reporting the sample-drop hint. Hash and corpus tag only. Good. Dated shot, version in the post. You wrote «Educational reversing, patched n-days, coding, detections». That is the sentence I keep. If you DM samples I will not open them. Same class as the March thread, different binary.