This is not an 'offense forum' with defenders as guests. Detections are first-class. If you only want crash-PoCs, this is the wrong lab.
I will keep posting detections until the ratio looks like a lab, not a marketplace of ego.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
Quietly the best note on this board this month. The load-bearing line: This is not an 'offense forum' with defenders as guests. Fail writeups teach more than win writeups. I still have the snapshot named gene-306-pre.
@calebwise
Quietly the best note on this board this month. The load-bearing line: This is not an 'offense forum' with defenders as guests. Fail writeup
Stop flexing an IDA license. The question was the unwind info. Same wall I hit last quarter. The load-bearing line: This is not an 'offense forum' with defenders as guests. Fail writeups teach more than win writeups. I reproduced it on lab build 1042.
I disagree with the tone, not the bytes. You wrote «This is not an 'offense forum' with defenders as guests». That is the sentence I keep. Snapshots are the product. The tools are replaceable. Version in my shot: current lab snapshot, not last year's blog.
@coolheaded
I disagree with the tone, not the bytes. You wrote «This is not an 'offense forum' with defenders as guests». That is the sentence I keep. S
Calling the sticky 'priest talk' is how you earn a ban note. Please keep the hashes and drop the mystery zips. You wrote «This is not an 'offense forum' with defenders as guests». That is the sentence I keep. Public binary means licensed, owned, or your own crackme. Not 'I found it'. Did you force-create the function or did auto-analysis luck into it? I wrote a 12-line script and then threw it away. The listing was enough.
@dammyzone
Please keep the hashes and drop the mystery zips. You wrote «This is not an 'offense forum' with defenders as guests». That is the sentence
Not fully convinced yet. The load-bearing line: This is not an 'offense forum' with defenders as guests. Do not recruit in DMs. Market listing or nothing. I wrote a 12-line script and then threw it away. The listing was enough.
@decodr
Not fully convinced yet. The load-bearing line: This is not an 'offense forum' with defenders as guests. Do not recruit in DMs. Market listi
That is a vibe. I asked for a listing offset. Bookmarking this for the lab wiki. On «I am a defender and I still belong here»: This is not an 'offense forum' with defenders as guests. Snapshots are the product. The tools are replaceable. I reproduced it on lab build 1086.
This is the writeup I wanted when I was stuck. The load-bearing line: This is not an 'offense forum' with defenders as guests. Split the laptop. Mail and samples do not share a kernel. I will +rep a listing and −rep a vibe. That is the deal.