>_0xFORUM
Sign in

When to DM and when to post

in General33 replies700 views

Post if it is a class. DM if it is a personal repo link you are willing to license. Do not DM me a sample.

If you DM me a sample I will not open it and I will be rude in the DM. Then I will post this again.

Refs: CVE Program

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 33 REPLIES

I reproduced it twice before I believed you. You wrote «Post if it is a class». That is the sentence I keep. Fail writeups teach more than win writeups. I reproduced it on lab build 1201.

@cloud

I reproduced it twice before I believed you. You wrote «Post if it is a class». That is the sentence I keep. Fail writeups teach more than w

I will argue the opposite and then probably agree. On «When to DM and when to post»: Post if it is a class. Do not recruit in DMs. Market listing or nothing. My note id for this: 133-01.

@crypta

I will argue the opposite and then probably agree. On «When to DM and when to post»: Post if it is a class. Do not recruit in DMs. Market li

Decompiler output is a hypothesis. Treat it like one. I reproduced it twice before I believed you. «When to DM and when to post» — specifically Post if it is a class. Public binary means licensed, owned, or your own crackme. Not 'I found it'. I reproduced it on lab build 1320.

Agreed on the class, not on the tool. On «When to DM and when to post»: Post if it is a class. Fail writeups teach more than win writeups. Did you snapshot before, or is this a restore-from-memory story? I reproduced it on lab build 1290.

@derekconnect

Agreed on the class, not on the tool. On «When to DM and when to post»: Post if it is a class. Fail writeups teach more than win writeups. D

I failed this exact class in January. «When to DM and when to post» — specifically Post if it is a class. Fail writeups teach more than win writeups. Same class as the March thread, different binary.

Came back to this after a coffee. Still hold. The load-bearing line: Post if it is a class. Bonded is a bond, not a halo. Use escrow. I wrote a 12-line script and then threw it away. The listing was enough.

@flarex

Came back to this after a coffee. Still hold. The load-bearing line: Post if it is a class. Bonded is a bond, not a halo. Use escrow. I wrot

That insult was not a technical point. I am reporting it. I ran this on a licensed corpus binary. The load-bearing line: Post if it is a class. Public binary means licensed, owned, or your own crackme. Not 'I found it'. I reproduced it on lab build 1229.

@freqx

I ran this on a licensed corpus binary. The load-bearing line: Post if it is a class. Public binary means licensed, owned, or your own crack

If you only have the decompiler, you do not have the bug. On «When to DM and when to post»: Post if it is a class. Quote the bytes or it is a vibe. I wrote a 12-line script and then threw it away. The listing was enough.

I dumped after OEP and then did this. «When to DM and when to post» — specifically Post if it is a class. If you DM samples I will not open them. Hash of the public file, or are we arguing a shape? Version in my shot: current lab snapshot, not last year's blog.

I want the listing, not the decompiler story. On «When to DM and when to post»: Post if it is a class. Do not recruit in DMs. Market listing or nothing. I reproduced it on lab build 1255.

@iam_sammy

I want the listing, not the decompiler story. On «When to DM and when to post»: Post if it is a class. Do not recruit in DMs. Market listing

The graph hid it. The listing did not. Trust the listing. I ran this on a licensed corpus binary. «When to DM and when to post» — specifically Post if it is a class. Date the screenshot and put the Ghidra version in the post. My note id for this: 133-10.

I dumped after OEP and then did this. «When to DM and when to post» — specifically Post if it is a class. Fail writeups teach more than win writeups. My note id for this: 133-11.

This belongs in the first-hour ritual. On «When to DM and when to post»: Post if it is a class. Quote the bytes or it is a vibe. Version in my shot: current lab snapshot, not last year's blog.

Also: Bonded is a bond, not a halo. Use escrow.

@labs

This belongs in the first-hour ritual. On «When to DM and when to post»: Post if it is a class. Quote the bytes or it is a vibe. Version in

I reproduced it twice before I believed you. «When to DM and when to post» — specifically Post if it is a class. If you DM samples I will not open them. Hash of the public file, or are we arguing a shape? Took me 12 hours the first time.

@loader

I reproduced it twice before I believed you. «When to DM and when to post» — specifically Post if it is a class. If you DM samples I will no

Calling the sticky 'priest talk' is how you earn a ban note. I will argue the opposite and then probably agree. On «When to DM and when to post»: Post if it is a class. Split the laptop. Mail and samples do not share a kernel. I still have the snapshot named gene-307-pre.

Please keep the hashes and drop the mystery zips. The load-bearing line: Post if it is a class. Do not recruit in DMs. Market listing or nothing. I reproduced it on lab build 1006.

@netsec

Please keep the hashes and drop the mystery zips. The load-bearing line: Post if it is a class. Do not recruit in DMs. Market listing or not

I tried the naive path first and wasted a morning. «When to DM and when to post» — specifically Post if it is a class. Snapshots are the product. The tools are replaceable. Version in my shot: current lab snapshot, not last year's blog.

If you only have the decompiler, you do not have the bug. The load-bearing line: Post if it is a class. Bonded is a bond, not a halo. Use escrow. I reproduced it on lab build 1328.

@patch

If you only have the decompiler, you do not have the bug. The load-bearing line: Post if it is a class. Bonded is a bond, not a halo. Use es

If you cannot paste bytes, you do not have a counterexample. I reproduced it twice before I believed you. You wrote «Post if it is a class». That is the sentence I keep. Do not recruit in DMs. Market listing or nothing. After you did that, did the decompiler pick it up or did you dump? Pinned a comment at 0x1400042ba in the listing.

Not fully convinced yet. The load-bearing line: Post if it is a class. Fail writeups teach more than win writeups. Took me 2 hours the first time.

@rr_or_gtfo

Not fully convinced yet. The load-bearing line: Post if it is a class. Fail writeups teach more than win writeups. Took me 2 hours the first

Agreed on the class, not on the tool. «When to DM and when to post» — specifically Post if it is a class. Do not recruit in DMs. Market listing or nothing. Did page heap see it, or only the sanitizer? I will +rep a listing and −rep a vibe. That is the deal.

This is the kind of thread that should be a sticky and is not. On «When to DM and when to post»: Post if it is a class. Split the laptop. Mail and samples do not share a kernel. I wrote a 12-line script and then threw it away. The listing was enough.

@babatunde_k

This is the kind of thread that should be a sticky and is not. On «When to DM and when to post»: Post if it is a class. Split the laptop. Ma

The graph hid it. The listing did not. Trust the listing. This is the kind of thread that should be a sticky and is not. On «When to DM and when to post»: Post if it is a class. Public binary means licensed, owned, or your own crackme. Not 'I found it'. I still have the snapshot named gene-307-pre.

@blk

This is the kind of thread that should be a sticky and is not. On «When to DM and when to post»: Post if it is a class. Public binary means

This matches a public n-day class from last patch Tuesday. The load-bearing line: Post if it is a class. Date the screenshot and put the Ghidra version in the post. Pinned a comment at 0x140002d9a in the listing.

I ran this on a licensed corpus binary. On «When to DM and when to post»: Post if it is a class. Date the screenshot and put the Ghidra version in the post. My note id for this: 133-32.

@proxyx

I reproduced it twice before I believed you. You wrote «Post if it is a class». That is the sentence I keep. Do not recruit in DMs. Market l

I tried the naive path first and wasted a morning. On «When to DM and when to post»: Post if it is a class. Public binary means licensed, owned, or your own crackme. Not 'I found it'. I wrote a 12-line script and then threw it away. The listing was enough.

Agreed on the class, not on the tool. The load-bearing line: Post if it is a class. Fail writeups teach more than win writeups. Took me 11 hours the first time.

Also: Date the screenshot and put the Ghidra version in the post.

This matches a public n-day class from last patch Tuesday. You wrote «Post if it is a class». That is the sentence I keep. Bonded is a bond, not a halo. Use escrow. Took me 7 hours the first time.

@smartken

This matches a public n-day class from last patch Tuesday. You wrote «Post if it is a class». That is the sentence I keep. Bonded is a bond,

Decompiler output is a hypothesis. Treat it like one. Did this on ARM64 last week — same shape, different pain. The load-bearing line: Post if it is a class. Snapshots are the product. The tools are replaceable. I still have the snapshot named gene-307-pre.

I want the listing, not the decompiler story. The load-bearing line: Post if it is a class. Fail writeups teach more than win writeups. Hash of the public file, or are we arguing a shape? Took me 4 hours the first time.

Did this on ARM64 last week — same shape, different pain. «When to DM and when to post» — specifically Post if it is a class. Snapshots are the product. The tools are replaceable. Same class as the June thread, different binary.

@victor_lee

Did this on ARM64 last week — same shape, different pain. «When to DM and when to post» — specifically Post if it is a class. Snapshots are

Did this on ARM64 last week — same shape, different pain. You wrote «Post if it is a class». That is the sentence I keep. Do not recruit in DMs. Market listing or nothing. Pinned a comment at 0x1400002f2 in the listing.

@white

Did this on ARM64 last week — same shape, different pain. You wrote «Post if it is a class». That is the sentence I keep. Do not recruit in

That insult was not a technical point. I am reporting it. I dumped after OEP and then did this. The load-bearing line: Post if it is a class. Date the screenshot and put the Ghidra version in the post. If anyone DMs me a zip I will not open it. Hash in-thread.

Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.