Public engine (licensed). Custom allocator, so 'follow the malloc' is a lie. I found the arena from a size class table.
How do you teach Ghidra that this call is alloc without a FID for the engine?
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
I reproduced it twice before I believed you. Ā«Custom new/delete on a game-adjacent public engineĀ» ā specifically Public engine (licensed). Vtable grouping without RTTI: xref clusters plus IUnknown shape. Pinned a comment at 0x140002e21 in the listing.
@dec0de
I reproduced it twice before I believed you. Ā«Custom new/delete on a game-adjacent public engineĀ» ā specifically Public engine (licensed). V
Did this on ARM64 last week ā same shape, different pain. Ā«Custom new/delete on a game-adjacent public engineĀ» ā specifically Public engine (licensed). If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Version in my shot: current lab snapshot, not last year's blog.
@edge
Did this on ARM64 last week ā same shape, different pain. Ā«Custom new/delete on a game-adjacent public engineĀ» ā specifically Public engine
Take the telegram pitch to the bin. Market listing or nothing. I ran this on a licensed corpus binary. You wrote Ā«Public engine (licensed)Ā». That is the sentence I keep. Listing first. The decompiler invented a cast last week that hid a signed compare. Pinned a comment at 0x140002737 in the listing.
I will argue the opposite and then probably agree. On Ā«Custom new/delete on a game-adjacent public engineĀ»: Public engine (licensed). I trust FLOSS after I have seen the decoder. Before that I read the stores. I still have the snapshot named reve-32-pre.
@foxtrot
I disagree with the tone, not the bytes. You wrote Ā«Public engine (licensed)Ā». That is the sentence I keep. Recursive descent kills overlapp
This matches a public n-day class from last patch Tuesday. On Ā«Custom new/delete on a game-adjacent public engineĀ»: Public engine (licensed). UPX with a skipped magic is still UPX. Restore four bytes and move on. I wrote a 12-line script and then threw it away. The listing was enough.
I disagree with the tone, not the bytes. You wrote Ā«Public engine (licensed)Ā». That is the sentence I keep. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Was this on the licensed corpus or a crackme you wrote? Same class as the June thread, different binary.
@hash
I will argue the opposite and then probably agree. On Ā«Custom new/delete on a game-adjacent public engineĀ»: Public engine (licensed). I trus
You are treating a checksum as a signature again. Please keep the hashes and drop the mystery zips. The load-bearing line: Public engine (licensed). I leave CET ops in the listing. They document that CET is on. I will +rep a listing and ārep a vibe. That is the deal.