>_0xFORUM
Sign in
locked

When a joke is a threat and I am not laughing

in General55 replies878 views

Jokes about doxxing, about dropping samples on someone's host, about swatting. Not jokes. Bans.

If you need this explained you will not like the ban note.

Refs: ATT&CK

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 55 REPLIES

I reproduced it twice before I believed you. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about swatting. Public binary means licensed, owned, or your own crackme. Not 'I found it'. Same class as the January thread, different binary.

@agentz

I reproduced it twice before I believed you. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about swa

Quote the bytes or sit down. I will argue the opposite and then probably agree. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someone's host, about swatting. Do not recruit in DMs. Market listing or nothing. Is the hang the incomplete patch, or a second bug? I will +rep a listing and −rep a vibe. That is the deal.

Agreed on the class, not on the tool. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping samples on someone's host, about swatting. Defenders belong here. Detections are first-class. I reproduced it on lab build 1252.

Also: Fail writeups teach more than win writeups.

@bf0rc

Agreed on the class, not on the tool. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping sam

You are treating a checksum as a signature again. I still keep a paper notebook for this kind of note. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the sentence I keep. If you DM samples I will not open them. Version in my shot: current lab snapshot, not last year's blog.

@brandonhub

I still keep a paper notebook for this kind of note. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swattin

Came back to this after a coffee. Still hold. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the sentence I keep. Defenders belong here. Detections are first-class. If anyone DMs me a zip I will not open it. Hash in-thread.

@bytez

Came back to this after a coffee. Still hold. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». Tha

You skipped isolation and then asked why the box is dirty. That is on you. Same wall I hit last quarter. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the sentence I keep. Snapshots are the product. The tools are replaceable. Version in my shot: current lab snapshot, not last year's blog.

Bookmarking this for the lab wiki. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping samples on someone's host, about swatting. Snapshots are the product. The tools are replaceable. Was this on the licensed corpus or a crackme you wrote? I wrote a 12-line script and then threw it away. The listing was enough.

@connectpro

Bookmarking this for the lab wiki. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping sample

I am not moving this to DMs so you can yell. Stay on the class. I ran this on a licensed corpus binary. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about swatting. If you DM samples I will not open them. My note id for this: 141-49.

I still keep a paper notebook for this kind of note. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about swatting. Snapshots are the product. The tools are replaceable. Took me 9 hours the first time.

banned sgdt — doxx threat. Permanent. Locked.

I ran this on a licensed corpus binary. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the sentence I keep. If you DM samples I will not open them. If anyone DMs me a zip I will not open it. Hash in-thread.

@r4dio

I ran this on a licensed corpus binary. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is t

Take the telegram pitch to the bin. Market listing or nothing. Please keep the hashes and drop the mystery zips. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping samples on someone's host, about swatting. Quote the bytes or it is a vibe. Pinned a comment at 0x1400000e0 in the listing.

If you only have the decompiler, you do not have the bug. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about swatting. Defenders belong here. Detections are first-class. Did you snapshot before, or is this a restore-from-memory story? My note id for this: 141-08.

@iam_dave

If you only have the decompiler, you do not have the bug. The load-bearing line: Jokes about doxxing, about dropping samples on someone's ho

I am not moving this to DMs so you can yell. Stay on the class. Agreed on the class, not on the tool. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping samples on someone's host, about swatting. Fail writeups teach more than win writeups. I will +rep a listing and −rep a vibe. That is the deal.

@agentx

Agreed on the class, not on the tool. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping sam

I still keep a paper notebook for this kind of note. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the sentence I keep. Bonded is a bond, not a halo. Use escrow. I reproduced it on lab build 1225.

@array

I still keep a paper notebook for this kind of note. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swattin

That is not what the listing shows. You are arguing a vibe. I failed this exact class in January. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about swatting. Public binary means licensed, owned, or your own crackme. Not 'I found it'. Same class as the October thread, different binary.

Came back to this after a coffee. Still hold. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the sentence I keep. Snapshots are the product. The tools are replaceable. Same class as the October thread, different binary.

Also: Defenders belong here. Detections are first-class.

@bolt

Came back to this after a coffee. Still hold. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». Tha

I read the patch. You read a tweet. Those are not the same source. I will argue the opposite and then probably agree. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about swatting. Split the laptop. Mail and samples do not share a kernel. After you did that, did the decompiler pick it up or did you dump? My note id for this: 141-13.

Did this on ARM64 last week — same shape, different pain. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someone's host, about swatting. If you DM samples I will not open them. If anyone DMs me a zip I will not open it. Hash in-thread.

@chriszone

Did this on ARM64 last week — same shape, different pain. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dro

Call-convention guess is not evidence. I reproduced it twice before I believed you. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping samples on someone's host, about swatting. Defenders belong here. Detections are first-class. My note id for this: 141-15.

@collinshub

I reproduced it twice before I believed you. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropp

I disagree with the tone, not the bytes. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someone's host, about swatting. Fail writeups teach more than win writeups. My note id for this: 141-16.

@ctrlx

I disagree with the tone, not the bytes. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on

Do not call people skids because they use Ghidra. Quietly the best note on this board this month. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about swatting. Date the screenshot and put the Ghidra version in the post. Took me 10 hours the first time.

I want the listing, not the decompiler story. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about swatting. Do not recruit in DMs. Market listing or nothing. Can you quote the offset instead of the graph screenshot? Took me 12 hours the first time.

@eastcoastkid

I want the listing, not the decompiler story. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about sw

You are describing a live target. Stop. Patched class only. The screenshot is the useful part of the post. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about swatting. Public binary means licensed, owned, or your own crackme. Not 'I found it'. I will +rep a listing and −rep a vibe. That is the deal.

This is the writeup I wanted when I was stuck. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping samples on someone's host, about swatting. If you DM samples I will not open them. Same class as the March thread, different binary.

Also: Public binary means licensed, owned, or your own crackme. Not 'I found it'.

@force

This is the writeup I wanted when I was stuck. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dro

Take the telegram pitch to the bin. Market listing or nothing. I tried the naive path first and wasted a morning. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the sentence I keep. If you DM samples I will not open them. If anyone DMs me a zip I will not open it. Hash in-thread.

@gammx

I tried the naive path first and wasted a morning. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting»

Came back to this after a coffee. Still hold. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about swatting. Snapshots are the product. The tools are replaceable. I still have the snapshot named gene-321-pre.

@guardz

Came back to this after a coffee. Still hold. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about sw

Quote the bytes or sit down. I ran this on a licensed corpus binary. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someone's host, about swatting. If you DM samples I will not open them. Hash of the public file, or are we arguing a shape? If anyone DMs me a zip I will not open it. Hash in-thread.

Agreed on the class, not on the tool. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping samples on someone's host, about swatting. Fail writeups teach more than win writeups. Pinned a comment at 0x140004161 in the listing.

@ignitx

Agreed on the class, not on the tool. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping sam

You are treating a checksum as a signature again. Not fully convinced yet. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the sentence I keep. Snapshots are the product. The tools are replaceable. I wrote a 12-line script and then threw it away. The listing was enough.

I failed this exact class in January. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someone's host, about swatting. Snapshots are the product. The tools are replaceable. Took me 2 hours the first time.

@kernl

I failed this exact class in January. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on som

You skipped isolation and then asked why the box is dirty. That is on you. Quietly the best note on this board this month. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping samples on someone's host, about swatting. Fail writeups teach more than win writeups. Pinned a comment at 0x140006161 in the listing.

@lambda

Quietly the best note on this board this month. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dr

I want the listing, not the decompiler story. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someone's host, about swatting. Bonded is a bond, not a halo. Use escrow. After you did that, did the decompiler pick it up or did you dump? My note id for this: 141-28.

@logsec

I want the listing, not the decompiler story. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping sample

I am not moving this to DMs so you can yell. Stay on the class. Quietly the best note on this board this month. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someone's host, about swatting. If you DM samples I will not open them. If anyone DMs me a zip I will not open it. Hash in-thread.

The screenshot is the useful part of the post. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the sentence I keep. Defenders belong here. Detections are first-class. Same class as the January thread, different binary.

@nodefx

The screenshot is the useful part of the post. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». Th

That is not what the listing shows. You are arguing a vibe. I ran this on a licensed corpus binary. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someone's host, about swatting. Date the screenshot and put the Ghidra version in the post. My note id for this: 141-31.

Bookmarking this for the lab wiki. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someone's host, about swatting. Split the laptop. Mail and samples do not share a kernel. I still have the snapshot named gene-321-pre.

@pivotr

Bookmarking this for the lab wiki. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someon

I read the patch. You read a tweet. Those are not the same source. This matches a public n-day class from last patch Tuesday. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping samples on someone's host, about swatting. Quote the bytes or it is a vibe. Did page heap see it, or only the sanitizer? Pinned a comment at 0x140006aec in the listing.

@realchris

This matches a public n-day class from last patch Tuesday. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxin

I failed this exact class in January. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the sentence I keep. Defenders belong here. Detections are first-class. My note id for this: 141-34.

This is the kind of thread that should be a sticky and is not. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the sentence I keep. Bonded is a bond, not a halo. Use escrow. If anyone DMs me a zip I will not open it. Hash in-thread.

@sadiqcrest

I failed this exact class in January. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the

Call-convention guess is not evidence. I will argue the opposite and then probably agree. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping samples on someone's host, about swatting. If you DM samples I will not open them. Pinned a comment at 0x140000869 in the listing.

@seyiwave

This is the kind of thread that should be a sticky and is not. You wrote «Jokes about doxxing, about dropping samples on someone's host, abo

Quote the bytes or sit down. Please keep the hashes and drop the mystery zips. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about dropping samples on someone's host, about swatting. Public binary means licensed, owned, or your own crackme. Not 'I found it'. Did you snapshot before, or is this a restore-from-memory story? I wrote a 12-line script and then threw it away. The listing was enough.

Came back to this after a coffee. Still hold. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about swatting. Defenders belong here. Detections are first-class. Same class as the January thread, different binary.

Also: Date the screenshot and put the Ghidra version in the post.

Soft forum. I already have the LinkedIn. Relax.

Funny if someone posted that skid's city and workplace. They would calm down. Joke. Unless.

@xray

This is the writeup I wanted when I was stuck. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping sampl

Take the telegram pitch to the bin. Market listing or nothing. This is the writeup I wanted when I was stuck. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someone's host, about swatting. Quote the bytes or it is a vibe. Version in my shot: current lab snapshot, not last year's blog.

@sodiqman

Came back to this after a coffee. Still hold. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about sw

Do not call people skids because they use Ghidra. I failed this exact class in January. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someone's host, about swatting. Split the laptop. Mail and samples do not share a kernel. Pinned a comment at 0x140004400 in the listing.

@sockx

Please keep the hashes and drop the mystery zips. «When a joke is a threat and I am not laughing» — specifically Jokes about doxxing, about

I want the listing, not the decompiler story. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the sentence I keep. Split the laptop. Mail and samples do not share a kernel. Pinned a comment at 0x140006ef7 in the listing.

If you only have the decompiler, you do not have the bug. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the sentence I keep. Bonded is a bond, not a halo. Use escrow. Can you quote the offset instead of the graph screenshot? Version in my shot: current lab snapshot, not last year's blog.

@streetwise

I want the listing, not the decompiler story. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». Tha

You are treating a checksum as a signature again. Did this on ARM64 last week — same shape, different pain. You wrote «Jokes about doxxing, about dropping samples on someone's host, about swatting». That is the sentence I keep. Defenders belong here. Detections are first-class. If anyone DMs me a zip I will not open it. Hash in-thread.

I would have written the opposite conclusion a year ago. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someone's host, about swatting. Fail writeups teach more than win writeups. Same class as the March thread, different binary.

@trevorhub

If you only have the decompiler, you do not have the bug. You wrote «Jokes about doxxing, about dropping samples on someone's host, about sw

You are describing a live target. Stop. Patched class only. I still keep a paper notebook for this kind of note. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someone's host, about swatting. Bonded is a bond, not a halo. Use escrow. If anyone DMs me a zip I will not open it. Hash in-thread.

@vmx

I would have written the opposite conclusion a year ago. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about drop

You skipped isolation and then asked why the box is dirty. That is on you. I still keep a paper notebook for this kind of note. The load-bearing line: Jokes about doxxing, about dropping samples on someone's host, about swatting. Bonded is a bond, not a halo. Use escrow. I will +rep a listing and −rep a vibe. That is the deal.

@volt

I still keep a paper notebook for this kind of note. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping

This is the writeup I wanted when I was stuck. On «When a joke is a threat and I am not laughing»: Jokes about doxxing, about dropping samples on someone's host, about swatting. Do not recruit in DMs. Market listing or nothing. Version in my shot: current lab snapshot, not last year's blog.

Thread is locked. Replies are closed.