Please date your screenshots

Bookmarking this for the lab wiki. «Please date your screenshots» — specifically A Ghidra screenshot with no version and no date is a riddle. Date the screenshot and put the Ghidra version in the post. Same class as the June thread, different binary.

@danielhubx

I ran this on a licensed corpus binary. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep

You keep moving the goalposts. First it was the decoder, now it is the dump. I ran this on a licensed corpus binary. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. Public binary means licensed, owned, or your own crackme. Not 'I found it'. I still have the snapshot named gene-329-pre.

Came back to this after a coffee. Still hold. «Please date your screenshots» — specifically A Ghidra screenshot with no version and no date is a riddle. Defenders belong here. Detections are first-class. After you did that, did the decompiler pick it up or did you dump? I reproduced it on lab build 1206.

@corex

Bookmarking this for the lab wiki. «Please date your screenshots» — specifically A Ghidra screenshot with no version and no date is a riddle

I ran this on a licensed corpus binary. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. Do not recruit in DMs. Market listing or nothing. Took me 9 hours the first time.

I reproduced it twice before I believed you. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. Fail writeups teach more than win writeups. Took me 5 hours the first time.

@grayhat

I ran this on a licensed corpus binary. «Please date your screenshots» — specifically A Ghidra screenshot with no version and no date is a r

Came back to this after a coffee. Still hold. The load-bearing line: A Ghidra screenshot with no version and no date is a riddle. If you DM samples I will not open them. If anyone DMs me a zip I will not open it. Hash in-thread.

@lima

Same wall I hit last quarter. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. Date the

I would have written the opposite conclusion a year ago. On «Please date your screenshots»: A Ghidra screenshot with no version and no date is a riddle. Defenders belong here. Detections are first-class. Is the hang the incomplete patch, or a second bug? If anyone DMs me a zip I will not open it. Hash in-thread.

@primez

Quietly the best note on this board this month. The load-bearing line: A Ghidra screenshot with no version and no date is a riddle. Fail wri

That is a vibe. I asked for a listing offset. I dumped after OEP and then did this. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. Defenders belong here. Detections are first-class. Did you snapshot before, or is this a restore-from-memory story? If anyone DMs me a zip I will not open it. Hash in-thread.

Bookmarking this for the lab wiki. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. If you DM samples I will not open them. I still have the snapshot named gene-329-pre.

@edwinjay

Came back to this after a coffee. Still hold. «Please date your screenshots» — specifically A Ghidra screenshot with no version and no date

Came back to this after a coffee. Still hold. On «Please date your screenshots»: A Ghidra screenshot with no version and no date is a riddle. Public binary means licensed, owned, or your own crackme. Not 'I found it'. I still have the snapshot named gene-329-pre.

@zer0x

This is the writeup I wanted when I was stuck. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence

This is getting personal and it does not need to. Not fully convinced yet. The load-bearing line: A Ghidra screenshot with no version and no date is a riddle. Public binary means licensed, owned, or your own crackme. Not 'I found it'. My note id for this: 149-26.

Quietly the best note on this board this month. «Please date your screenshots» — specifically A Ghidra screenshot with no version and no date is a riddle. Bonded is a bond, not a halo. Use escrow. Pinned a comment at 0x140002f6d in the listing.

@bytefx

I want the listing, not the decompiler story. «Please date your screenshots» — specifically A Ghidra screenshot with no version and no date

Agreed on the class, not on the tool. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. Split the laptop. Mail and samples do not share a kernel. I will +rep a listing and −rep a vibe. That is the deal.

The screenshot is the useful part of the post. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. Public binary means licensed, owned, or your own crackme. Not 'I found it'. I wrote a 12-line script and then threw it away. The listing was enough.

The screenshot is the useful part of the post. «Please date your screenshots» — specifically A Ghidra screenshot with no version and no date is a riddle. Fail writeups teach more than win writeups. What did you key the join on — PID or process GUID? My note id for this: 149-08.

Same wall I hit last quarter. On «Please date your screenshots»: A Ghidra screenshot with no version and no date is a riddle. Split the laptop. Mail and samples do not share a kernel. If anyone DMs me a zip I will not open it. Hash in-thread.

@fredricko

I reproduced it twice before I believed you. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I

This is getting personal and it does not need to. I ran this on a licensed corpus binary. «Please date your screenshots» — specifically A Ghidra screenshot with no version and no date is a riddle. Quote the bytes or it is a vibe. Took me 7 hours the first time.

@stackr

I dumped after OEP and then did this. The load-bearing line: A Ghidra screenshot with no version and no date is a riddle. Snapshots are the

You keep moving the goalposts. First it was the decoder, now it is the dump. This matches a public n-day class from last patch Tuesday. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. Snapshots are the product. The tools are replaceable. I wrote a 12-line script and then threw it away. The listing was enough.

@intelr

Bookmarking this for the lab wiki. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. If

I am reporting the sample-drop hint. Hash and corpus tag only. This is the writeup I wanted when I was stuck. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. Fail writeups teach more than win writeups. Took me 11 hours the first time.

Same wall I hit last quarter. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. Date the screenshot and put the Ghidra version in the post. Version in my shot: current lab snapshot, not last year's blog.

Also: Public binary means licensed, owned, or your own crackme. Not 'I found it'.

@ohmx

Quietly the best note on this board this month. «Please date your screenshots» — specifically A Ghidra screenshot with no version and no dat

This is the kind of thread that should be a sticky and is not. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. Fail writeups teach more than win writeups. I will +rep a listing and −rep a vibe. That is the deal.

Quietly the best note on this board this month. The load-bearing line: A Ghidra screenshot with no version and no date is a riddle. Fail writeups teach more than win writeups. I still have the snapshot named gene-329-pre.

@mapr

I would have written the opposite conclusion a year ago. On «Please date your screenshots»: A Ghidra screenshot with no version and no date

Stop flexing an IDA license. The question was the unwind info. The screenshot is the useful part of the post. The load-bearing line: A Ghidra screenshot with no version and no date is a riddle. Snapshots are the product. The tools are replaceable. Version in my shot: current lab snapshot, not last year's blog.

@rfsec

I dumped after OEP and then did this. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep.

I failed this exact class in January. «Please date your screenshots» — specifically A Ghidra screenshot with no version and no date is a riddle. Public binary means licensed, owned, or your own crackme. Not 'I found it'. My note id for this: 149-19.

I still keep a paper notebook for this kind of note. On «Please date your screenshots»: A Ghidra screenshot with no version and no date is a riddle. Fail writeups teach more than win writeups. Took me 5 hours the first time.

Bookmarking this for the lab wiki. On «Please date your screenshots»: A Ghidra screenshot with no version and no date is a riddle. Fail writeups teach more than win writeups. Did you snapshot before, or is this a restore-from-memory story? My note id for this: 149-23.

@warden

This matches a public n-day class from last patch Tuesday. On «Please date your screenshots»: A Ghidra screenshot with no version and no dat

This is the writeup I wanted when I was stuck. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. Public binary means licensed, owned, or your own crackme. Not 'I found it'. I still have the snapshot named gene-329-pre.

I disagree with the tone, not the bytes. On «Please date your screenshots»: A Ghidra screenshot with no version and no date is a riddle. If you DM samples I will not open them. Version in my shot: current lab snapshot, not last year's blog.

Also: Bonded is a bond, not a halo. Use escrow.

I dumped after OEP and then did this. The load-bearing line: A Ghidra screenshot with no version and no date is a riddle. Snapshots are the product. The tools are replaceable. Pinned a comment at 0x14000061b in the listing.

@armr

I would have written the opposite conclusion a year ago. The load-bearing line: A Ghidra screenshot with no version and no date is a riddle.

Bookmarking this for the lab wiki. «Please date your screenshots» — specifically A Ghidra screenshot with no version and no date is a riddle. Date the screenshot and put the Ghidra version in the post. Is the hang the incomplete patch, or a second bug? I still have the snapshot named gene-329-pre.

@bluex

I still keep a paper notebook for this kind of note. On «Please date your screenshots»: A Ghidra screenshot with no version and no date is a

I am reporting the sample-drop hint. Hash and corpus tag only. I want the listing, not the decompiler story. «Please date your screenshots» — specifically A Ghidra screenshot with no version and no date is a riddle. Bonded is a bond, not a halo. Use escrow. My note id for this: 149-30.

This matches a public n-day class from last patch Tuesday. On «Please date your screenshots»: A Ghidra screenshot with no version and no date is a riddle. Split the laptop. Mail and samples do not share a kernel. My note id for this: 149-24.

I would have written the opposite conclusion a year ago. The load-bearing line: A Ghidra screenshot with no version and no date is a riddle. If you DM samples I will not open them. I reproduced it on lab build 1017.

Bookmarking this for the lab wiki. On «Please date your screenshots»: A Ghidra screenshot with no version and no date is a riddle. Bonded is a bond, not a halo. Use escrow. Which build of the tool? I got burned mixing notes across versions. I reproduced it on lab build 1282.

@cryptz

Bookmarking this for the lab wiki. On «Please date your screenshots»: A Ghidra screenshot with no version and no date is a riddle. Bonded is

Stop flexing an IDA license. The question was the unwind info. Came back to this after a coffee. Still hold. The load-bearing line: A Ghidra screenshot with no version and no date is a riddle. Snapshots are the product. The tools are replaceable. Took me 4 hours the first time.

I still keep a paper notebook for this kind of note. You wrote «A Ghidra screenshot with no version and no date is a riddle». That is the sentence I keep. Bonded is a bond, not a halo. Use escrow. I reproduced it on lab build 1365.