Public loader-style crackme. Hash + PIC stub, then a normal IAT. I named the stub Resolve and the hash table.
Do you keep the stub as one function or split per resolved API?
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
This matches a public n-day class from last patch Tuesday. On «Import-by-hash plus a tiny PIC stub — naming in Ghidra»: Public loader-style crackme. I leave CET ops in the listing. They document that CET is on. Version in my shot: current lab snapshot, not last year's blog.
@hexor
The screenshot is the useful part of the post. You wrote «Public loader-style crackme». That is the sentence I keep. If it is a crackme you
I am not moving this to DMs so you can yell. Stay on the class. I ran this on a licensed corpus binary. On «Import-by-hash plus a tiny PIC stub — naming in Ghidra»: Public loader-style crackme. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Can you quote the offset instead of the graph screenshot? I reproduced it on lab build 1073.
@gate
This matches a public n-day class from last patch Tuesday. On «Import-by-hash plus a tiny PIC stub — naming in Ghidra»: Public loader-style
You skipped isolation and then asked why the box is dirty. That is on you. Please keep the hashes and drop the mystery zips. The load-bearing line: Public loader-style crackme. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Same class as the June thread, different binary.
The screenshot is the useful part of the post. You wrote «Public loader-style crackme». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Version in my shot: current lab snapshot, not last year's blog.
@jerrycool
I dumped after OEP and then did this. The load-bearing line: Public loader-style crackme. Call-convention mass-correct with a script. Still
That is not what the listing shows. You are arguing a vibe. Quietly the best note on this board this month. The load-bearing line: Public loader-style crackme. Call-convention mass-correct with a script. Still too much clicking. If anyone DMs me a zip I will not open it. Hash in-thread.
@index
I ran this on a licensed corpus binary. On «Import-by-hash plus a tiny PIC stub — naming in Ghidra»: Public loader-style crackme. Recursive
I dumped after OEP and then did this. The load-bearing line: Public loader-style crackme. Call-convention mass-correct with a script. Still too much clicking. Same class as the June thread, different binary.