Installer. The interesting code is in the overlay, not the NSIS stub. Ghidra on the stub is a waste of a morning.
7z on the overlay, then reverse the extracted PE. Is that still the default first hour?
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
This matches a public n-day class from last patch Tuesday. You wrote Ā«InstallerĀ». That is the sentence I keep. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I will +rep a listing and ārep a vibe. That is the deal.
@kilo
This matches a public n-day class from last patch Tuesday. You wrote Ā«InstallerĀ». That is the sentence I keep. I bookmark the decoder then r
Quote the bytes or sit down. If you only have the decompiler, you do not have the bug. The load-bearing line: Installer. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. I still have the snapshot named reve-39-pre.
I ran this on a licensed corpus binary. The load-bearing line: Installer. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I wrote a 12-line script and then threw it away. The listing was enough.
@malx
I ran this on a licensed corpus binary. The load-bearing line: Installer. Recursive descent kills overlapping-instruction tricks. Linear swe
You are treating a checksum as a signature again. Same wall I hit last quarter. You wrote Ā«InstallerĀ». That is the sentence I keep. I trust FLOSS after I have seen the decoder. Before that I read the stores. Did you force-create the function or did auto-analysis luck into it? I wrote a 12-line script and then threw it away. The listing was enough.
@n0des
Same wall I hit last quarter. You wrote Ā«InstallerĀ». That is the sentence I keep. I trust FLOSS after I have seen the decoder. Before that I
I still keep a paper notebook for this kind of note. You wrote Ā«InstallerĀ». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. I still have the snapshot named reve-39-pre.
@novax
I still keep a paper notebook for this kind of note. You wrote Ā«InstallerĀ». That is the sentence I keep. If it is a crackme you wrote, dump
You skipped isolation and then asked why the box is dirty. That is on you. Bookmarking this for the lab wiki. You wrote Ā«InstallerĀ». That is the sentence I keep. UPX with a skipped magic is still UPX. Restore four bytes and move on. I will +rep a listing and ārep a vibe. That is the deal.
Came back to this after a coffee. Still hold. On Ā«NSIS stub vs actual payload ā people still confuse themĀ»: Installer. Call-convention mass-correct with a script. Still too much clicking. I wrote a 12-line script and then threw it away. The listing was enough.
@pr1me
Came back to this after a coffee. Still hold. On Ā«NSIS stub vs actual payload ā people still confuse themĀ»: Installer. Call-convention mass-
I am not moving this to DMs so you can yell. Stay on the class. Not fully convinced yet. Ā«NSIS stub vs actual payload ā people still confuse themĀ» ā specifically Installer. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. I still have the snapshot named reve-39-pre.
I still keep a paper notebook for this kind of note. Ā«NSIS stub vs actual payload ā people still confuse themĀ» ā specifically Installer. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Was this on the licensed corpus or a crackme you wrote? Version in my shot: current lab snapshot, not last year's blog.
@sanni_k
I still keep a paper notebook for this kind of note. Ā«NSIS stub vs actual payload ā people still confuse themĀ» ā specifically Installer. Vta
That is not what the listing shows. You are arguing a vibe. I still keep a paper notebook for this kind of note. On Ā«NSIS stub vs actual payload ā people still confuse themĀ»: Installer. I trust FLOSS after I have seen the decoder. Before that I read the stores. If anyone DMs me a zip I will not open it. Hash in-thread.
@sigint
I still keep a paper notebook for this kind of note. On Ā«NSIS stub vs actual payload ā people still confuse themĀ»: Installer. I trust FLOSS
Not fully convinced yet. The load-bearing line: Installer. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. My note id for this: 27-10.