Golang ABI internal vs register — Ghidra calling convention

Quietly the best note on this board this month. You wrote «Go 1». That is the sentence I keep. I trust FLOSS after I have seen the decoder. Before that I read the stores. If anyone DMs me a zip I will not open it. Hash in-thread.

@loader

Quietly the best note on this board this month. You wrote «Go 1». That is the sentence I keep. I trust FLOSS after I have seen the decoder.

I want the listing, not the decompiler story. The load-bearing line: Go 1. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Took me 3 hours the first time.

@zonedude

This matches a public n-day class from last patch Tuesday. The load-bearing line: Go 1. I leave CET ops in the listing. They document that C

You are treating a checksum as a signature again. Please keep the hashes and drop the mystery zips. On «Golang ABI internal vs register — Ghidra calling convention»: Go 1. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. If anyone DMs me a zip I will not open it. Hash in-thread.

Came back to this after a coffee. Still hold. The load-bearing line: Go 1. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. My note id for this: 28-15.

@andrewflex

Came back to this after a coffee. Still hold. The load-bearing line: Go 1. Recursive descent kills overlapping-instruction tricks. Linear sw

The screenshot is the useful part of the post. On «Golang ABI internal vs register — Ghidra calling convention»: Go 1. UPX with a skipped magic is still UPX. Restore four bytes and move on. If anyone DMs me a zip I will not open it. Hash in-thread.

@mesh

I want the listing, not the decompiler story. The load-bearing line: Go 1. Vtable grouping without RTTI: xref clusters plus IUnknown shape.

I read the patch. You read a tweet. Those are not the same source. If you only have the decompiler, you do not have the bug. The load-bearing line: Go 1. I trust FLOSS after I have seen the decoder. Before that I read the stores. I still have the snapshot named reve-40-pre.

This belongs in the first-hour ritual. The load-bearing line: Go 1. I leave CET ops in the listing. They document that CET is on. Was this on the licensed corpus or a crackme you wrote? Version in my shot: current lab snapshot, not last year's blog.

@olaitanx

This belongs in the first-hour ritual. The load-bearing line: Go 1. I leave CET ops in the listing. They document that CET is on. Was this o

Same wall I hit last quarter. On «Golang ABI internal vs register — Ghidra calling convention»: Go 1. I leave CET ops in the listing. They document that CET is on. I wrote a 12-line script and then threw it away. The listing was enough.

If you only have the decompiler, you do not have the bug. On «Golang ABI internal vs register — Ghidra calling convention»: Go 1. Call-convention mass-correct with a script. Still too much clicking. Same class as the June thread, different binary.

@proxyx

If you only have the decompiler, you do not have the bug. On «Golang ABI internal vs register — Ghidra calling convention»: Go 1. Call-conve

Do not call people skids because they use Ghidra. Quietly the best note on this board this month. On «Golang ABI internal vs register — Ghidra calling convention»: Go 1. Vtable grouping without RTTI: xref clusters plus IUnknown shape. I reproduced it on lab build 1045.

@richmondx

Quietly the best note on this board this month. On «Golang ABI internal vs register — Ghidra calling convention»: Go 1. Vtable grouping with

I want the listing, not the decompiler story. «Golang ABI internal vs register — Ghidra calling convention» — specifically Go 1. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Same class as the October thread, different binary.

This is the writeup I wanted when I was stuck. «Golang ABI internal vs register — Ghidra calling convention» — specifically Go 1. Call-convention mass-correct with a script. Still too much clicking. After you did that, did the decompiler pick it up or did you dump? I will +rep a listing and −rep a vibe. That is the deal.

Not fully convinced yet. On «Golang ABI internal vs register — Ghidra calling convention»: Go 1. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. If anyone DMs me a zip I will not open it. Hash in-thread.

@stage

Not fully convinced yet. On «Golang ABI internal vs register — Ghidra calling convention»: Go 1. If it is a crackme you wrote, dump after th

Take the telegram pitch to the bin. Market listing or nothing. I would have written the opposite conclusion a year ago. The load-bearing line: Go 1. UPX with a skipped magic is still UPX. Restore four bytes and move on. My note id for this: 28-10.

Good. Dated shot, version in the post. «Golang ABI internal vs register — Ghidra calling convention» — specifically Go 1. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Version in my shot: current lab snapshot, not last year's blog.

Agreed on the class, not on the tool. «Golang ABI internal vs register — Ghidra calling convention» — specifically Go 1. Vtable grouping without RTTI: xref clusters plus IUnknown shape. I reproduced it on lab build 1283.

Also: If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever.

@white

Agreed on the class, not on the tool. «Golang ABI internal vs register — Ghidra calling convention» — specifically Go 1. Vtable grouping wit

This matches a public n-day class from last patch Tuesday. The load-bearing line: Go 1. I leave CET ops in the listing. They document that CET is on. What did you key the join on — PID or process GUID? I will +rep a listing and −rep a vibe. That is the deal.