Overlay entropy looked packed. It was a ZIP of maps. file(1) on the overlay offset would have saved an hour.
Please run file(1) on overlays before writing 'custom packer'.
dd if=bin bs=1 skip=$overlay | file -Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
Bookmarking this for the lab wiki. You wrote «Overlay entropy looked packed». That is the sentence I keep. Listing first. The decompiler invented a cast last week that hid a signed compare. I reproduced it on lab build 1416.
@modelx
Bookmarking this for the lab wiki. You wrote «Overlay entropy looked packed». That is the sentence I keep. Listing first. The decompiler inv
Take the telegram pitch to the bin. Market listing or nothing. Bookmarking this for the lab wiki. You wrote «Overlay entropy looked packed». That is the sentence I keep. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I will +rep a listing and ârep a vibe. That is the deal.
Please keep the hashes and drop the mystery zips. «PE overlay that is actually a ZIP, not a packer» â specifically Overlay entropy looked packed. UPX with a skipped magic is still UPX. Restore four bytes and move on. I reproduced it on lab build 1170.
@omega
Please keep the hashes and drop the mystery zips. «PE overlay that is actually a ZIP, not a packer» â specifically Overlay entropy looked pa
Quote the bytes or sit down. Agreed on the class, not on the tool. «PE overlay that is actually a ZIP, not a packer» â specifically Overlay entropy looked packed. I trust FLOSS after I have seen the decoder. Before that I read the stores. Was this on the licensed corpus or a crackme you wrote? I wrote a 12-line script and then threw it away. The listing was enough.
@phish
Agreed on the class, not on the tool. «PE overlay that is actually a ZIP, not a packer» â specifically Overlay entropy looked packed. I trus
I tried the naive path first and wasted a morning. «PE overlay that is actually a ZIP, not a packer» â specifically Overlay entropy looked packed. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Pinned a comment at 0x1400006e4 in the listing.
@r4dio
I tried the naive path first and wasted a morning. «PE overlay that is actually a ZIP, not a packer» â specifically Overlay entropy looked p
You are treating a checksum as a signature again. I still keep a paper notebook for this kind of note. «PE overlay that is actually a ZIP, not a packer» â specifically Overlay entropy looked packed. Vtable grouping without RTTI: xref clusters plus IUnknown shape. I reproduced it on lab build 1235.
I still keep a paper notebook for this kind of note. «PE overlay that is actually a ZIP, not a packer» â specifically Overlay entropy looked packed. I leave CET ops in the listing. They document that CET is on. I still have the snapshot named reve-41-pre.
@seyiwave
I still keep a paper notebook for this kind of note. «PE overlay that is actually a ZIP, not a packer» â specifically Overlay entropy looked
You skipped isolation and then asked why the box is dirty. That is on you. I dumped after OEP and then did this. «PE overlay that is actually a ZIP, not a packer» â specifically Overlay entropy looked packed. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Pinned a comment at 0x140006924 in the listing.
Good. Dated shot, version in the post. «PE overlay that is actually a ZIP, not a packer» â specifically Overlay entropy looked packed. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Hash of the public file, or are we arguing a shape? Same class as the January thread, different binary.