Shadow stack / CET on a user binary — what breaks in the decompiler

@zero

Same wall I hit last quarter. «Shadow stack / CET on a user binary — what breaks in the decompiler» — specifically CET-enabled public binary

I dumped after OEP and then did this. On «Shadow stack / CET on a user binary — what breaks in the decompiler»: CET-enabled public binary. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Same class as the June thread, different binary.

Bookmarking this for the lab wiki. «Shadow stack / CET on a user binary — what breaks in the decompiler» — specifically CET-enabled public binary. UPX with a skipped magic is still UPX. Restore four bytes and move on. If anyone DMs me a zip I will not open it. Hash in-thread.

@osinx

Bookmarking this for the lab wiki. «Shadow stack / CET on a user binary — what breaks in the decompiler» — specifically CET-enabled public b

You are describing a live target. Stop. Patched class only. I dumped after OEP and then did this. On «Shadow stack / CET on a user binary — what breaks in the decompiler»: CET-enabled public binary. I leave CET ops in the listing. They document that CET is on. Took me 4 hours the first time.

This is the kind of thread that should be a sticky and is not. The load-bearing line: CET-enabled public binary. Call-convention mass-correct with a script. Still too much clicking. My note id for this: 2b-02.

@richkiddo

This is the kind of thread that should be a sticky and is not. The load-bearing line: CET-enabled public binary. Call-convention mass-correc

Take the telegram pitch to the bin. Market listing or nothing. Bookmarking this for the lab wiki. «Shadow stack / CET on a user binary — what breaks in the decompiler» — specifically CET-enabled public binary. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Which build of the tool? I got burned mixing notes across versions. Version in my shot: current lab snapshot, not last year's blog.

@secbit

Bookmarking this for the lab wiki. «Shadow stack / CET on a user binary — what breaks in the decompiler» — specifically CET-enabled public b

Quietly the best note on this board this month. «Shadow stack / CET on a user binary — what breaks in the decompiler» — specifically CET-enabled public binary. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Pinned a comment at 0x1400004a3 in the listing.

@slim_tony

Quietly the best note on this board this month. «Shadow stack / CET on a user binary — what breaks in the decompiler» — specifically CET-ena

Quote the bytes or sit down. I disagree with the tone, not the bytes. «Shadow stack / CET on a user binary — what breaks in the decompiler» — specifically CET-enabled public binary. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. I still have the snapshot named reve-43-pre.

Please keep the hashes and drop the mystery zips. «Shadow stack / CET on a user binary — what breaks in the decompiler» — specifically CET-enabled public binary. UPX with a skipped magic is still UPX. Restore four bytes and move on. I still have the snapshot named reve-43-pre.

@thndr

Please keep the hashes and drop the mystery zips. «Shadow stack / CET on a user binary — what breaks in the decompiler» — specifically CET-e

You are treating a checksum as a signature again. Good. Dated shot, version in the post. You wrote «CET-enabled public binary». That is the sentence I keep. Vtable grouping without RTTI: xref clusters plus IUnknown shape. If anyone DMs me a zip I will not open it. Hash in-thread.

I disagree with the tone, not the bytes. On «Shadow stack / CET on a user binary — what breaks in the decompiler»: CET-enabled public binary. I trust FLOSS after I have seen the decoder. Before that I read the stores. After you did that, did the decompiler pick it up or did you dump? Took me 5 hours the first time.

@westsideguy

I disagree with the tone, not the bytes. On «Shadow stack / CET on a user binary — what breaks in the decompiler»: CET-enabled public binary

You skipped isolation and then asked why the box is dirty. That is on you. Same wall I hit last quarter. «Shadow stack / CET on a user binary — what breaks in the decompiler» — specifically CET-enabled public binary. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Took me 6 hours the first time.