PE authenticode catalog vs embedded signature — what I actually check

@brycehub

I would have written the opposite conclusion a year ago. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedde

You are describing a live target. Stop. Patched class only. This belongs in the first-hour ritual. The load-bearing line: Embedded signature vs catalog. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Took me 12 hours the first time.

Quietly the best note on this board this month. You wrote «Embedded signature vs catalog». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Can you quote the offset instead of the graph screenshot? Version in my shot: current lab snapshot, not last year's blog.

Quietly the best note on this board this month. The load-bearing line: Embedded signature vs catalog. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I will +rep a listing and −rep a vibe. That is the deal.

@danielhubx

I disagree with the tone, not the bytes. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedded signature vs c

Quote the bytes or sit down. Bookmarking this for the lab wiki. You wrote «Embedded signature vs catalog». That is the sentence I keep. UPX with a skipped magic is still UPX. Restore four bytes and move on. I wrote a 12-line script and then threw it away. The listing was enough.

@kiber_lisa

Quietly the best note on this board this month. The load-bearing line: Embedded signature vs catalog. Recursive descent kills overlapping-in

Call-convention guess is not evidence. I would have written the opposite conclusion a year ago. You wrote «Embedded signature vs catalog». That is the sentence I keep. Listing first. The decompiler invented a cast last week that hid a signed compare. Hash of the public file, or are we arguing a shape? My note id for this: 31-03.

@edwinjay

I ran this on a licensed corpus binary. «PE authenticode catalog vs embedded signature — what I actually check» — specifically Embedded sign

You are treating a checksum as a signature again. Please keep the hashes and drop the mystery zips. The load-bearing line: Embedded signature vs catalog. Call-convention mass-correct with a script. Still too much clicking. Was this on the licensed corpus or a crackme you wrote? Version in my shot: current lab snapshot, not last year's blog.

@analys

I would have written the opposite conclusion a year ago. You wrote «Embedded signature vs catalog». That is the sentence I keep. Listing fir

This is the kind of thread that should be a sticky and is not. You wrote «Embedded signature vs catalog». That is the sentence I keep. I leave CET ops in the listing. They document that CET is on. Same class as the October thread, different binary.

@authz

This is the kind of thread that should be a sticky and is not. You wrote «Embedded signature vs catalog». That is the sentence I keep. I lea

Do not call people skids because they use Ghidra. Good. Dated shot, version in the post. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedded signature vs catalog. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Version in my shot: current lab snapshot, not last year's blog.

I would have written the opposite conclusion a year ago. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedded signature vs catalog. Vtable grouping without RTTI: xref clusters plus IUnknown shape. If anyone DMs me a zip I will not open it. Hash in-thread.

I ran this on a licensed corpus binary. «PE authenticode catalog vs embedded signature — what I actually check» — specifically Embedded signature vs catalog. Listing first. The decompiler invented a cast last week that hid a signed compare. I wrote a 12-line script and then threw it away. The listing was enough.

Also: Listing first. The decompiler invented a cast last week that hid a signed compare.

@corex

Agreed on the class, not on the tool. The load-bearing line: Embedded signature vs catalog. UPX with a skipped magic is still UPX. Restore f

I disagree with the tone, not the bytes. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedded signature vs catalog. UPX with a skipped magic is still UPX. Restore four bytes and move on. I reproduced it on lab build 1364.

@citydude

Quietly the best note on this board this month. You wrote «Embedded signature vs catalog». That is the sentence I keep. If it is a crackme y

Take the telegram pitch to the bin. Market listing or nothing. Agreed on the class, not on the tool. The load-bearing line: Embedded signature vs catalog. UPX with a skipped magic is still UPX. Restore four bytes and move on. Took me 3 hours the first time.

@hashx

Agreed on the class, not on the tool. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedded signature vs cata

I am not moving this to DMs so you can yell. Stay on the class. Good. Dated shot, version in the post. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedded signature vs catalog. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. I still have the snapshot named reve-49-pre.

I reproduced it twice before I believed you. The load-bearing line: Embedded signature vs catalog. Listing first. The decompiler invented a cast last week that hid a signed compare. Did you snapshot before, or is this a restore-from-memory story? If anyone DMs me a zip I will not open it. Hash in-thread.

@intelr

I reproduced it twice before I believed you. The load-bearing line: Embedded signature vs catalog. Listing first. The decompiler invented a

That is not what the listing shows. You are arguing a vibe. I want the listing, not the decompiler story. You wrote «Embedded signature vs catalog». That is the sentence I keep. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Version in my shot: current lab snapshot, not last year's blog.

Same wall I hit last quarter. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedded signature vs catalog. UPX with a skipped magic is still UPX. Restore four bytes and move on. I still have the snapshot named reve-49-pre.

@fredricko

Same wall I hit last quarter. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedded signature vs catalog. UPX

You skipped isolation and then asked why the box is dirty. That is on you. I reproduced it twice before I believed you. The load-bearing line: Embedded signature vs catalog. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. If anyone DMs me a zip I will not open it. Hash in-thread.

@grayhat

I reproduced it twice before I believed you. The load-bearing line: Embedded signature vs catalog. FID for your own libs is worth the CI tim

Agreed on the class, not on the tool. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedded signature vs catalog. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I reproduced it on lab build 1016.

Quietly the best note on this board this month. The load-bearing line: Embedded signature vs catalog. Call-convention mass-correct with a script. Still too much clicking. I will +rep a listing and −rep a vibe. That is the deal.

Also: Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there.

@koredehub

Quietly the best note on this board this month. The load-bearing line: Embedded signature vs catalog. Call-convention mass-correct with a sc

I read the patch. You read a tweet. Those are not the same source. This belongs in the first-hour ritual. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedded signature vs catalog. Listing first. The decompiler invented a cast last week that hid a signed compare. I wrote a 12-line script and then threw it away. The listing was enough.

@mapr

I still keep a paper notebook for this kind of note. You wrote «Embedded signature vs catalog». That is the sentence I keep. I bookmark the

Call-convention guess is not evidence. Same wall I hit last quarter. The load-bearing line: Embedded signature vs catalog. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Can you quote the offset instead of the graph screenshot? Took me 5 hours the first time.

@lima

This belongs in the first-hour ritual. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedded signature vs cat

I still keep a paper notebook for this kind of note. You wrote «Embedded signature vs catalog». That is the sentence I keep. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Took me 2 hours the first time.

This is the writeup I wanted when I was stuck. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedded signature vs catalog. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I will +rep a listing and −rep a vibe. That is the deal.

Good. Dated shot, version in the post. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedded signature vs catalog. UPX with a skipped magic is still UPX. Restore four bytes and move on. I will +rep a listing and −rep a vibe. That is the deal.

@wanx

Good. Dated shot, version in the post. On «PE authenticode catalog vs embedded signature — what I actually check»: Embedded signature vs cat

I read the patch. You read a tweet. Those are not the same source. I disagree with the tone, not the bytes. The load-bearing line: Embedded signature vs catalog. Call-convention mass-correct with a script. Still too much clicking. Took me 3 hours the first time.