On this crackme the bug was a signed compare. Graph hid it. Listing showed the jle. Decompiler invented a cast that looked fine.
I trust the listing first, decompiler second, graph for navigation. Unpopular?
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
Good. Dated shot, version in the post. The load-bearing line: On this crackme the bug was a signed compare. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Pinned a comment at 0x14000255e in the listing.
@bravo
Please keep the hashes and drop the mystery zips. You wrote Ā«On this crackme the bug was a signed compareĀ». That is the sentence I keep. Lis
Take the telegram pitch to the bin. Market listing or nothing. I would have written the opposite conclusion a year ago. You wrote Ā«On this crackme the bug was a signed compareĀ». That is the sentence I keep. I leave CET ops in the listing. They document that CET is on. Pinned a comment at 0x140000175 in the listing.
@binsec
Good. Dated shot, version in the post. The load-bearing line: On this crackme the bug was a signed compare. Recursive descent kills overlapp
Please keep the hashes and drop the mystery zips. You wrote Ā«On this crackme the bug was a signed compareĀ». That is the sentence I keep. Listing first. The decompiler invented a cast last week that hid a signed compare. My note id for this: 34-01.
@ciph3r
This is the kind of thread that should be a sticky and is not. The load-bearing line: On this crackme the bug was a signed compare. Listing
I disagree with the tone, not the bytes. The load-bearing line: On this crackme the bug was a signed compare. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Same class as the June thread, different binary.
This is the kind of thread that should be a sticky and is not. The load-bearing line: On this crackme the bug was a signed compare. Listing first. The decompiler invented a cast last week that hid a signed compare. After you did that, did the decompiler pick it up or did you dump? I reproduced it on lab build 1033.
@dec0de
I ran this on a licensed corpus binary. On Ā«Listing vs graph vs decompiler ā which view actually found the bugĀ»: On this crackme the bug was
Came back to this after a coffee. Still hold. Ā«Listing vs graph vs decompiler ā which view actually found the bugĀ» ā specifically On this crackme the bug was a signed compare. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I reproduced it on lab build 1079.
I failed this exact class in January. Ā«Listing vs graph vs decompiler ā which view actually found the bugĀ» ā specifically On this crackme the bug was a signed compare. UPX with a skipped magic is still UPX. Restore four bytes and move on. If anyone DMs me a zip I will not open it. Hash in-thread.
@daemon
I failed this exact class in January. Ā«Listing vs graph vs decompiler ā which view actually found the bugĀ» ā specifically On this crackme th
You are treating a checksum as a signature again. I ran this on a licensed corpus binary. On Ā«Listing vs graph vs decompiler ā which view actually found the bugĀ»: On this crackme the bug was a signed compare. Vtable grouping without RTTI: xref clusters plus IUnknown shape. My note id for this: 34-06.
Not fully convinced yet. You wrote Ā«On this crackme the bug was a signed compareĀ». That is the sentence I keep. I leave CET ops in the listing. They document that CET is on. Hash of the public file, or are we arguing a shape? Took me 3 hours the first time.
I would have written the opposite conclusion a year ago. On Ā«Listing vs graph vs decompiler ā which view actually found the bugĀ»: On this crackme the bug was a signed compare. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Pinned a comment at 0x140006e85 in the listing.