Oliver Old

This is not a help forum, but here's a minimal example of how to do it for one signal. ```c++ #include #include #include #include // This is definitely not async-signal-safe....

It prints to stderr. That's usually not buffered, so it should print directly. And even in the case of buffered output, any `\n` character should cause the buffer to be...

There is a kernel limit for the amount of active swap files. Should be 32 and it seems like additional limitations imposed by some kernel configuration options can bring that...

I did some searching and the issue could be that `python3` is not where the script expects it to be, which would be `/usr/bin/python3`. Could also be something with SELinux...

Maybe it's worth mentioning that the workaround for C++ looks like this: ```c++ MainWindow::MainWindow() { InitializeComponent(); this->Title(L"Your Window Title"); } ```

That is pretty backwards. Use the latest version, get less features and worse support.

The 64-bit signature was taken from issue #436 (build 14393) and validated to work on build 17763, the 32-bit signature was extracted from build 19041 and, due to missing profiles,...

@mydockergit Those are the first few bytes of the ObGetObjectType function. You can see the function in the screenshot (without the bytes the ASM instructions translate to). The hex values...

@mydockergit That's what I meant. The bytes corresponding to the instructions can't be seen in the screenshot, but what's fed into yarascan is exactly those bytes. If you look into...

Well, you changed your working directory to the checked out repo. The `desktop.raw` file you’re trying to scan probably isn’t in there. ________________________________ From: mydockergit Sent: Friday, August 7, 2020...