In a SOC, "silence" can be a bad thing but it can also be misleading. If logs stop flowing from a managed host, how do you know if it's just a quiet evening, if the network is blocked, or if the QRadar pipeline itself has failed?
Part 2! Previously I identified that the board is held by DAT_01005340 (with no ASLR!). If I want to track down where the mines come in, that seems like a good place to start. What references DAT_01005340? DAT_01005340 XREF[20]: FUN_01002eab:01002eba(*), FUN_01002ed5:01002f04(W)
Disclaimer: This article documents my reverse engineering process for the classic Windows Minesweeper (WinMine). The goal is to understand how the game represents the board internally, not simply to modify it. The Goal I wanted to find where WinMine stores the actual game board in memory. Finding counters such as
Disclaimer: This is my own personal blog and wiki and should not be treated as official advice. Refreshing log source status Log source status should be updated by toggling the log source or restarting ingress. This allows the log sources to reconnect. Sometimes, that doesn't work and the