Max Altgelt

[Max Altgelt @AltgeltMax]

@securityfreax @cyb3rops @bh4b3sh @SecurePeacock Could I ask which ETW provider you are using? I've tried DISK_FILE_IO, but it doesn't include named pipes, only "normal" files.

[Max Altgelt @AltgeltMax]

@wxs @cyb3rops I'm currently testing on a list of a few hundred golang executables we already had, with cross-checking the results of the Golang and C implementations. That's helpful so far, but we'll need more work on tests as we move out of draft stage.

[Max Altgelt @AltgeltMax]

@invisig0th @cyb3rops Currently we sort the imports. I'll need to run some tests to check if the order in which the packages appear in the pclntab is deterministic. If it is, not sorting sounds like a good idea.

[Max Altgelt @AltgeltMax]

@gero_aka_red @cyb3rops Try running thor-lite-util upgrade --force, that should update thor-lite to the latest version (where that bug is fixed) and download the newest signatures.