Yun Zheng Hu

No I don’t have any updates. PR should still be applicable. @vmwkruti1111 good to know, was there a reason why the change was done outside this PR?

Alright, thanks. happy to see it being fixed. PR can be closed then :)

This works!, however it's unclear to me that I should define it like that. Also the examples are not updated to use this.

`pip -e` only works if you have cloned the source repository. To just install from PyPI, try: ``` $ pip install dissect.cobaltstrike[pcap] ``` If you want `--editable` source installation, try:...

Also make sure to put `[pcap]` in the brackets, from your command output it looks like it got lost. Depending on the shell it might be better to put it...

Hi, are you dumping over SSH? If so, this is most like that `head` or `tail` on your local (Linux) system does not support negative numbers. In that case you...

On Ubuntu the head and tail command should work fine. You can try to run Ubuntu on Windows using WSL2.

please double check the first few bytes of your image, for example using: ``hexdump -C disk.img | head``

@hellotherehelpme Looks like the NetScaler outputted also an error/warning message to stdout, see also https://github.com/fox-it/citrix-netscaler-triage/issues/2#issuecomment-1687711480 you can fix it by stripping the error message from the, for example: ```shell cat...

> I tried as in #2 comment. No luck. Same error. Where does the number +141 comes from? How do I calculate the "right" number. It was by counting the...