WOW64. I forgot to switch to the 32-bit stack and read garbage for 20 minutes. !wow64exts.sw exists. I used it afte…
heapsprayFriday, 12:57
9 readingUSDT probes in a public binary. rr could see them. Regular gdb needed the extra setup. I will start adding USDT pro…
stibpMEMBERstarted 5 Aug 2026, 21:34
microThursday, 19:03
8 readingNew crash in CI with ASan. I opened the report, then the debugger. The report was enough. I still opened the debugg…
saferetMEMBERstarted 25 Aug 2026, 13:03
endbr64Wednesday, 04:21
6 readingWindows wait chain traversal said nothing useful. WinDbg !locks plus a hang dump showed two SRW locks taken backwar…
tscskewMEMBERstarted 6 Jan 2026, 02:54
mmiostaleTuesday, 04:34
7 readingx86 hardware watchpoint on a 3-byte field worked by accident. ARM64 refused. I watched the 8-byte container. Docume…
avx512MEMBERstarted 5 Jul 2026, 06:51enqcmd23 Aug 2026, 08:09
10 readingThe bug only showed up on a loaded CI runner. Locally it was a heisenbug. rr record --chaos hit it in ~40 recording…
sha256r19 Aug 2026, 11:58
8 readingC++ exceptions as first-chance will ruin your day on a UI app. Break on second-chance unless you are hunting a swal…
5 readingStoring recordings in git-lfs. They bitrotted, they were huge, nobody replayed them. We keep a 30-day NAS instead. …
gnuhashMEMBERstarted 24 Apr 2026, 10:20rasbank8 Aug 2026, 03:364 readingParent looked hung. Child had already crashed. People dumped the parent for two hours. If there is a helper process…
fsbaseMEMBERstarted 31 Jul 2026, 02:26bugon6 Aug 2026, 07:201 readingService hung, no exception. People collected a minidump and we learned nothing. Hang dump, full, with handle stack …
sleighjitMEMBERstarted 15 Nov 2025, 08:07
racehunt4 Aug 2026, 23:201 readingI still write pykd for batch dumps. JS for interactive. Raw dbgeng for one tool that must not depend on Python. Thr…
clwbMEMBERstarted 21 Jul 2026, 20:58racehunt4 Aug 2026, 23:20
4 readingcatch syscall write, then a condition on the fd. It worked. It was slow. strace -e would have been enough for this …
6 readingTrace on a lab box, replay on a laptop. Symbols missing, line numbers gone, I stared at disassembly I already under…
microcodeMEMBERstarted 15 Jun 2026, 07:10cgroupv231 Jul 2026, 23:29
2 readingDebugging a service with ETW session still running. The session caught my debugger's own noise and I chased a ghost…
yama29 Jul 2026, 16:39
6 readingDR0-DR3 worked bare metal. Under Hyper-V the guest debugger lost them on some resumes. I switched to code breakpoin…
headlessMEMBERstarted 18 Nov 2025, 03:41
paulnoble29 Jul 2026, 16:108 readingI stepped 400 times. The bug was a comment that lied about ownership. Reading the function would have been faster. …
clacstacMEMBERstarted 16 Jul 2026, 04:32initarray27 Jul 2026, 18:16
3 readingChaos mode plus ASLR made two recordings incomparable. I pin layout for the campaign, then re-enable ASLR for the f…
retsyncMEMBERstarted 4 Nov 2025, 10:51
outstack24 Jul 2026, 03:38
4 readingI keep seeing Twitter comparisons. Here is a week of using all three on the same flaky parser. rr won for userspace…
gdbrecMEMBERstarted 21 Sep 2025, 10:32
passive23 Jul 2026, 08:12
5 readingEmbedded board, no debugger transport. netconsole + a panic on WARN. It shipped a fix. Not every kernel bug needs k…
ttdpos25 Jun 2026, 15:43
7 readingStack buffer. ASan said stack. !analyze said heap corruption because we had already returned. I believed ASan. Orde…
paveldbg19 Jun 2026, 13:235 readingfinish from a frame that longjmp'd out. gdb sat there. I Ctrl-C and used the recording instead. If the code has set…
hltspin22 May 2026, 18:599 readingI needed stacks without changing timing much. Non-invasive attach, dump, detach. Good enough. Invasive attach is a …
bpflsmMEMBERstarted 15 May 2026, 20:18mcestack17 May 2026, 00:21
8 readingEnabled both, forgot a flag, boot loop on the lab box. Recovery from last known good. Snapshot next time. Verifier …
xorpse8 May 2026, 00:131 readingA dump with 80 threads named 'unknown' or 'ThreadPool'. Set the name at creation. WinDbg and gdb both show it. This…
3 readingDistroless. No gdb. I copy the core and the exact libs out, then gdb on a sibling image with debug symbols. Please …
endbr64MEMBERstarted 7 Apr 2026, 02:09
wrpkru7 Apr 2026, 23:55
10 readingPreview for TTD and dx. Classic for a kernel connection that preview dropped once. Both stay on the tools snapshot.…
7 readingTiming bug that needed a loaded disk. Debugger and rr both slowed it enough to hide it. Logging with TSC stamps fou…
loadcfgSENIORvendorstarted 21 Mar 2026, 23:34slaspec24 Mar 2026, 13:322 readingCustom minidump callback. I include the heap? No. Indirect memory? Sometimes. Handle data? Yes for hangs. Paste you…
acpidsdt17 Mar 2026, 01:025 readingA 200-line suppression file. Half of it was real bugs we papered over. I deleted 80 lines and CI went red in a good…
cryptGUESTstarted 28 Feb 2026, 09:12artemttd2 Mar 2026, 22:519 readingStepping into NtDeviceIoControlFile in TTD does not take you to the kernel. People still try. You get the user retu…
kdnetMEMBERstarted 17 Feb 2026, 19:14volchok18 Feb 2026, 10:408 readingSoak test, 2 hours, race in hour 1.8. rr recording was huge. A logging build with seqlocks would have been cheaper.…
cioptsMEMBERstarted 9 Feb 2026, 18:35
tebself11 Feb 2026, 13:461 readingNested VM, no debug transport. I triggered a hang dump from the hypervisor side and pulled the vmem. It worked. It …
bootmgfwMEMBERstarted 29 Jan 2026, 21:21rttimsvc30 Jan 2026, 19:014 readingA condition that walks a list on every hit. Target became a slideshow. I logged instead. When is a conditional brea…
spidumpMEMBERstarted 22 Jan 2026, 00:14cetss22 Jan 2026, 21:503 readingManaged service, TTD, SOS. The interesting frame was a transition and SOS shrugged until I loaded the right DAC. DA…
smbiosMEMBERstarted 12 Jan 2026, 10:17cpuidleaf14 Jan 2026, 08:5910 readingSame test, two platforms. lldb pretty-printers saved me. gdb + rr saved me more. I will not pretend they are interc…
ud2padMEMBERstarted 27 Dec 2025, 14:08flossstr30 Dec 2025, 23:252 readingI wrote a JS script, then a dx one-liner that did the same thing. The one-liner survived. The script bitrotted. If …
swapgsMEMBERstarted 8 Dec 2025, 07:17bitstream8 Dec 2025, 23:246 readingrr pack, 40GB, reverse-continue from the crash to the first write. Took minutes, not hours. Still worth it. Where d…
wowentryMEMBERstarted 1 Dec 2025, 18:31mkstruct7 Dec 2025, 08:009 readingPeople write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. Narrow to a tim…
3 readingSerial is honest and slow. kdnet on a lab host is fine if the NIC is dedicated. I still keep a serial fallback beca…
yarahotMEMBERstarted 19 Oct 2025, 21:50fsgsbase21 Oct 2025, 17:0710 readingFlake is 1/80 on CI, never local. I cannot copy the runner. cgroups + noise got me to 1/10 locally. If your CI is o…
flossstrMEMBERstarted 12 Oct 2025, 14:12simdfault14 Oct 2025, 12:307 readingBugcheck 0xA. !analyze pointed at a third-party filter. The actual bug was our completion routine completing twice.…
heaven1 Oct 2025, 18:572 readingSame test, two tools. ASan silent. Full page heap on a verifier-enabled build exploded immediately. The free was in…
ttdposSENIORvendorstarted 9 Sep 2025, 20:10alignas11 Sep 2025, 22:066 readingTime Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh. dx @$cursession.TTD.Calls("ntdl…
x64dbgbpMEMBERstarted 2 Sep 2025, 14:53setnz5 Sep 2025, 04:249 reading