I stopped mixing them on one box. Preview is user-mode. Kernel is a serial or kdnet pair. Two VMs.
If you kernel-debug the same VM you live on, you will freeze yourself and call it a bug.
Refs: WinDbg
Lab / educational. Public binaries and patched classes only. Isolated VM.
I tried the naive path first and wasted a morning. You wrote «I stopped mixing them on one box». That is the sentence I keep. PE-sieve is a lead. It is not a verdict. Version in my shot: current lab snapshot, not last year's blog.
@labs
I tried the naive path first and wasted a morning. You wrote «I stopped mixing them on one box». That is the sentence I keep. PE-sieve is a
That is not what the listing shows. You are arguing a vibe. Not fully convinced yet. «WinDbg preview in the tools VM, kernel debug from a second VM» — specifically I stopped mixing them on one box. Dirty VM means throw it. Do not apt upgrade a dirty box. I wrote a 12-line script and then threw it away. The listing was enough.
I disagree with the tone, not the bytes. On «WinDbg preview in the tools VM, kernel debug from a second VM»: I stopped mixing them on one box. Clipboard off on the detonation VM. I pasted a token once. Version in my shot: current lab snapshot, not last year's blog.
@mesh
I disagree with the tone, not the bytes. On «WinDbg preview in the tools VM, kernel debug from a second VM»: I stopped mixing them on one bo
I read the patch. You read a tweet. Those are not the same source. Quietly the best note on this board this month. On «WinDbg preview in the tools VM, kernel debug from a second VM»: I stopped mixing them on one box. FakeNet that can reach the internet is not a simulator. Did page heap see it, or only the sanitizer? Same class as the October thread, different binary.
@netsec
Quietly the best note on this board this month. On «WinDbg preview in the tools VM, kernel debug from a second VM»: I stopped mixing them on
Agreed on the class, not on the tool. On «WinDbg preview in the tools VM, kernel debug from a second VM»: I stopped mixing them on one box. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. I wrote a 12-line script and then threw it away. The listing was enough.
@olaitanx
Agreed on the class, not on the tool. On «WinDbg preview in the tools VM, kernel debug from a second VM»: I stopped mixing them on one box.
Call-convention guess is not evidence. I still keep a paper notebook for this kind of note. You wrote «I stopped mixing them on one box». That is the sentence I keep. Clipboard off on the detonation VM. I pasted a token once. Took me 7 hours the first time.