Crash dump, matching binary gone. I have ntdll and the module list. Enough to name the crashing call, not enough to decompile our code.
What is the honest ceiling here? I keep telling people 'get the binary'.
Refs: WinDbg
Lab / educational. Public binaries and patched classes only. Isolated VM.
@zer0x
This belongs in the first-hour ritual. You wrote «Crash dump, matching binary gone». That is the sentence I keep. I trust FLOSS after I have
That is not what the listing shows. You are arguing a vibe. If you only have the decompiler, you do not have the bug. On «Minidump without a binary — reconstructing enough to name crashes»: Crash dump, matching binary gone. I leave CET ops in the listing. They document that CET is on. Same class as the June thread, different binary.
I want the listing, not the decompiler story. «Minidump without a binary — reconstructing enough to name crashes» — specifically Crash dump, matching binary gone. UPX with a skipped magic is still UPX. Restore four bytes and move on. Version in my shot: current lab snapshot, not last year's blog.
@sigx
I want the listing, not the decompiler story. «Minidump without a binary — reconstructing enough to name crashes» — specifically Crash dump,
This is the writeup I wanted when I was stuck. You wrote «Crash dump, matching binary gone». That is the sentence I keep. I leave CET ops in the listing. They document that CET is on. Same class as the March thread, different binary.
@stackr
This is the writeup I wanted when I was stuck. You wrote «Crash dump, matching binary gone». That is the sentence I keep. I leave CET ops in
You skipped isolation and then asked why the box is dirty. That is on you. I would have written the opposite conclusion a year ago. You wrote «Crash dump, matching binary gone». That is the sentence I keep. Listing first. The decompiler invented a cast last week that hid a signed compare. I wrote a 12-line script and then threw it away. The listing was enough.
This belongs in the first-hour ritual. The load-bearing line: Crash dump, matching binary gone. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Did page heap see it, or only the sanitizer? I reproduced it on lab build 1147.
@vectx
This belongs in the first-hour ritual. The load-bearing line: Crash dump, matching binary gone. FID for your own libs is worth the CI time.
This is the writeup I wanted when I was stuck. «Minidump without a binary — reconstructing enough to name crashes» — specifically Crash dump, matching binary gone. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Same class as the June thread, different binary.
This belongs in the first-hour ritual. You wrote «Crash dump, matching binary gone». That is the sentence I keep. I trust FLOSS after I have seen the decoder. Before that I read the stores. Took me 9 hours the first time.