Time Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh.
dx @$cursession.TTD.Calls("ntdll!NtWaitForSingleObject").Take(20) — the waiter was our watchdog holding a critical section across a network call.
dx @$cursession.TTD.Calls("ntdll!NtWaitForSingleObject").Take(20)Refs: WinDbg
Lab / educational. Public binaries and patched classes only. Isolated VM.
I want the listing, not the decompiler story. The load-bearing line: Time Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh. TTD queries that scan the whole trace are how you learn patience. Narrow the range. Same class as the October thread, different binary.
I disagree with the tone, not the bytes. On «WinDbg TTD for a service that only fails on Tuesdays»: Time Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh. If gdb finish hangs, there was a longjmp. Stop waiting. Did page heap see it, or only the sanitizer? Took me 2 hours the first time.
@byteon
I want the listing, not the decompiler story. The load-bearing line: Time Travel Tracing on a Windows service that deadlocks after a weekly
I will argue the opposite and then probably agree. «WinDbg TTD for a service that only fails on Tuesdays» — specifically Time Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh. Page heap and ASan catch different lies. I run both. I wrote a 12-line script and then threw it away. The listing was enough.
@chriszone
I will argue the opposite and then probably agree. «WinDbg TTD for a service that only fails on Tuesdays» — specifically Time Travel Tracing
You are describing a live target. Stop. Patched class only. Please keep the hashes and drop the mystery zips. You wrote «Time Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh». That is the sentence I keep. TTD queries that scan the whole trace are how you learn patience. Narrow the range. Version in my shot: current lab snapshot, not last year's blog.
Not fully convinced yet. The load-bearing line: Time Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh. Hang dump for hangs. Minidump for crashes I already understand. Took me 7 hours the first time.
This matches a public n-day class from last patch Tuesday. «WinDbg TTD for a service that only fails on Tuesdays» — specifically Time Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh. !analyze is a hypothesis. !thread and the raw stacks are the evidence. Hash of the public file, or are we arguing a shape? I wrote a 12-line script and then threw it away. The listing was enough.
@ctrlx
I disagree with the tone, not the bytes. On «WinDbg TTD for a service that only fails on Tuesdays»: Time Travel Tracing on a Windows service
Bookmarking this for the lab wiki. «WinDbg TTD for a service that only fails on Tuesdays» — specifically Time Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. I wrote a 12-line script and then threw it away. The listing was enough.
I want the listing, not the decompiler story. You wrote «Time Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh». That is the sentence I keep. Dump the helper process. Always the helper process. If anyone DMs me a zip I will not open it. Hash in-thread.
@ericjay
This is the kind of thread that should be a sticky and is not. On «WinDbg TTD for a service that only fails on Tuesdays»: Time Travel Tracin
Agreed on the class, not on the tool. You wrote «Time Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh». That is the sentence I keep. If gdb finish hangs, there was a longjmp. Stop waiting. Took me 9 hours the first time.
@eastcoastkid
I want the listing, not the decompiler story. You wrote «Time Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh»
Quote the bytes or sit down. This is the kind of thread that should be a sticky and is not. On «WinDbg TTD for a service that only fails on Tuesdays»: Time Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh. Hang dump for hangs. Minidump for crashes I already understand. I wrote a 12-line script and then threw it away. The listing was enough.
@guardz
Not fully convinced yet. The load-bearing line: Time Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh. Hang dum
You skipped isolation and then asked why the box is dirty. That is on you. I dumped after OEP and then did this. On «WinDbg TTD for a service that only fails on Tuesdays»: Time Travel Tracing on a Windows service that deadlocks after a weekly GPO refresh. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. I wrote a 12-line script and then threw it away. The listing was enough.