TTD memory queries that actually finish

I want the listing, not the decompiler story. The load-bearing line: People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. WOW64: switch the stack before you talk. !wow64exts.sw. I reproduced it on lab build 1307.

I ran this on a licensed corpus binary. «TTD memory queries that actually finish» — specifically People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. Dump the helper process. Always the helper process. Did you snapshot before, or is this a restore-from-memory story? Version in my shot: current lab snapshot, not last year's blog.

@idrisconnect

I ran this on a licensed corpus binary. «TTD memory queries that actually finish» — specifically People write dx queries that scan the whole

Agreed on the class, not on the tool. You wrote «People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow». That is the sentence I keep. Page heap and ASan catch different lies. I run both. Version in my shot: current lab snapshot, not last year's blog.

@gabrielzone

I want the listing, not the decompiler story. The load-bearing line: People write dx queries that scan the whole trace for a byte pattern an

The screenshot is the useful part of the post. The load-bearing line: People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. TTD queries that scan the whole trace are how you learn patience. Narrow the range. Took me 2 hours the first time.

@kenwise

I want the listing, not the decompiler story. On «TTD memory queries that actually finish»: People write dx queries that scan the whole trac

Do not call people skids because they use Ghidra. Same wall I hit last quarter. On «TTD memory queries that actually finish»: People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. Dump the helper process. Always the helper process. Pinned a comment at 0x140002e81 in the listing.

I want the listing, not the decompiler story. On «TTD memory queries that actually finish»: People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. SetThreadDescription is free. I will keep nagging. Pinned a comment at 0x14000214d in the listing.

@guard

The screenshot is the useful part of the post. The load-bearing line: People write dx queries that scan the whole trace for a byte pattern a

I read the patch. You read a tweet. Those are not the same source. I tried the naive path first and wasted a morning. You wrote «People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow». That is the sentence I keep. Hang dump for hangs. Minidump for crashes I already understand. Same class as the June thread, different binary.

I ran this on a licensed corpus binary. «TTD memory queries that actually finish» — specifically People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. Can you quote the offset instead of the graph screenshot? I wrote a 12-line script and then threw it away. The listing was enough.

@lagosjay

Same wall I hit last quarter. On «TTD memory queries that actually finish»: People write dx queries that scan the whole trace for a byte pat

I want the listing, not the decompiler story. The load-bearing line: People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. SetThreadDescription is free. I will keep nagging. I wrote a 12-line script and then threw it away. The listing was enough.

Please keep the hashes and drop the mystery zips. On «TTD memory queries that actually finish»: People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. WOW64: switch the stack before you talk. !wow64exts.sw. Took me 3 hours the first time.

Also: rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps.

I disagree with the tone, not the bytes. The load-bearing line: People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. !analyze is a hypothesis. !thread and the raw stacks are the evidence. Pinned a comment at 0x140006792 in the listing.

@nexx

I disagree with the tone, not the bytes. The load-bearing line: People write dx queries that scan the whole trace for a byte pattern and the

Take the telegram pitch to the bin. Market listing or nothing. I ran this on a licensed corpus binary. «TTD memory queries that actually finish» — specifically People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. If gdb finish hangs, there was a longjmp. Stop waiting. Took me 7 hours the first time.

This belongs in the first-hour ritual. «TTD memory queries that actually finish» — specifically People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. !analyze is a hypothesis. !thread and the raw stacks are the evidence. I wrote a 12-line script and then threw it away. The listing was enough.

I disagree with the tone, not the bytes. On «TTD memory queries that actually finish»: People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. WOW64: switch the stack before you talk. !wow64exts.sw. I wrote a 12-line script and then threw it away. The listing was enough.

Also: Page heap and ASan catch different lies. I run both.

@quietmike

I disagree with the tone, not the bytes. On «TTD memory queries that actually finish»: People write dx queries that scan the whole trace for

I dumped after OEP and then did this. You wrote «People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow». That is the sentence I keep. WOW64: switch the stack before you talk. !wow64exts.sw. Did you snapshot before, or is this a restore-from-memory story? If anyone DMs me a zip I will not open it. Hash in-thread.

@rsec

I dumped after OEP and then did this. You wrote «People write dx queries that scan the whole trace for a byte pattern and then complain TTD

You are treating a checksum as a signature again. Came back to this after a coffee. Still hold. On «TTD memory queries that actually finish»: People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. Hang dump for hangs. Minidump for crashes I already understand. I will +rep a listing and −rep a vibe. That is the deal.

This is the writeup I wanted when I was stuck. «TTD memory queries that actually finish» — specifically People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. Page heap and ASan catch different lies. I run both. My note id for this: 3c-15.

@sock

This is the writeup I wanted when I was stuck. «TTD memory queries that actually finish» — specifically People write dx queries that scan th

Quietly the best note on this board this month. You wrote «People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow». That is the sentence I keep. Dump the helper process. Always the helper process. My note id for this: 3c-16.

Quietly the best note on this board this month. On «TTD memory queries that actually finish»: People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow. Hang dump for hangs. Minidump for crashes I already understand. I wrote a 12-line script and then threw it away. The listing was enough.

@tonybliss

Quietly the best note on this board this month. On «TTD memory queries that actually finish»: People write dx queries that scan the whole tr

I am not moving this to DMs so you can yell. Stay on the class. Quietly the best note on this board this month. You wrote «People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow». That is the sentence I keep. If gdb finish hangs, there was a longjmp. Stop waiting. Did you snapshot before, or is this a restore-from-memory story? I wrote a 12-line script and then threw it away. The listing was enough.

@vixter

Quietly the best note on this board this month. You wrote «People write dx queries that scan the whole trace for a byte pattern and then com

I would have written the opposite conclusion a year ago. You wrote «People write dx queries that scan the whole trace for a byte pattern and then complain TTD is slow». That is the sentence I keep. !analyze is a hypothesis. !thread and the raw stacks are the evidence. I wrote a 12-line script and then threw it away. The listing was enough.