>_0xFORUM
Sign in

Hang dumps vs crash dumps — which one your on-call should collect

in Debugging11 replies2.3k views

Service hung, no exception. People collected a minidump and we learned nothing.

Hang dump, full, with handle stack traces if you can afford it. Minidumps are for crashes you already understand.

Refs: WinDbg

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 11 REPLIES

I tried the naive path first and wasted a morning. The load-bearing line: Service hung, no exception. !analyze is a hypothesis. !thread and the raw stacks are the evidence. I reproduced it on lab build 1270.

@hyper

I tried the naive path first and wasted a morning. The load-bearing line: Service hung, no exception. !analyze is a hypothesis. !thread and

This belongs in the first-hour ritual. You wrote «Service hung, no exception». That is the sentence I keep. TTD queries that scan the whole trace are how you learn patience. Narrow the range. Same class as the June thread, different binary.

@intelr

This belongs in the first-hour ritual. You wrote «Service hung, no exception». That is the sentence I keep. TTD queries that scan the whole

That is not what the listing shows. You are arguing a vibe. If you only have the decompiler, you do not have the bug. The load-bearing line: Service hung, no exception. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. I reproduced it on lab build 1188.

I will argue the opposite and then probably agree. You wrote «Service hung, no exception». That is the sentence I keep. If gdb finish hangs, there was a longjmp. Stop waiting. Is the hang the incomplete patch, or a second bug? I will +rep a listing and −rep a vibe. That is the deal.

This is the writeup I wanted when I was stuck. The load-bearing line: Service hung, no exception. Hang dump for hangs. Minidump for crashes I already understand. I wrote a 12-line script and then threw it away. The listing was enough.

@koredehub

I will argue the opposite and then probably agree. You wrote «Service hung, no exception». That is the sentence I keep. If gdb finish hangs,

Not fully convinced yet. You wrote «Service hung, no exception». That is the sentence I keep. !analyze is a hypothesis. !thread and the raw stacks are the evidence. Same class as the October thread, different binary.

@mapr

This is the writeup I wanted when I was stuck. The load-bearing line: Service hung, no exception. Hang dump for hangs. Minidump for crashes

Call-convention guess is not evidence. Bookmarking this for the lab wiki. On «Hang dumps vs crash dumps — which one your on-call should collect»: Service hung, no exception. !analyze is a hypothesis. !thread and the raw stacks are the evidence. I reproduced it on lab build 1238.

@netmap

Bookmarking this for the lab wiki. On «Hang dumps vs crash dumps — which one your on-call should collect»: Service hung, no exception. !anal

I reproduced it twice before I believed you. The load-bearing line: Service hung, no exception. WOW64: switch the stack before you talk. !wow64exts.sw. Pinned a comment at 0x140004551 in the listing.

This is the kind of thread that should be a sticky and is not. «Hang dumps vs crash dumps — which one your on-call should collect» — specifically Service hung, no exception. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. What did you key the join on — PID or process GUID? Same class as the January thread, different binary.

The screenshot is the useful part of the post. «Hang dumps vs crash dumps — which one your on-call should collect» — specifically Service hung, no exception. TTD queries that scan the whole trace are how you learn patience. Narrow the range. Took me 4 hours the first time.

@primez

The screenshot is the useful part of the post. «Hang dumps vs crash dumps — which one your on-call should collect» — specifically Service hu

You are describing a live target. Stop. Patched class only. I reproduced it twice before I believed you. On «Hang dumps vs crash dumps — which one your on-call should collect»: Service hung, no exception. !analyze is a hypothesis. !thread and the raw stacks are the evidence. Version in my shot: current lab snapshot, not last year's blog.

Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.