DR0-DR3 worked bare metal. Under Hyper-V the guest debugger lost them on some resumes.
I switched to code breakpoints plus a watch on the variable in TTD. Known issue, or my setup?
Refs: WinDbg
Lab / educational. Public binaries and patched classes only. Isolated VM.
This is the kind of thread that should be a sticky and is not. You wrote «DR0-DR3 worked bare metal». That is the sentence I keep. TTD queries that scan the whole trace are how you learn patience. Narrow the range. Version in my shot: current lab snapshot, not last year's blog.
@iso
This is the kind of thread that should be a sticky and is not. You wrote «DR0-DR3 worked bare metal». That is the sentence I keep. TTD queri
You are describing a live target. Stop. Patched class only. I reproduced it twice before I believed you. «Hardware breakpoints that vanish under a hypervisor» — specifically DR0-DR3 worked bare metal. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. I will +rep a listing and −rep a vibe. That is the deal.
Good. Dated shot, version in the post. The load-bearing line: DR0-DR3 worked bare metal. TTD queries that scan the whole trace are how you learn patience. Narrow the range. I wrote a 12-line script and then threw it away. The listing was enough.
@labx
Good. Dated shot, version in the post. The load-bearing line: DR0-DR3 worked bare metal. TTD queries that scan the whole trace are how you l
Take the telegram pitch to the bin. Market listing or nothing. If you only have the decompiler, you do not have the bug. On «Hardware breakpoints that vanish under a hypervisor»: DR0-DR3 worked bare metal. Dump the helper process. Always the helper process. Was this on the licensed corpus or a crackme you wrote? I still have the snapshot named debu-63-pre.
@lock
If you only have the decompiler, you do not have the bug. On «Hardware breakpoints that vanish under a hypervisor»: DR0-DR3 worked bare meta
This matches a public n-day class from last patch Tuesday. You wrote «DR0-DR3 worked bare metal». That is the sentence I keep. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. I reproduced it on lab build 1352.
@michaelson
This matches a public n-day class from last patch Tuesday. You wrote «DR0-DR3 worked bare metal». That is the sentence I keep. rr --chaos is
Quote the bytes or sit down. I disagree with the tone, not the bytes. On «Hardware breakpoints that vanish under a hypervisor»: DR0-DR3 worked bare metal. SetThreadDescription is free. I will keep nagging. My note id for this: 3f-05.
I dumped after OEP and then did this. The load-bearing line: DR0-DR3 worked bare metal. Dump the helper process. Always the helper process. I reproduced it on lab build 1252.
@oluwafemi
I dumped after OEP and then did this. The load-bearing line: DR0-DR3 worked bare metal. Dump the helper process. Always the helper process.
You are treating a checksum as a signature again. Not fully convinced yet. «Hardware breakpoints that vanish under a hypervisor» — specifically DR0-DR3 worked bare metal. SetThreadDescription is free. I will keep nagging. Version in my shot: current lab snapshot, not last year's blog.