rr pack, 40GB, reverse-continue from the crash to the first write. Took minutes, not hours. Still worth it.
Where do you draw the line and switch to a logging build instead of a bigger recording?
Refs: rr
Lab / educational. Public binaries and patched classes only. Isolated VM.
I failed this exact class in January. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». That is the sentence I keep. Page heap and ASan catch different lies. I run both. I still have the snapshot named debu-64-pre.
@kernx
I failed this exact class in January. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». That is the sentence I
I ran this on a licensed corpus binary. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». That is the sentence I keep. Dump the helper process. Always the helper process. Pinned a comment at 0x140006e7e in the listing.
Quietly the best note on this board this month. On «gdb reverse-continue on a recording that is 40GB»: rr pack, 40GB, reverse-continue from the crash to the first write. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. Is the hang the incomplete patch, or a second bug? Same class as the June thread, different binary.
@lanrepro
I ran this on a licensed corpus binary. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». That is the sentence
I am not moving this to DMs so you can yell. Stay on the class. I still keep a paper notebook for this kind of note. On «gdb reverse-continue on a recording that is 40GB»: rr pack, 40GB, reverse-continue from the crash to the first write. Dump the helper process. Always the helper process. I will +rep a listing and −rep a vibe. That is the deal.
@audit
I will argue the opposite and then probably agree. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». That is th
You are treating a checksum as a signature again. This is the kind of thread that should be a sticky and is not. The load-bearing line: rr pack, 40GB, reverse-continue from the crash to the first write. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. Did page heap see it, or only the sanitizer? Pinned a comment at 0x140004211 in the listing.
Did this on ARM64 last week — same shape, different pain. On «gdb reverse-continue on a recording that is 40GB»: rr pack, 40GB, reverse-continue from the crash to the first write. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. I will +rep a listing and −rep a vibe. That is the deal.
@foxtrot
Did this on ARM64 last week — same shape, different pain. On «gdb reverse-continue on a recording that is 40GB»: rr pack, 40GB, reverse-cont
This matches a public n-day class from last patch Tuesday. On «gdb reverse-continue on a recording that is 40GB»: rr pack, 40GB, reverse-continue from the crash to the first write. Dump the helper process. Always the helper process. Which build of the tool? I got burned mixing notes across versions. If anyone DMs me a zip I will not open it. Hash in-thread.
If you only have the decompiler, you do not have the bug. «gdb reverse-continue on a recording that is 40GB» — specifically rr pack, 40GB, reverse-continue from the crash to the first write. !analyze is a hypothesis. !thread and the raw stacks are the evidence. I reproduced it on lab build 1102.
This is the kind of thread that should be a sticky and is not. «gdb reverse-continue on a recording that is 40GB» — specifically rr pack, 40GB, reverse-continue from the crash to the first write. Page heap and ASan catch different lies. I run both. Took me 11 hours the first time.
@ciph3r
This is the kind of thread that should be a sticky and is not. «gdb reverse-continue on a recording that is 40GB» — specifically rr pack, 40
I am not moving this to DMs so you can yell. Stay on the class. I dumped after OEP and then did this. «gdb reverse-continue on a recording that is 40GB» — specifically rr pack, 40GB, reverse-continue from the crash to the first write. TTD queries that scan the whole trace are how you learn patience. Narrow the range. Same class as the June thread, different binary.
This matches a public n-day class from last patch Tuesday. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». That is the sentence I keep. SetThreadDescription is free. I will keep nagging. Is the hang the incomplete patch, or a second bug? I will +rep a listing and −rep a vibe. That is the deal.
Agreed on the class, not on the tool. The load-bearing line: rr pack, 40GB, reverse-continue from the crash to the first write. Page heap and ASan catch different lies. I run both. Pinned a comment at 0x14000085f in the listing.
I will argue the opposite and then probably agree. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». That is the sentence I keep. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. I wrote a 12-line script and then threw it away. The listing was enough.
I failed this exact class in January. The load-bearing line: rr pack, 40GB, reverse-continue from the crash to the first write. TTD queries that scan the whole trace are how you learn patience. Narrow the range. Pinned a comment at 0x140002ad1 in the listing.
@voltx
I ran this on a licensed corpus binary. On «gdb reverse-continue on a recording that is 40GB»: rr pack, 40GB, reverse-continue from the cras
This is the kind of thread that should be a sticky and is not. On «gdb reverse-continue on a recording that is 40GB»: rr pack, 40GB, reverse-continue from the crash to the first write. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. Pinned a comment at 0x14000060e in the listing.
@binsec
This is the kind of thread that should be a sticky and is not. The load-bearing line: rr pack, 40GB, reverse-continue from the crash to the
Agreed on the class, not on the tool. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». That is the sentence I keep. !analyze is a hypothesis. !thread and the raw stacks are the evidence. I will +rep a listing and −rep a vibe. That is the deal.
I tried the naive path first and wasted a morning. The load-bearing line: rr pack, 40GB, reverse-continue from the crash to the first write. WOW64: switch the stack before you talk. !wow64exts.sw. If anyone DMs me a zip I will not open it. Hash in-thread.
Also: TTD queries that scan the whole trace are how you learn patience. Narrow the range.
@edge
If you only have the decompiler, you do not have the bug. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». Tha
I read the patch. You read a tweet. Those are not the same source. I tried the naive path first and wasted a morning. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». That is the sentence I keep. Hang dump for hangs. Minidump for crashes I already understand. Version in my shot: current lab snapshot, not last year's blog.
I want the listing, not the decompiler story. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». That is the sentence I keep. WOW64: switch the stack before you talk. !wow64exts.sw. Is the hang the incomplete patch, or a second bug? Pinned a comment at 0x1400025b3 in the listing.
@dec0de
Agreed on the class, not on the tool. The load-bearing line: rr pack, 40GB, reverse-continue from the crash to the first write. Page heap an
If you only have the decompiler, you do not have the bug. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». That is the sentence I keep. Hang dump for hangs. Minidump for crashes I already understand. Took me 2 hours the first time.
@hexorx
I failed this exact class in January. The load-bearing line: rr pack, 40GB, reverse-continue from the crash to the first write. !analyze is
Please keep the hashes and drop the mystery zips. «gdb reverse-continue on a recording that is 40GB» — specifically rr pack, 40GB, reverse-continue from the crash to the first write. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. Same class as the October thread, different binary.
@hash
If you only have the decompiler, you do not have the bug. «gdb reverse-continue on a recording that is 40GB» — specifically rr pack, 40GB, r
Do not call people skids because they use Ghidra. I failed this exact class in January. The load-bearing line: rr pack, 40GB, reverse-continue from the crash to the first write. !analyze is a hypothesis. !thread and the raw stacks are the evidence. Version in my shot: current lab snapshot, not last year's blog.
@modx
Quietly the best note on this board this month. On «gdb reverse-continue on a recording that is 40GB»: rr pack, 40GB, reverse-continue from
I dumped after OEP and then did this. The load-bearing line: rr pack, 40GB, reverse-continue from the crash to the first write. WOW64: switch the stack before you talk. !wow64exts.sw. I wrote a 12-line script and then threw it away. The listing was enough.
If you only have the decompiler, you do not have the bug. On «gdb reverse-continue on a recording that is 40GB»: rr pack, 40GB, reverse-continue from the crash to the first write. SetThreadDescription is free. I will keep nagging. Same class as the January thread, different binary.
@opsec
If you only have the decompiler, you do not have the bug. On «gdb reverse-continue on a recording that is 40GB»: rr pack, 40GB, reverse-cont
I read the patch. You read a tweet. Those are not the same source. I would have written the opposite conclusion a year ago. «gdb reverse-continue on a recording that is 40GB» — specifically rr pack, 40GB, reverse-continue from the crash to the first write. Hang dump for hangs. Minidump for crashes I already understand. Version in my shot: current lab snapshot, not last year's blog.
@pktsec
I would have written the opposite conclusion a year ago. «gdb reverse-continue on a recording that is 40GB» — specifically rr pack, 40GB, re
I want the listing, not the decompiler story. «gdb reverse-continue on a recording that is 40GB» — specifically rr pack, 40GB, reverse-continue from the crash to the first write. Dump the helper process. Always the helper process. I will +rep a listing and −rep a vibe. That is the deal.
I disagree with the tone, not the bytes. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». That is the sentence I keep. TTD queries that scan the whole trace are how you learn patience. Narrow the range. After you did that, did the decompiler pick it up or did you dump? Pinned a comment at 0x140006038 in the listing.
Quietly the best note on this board this month. The load-bearing line: rr pack, 40GB, reverse-continue from the crash to the first write. !analyze is a hypothesis. !thread and the raw stacks are the evidence. I reproduced it on lab build 1076.
@shield
Quietly the best note on this board this month. The load-bearing line: rr pack, 40GB, reverse-continue from the crash to the first write. !a
Do not call people skids because they use Ghidra. Not fully convinced yet. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». That is the sentence I keep. SetThreadDescription is free. I will keep nagging. Pinned a comment at 0x14000013a in the listing.
This belongs in the first-hour ritual. The load-bearing line: rr pack, 40GB, reverse-continue from the crash to the first write. Page heap and ASan catch different lies. I run both. I will +rep a listing and −rep a vibe. That is the deal.
Same wall I hit last quarter. «gdb reverse-continue on a recording that is 40GB» — specifically rr pack, 40GB, reverse-continue from the crash to the first write. SetThreadDescription is free. I will keep nagging. Same class as the June thread, different binary.
Also: Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel.
I ran this on a licensed corpus binary. On «gdb reverse-continue on a recording that is 40GB»: rr pack, 40GB, reverse-continue from the crash to the first write. SetThreadDescription is free. I will keep nagging. Pinned a comment at 0x140004b43 in the listing.
@ttyx
Same wall I hit last quarter. «gdb reverse-continue on a recording that is 40GB» — specifically rr pack, 40GB, reverse-continue from the cra
Not fully convinced yet. On «gdb reverse-continue on a recording that is 40GB»: rr pack, 40GB, reverse-continue from the crash to the first write. Dump the helper process. Always the helper process. Can you quote the offset instead of the graph screenshot? I reproduced it on lab build 1009.
@vuln
Not fully convinced yet. On «gdb reverse-continue on a recording that is 40GB»: rr pack, 40GB, reverse-continue from the crash to the first
Take the telegram pitch to the bin. Market listing or nothing. Not fully convinced yet. You wrote «rr pack, 40GB, reverse-continue from the crash to the first write». That is the sentence I keep. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. My note id for this: 40-14.