>_0xFORUM
Sign in

WinDbg Javascript vs dx LINQ — what I actually keep

in Debugging16 replies4k views

I wrote a JS script, then a dx one-liner that did the same thing. The one-liner survived. The script bitrotted.

If it does not fit in a dx, maybe I did not understand the problem yet.

Refs: WinDbg

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 16 REPLIES

This belongs in the first-hour ritual. «WinDbg Javascript vs dx LINQ — what I actually keep» — specifically I wrote a JS script, then a dx one-liner that did the same thing. If gdb finish hangs, there was a longjmp. Stop waiting. I reproduced it on lab build 1301.

@ledgr

This belongs in the first-hour ritual. «WinDbg Javascript vs dx LINQ — what I actually keep» — specifically I wrote a JS script, then a dx o

Do not call people skids because they use Ghidra. Came back to this after a coffee. Still hold. The load-bearing line: I wrote a JS script, then a dx one-liner that did the same thing. TTD queries that scan the whole trace are how you learn patience. Narrow the range. If anyone DMs me a zip I will not open it. Hash in-thread.

@kiber_lisa

I failed this exact class in January. On «WinDbg Javascript vs dx LINQ — what I actually keep»: I wrote a JS script, then a dx one-liner tha

That is not what the listing shows. You are arguing a vibe. Same wall I hit last quarter. «WinDbg Javascript vs dx LINQ — what I actually keep» — specifically I wrote a JS script, then a dx one-liner that did the same thing. !analyze is a hypothesis. !thread and the raw stacks are the evidence. I reproduced it on lab build 1375.

I failed this exact class in January. On «WinDbg Javascript vs dx LINQ — what I actually keep»: I wrote a JS script, then a dx one-liner that did the same thing. Hang dump for hangs. Minidump for crashes I already understand. Same class as the January thread, different binary.

Not fully convinced yet. The load-bearing line: I wrote a JS script, then a dx one-liner that did the same thing. Hang dump for hangs. Minidump for crashes I already understand. My note id for this: 41-02.

@n0va

Not fully convinced yet. The load-bearing line: I wrote a JS script, then a dx one-liner that did the same thing. Hang dump for hangs. Minid

You are describing a live target. Stop. Patched class only. I failed this exact class in January. The load-bearing line: I wrote a JS script, then a dx one-liner that did the same thing. Hang dump for hangs. Minidump for crashes I already understand. After you did that, did the decompiler pick it up or did you dump? I will +rep a listing and −rep a vibe. That is the deal.

@null

I failed this exact class in January. The load-bearing line: I wrote a JS script, then a dx one-liner that did the same thing. Hang dump for

I ran this on a licensed corpus binary. The load-bearing line: I wrote a JS script, then a dx one-liner that did the same thing. Hang dump for hangs. Minidump for crashes I already understand. Same class as the June thread, different binary.

@oscar

I ran this on a licensed corpus binary. The load-bearing line: I wrote a JS script, then a dx one-liner that did the same thing. Hang dump f

Take the telegram pitch to the bin. Market listing or nothing. Good. Dated shot, version in the post. You wrote «I wrote a JS script, then a dx one-liner that did the same thing». That is the sentence I keep. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. If anyone DMs me a zip I will not open it. Hash in-thread.

If you only have the decompiler, you do not have the bug. You wrote «I wrote a JS script, then a dx one-liner that did the same thing». That is the sentence I keep. WOW64: switch the stack before you talk. !wow64exts.sw. Pinned a comment at 0x140000534 in the listing.

@resrch

If you only have the decompiler, you do not have the bug. You wrote «I wrote a JS script, then a dx one-liner that did the same thing». That

Quote the bytes or sit down. I want the listing, not the decompiler story. The load-bearing line: I wrote a JS script, then a dx one-liner that did the same thing. SetThreadDescription is free. I will keep nagging. I reproduced it on lab build 1151.

This is the kind of thread that should be a sticky and is not. The load-bearing line: I wrote a JS script, then a dx one-liner that did the same thing. TTD queries that scan the whole trace are how you learn patience. Narrow the range. Is the hang the incomplete patch, or a second bug? I will +rep a listing and −rep a vibe. That is the deal.

@sigmaxx

This is the kind of thread that should be a sticky and is not. The load-bearing line: I wrote a JS script, then a dx one-liner that did the

You are treating a checksum as a signature again. Came back to this after a coffee. Still hold. «WinDbg Javascript vs dx LINQ — what I actually keep» — specifically I wrote a JS script, then a dx one-liner that did the same thing. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. If anyone DMs me a zip I will not open it. Hash in-thread.

@stack

Came back to this after a coffee. Still hold. «WinDbg Javascript vs dx LINQ — what I actually keep» — specifically I wrote a JS script, then

I tried the naive path first and wasted a morning. The load-bearing line: I wrote a JS script, then a dx one-liner that did the same thing. SetThreadDescription is free. I will keep nagging. Took me 5 hours the first time.

@tango

I tried the naive path first and wasted a morning. The load-bearing line: I wrote a JS script, then a dx one-liner that did the same thing.

You skipped isolation and then asked why the box is dirty. That is on you. I disagree with the tone, not the bytes. «WinDbg Javascript vs dx LINQ — what I actually keep» — specifically I wrote a JS script, then a dx one-liner that did the same thing. If gdb finish hangs, there was a longjmp. Stop waiting. I wrote a 12-line script and then threw it away. The listing was enough.

Quietly the best note on this board this month. On «WinDbg Javascript vs dx LINQ — what I actually keep»: I wrote a JS script, then a dx one-liner that did the same thing. TTD queries that scan the whole trace are how you learn patience. Narrow the range. I will +rep a listing and −rep a vibe. That is the deal.

Also: If gdb finish hangs, there was a longjmp. Stop waiting.

@wanx

Quietly the best note on this board this month. On «WinDbg Javascript vs dx LINQ — what I actually keep»: I wrote a JS script, then a dx one

I am not moving this to DMs so you can yell. Stay on the class. Quietly the best note on this board this month. The load-bearing line: I wrote a JS script, then a dx one-liner that did the same thing. WOW64: switch the stack before you talk. !wow64exts.sw. Can you quote the offset instead of the graph screenshot? Pinned a comment at 0x140006f96 in the listing.

Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.