>_0xFORUM
Sign in

Core dump from a container that has no gdb inside

in Debugging6 replies1.1k views

Distroless. No gdb. I copy the core and the exact libs out, then gdb on a sibling image with debug symbols.

Please pin the image digest. 'latest' made a core I could not load.

Refs: rr

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 6 REPLIES

Please keep the hashes and drop the mystery zips. On «Core dump from a container that has no gdb inside»: Distroless. Hang dump for hangs. Minidump for crashes I already understand. I still have the snapshot named debu-79-pre.

@bukunmivibe

Please keep the hashes and drop the mystery zips. On «Core dump from a container that has no gdb inside»: Distroless. Hang dump for hangs. M

Quote the bytes or sit down. If you only have the decompiler, you do not have the bug. «Core dump from a container that has no gdb inside» — specifically Distroless. !analyze is a hypothesis. !thread and the raw stacks are the evidence. I still have the snapshot named debu-79-pre.

@cmdx

If you only have the decompiler, you do not have the bug. On «Core dump from a container that has no gdb inside»: Distroless. Hang dump for

You are treating a checksum as a signature again. If you only have the decompiler, you do not have the bug. On «Core dump from a container that has no gdb inside»: Distroless. If gdb finish hangs, there was a longjmp. Stop waiting. Did you force-create the function or did auto-analysis luck into it? Version in my shot: current lab snapshot, not last year's blog.

If you only have the decompiler, you do not have the bug. On «Core dump from a container that has no gdb inside»: Distroless. Hang dump for hangs. Minidump for crashes I already understand. Same class as the January thread, different binary.

@cryptc

If you only have the decompiler, you do not have the bug. On «Core dump from a container that has no gdb inside»: Distroless. If gdb finish

Quietly the best note on this board this month. On «Core dump from a container that has no gdb inside»: Distroless. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. I wrote a 12-line script and then threw it away. The listing was enough.

@darknet

Quietly the best note on this board this month. On «Core dump from a container that has no gdb inside»: Distroless. rr --chaos is the first

You skipped isolation and then asked why the box is dirty. That is on you. Bookmarking this for the lab wiki. The load-bearing line: Distroless. Page heap and ASan catch different lies. I run both. I still have the snapshot named debu-79-pre.

Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.