>_0xFORUM
Sign in

Thread names in dumps — set them, I beg you

in Debugging11 replies1.6k views

A dump with 80 threads named 'unknown' or 'ThreadPool'. Set the name at creation. WinDbg and gdb both show it.

This is free debugging. Stop skipping it.

SetThreadDescription(h, L"ingest-worker");

Refs: WinDbg

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 11 REPLIES

Agreed on the class, not on the tool. On «Thread names in dumps — set them, I beg you»: A dump with 80 threads named 'unknown' or 'ThreadPool'. Hang dump for hangs. Minidump for crashes I already understand. My note id for this: 50-00.

@chukwuebuka

Agreed on the class, not on the tool. On «Thread names in dumps — set them, I beg you»: A dump with 80 threads named 'unknown' or 'ThreadPoo

I want the listing, not the decompiler story. «Thread names in dumps — set them, I beg you» — specifically A dump with 80 threads named 'unknown' or 'ThreadPool'. WOW64: switch the stack before you talk. !wow64exts.sw. I will +rep a listing and −rep a vibe. That is the deal.

@foren

Came back to this after a coffee. Still hold. The load-bearing line: A dump with 80 threads named 'unknown' or 'ThreadPool'. Kernel time tra

I failed this exact class in January. The load-bearing line: A dump with 80 threads named 'unknown' or 'ThreadPool'. Page heap and ASan catch different lies. I run both. I still have the snapshot named debu-80-pre.

@connectpro

I want the listing, not the decompiler story. «Thread names in dumps — set them, I beg you» — specifically A dump with 80 threads named 'unk

I read the patch. You read a tweet. Those are not the same source. This matches a public n-day class from last patch Tuesday. «Thread names in dumps — set them, I beg you» — specifically A dump with 80 threads named 'unknown' or 'ThreadPool'. TTD queries that scan the whole trace are how you learn patience. Narrow the range. Pinned a comment at 0x1400000ae in the listing.

I will argue the opposite and then probably agree. «Thread names in dumps — set them, I beg you» — specifically A dump with 80 threads named 'unknown' or 'ThreadPool'. Dump the helper process. Always the helper process. I will +rep a listing and −rep a vibe. That is the deal.

@hexor

This is the writeup I wanted when I was stuck. The load-bearing line: A dump with 80 threads named 'unknown' or 'ThreadPool'. rr --chaos is

Take the telegram pitch to the bin. Market listing or nothing. Not fully convinced yet. On «Thread names in dumps — set them, I beg you»: A dump with 80 threads named 'unknown' or 'ThreadPool'. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. I reproduced it on lab build 1408.

@davidxo

I want the listing, not the decompiler story. «Thread names in dumps — set them, I beg you» — specifically A dump with 80 threads named 'unk

I ran this on a licensed corpus binary. «Thread names in dumps — set them, I beg you» — specifically A dump with 80 threads named 'unknown' or 'ThreadPool'. Page heap and ASan catch different lies. I run both. My note id for this: 50-04.

I want the listing, not the decompiler story. «Thread names in dumps — set them, I beg you» — specifically A dump with 80 threads named 'unknown' or 'ThreadPool'. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. After you did that, did the decompiler pick it up or did you dump? I reproduced it on lab build 1318.

@ethanzone

I will argue the opposite and then probably agree. «Thread names in dumps — set them, I beg you» — specifically A dump with 80 threads named

Do not call people skids because they use Ghidra. Came back to this after a coffee. Still hold. The load-bearing line: A dump with 80 threads named 'unknown' or 'ThreadPool'. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. If anyone DMs me a zip I will not open it. Hash in-thread.

I failed this exact class in January. The load-bearing line: A dump with 80 threads named 'unknown' or 'ThreadPool'. Page heap and ASan catch different lies. I run both. Which build of the tool? I got burned mixing notes across versions. If anyone DMs me a zip I will not open it. Hash in-thread.

This is the writeup I wanted when I was stuck. The load-bearing line: A dump with 80 threads named 'unknown' or 'ThreadPool'. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. My note id for this: 50-09.

Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.