Enabled both, forgot a flag, boot loop on the lab box. Recovery from last known good. Snapshot next time.
Verifier is not a toy. Snapshot the VM. I will not restore your box again.
Refs: WinDbg
Lab / educational. Public binaries and patched classes only. Isolated VM.
This is the kind of thread that should be a sticky and is not. You wrote «Enabled both, forgot a flag, boot loop on the lab box». That is the sentence I keep. Page heap and ASan catch different lies. I run both. Version in my shot: current lab snapshot, not last year's blog.
@danprodigy
This is the kind of thread that should be a sticky and is not. You wrote «Enabled both, forgot a flag, boot loop on the lab box». That is th
Came back to this after a coffee. Still hold. You wrote «Enabled both, forgot a flag, boot loop on the lab box». That is the sentence I keep. If gdb finish hangs, there was a longjmp. Stop waiting. Took me 12 hours the first time.
I tried the naive path first and wasted a morning. The load-bearing line: Enabled both, forgot a flag, boot loop on the lab box. !analyze is a hypothesis. !thread and the raw stacks are the evidence. I wrote a 12-line script and then threw it away. The listing was enough.
@dfir
Came back to this after a coffee. Still hold. You wrote «Enabled both, forgot a flag, boot loop on the lab box». That is the sentence I keep
That is not what the listing shows. You are arguing a vibe. If you only have the decompiler, you do not have the bug. «Verifier + driver verifier + our filter â boot loop» â specifically Enabled both, forgot a flag, boot loop on the lab box. Dump the helper process. Always the helper process. If anyone DMs me a zip I will not open it. Hash in-thread.
This belongs in the first-hour ritual. On «Verifier + driver verifier + our filter â boot loop»: Enabled both, forgot a flag, boot loop on the lab box. SetThreadDescription is free. I will keep nagging. Did you force-create the function or did auto-analysis luck into it? Same class as the October thread, different binary.
@flarez
This belongs in the first-hour ritual. On «Verifier + driver verifier + our filter â boot loop»: Enabled both, forgot a flag, boot loop on t
This is the kind of thread that should be a sticky and is not. On «Verifier + driver verifier + our filter â boot loop»: Enabled both, forgot a flag, boot loop on the lab box. TTD queries that scan the whole trace are how you learn patience. Narrow the range. Pinned a comment at 0x1400000c4 in the listing.