>_0xFORUM
Sign in

Non-invasive attach to a production-shaped lab process

in Debugging10 replies1.5k views

I needed stacks without changing timing much. Non-invasive attach, dump, detach. Good enough.

Invasive attach is a different experiment. Do not mix them and then compare timings.

.attach -v 

Refs: WinDbg

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 10 REPLIES

I would have written the opposite conclusion a year ago. The load-bearing line: I needed stacks without changing timing much. Page heap and ASan catch different lies. I run both. Took me 11 hours the first time.

Did this on ARM64 last week — same shape, different pain. You wrote Ā«I needed stacks without changing timing muchĀ». That is the sentence I keep. Page heap and ASan catch different lies. I run both. I still have the snapshot named debu-83-pre.

@eastcoastkid

I would have written the opposite conclusion a year ago. The load-bearing line: I needed stacks without changing timing much. Page heap and

You are describing a live target. Stop. Patched class only. I want the listing, not the decompiler story. On «Non-invasive attach to a production-shaped lab process»: I needed stacks without changing timing much. If gdb finish hangs, there was a longjmp. Stop waiting. Pinned a comment at 0x140000384 in the listing.

@force

Did this on ARM64 last week — same shape, different pain. You wrote Ā«I needed stacks without changing timing muchĀ». That is the sentence I k

Take the telegram pitch to the bin. Market listing or nothing. Good. Dated shot, version in the post. Ā«Non-invasive attach to a production-shaped lab processĀ» — specifically I needed stacks without changing timing much. Hang dump for hangs. Minidump for crashes I already understand. Which build of the tool? I got burned mixing notes across versions. I wrote a 12-line script and then threw it away. The listing was enough.

@gammx

Good. Dated shot, version in the post. Ā«Non-invasive attach to a production-shaped lab processĀ» — specifically I needed stacks without chang

This matches a public n-day class from last patch Tuesday. Ā«Non-invasive attach to a production-shaped lab processĀ» — specifically I needed stacks without changing timing much. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. I will +rep a listing and āˆ’rep a vibe. That is the deal.

Please keep the hashes and drop the mystery zips. The load-bearing line: I needed stacks without changing timing much. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. Is the hang the incomplete patch, or a second bug? Version in my shot: current lab snapshot, not last year's blog.

@ignitx

Please keep the hashes and drop the mystery zips. Ā«Non-invasive attach to a production-shaped lab processĀ» — specifically I needed stacks wi

You are treating a checksum as a signature again. Same wall I hit last quarter. The load-bearing line: I needed stacks without changing timing much. SetThreadDescription is free. I will keep nagging. My note id for this: 53-07.

@guardz

This matches a public n-day class from last patch Tuesday. Ā«Non-invasive attach to a production-shaped lab processĀ» — specifically I needed

Quote the bytes or sit down. This is the kind of thread that should be a sticky and is not. On «Non-invasive attach to a production-shaped lab process»: I needed stacks without changing timing much. TTD queries that scan the whole trace are how you learn patience. Narrow the range. My note id for this: 53-05.

@kernl

Please keep the hashes and drop the mystery zips. The load-bearing line: I needed stacks without changing timing much. Kernel time travel is

You skipped isolation and then asked why the box is dirty. That is on you. I reproduced it twice before I believed you. The load-bearing line: I needed stacks without changing timing much. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. Same class as the March thread, different binary.

Please keep the hashes and drop the mystery zips. Ā«Non-invasive attach to a production-shaped lab processĀ» — specifically I needed stacks without changing timing much. Dump the helper process. Always the helper process. I wrote a 12-line script and then threw it away. The listing was enough.

Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.