Stack smash that ASan caught and WinDbg !analyze called 'heap'

I still keep a paper notebook for this kind of note. On «Stack smash that ASan caught and WinDbg !analyze called 'heap'»: Stack buffer. TTD queries that scan the whole trace are how you learn patience. Narrow the range. If anyone DMs me a zip I will not open it. Hash in-thread.

@guardx

I still keep a paper notebook for this kind of note. On «Stack smash that ASan caught and WinDbg !analyze called 'heap'»: Stack buffer. TTD

Please keep the hashes and drop the mystery zips. «Stack smash that ASan caught and WinDbg !analyze called 'heap'» — specifically Stack buffer. WOW64: switch the stack before you talk. !wow64exts.sw. I wrote a 12-line script and then threw it away. The listing was enough.

@hexbit

Please keep the hashes and drop the mystery zips. «Stack smash that ASan caught and WinDbg !analyze called 'heap'» — specifically Stack buff

You skipped isolation and then asked why the box is dirty. That is on you. Agreed on the class, not on the tool. «Stack smash that ASan caught and WinDbg !analyze called 'heap'» — specifically Stack buffer. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. Version in my shot: current lab snapshot, not last year's blog.

@lambd

This is the writeup I wanted when I was stuck. On «Stack smash that ASan caught and WinDbg !analyze called 'heap'»: Stack buffer. !analyze i

That is not what the listing shows. You are arguing a vibe. I would have written the opposite conclusion a year ago. You wrote «Stack buffer». That is the sentence I keep. If gdb finish hangs, there was a longjmp. Stop waiting. Took me 8 hours the first time.

Came back to this after a coffee. Still hold. The load-bearing line: Stack buffer. WOW64: switch the stack before you talk. !wow64exts.sw. After you did that, did the decompiler pick it up or did you dump? Pinned a comment at 0x140006f93 in the listing.

@xorx

I tried the naive path first and wasted a morning. On «Stack smash that ASan caught and WinDbg !analyze called 'heap'»: Stack buffer. Dump t

I will argue the opposite and then probably agree. The load-bearing line: Stack buffer. If gdb finish hangs, there was a longjmp. Stop waiting. I wrote a 12-line script and then threw it away. The listing was enough.

@jasonconnect

Came back to this after a coffee. Still hold. The load-bearing line: Stack buffer. WOW64: switch the stack before you talk. !wow64exts.sw. A

Bookmarking this for the lab wiki. The load-bearing line: Stack buffer. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. My note id for this: 56-04.

This is the writeup I wanted when I was stuck. On «Stack smash that ASan caught and WinDbg !analyze called 'heap'»: Stack buffer. !analyze is a hypothesis. !thread and the raw stacks are the evidence. Took me 7 hours the first time.

Did this on ARM64 last week — same shape, different pain. On «Stack smash that ASan caught and WinDbg !analyze called 'heap'»: Stack buffer. If gdb finish hangs, there was a longjmp. Stop waiting. Took me 7 hours the first time.

@ctrlx

Quietly the best note on this board this month. The load-bearing line: Stack buffer. rr --chaos is the first thing I try on a userspace race

The screenshot is the useful part of the post. The load-bearing line: Stack buffer. Page heap and ASan catch different lies. I run both. After you did that, did the decompiler pick it up or did you dump? I reproduced it on lab build 1203.

@logic

I would have written the opposite conclusion a year ago. You wrote «Stack buffer». That is the sentence I keep. If gdb finish hangs, there w

Did this on ARM64 last week — same shape, different pain. «Stack smash that ASan caught and WinDbg !analyze called 'heap'» — specifically Stack buffer. If gdb finish hangs, there was a longjmp. Stop waiting. I reproduced it on lab build 1227.

@chriszone

If you only have the decompiler, you do not have the bug. The load-bearing line: Stack buffer. Page heap and ASan catch different lies. I ru

That is not what the listing shows. You are arguing a vibe. Came back to this after a coffee. Still hold. You wrote «Stack buffer». That is the sentence I keep. Hang dump for hangs. Minidump for crashes I already understand. If anyone DMs me a zip I will not open it. Hash in-thread.

Quietly the best note on this board this month. The load-bearing line: Stack buffer. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. My note id for this: 56-27.

This is the kind of thread that should be a sticky and is not. You wrote «Stack buffer». That is the sentence I keep. !analyze is a hypothesis. !thread and the raw stacks are the evidence. Can you quote the offset instead of the graph screenshot? Version in my shot: current lab snapshot, not last year's blog.

Quietly the best note on this board this month. «Stack smash that ASan caught and WinDbg !analyze called 'heap'» — specifically Stack buffer. SetThreadDescription is free. I will keep nagging. Took me 8 hours the first time.

@array

Did this on ARM64 last week — same shape, different pain. On «Stack smash that ASan caught and WinDbg !analyze called 'heap'»: Stack buffer.

You skipped isolation and then asked why the box is dirty. That is on you. The screenshot is the useful part of the post. On «Stack smash that ASan caught and WinDbg !analyze called 'heap'»: Stack buffer. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. Same class as the January thread, different binary.

I would have written the opposite conclusion a year ago. «Stack smash that ASan caught and WinDbg !analyze called 'heap'» — specifically Stack buffer. TTD queries that scan the whole trace are how you learn patience. Narrow the range. Same class as the January thread, different binary.

This belongs in the first-hour ritual. You wrote «Stack buffer». That is the sentence I keep. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. Pinned a comment at 0x140002cff in the listing.

Also: Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel.

@byteon

Quietly the best note on this board this month. «Stack smash that ASan caught and WinDbg !analyze called 'heap'» — specifically Stack buffer

If you only have the decompiler, you do not have the bug. The load-bearing line: Stack buffer. Page heap and ASan catch different lies. I run both. I still have the snapshot named debu-86-pre.

@ericjay

Came back to this after a coffee. Still hold. On «Stack smash that ASan caught and WinDbg !analyze called 'heap'»: Stack buffer. !analyze is

I still keep a paper notebook for this kind of note. On «Stack smash that ASan caught and WinDbg !analyze called 'heap'»: Stack buffer. TTD queries that scan the whole trace are how you learn patience. Narrow the range. Same class as the October thread, different binary.

@eastcoastkid

I would have written the opposite conclusion a year ago. «Stack smash that ASan caught and WinDbg !analyze called 'heap'» — specifically Sta

Call-convention guess is not evidence. Came back to this after a coffee. Still hold. On «Stack smash that ASan caught and WinDbg !analyze called 'heap'»: Stack buffer. !analyze is a hypothesis. !thread and the raw stacks are the evidence. My note id for this: 56-30.

I reproduced it twice before I believed you. On «Stack smash that ASan caught and WinDbg !analyze called 'heap'»: Stack buffer. Dump the helper process. Always the helper process. Pinned a comment at 0x140006e48 in the listing.

I failed this exact class in January. You wrote «Stack buffer». That is the sentence I keep. SetThreadDescription is free. I will keep nagging. Did page heap see it, or only the sanitizer? My note id for this: 56-08.

This is the writeup I wanted when I was stuck. You wrote «Stack buffer». That is the sentence I keep. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. I reproduced it on lab build 1214.

@omega

This is the writeup I wanted when I was stuck. You wrote «Stack buffer». That is the sentence I keep. rr --chaos is the first thing I try on

Call-convention guess is not evidence. I dumped after OEP and then did this. The load-bearing line: Stack buffer. !analyze is a hypothesis. !thread and the raw stacks are the evidence. Took me 2 hours the first time.

The screenshot is the useful part of the post. «Stack smash that ASan caught and WinDbg !analyze called 'heap'» — specifically Stack buffer. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. Same class as the June thread, different binary.

I reproduced it twice before I believed you. The load-bearing line: Stack buffer. WOW64: switch the stack before you talk. !wow64exts.sw. My note id for this: 56-12.

Also: Dump the helper process. Always the helper process.

@rseclab

I reproduced it twice before I believed you. The load-bearing line: Stack buffer. WOW64: switch the stack before you talk. !wow64exts.sw. My

This matches a public n-day class from last patch Tuesday. You wrote «Stack buffer». That is the sentence I keep. SetThreadDescription is free. I will keep nagging. Was this on the licensed corpus or a crackme you wrote? Same class as the October thread, different binary.

@seyiwave

This matches a public n-day class from last patch Tuesday. You wrote «Stack buffer». That is the sentence I keep. SetThreadDescription is fr

You are describing a live target. Stop. Patched class only. I reproduced it twice before I believed you. You wrote «Stack buffer». That is the sentence I keep. If gdb finish hangs, there was a longjmp. Stop waiting. I wrote a 12-line script and then threw it away. The listing was enough.

Same wall I hit last quarter. The load-bearing line: Stack buffer. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. Same class as the January thread, different binary.

@streetwise

Same wall I hit last quarter. The load-bearing line: Stack buffer. rr --chaos is the first thing I try on a userspace race. If it cannot see

Bookmarking this for the lab wiki. «Stack smash that ASan caught and WinDbg !analyze called 'heap'» — specifically Stack buffer. !analyze is a hypothesis. !thread and the raw stacks are the evidence. Pinned a comment at 0x1400007ed in the listing.

Quietly the best note on this board this month. The load-bearing line: Stack buffer. Dump the helper process. Always the helper process. My note id for this: 56-17.

@vmx

Quietly the best note on this board this month. The load-bearing line: Stack buffer. Dump the helper process. Always the helper process. My

Quote the bytes or sit down. I tried the naive path first and wasted a morning. On «Stack smash that ASan caught and WinDbg !analyze called 'heap'»: Stack buffer. Dump the helper process. Always the helper process. After you did that, did the decompiler pick it up or did you dump? Same class as the June thread, different binary.