Replay a TTD trace on a different machine — symbol path pain

Agreed on the class, not on the tool. You wrote «Trace on a lab box, replay on a laptop». That is the sentence I keep. Dump the helper process. Always the helper process. I wrote a 12-line script and then threw it away. The listing was enough.

@hexsec

Agreed on the class, not on the tool. You wrote «Trace on a lab box, replay on a laptop». That is the sentence I keep. Dump the helper proce

Call-convention guess is not evidence. I still keep a paper notebook for this kind of note. You wrote «Trace on a lab box, replay on a laptop». That is the sentence I keep. SetThreadDescription is free. I will keep nagging. If anyone DMs me a zip I will not open it. Hash in-thread.

@johnflex

I dumped after OEP and then did this. «Replay a TTD trace on a different machine — symbol path pain» — specifically Trace on a lab box, repl

Do not call people skids because they use Ghidra. This is the kind of thread that should be a sticky and is not. You wrote «Trace on a lab box, replay on a laptop». That is the sentence I keep. Page heap and ASan catch different lies. I run both. Which build of the tool? I got burned mixing notes across versions. Same class as the June thread, different binary.

@lawrencex

I ran this on a licensed corpus binary. The load-bearing line: Trace on a lab box, replay on a laptop. If gdb finish hangs, there was a long

You are describing a live target. Stop. Patched class only. The screenshot is the useful part of the post. You wrote «Trace on a lab box, replay on a laptop». That is the sentence I keep. Dump the helper process. Always the helper process. I reproduced it on lab build 1242.

I ran this on a licensed corpus binary. On «Replay a TTD trace on a different machine — symbol path pain»: Trace on a lab box, replay on a laptop. !analyze is a hypothesis. !thread and the raw stacks are the evidence. I reproduced it on lab build 1244.

I dumped after OEP and then did this. «Replay a TTD trace on a different machine — symbol path pain» — specifically Trace on a lab box, replay on a laptop. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. Took me 11 hours the first time.

@keyx

This is the kind of thread that should be a sticky and is not. You wrote «Trace on a lab box, replay on a laptop». That is the sentence I ke

I ran this on a licensed corpus binary. The load-bearing line: Trace on a lab box, replay on a laptop. If gdb finish hangs, there was a longjmp. Stop waiting. I will +rep a listing and −rep a vibe. That is the deal.

@mosesprime

I ran this on a licensed corpus binary. On «Replay a TTD trace on a different machine — symbol path pain»: Trace on a lab box, replay on a l

Take the telegram pitch to the bin. Market listing or nothing. Came back to this after a coffee. Still hold. You wrote «Trace on a lab box, replay on a laptop». That is the sentence I keep. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. I reproduced it on lab build 1099.

Agreed on the class, not on the tool. «Replay a TTD trace on a different machine — symbol path pain» — specifically Trace on a lab box, replay on a laptop. Page heap and ASan catch different lies. I run both. Was this on the licensed corpus or a crackme you wrote? Took me 6 hours the first time.

@opzsec

Agreed on the class, not on the tool. «Replay a TTD trace on a different machine — symbol path pain» — specifically Trace on a lab box, repl

Quote the bytes or sit down. I ran this on a licensed corpus binary. On «Replay a TTD trace on a different machine — symbol path pain»: Trace on a lab box, replay on a laptop. SetThreadDescription is free. I will keep nagging. If anyone DMs me a zip I will not open it. Hash in-thread.