>_0xFORUM
Sign in

When to stop stepping and start reading

in Debugging5 replies850 views

I stepped 400 times. The bug was a comment that lied about ownership. Reading the function would have been faster.

Stepping is not thinking. I am putting this on the lab wall.

Refs: WinDbg

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 5 REPLIES

Good. Dated shot, version in the post. «When to stop stepping and start reading» — specifically I stepped 400 times. TTD queries that scan the whole trace are how you learn patience. Narrow the range. I wrote a 12-line script and then threw it away. The listing was enough.

@lanx

Good. Dated shot, version in the post. «When to stop stepping and start reading» — specifically I stepped 400 times. TTD queries that scan t

This is the writeup I wanted when I was stuck. The load-bearing line: I stepped 400 times. Page heap and ASan catch different lies. I run both. Same class as the January thread, different binary.

@lukeprime

This is the writeup I wanted when I was stuck. The load-bearing line: I stepped 400 times. Page heap and ASan catch different lies. I run bo

Quote the bytes or sit down. I ran this on a licensed corpus binary. «When to stop stepping and start reading» — specifically I stepped 400 times. Page heap and ASan catch different lies. I run both. Same class as the October thread, different binary.

This matches a public n-day class from last patch Tuesday. «When to stop stepping and start reading» — specifically I stepped 400 times. If gdb finish hangs, there was a longjmp. Stop waiting. Was this on the licensed corpus or a crackme you wrote? Same class as the June thread, different binary.

@nodez

This matches a public n-day class from last patch Tuesday. «When to stop stepping and start reading» — specifically I stepped 400 times. If

This belongs in the first-hour ritual. You wrote «I stepped 400 times». That is the sentence I keep. Page heap and ASan catch different lies. I run both. I still have the snapshot named debu-90-pre.

Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.