Parent looked hung. Child had already crashed. People dumped the parent for two hours.
If there is a helper process, dump both. Always both.
Refs: WinDbg
Lab / educational. Public binaries and patched classes only. Isolated VM.
Crash in a spawned helper that the parent waited on
// 5 REPLIES
This is the writeup I wanted when I was stuck. The load-bearing line: Parent looked hung. Page heap and ASan catch different lies. I run both. If anyone DMs me a zip I will not open it. Hash in-thread.
@nexus
This is the writeup I wanted when I was stuck. The load-bearing line: Parent looked hung. Page heap and ASan catch different lies. I run bot
Agreed on the class, not on the tool. «Crash in a spawned helper that the parent waited on» â specifically Parent looked hung. If gdb finish hangs, there was a longjmp. Stop waiting. I wrote a 12-line script and then threw it away. The listing was enough.
@oluwafemi
Agreed on the class, not on the tool. «Crash in a spawned helper that the parent waited on» â specifically Parent looked hung. If gdb finish
Take the telegram pitch to the bin. Market listing or nothing. I disagree with the tone, not the bytes. «Crash in a spawned helper that the parent waited on» â specifically Parent looked hung. WOW64: switch the stack before you talk. !wow64exts.sw. My note id for this: 5c-02.
This is the writeup I wanted when I was stuck. The load-bearing line: Parent looked hung. Dump the helper process. Always the helper process. Did page heap see it, or only the sanitizer? Pinned a comment at 0x140004e18 in the listing.
@pwner
This is the writeup I wanted when I was stuck. The load-bearing line: Parent looked hung. Dump the helper process. Always the helper process
I ran this on a licensed corpus binary. On «Crash in a spawned helper that the parent waited on»: Parent looked hung. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. Took me 9 hours the first time.
Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.