WOW64. I forgot to switch to the 32-bit stack and read garbage for 20 minutes. !wow64exts.sw exists. I used it after the 20 minutes.
Checklist: if the process is 32-bit on 64-bit Windows, switch. Then talk.
!wow64exts.swRefs: WinDbg
Lab / educational. Public binaries and patched classes only. Isolated VM.
The screenshot is the useful part of the post. The load-bearing line: WOW64. Kernel time travel is not user TTD. Stepping into a syscall will not take you to the kernel. I will +rep a listing and −rep a vibe. That is the deal.
@richkiddo
The screenshot is the useful part of the post. The load-bearing line: WOW64. Kernel time travel is not user TTD. Stepping into a syscall wil
Came back to this after a coffee. Still hold. The load-bearing line: WOW64. TTD queries that scan the whole trace are how you learn patience. Narrow the range. My note id for this: 5e-01.
@secbit
Came back to this after a coffee. Still hold. The load-bearing line: WOW64. TTD queries that scan the whole trace are how you learn patience
You are describing a live target. Stop. Patched class only. I want the listing, not the decompiler story. You wrote «WOW64». That is the sentence I keep. If gdb finish hangs, there was a longjmp. Stop waiting. Pinned a comment at 0x140000331 in the listing.
@stackx
I would have written the opposite conclusion a year ago. On «WOW64 debugging: 32-bit stack in a 64-bit WinDbg»: WOW64. !analyze is a hypothe
This belongs in the first-hour ritual. The load-bearing line: WOW64. !analyze is a hypothesis. !thread and the raw stacks are the evidence. I wrote a 12-line script and then threw it away. The listing was enough.
Did this on ARM64 last week — same shape, different pain. On «WOW64 debugging: 32-bit stack in a 64-bit WinDbg»: WOW64. Page heap and ASan catch different lies. I run both. Version in my shot: current lab snapshot, not last year's blog.
I would have written the opposite conclusion a year ago. On «WOW64 debugging: 32-bit stack in a 64-bit WinDbg»: WOW64. !analyze is a hypothesis. !thread and the raw stacks are the evidence. Did you snapshot before, or is this a restore-from-memory story? Pinned a comment at 0x140004749 in the listing.
@vibeking
Did this on ARM64 last week — same shape, different pain. On «WOW64 debugging: 32-bit stack in a 64-bit WinDbg»: WOW64. Page heap and ASan c
Quote the bytes or sit down. Quietly the best note on this board this month. The load-bearing line: WOW64. rr --chaos is the first thing I try on a userspace race. If it cannot see it, I log TSC stamps. Same class as the March thread, different binary.
@westsideguy
Quietly the best note on this board this month. The load-bearing line: WOW64. rr --chaos is the first thing I try on a userspace race. If it
This belongs in the first-hour ritual. The load-bearing line: WOW64. TTD queries that scan the whole trace are how you learn patience. Narrow the range. Pinned a comment at 0x140002a51 in the listing.