Music for Debugging
555 Binary Threads
Domenico Scarlatti41 555 binary form42 sonatas are an ideal background complement to a static memory dump analysis activity. Endless thread transitions between user and kernel spaces. A memory dump in front of my eyes in WinDbg window becomes live and software behavior patterns are literally heard: a spiking blocked thread trying to get a lock finally gets it and gradually descends from one module to another to rise again touching a kernel space ceiling and abruptly disappears from the memory landscape reborn in another thread form.
Out of Memory and Losing My Data (Comment Impact)
R.E.M. album “Out of Time” is a great joy to listen for Win32 API debugging veterans familiar with Visual Basic.
I put my own track title names here:
1. I Can't Find It!
2. Losing My Data
3. LOWORD
4. Near A Wild Pointer (*pa, *pa, *ppa,…)
5. End Of Session
6. Happy Customers
7. Be LONG
8. Half A Word Away! (A Miracle)
9. Printer Driver (Can't Spell Its Name)
10. Customer Feedback (One, Two, Three,…)
11. Found Me In Dumps
Navigating the Long List
If you like the completeness, grand complete memory dumps, multi-volume oeuvres (the more volumes the better) and natural memory visualization (Volume 1, page 532) you would like then to open the box and listen to that complete performance achievement to get energy and inspiration for long debugging sessions: “Liszt: The Complete Piano Music”.
Debugging Joke
Q. Why the execution of this program is so stable?
A. Because there is a breakpoint at every instruction.
Memory Dump Barcodes
Former Memory Dump Analysis Services43 (now Software Diagnostics Services) was the first to use a memory dump slice as a barcode. You can see that on its founder old business card:
MessageBox at Dublin Zoo
Visited Dublin Zoo44 with my family during last Halloween weekend where my daughter Alexandra pointed me to this funny message box:
CDB for Kids
When looking for the shortest book titles found this little book with a buzzing bug on its cover: Cdb!45
CDB also stands for Console DeBugger from Microsoft Debugging Tools for Windows. It can be used in place of WinDbg for user space targets if you don't like graphical interface or when GUI interferes with debugging.
Snow Spike Residue
Here is Dublin Citrix Office in Eastpoint Business Park as seen from outside:
Second Snowfall Spike in Dublin
The first big one was in January, 201046. In December, 2010 we had the second snowfall in just one year which was the longest and coldest as well. The pictures below were taken when it started with temperatures down to -7 in the morning so we were able to practice only small scale architecture while building a snowman:
MMXI
Similar to Google GMMXIe depiction and interpretation we propose another one related to memory centuries that start from 1000 CE47 (M…):
MMXI
Malware Memory eXception and Injection
Monitoring Memory, eXceptions, and Injections
Happy New Year and Decade of Debugging 0×7DB - 0×7E4!
The New Year of DeBugging 0×7DB opened the DeBugging Decade. Here are tips for the beginning (some output is skipped to save trees):
1: kd>* 1: kd>* Virtual memory search 1: kd>* 1: kd> s-d 0 L?3FFFFFFF 7DB 00000000`777509dc 0000007db 0004c550 0005dd80 0000b610 1: kd>* 1: kd>* Physical memory search for the first 65535 pages 1: kd>* 1: kd> !search 7DB 0 0 FFFF Searching PFNs in range 0000000000000001 - 000000000000FFFF for [00000000000007DB - 00000000000007DB] Pfn Offset Hit Va Pte - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 000000000000041D 00000D10 000000000000075B FFFFF8A000437D10 FFFFF6FC500021B8 fffff8a00040b000+0x2cd10 : NtFB (LargePool) -- BitmpSup.c 000000000000045F 00000090 000000000000079B FFFFF8A000439090 FFFFF6FC500021C8 fffff8a00040b000+0x2e090 : NtFB (LargePool) -- BitmpSup.c 000000000000045F 00000B40 00000000000007CB FFFFF8A000439B40 FFFFF6FC500021C8 fffff8a00040b000+0x2eb40 : NtFB (LargePool) -- BitmpSup.c 000000000000045F 00000D80 00000000000007D3 FFFFF8A000439D80 FFFFF6FC500021C8 fffff8a00040b000+0x2ed80 : NtFB (LargePool) -- BitmpSup.c 0000000000000460 000000B0 00000000000007D9 FFFFF8A00043A0B0 FFFFF6FC500021D0 fffff8a00040b000+0x2f0b0 : NtFB (LargePool) -- BitmpSup.c 0000000000000460 000000C8 00000000000007DA FFFFF8A00043A0C8 FFFFF6FC500021D0 fffff8a00040b000+0x2f0c8 : NtFB (LargePool) -- BitmpSup.c 0000000000000460 000000E0 00000000000007DB FFFFF8A00043A0E0 FFFFF6FC500021D0 fffff8a00040b000+0x2f0e0 : NtFB (LargePool) -- BitmpSup.c 0000000000000460 00000218 00000000000007DF FFFFF8A00043A218 FFFFF6FC500021D0 fffff8a00040b000+0x2f218 : NtFB (LargePool) -- BitmpSup.c 0000000000000460 00000950 00000000000007FB FFFFF8A00043A950 FFFFF6FC500021D0 fffff8a00040b000+0x2f950 : NtFB (LargePool) -- BitmpSup.c 0000000000000494 00000ED8 00000000000006DB FFFFF8A00042EED8 FFFFF6FC50002170 fffff8a00040b000+0x23ed8 : NtFB (LargePool) -- BitmpSup.c 00000000000004D0 00000708 00000000000005DB FFFFF8A00042A708 FFFFF6FC50002150 fffff8a00040b000+0x1f708 : NtFB (LargePool) -- BitmpSup.c 0000000000000562 000002A0 0000000000000FDB FFFFF8A00043C2A0 FFFFF6FC500021E0 fffff8a00040b000+0x312a0 : NtFB (LargePool) -- BitmpSup.c 00000000000005C8 00000020 00000000000003DB FFFFF8A000422020 FFFFF6FC50002110 fffff8a00040b000+0x17020 : NtFB (LargePool) -- BitmpSup.c 0000000000000A80 00000F58 00000000000017DB FFFFF8A00041AF58 FFFFF6FC500020D0 fffff8a00040b000+0xff58 : NtFB (LargePool) -- BitmpSup.c 0000000000003411 000008E0 00000000000005DB FFFFFA80000118E0 FFFFF6FD40000088 0000000000003411 00000948 00000000000005DB FFFFFA8000011948 FFFFF6FD40000088 0000000000003413 00000D18 000000000000079B FFFFFA8000013D18 FFFFF6FD40000098 0000000000003415 00000510 000000000000079B FFFFFA8000015510 FFFFF6FD400000A8 0000000000003415 00000518 000000000000075B FFFFFA8000015518 FFFFF6FD400000A8 0000000000003416 00000CB8 00000000000007D9 FFFFFA8000016CB8 FFFFF6FD400000B0 0000000000003431 00000110 00000000000017DB FFFFFA8000031110 FFFFF6FD40000188 0000000000003431 00000D10 0000000000000FDB FFFFFA8000031D10 FFFFF6FD40000188 0000000000003449 00000118 00000000000017DB FFFFFA8000049118 FFFFF6FD40000248 0000000000003466 00000218 00000000000007CB FFFFFA8000066218 FFFFF6FD40000330 0000000000003466 000004B0 00000000000007D9 FFFFFA80000664B0 FFFFF6FD40000330 0000000000003466 00000510 000000000000075B FFFFFA8000066510 FFFFF6FD40000330 0000000000003467 00000110 00000000000007DB FFFFFA8000067110 FFFFF6FD40000338 000000000000346B 00000918 00000000000007DB FFFFFA800006B918 FFFFF6FD40000358 0000000000003473 00000260 00000000000005DB FFFFFA8000073260 FFFFF6FD40000398 000000000000349A 00000A10 00000000000007CB FFFFFA800009AA10 FFFFF6FD400004D0 000000000000349B 00000348 00000000000007FB FFFFFA800009B348 FFFFF6FD400004D8 000000000000352C 00000510 00000000000006DB FFFFFA800012C510 FFFFF6FD40000960 000000000000352C 00000AE0 00000000000007FB FFFFFA800012CAE0 FFFFF6FD40000960 0000000000003563 000001D0 00000000000007DF FFFFFA80001631D0 FFFFF6FD40000B18 000000000000356A 00000938 00000000000007DA FFFFFA800016A938 FFFFF6FD40000B50 0000000000003596 00000D10 00000000000087DB FFFFFA8000196D10 FFFFF6FD40000CB0 0000000000003599 00000D18 00000000000087DB FFFFFA8000199D18 FFFFF6FD40000CC8 00000000000035A8 00000738 00000000000007DA FFFFFA80001A8738 FFFFF6FD40000D40 000000000000369B 00000B30 00000000000027DB FFFFFA800029BB30 FFFFF6FD400014D8 00000000000036FE 00000B90 00000000000007D3 FFFFFA80002FEB90 FFFFF6FD400017F0 0000000000003710 00000D10 00000000000107DB FFFFFA8000310D10 FFFFF6FD40001880 0000000000003747 00000918 00000000000107DB FFFFFA8000347918 FFFFF6FD40001A38 00000000000037B9 000009D8 00000000000007DF FFFFFA80003B99D8 FFFFF6FD40001DC8 000000000000380D 00000640 00000000000003DB FFFFFA800040D640 FFFFF6FD40002068 00000000000038D7 00000870 0000000000000FDB FFFFFA80004D7870 FFFFF6FD400026B8 000000000000391B 00000490 0000000000000FDB FFFFFA800051B490 FFFFF6FD400028D8 0000000000003923 000003E0 000000000000075B FFFFFA80005233E0 FFFFF6FD40002918 000000000000392A 000001F0 00000000000007DB FFFFFA800052A1F0 FFFFF6FD40002950 000000000000393C 00000A30 00000000000007FB FFFFFA800053CA30 FFFFF6FD400029E0 0000000000003951 00000BE0 00000000000007D3 FFFFFA8000551BE0 FFFFF6FD40002A88 0000000000003964 00000F00 00000000000007FB FFFFFA8000564F00 FFFFF6FD40002B20 0000000000003980 000004D0 00000000000007CB FFFFFA80005804D0 FFFFF6FD40002C00 000000000000399D 00000900 00000000000007DA FFFFFA800059D900 FFFFF6FD40002CE8 0000000000003A11 00000910 00000000000207DB FFFFFA8000611910 FFFFF6FD40003088 0000000000003A16 00000118 00000000000207DB FFFFFA8000616118 FFFFF6FD400030B0 0000000000003B3E 00000570 00000000000006DB FFFFFA800073E570 FFFFF6FD400039F0 0000000000003D23 000003D0 00000000000006DB FFFFFA80009233D0 FFFFF6FD40004918 0000000000003D32 00000AF0 00000000000007FB FFFFFA8000932AF0 FFFFF6FD40004990 0000000000003D5C 00000580 00000000000007DB FFFFFA800095C580 FFFFF6FD40004AE0 0000000000003D7B 00000150 00000000000007DA FFFFFA800097B150 FFFFF6FD40004BD8 0000000000003D81 00000D20 00000000000007D9 FFFFFA8000981D20 FFFFF6FD40004C08 0000000000003DB9 000009A0 00000000000007DB FFFFFA80009B99A0 FFFFF6FD40004DC8 0000000000003DE7 00000AB0 00000000000007D3 FFFFFA80009E7AB0 FFFFF6FD40004F38 0000000000003DE8 000001D0 00000000000007D9 FFFFFA80009E81D0 FFFFF6FD40004F40 0000000000003F29 00000410 00000000000006DB FFFFFA8000B29410 FFFFF6FD40005948 0000000000003FA5 00000918 00000000000407DB FFFFFA8000BA5918 FFFFF6FD40005D28 000000000000401C 00000110 00000000000407DB FFFFFA8000C1C110 FFFFF6FD400060E0 000000000000443D 00000580 00000000000007FB FFFFFA800103D580 FFFFF6FD400081E8 0000000000004502 000006B0 000000000000079B FFFFFA80011026B0 FFFFF6FD40008810 000000000000456B 00000BF0 00000000000007DF FFFFFA800116BBF0 FFFFF6FD40008B58 0000000000004577 00000B90 000000000000075B FFFFFA8001177B90 FFFFF6FD40008BB8 00000000000046B7 00000330 00000000000007CB FFFFFA80012B7330 FFFFF6FD400095B8 0000000000004819 00000F90 00000000000007DB FFFFFA8001419F90 FFFFF6FD4000A0C8 0000000000004A62 00000930 00000000000003DB FFFFFA8001662930 FFFFF6FD4000B310 0000000000004AA2 00000C20 00000000000006DB FFFFFA80016A2C20 FFFFF6FD4000B510 0000000000004AB6 00000870 00000000000007FB FFFFFA80016B6870 FFFFF6FD4000B5B0 0000000000004ABB 000007C0 000000000000079B FFFFFA80016BB7C0 FFFFF6FD4000B5D8 0000000000004AD5 000003E0 00000000000007DA FFFFFA80016D53E0 FFFFF6FD4000B6A8 0000000000004BAA 00000560 00000000000007D3 FFFFFA80017AA560 FFFFF6FD4000BD50 0000000000004BE5 00000570 00000000000007CB FFFFFA80017E5570 FFFFF6FD4000BF28 0000000000004C18 00000510 00000000000807DB FFFFFA8001818510 FFFFF6FD4000C0C0 0000000000004C19 00000118 00000000000807DB FFFFFA8001819118 FFFFF6FD4000C0C8 0000000000004C1F 00000530 00000000000107DB FFFFFA800181F530 FFFFF6FD4000C0F8 0000000000004CAB 00000750 000000000000079B FFFFFA80018AB750 FFFFF6FD4000C558 0000000000004CB3 00000AF0 00000000000007D3 FFFFFA80018B3AF0 FFFFF6FD4000C598 0000000000005061 000002E0 000000000000075B FFFFFA8001C612E0 FFFFF6FD4000E308 0000000000005291 00000F80 00000000000006DB FFFFFA8001E91F80 FFFFF6FD4000F488 00000000000052B7 00000E70 00000000000027DB FFFFFA8001EB7E70 FFFFF6FD4000F5B8 0000000000005314 00000630 00000000000007DB FFFFFA8001F14630 FFFFF6FD4000F8A0 000000000000531D 00000630 000000000000079B FFFFFA8001F1D630 FFFFF6FD4000F8E8 0000000000005336 00000230 00000000000005DB FFFFFA8001F36230 FFFFF6FD4000F9B0 000000000000533E 00000660 00000000000006DB FFFFFA8001F3E660 FFFFF6FD4000F9F0 0000000000005343 00000550 0000000000000FDB FFFFFA8001F43550 FFFFF6FD4000FA18 0000000000005384 00000E60 00000000000007DA FFFFFA8001F84E60 FFFFF6FD4000FC20 00000000000053F1 00000820 00000000000007DA FFFFFA8001FF1820 FFFFF6FD4000FF88 00000000000053F1 00000BB0 00000000000003DB FFFFFA8001FF1BB0 FFFFF6FD4000FF88 00000000000053FF 00000C80 00000000000007D9 FFFFFA8001FFFC80 FFFFF6FD4000FFF8 0000000000005428 00000C00 00000000000007DA FFFFFA8002028C00 FFFFF6FD40010140 000000000000542D 00000DC0 00000000000007FB FFFFFA800202DDC0 FFFFF6FD40010168 0000000000005456 00000800 0000000000000FDB FFFFFA8002056800 FFFFF6FD400102B0 0000000000005459 00000CB0 00000000000006DB FFFFFA8002059CB0 FFFFF6FD400102C8 000000000000546B 00000B30 00000000000003DB FFFFFA800206BB30 FFFFF6FD40010358 000000000000547F 00000450 00000000000005DB FFFFFA800207F450 FFFFF6FD400103F8 000000000000549E 00000290 00000000000087DB FFFFFA800209E290 FFFFF6FD400104F0 000000000000551C 00000410 00000000000003DB FFFFFA800211C410 FFFFF6FD400108E0 000000000000563E 00000510 000000000000075B FFFFFA800223E510 FFFFF6FD400111F0 000000000000567C 00000FD0 00000000000007DF FFFFFA800227CFD0 FFFFF6FD400113E0 0000000000005731 000002A0 00000000000017DB FFFFFA80023312A0 FFFFF6FD40011988 000000000000575A 00000400 00000000000007FB FFFFFA800235A400 FFFFF6FD40011AD0 0000000000005847 00000400 00000000000003DB FFFFFA8003047400 FFFFF6FD40018238 000000000000588E 00000290 00000000000007D9 FFFFFA800308E290 FFFFF6FD40018470 0000000000005890 00000C60 000000000000075B FFFFFA8003090C60 FFFFF6FD40018480 0000000000005893 00000F90 00000000000005DB FFFFFA8003093F90 FFFFF6FD40018498 000000000000589B 000006D0 00000000000006DB FFFFFA800309B6D0 FFFFF6FD400184D8 00000000000058A5 000009C0 000000000000079B FFFFFA80030A59C0 FFFFF6FD40018528 00000000000058AA 000008B0 00000000000017DB FFFFFA80030AA8B0 FFFFF6FD40018550 00000000000058BC 00000400 00000000000003DB FFFFFA80030BC400 FFFFF6FD400185E0 0000000000005911 000002A0 00000000000007D3 FFFFFA80031112A0 FFFFF6FD40018888 0000000000005957 00000A40 00000000000005DB FFFFFA8003157A40 FFFFF6FD40018AB8 0000000000005995 00000E40 00000000000003DB FFFFFA8003195E40 FFFFF6FD40018CA8 000000000000599D 00000AF0 0000000000000FDB FFFFFA800319DAF0 FFFFF6FD40018CE8 00000000000059AD 000002A0 00000000000007DF FFFFFA80031AD2A0 FFFFF6FD40018D68 00000000000059B2 00000910 00000000000007DF FFFFFA80031B2910 FFFFF6FD40018D90 00000000000059D0 00000520 00000000000003DB FFFFFA80031D0520 FFFFF6FD40018E80 00000000000059E1 000003B0 00000000000007FB FFFFFA80031E13B0 FFFFF6FD40018F08 00000000000059E7 00000D10 00000000000007D3 FFFFFA80031E7D10 FFFFF6FD40018F38 00000000000059EC 00000690 00000000000007CB FFFFFA80031EC690 FFFFF6FD40018F60 00000000000059FB 000003C0 00000000000005DB FFFFFA80031FB3C0 FFFFF6FD40018FD8 00000000000059FB 00000FF0 00000000000005DB FFFFFA80031FBFF0 FFFFF6FD40018FD8 00000000000059FE 000003C0 00000000000006DB FFFFFA80031FE3C0 FFFFF6FD40018FF0 0000000000005A01 000003C0 00000000000007DA FFFFFA80032013C0 FFFFF6FD40019008 0000000000005A0A 000003F0 00000000000007D9 FFFFFA800320A3F0 FFFFF6FD40019050 0000000000005A0D 00000390 000000000000075B FFFFFA800320D390 FFFFF6FD40019068 0000000000005A0D 00000960 00000000000007FB FFFFFA800320D960 FFFFF6FD40019068 0000000000005A0D 00000F90 000000000000079B FFFFFA800320DF90 FFFFF6FD40019068 0000000000005A0E 000003B0 00000000000007FB FFFFFA800320E3B0 FFFFF6FD40019070 0000000000005A0E 00000B90 00000000000007DB FFFFFA800320EB90 FFFFF6FD40019070 0000000000005A0F 000006D0 00000000000007DF FFFFFA800320F6D0 FFFFF6FD40019078 0000000000005A11 00000080 00000000000003DB FFFFFA8003211080 FFFFF6FD40019088 0000000000005A19 000006F0 0000000000000FDB FFFFFA80032196F0 FFFFF6FD400190C8 0000000000005A31 00000930 00000000000006DB FFFFFA8003231930 FFFFF6FD40019188 0000000000005A47 00000560 00000000000017DB FFFFFA8003247560 FFFFF6FD40019238 0000000000005A7E 000002B0 00000000000017DB FFFFFA800327E2B0 FFFFF6FD400193F0 0000000000005ADC 00000480 00000000000003DB FFFFFA80032DC480 FFFFF6FD400196E0 0000000000005ADC 00000630 0000000000000FDB FFFFFA80032DC630 FFFFF6FD400196E0 0000000000005AF1 00000180 00000000000007D3 FFFFFA80032F1180 FFFFF6FD40019788 0000000000005AF5 00000B00 0000000000000FDB FFFFFA80032F5B00 FFFFF6FD400197A8 0000000000005AFA 00000630 00000000000003DB FFFFFA80032FA630 FFFFF6FD400197D0 0000000000005AFE 00000890 0000000000000FDB FFFFFA80032FE890 FFFFF6FD400197F0 0000000000005AFE 00000D10 00000000000007D9 FFFFFA80032FED10 FFFFF6FD400197F0 0000000000005B12 00000F30 00000000000007FB FFFFFA8003312F30 FFFFF6FD40019890 0000000000005B1F 00000680 00000000000007CB FFFFFA800331F680 FFFFF6FD400198F8 0000000000005B25 00000F20 00000000000003DB FFFFFA8003325F20 FFFFF6FD40019928 0000000000005B25 00000FE0 00000000000007DF FFFFFA8003325FE0 FFFFF6FD40019928 0000000000005B28 000005F0 00000000000007D3 FFFFFA80033285F0 FFFFF6FD40019940 0000000000005B33 00000DB0 000000000000075B FFFFFA8003333DB0 FFFFF6FD40019998 0000000000005B35 000005B0 00000000000006DB FFFFFA80033355B0 FFFFF6FD400199A8 0000000000005B39 00000120 000000000000075B FFFFFA8003339120 FFFFF6FD400199C8 0000000000005B3A 000006B0 00000000000007DB FFFFFA800333A6B0 FFFFF6FD400199D0 0000000000005B47 00000E50 000000000000079B FFFFFA8003347E50 FFFFF6FD40019A38 0000000000005B55 00000FE0 000000000000079B FFFFFA8003355FE0 FFFFF6FD40019AA8 0000000000005B5A 00000390 00000000000006DB FFFFFA800335A390 FFFFF6FD40019AD0 0000000000005B6B 00000310 00000000000006DB FFFFFA800336B310 FFFFF6FD40019B58 0000000000005BF4 00000200 00000000000027DB FFFFFA80033F4200 FFFFF6FD40019FA0 0000000000005CA3 00000250 00000000000007DF FFFFFA80034A3250 FFFFF6FD4001A518 0000000000005CB0 00000F90 00000000000007DA FFFFFA80034B0F90 FFFFF6FD4001A580 0000000000005CC1 00000310 00000000000003DB FFFFFA80034C1310 FFFFF6FD4001A608 0000000000005D06 00000130 00000000000005DB FFFFFA8003506130 FFFFF6FD4001A830 0000000000005D0E 00000170 00000000000003DB FFFFFA800350E170 FFFFF6FD4001A870 0000000000005D2B 00000330 00000000000007DF FFFFFA800352B330 FFFFF6FD4001A958 0000000000005D30 00000EB0 00000000000007D3 FFFFFA8003530EB0 FFFFF6FD4001A980 0000000000005D33 000003D0 00000000000007D9 FFFFFA80035333D0 FFFFF6FD4001A998 0000000000005D38 00000830 00000000000007DB FFFFFA8003538830 FFFFF6FD4001A9C0 0000000000005D3E 00000980 00000000000007CB FFFFFA800353E980 FFFFF6FD4001A9F0 0000000000005D42 00000700 000000000000075B FFFFFA8003542700 FFFFF6FD4001AA10 0000000000005D47 00000E60 00000000000007D3 FFFFFA8003547E60 FFFFF6FD4001AA38 0000000000005D4E 000002B0 00000000000007FB FFFFFA800354E2B0 FFFFF6FD4001AA70 0000000000005D4F 000008D0 00000000000007DF FFFFFA800354F8D0 FFFFF6FD4001AA78 0000000000005D55 00000030 00000000000007DB FFFFFA8003555030 FFFFF6FD4001AAA8 0000000000005D58 000002A0 00000000000007DF FFFFFA80035582A0 FFFFF6FD4001AAC0 0000000000005D67 00000060 00000000000007D3 FFFFFA8003567060 FFFFF6FD4001AB38 0000000000005D81 000006D0 000000000000075B FFFFFA80035816D0 FFFFF6FD4001AC08 0000000000005D86 00000BF0 00000000000006DB FFFFFA8003586BF0 FFFFF6FD4001AC30 0000000000005D87 00000670 00000000000005DB FFFFFA8003587670 FFFFF6FD4001AC38 0000000000005D87 00000700 00000000000007CB FFFFFA8003587700 FFFFF6FD4001AC38 0000000000005D96 00000B50 00000000000003DB FFFFFA8003596B50 FFFFF6FD4001ACB0 0000000000005DA4 00000290 00000000000005DB FFFFFA80035A4290 FFFFF6FD4001AD20 0000000000005DBF 000005C0 00000000000007D3 FFFFFA80035BF5C0 FFFFF6FD4001ADF8 0000000000005DC6 00000F10 00000000000003DB FFFFFA80035C6F10 FFFFF6FD4001AE30 0000000000005DCF 00000B20 00000000000007D3 FFFFFA80035CFB20 FFFFF6FD4001AE78 0000000000005DD6 00000CF0 00000000000007DB FFFFFA80035D6CF0 FFFFF6FD4001AEB0 0000000000005DDC 00000FF0 00000000000007DF FFFFFA80035DCFF0 FFFFF6FD4001AEE0 0000000000005DEF 00000B90 000000000000075B FFFFFA80035EFB90 FFFFF6FD4001AF78 0000000000005DF1 00000CC0 000000000000079B FFFFFA80035F1CC0 FFFFF6FD4001AF88 0000000000005E03 00000F30 00000000000005DB FFFFFA8003603F30 FFFFF6FD4001B018 0000000000005E12 00000F60 00000000000005DB FFFFFA8003612F60 FFFFF6FD4001B090 0000000000005E13 00000890 00000000000003DB FFFFFA8003613890 FFFFF6FD4001B098 0000000000005E18 00000E10 000000000000075B FFFFFA8003618E10 FFFFF6FD4001B0C0 0000000000005E1A 00000100 00000000000007CB FFFFFA800361A100 FFFFF6FD4001B0D0 0000000000005E38 00000310 000000000000075B FFFFFA8003638310 FFFFF6FD4001B1C0 0000000000005E41 00000820 00000000000007DB FFFFFA8003641820 FFFFF6FD4001B208 0000000000005E54 00000C90 00000000000005DB FFFFFA8003654C90 FFFFF6FD4001B2A0 0000000000005E63 000005D0 00000000000007CB FFFFFA80036635D0 FFFFF6FD4001B318 0000000000005E67 00000680 00000000000005DB FFFFFA8003667680 FFFFF6FD4001B338 0000000000005E73 000009E0 000000000000075B FFFFFA80036739E0 FFFFF6FD4001B398 0000000000005E7E 000007E0 00000000000007CB FFFFFA800367E7E0 FFFFF6FD4001B3F0 0000000000005E82 00000C20 00000000000007DF FFFFFA8003682C20 FFFFF6FD4001B410 0000000000005E84 00000360 00000000000007D9 FFFFFA8003684360 FFFFF6FD4001B420 0000000000005E84 00000FC0 00000000000007DB FFFFFA8003684FC0 FFFFF6FD4001B420 0000000000005E85 000002C0 00000000000006DB FFFFFA80036852C0 FFFFF6FD4001B428 0000000000005E8C 00000C70 00000000000007FB FFFFFA800368CC70 FFFFF6FD4001B460 0000000000005E8C 00000F40 00000000000007D3 FFFFFA800368CF40 FFFFF6FD4001B460 0000000000005E90 00000F90 00000000000007DA FFFFFA8003690F90 FFFFF6FD4001B480 0000000000005E91 00000530 00000000000003DB FFFFFA8003691530 FFFFF6FD4001B488 0000000000005E9B 00000190 000000000000079B FFFFFA800369B190 FFFFF6FD4001B4D8 0000000000005E9B 000003A0 000000000000075B FFFFFA800369B3A0 FFFFF6FD4001B4D8 0000000000005E9E 00000460 00000000000007DA FFFFFA800369E460 FFFFF6FD4001B4F0 0000000000005EA7 00000E50 00000000000003DB FFFFFA80036A7E50 FFFFF6FD4001B538 0000000000005EAF 00000080 00000000000005DB FFFFFA80036AF080 FFFFF6FD4001B578 0000000000005EB9 00000250 00000000000007DA FFFFFA80036B9250 FFFFF6FD4001B5C8 0000000000005EBB 000005C0 00000000000003DB FFFFFA80036BB5C0 FFFFF6FD4001B5D8 0000000000005EC4 00000770 00000000000003DB FFFFFA80036C4770 FFFFF6FD4001B620 0000000000005EC5 00000DC0 00000000000007D3 FFFFFA80036C5DC0 FFFFF6FD4001B628 0000000000005ECA 00000E60 00000000000003DB FFFFFA80036CAE60 FFFFF6FD4001B650 0000000000005ECC 000003C0 000000000000075B FFFFFA80036CC3C0 FFFFF6FD4001B660 0000000000005ECD 00000C20 00000000000007DA FFFFFA80036CDC20 FFFFF6FD4001B668 0000000000005EE9 000004F0 00000000000003DB FFFFFA80036E94F0 FFFFF6FD4001B748 0000000000005EF2 000007C0 00000000000006DB FFFFFA80036F27C0 FFFFF6FD4001B790 0000000000005F05 00000E10 00000000000007CB FFFFFA8003705E10 FFFFF6FD4001B828 0000000000005F07 00000A60 00000000000007D9 FFFFFA8003707A60 FFFFF6FD4001B838 0000000000005F08 00000150 00000000000007FB FFFFFA8003708150 FFFFF6FD4001B840 0000000000005F09 00000710 00000000000005DB FFFFFA8003709710 FFFFF6FD4001B848 0000000000005F17 00000600 00000000000005DB FFFFFA8003717600 FFFFF6FD4001B8B8 0000000000005F1D 00000990 00000000000007DF FFFFFA800371D990 FFFFF6FD4001B8E8 0000000000005F2C 00000E40 00000000000007DA FFFFFA800372CE40 FFFFF6FD4001B960 0000000000005F2D 000001D0 00000000000007DF FFFFFA800372D1D0 FFFFF6FD4001B968 0000000000005F2F 00000EA0 00000000000007D9 FFFFFA800372FEA0 FFFFF6FD4001B978 0000000000005F3F 000008F0 00000000000003DB FFFFFA800373F8F0 FFFFF6FD4001B9F8 0000000000005F57 00000860 00000000000006DB FFFFFA8003757860 FFFFF6FD4001BAB8 0000000000005F59 000001B0 00000000000007CB FFFFFA80037591B0 FFFFF6FD4001BAC8 0000000000005F59 00000A50 00000000000005DB FFFFFA8003759A50 FFFFF6FD4001BAC8 0000000000005F60 00000620 00000000000003DB FFFFFA8003760620 FFFFF6FD4001BB00 0000000000005F63 00000AD0 000000000000075B FFFFFA8003763AD0 FFFFF6FD4001BB18 0000000000005F70 00000790 00000000000007DF FFFFFA8003770790 FFFFF6FD4001BB80 0000000000005F77 000001E0 00000000000007CB FFFFFA80037771E0 FFFFF6FD4001BBB8 0000000000005F80 00000B70 000000000000079B FFFFFA8003780B70 FFFFF6FD4001BC00 0000000000005F97 00000070 00000000000007D3 FFFFFA8003797070 FFFFF6FD4001BCB8 0000000000005FDF 00000550 00000000000007CB FFFFFA80037DF550 FFFFF6FD4001BEF8 0000000000005FF4 000000D0 00000000000007D9 FFFFFA80037F40D0 FFFFF6FD4001BFA0 0000000000006008 00000410 00000000000017DB FFFFFA8003808410 FFFFF6FD4001C040 0000000000006035 00000BF0 00000000000027DB FFFFFA8003835BF0 FFFFF6FD4001C1A8 0000000000006099 00000C10 00000000000047DB FFFFFA8003899C10 FFFFF6FD4001C4C8 00000000000060B8 00000518 0000000000000FDB FFFFFA80038B8518 FFFFF6FD4001C5C0 000000000000613B 00000918 00000000000006DB FFFFFA800393B918 FFFFF6FD4001C9D8 0000000000006153 00000798 00000000000007D3 FFFFFA8003953798 FFFFF6FD4001CA98 000000000000617B 00000F30 0000000000000FDB FFFFFA800397BF30 FFFFF6FD4001CBD8 0000000000006192 00000580 00000000000007DA FFFFFA8003992580 FFFFF6FD4001CC90 0000000000006193 00000180 000000000000079B FFFFFA8003993180 FFFFF6FD4001CC98 0000000000006193 00000D50 00000000000007D9 FFFFFA8003993D50 FFFFF6FD4001CC98 0000000000006194 000009B0 00000000000007DB FFFFFA80039949B0 FFFFF6FD4001CCA0 0000000000006195 00000550 000000000000075B FFFFFA8003995550 FFFFF6FD4001CCA8 0000000000006195 00000670 00000000000007DF FFFFFA8003995670 FFFFF6FD4001CCA8 0000000000006196 00000D50 00000000000006DB FFFFFA8003996D50 FFFFF6FD4001CCB0 0000000000006197 000003B0 00000000000007FB FFFFFA80039973B0 FFFFF6FD4001CCB8 000000000000619A 00000830 00000000000007D3 FFFFFA800399A830 FFFFF6FD4001CCD0 000000000000619B 000002B0 00000000000007CB FFFFFA800399B2B0 FFFFF6FD4001CCD8 00000000000061A9 000003E0 00000000000005DB FFFFFA80039A93E0 FFFFF6FD4001CD48 00000000000061A9 00000D70 00000000000003DB FFFFFA80039A9D70 FFFFF6FD4001CD48 00000000000061B7 00000090 000000000000079B FFFFFA80039B7090 FFFFF6FD4001CDB8 00000000000061BF 00000610 00000000000003DB FFFFFA80039BF610 FFFFF6FD4001CDF8 0000000000007D32 00000EC8 00000000000003DB 000000007790BEC8 FFFFF680003BC858 0000000000009513 00000EC8 00000000000003DB 000000007790BEC8 FFFFF680003BC858 000000000000C631 00000EC8 00000000000003DB 000000007790BEC8 FFFFF680003BC858 000000000000EA70 00000E08 00000000000003DB 0000000000000000 FFFFF8A0099382D8 000000000000EBA3 00000AB0 000000000000075B 0000000000000000 FFFFF8A009938E70 000000000000ED2A 00000E20 00000000000007D9 0000000000000000 FFFFF8A009938EA8 000000000000F4B6 00000BB8 00000000000007D9 0000000000000000 FFFFF8A009938F08 000000000000FCB6 000000C0 00000000020007DB 0000000000000000 FFFFF8A009938D08 000000000000FCE6 00000CF0 00000000000005DB 0000000000000000 FFFFF8A009938E88 000000000000FDE6 00000D90 00000000000007D9 000000000CB3CD90 FFFFF680000659E0 Search done.
Do Security Professionals Dream?
Paraphrasing the title of Philip K. Dick's48 novel Do Androids Dream of Electric Sheep?49 I'd like to tell the dream I had after starting my work on a computational security novel Session Zero (ISBN: 978-1908043092). I was in the hall of a building where Russian and American spies frequently intersect. Apparently, I was a technician there and everyone passing by was complaining about difficulties being a spy. I was listening and telling everyone that I wasn't a spy, just a technician. Suddenly a thought came to my mind that if I were a real spy masquerading as a technician it would have made make a good novel plot…Then I met colleagues from one of my previous companies and I woke up.
Debugging Slang
Golden Bug
Golden bug - A software defect that if fixed entails a promotion and pay rise prospects.
Example:
- You are a Principal now!!!
- Oh, thanks to that persistent golden bug nobody could fix until I was assigned…
Beer Time
Beer time - Time to socialize and discuss the politics of debugging. For some engineers it is actually the time of debugging.
Finger Exercise
Finger exercise - Repeated application of certain keyboard debugging commands like t (trace).
Example:
An engineer is doing 15 minute finger exercise to detect a pointer change.
Resolution Rush
Resolution rush - The rush of software technical support and maintenance engineers to provide the resolution to a suddenly escalated incident.
Example:
After it crashed 3 times in a row at the customer site our VP was called and we all got resolution rush.
The Window of Opportunity
The Window of Opportunity - WYSIWYG. Requires scrolling or search to get most of it.
Example:
He opened a log file in notepad and was staring at it with disbelief. There was no error message inside. After some time he closed the window of opportunity.
Dump
Dump - The last hope.
Example:
He was so desperate on site to ask whether a complete dump would do.
Pre-analysis
Pre-analysis - Avoiding crash dump analysis anti-patterns like Wrong Dump (Volume 1, page 496) or Zippocricy (Volume 1, page 494). Sometimes it goes with Wild Explanation (Volume 5, page 129) no one asked for. Checking whether a software trace is empty before sending it.
Example:
He is always doing !locks pre-analysis before sending any dump.
Tapping
Tapping - The act of collecting software traces for subsequent pattern-driven trace analysis. From TAP (Trace Analysis Pattern).
Examples:
We started tapping the service for any anomalies. Software tapping methods and tools.
Having Fun
Having Fun - Having too many functions to analyze, reverse engineer, or simply having too many of them on a call stack.
Examples:
We were having fun all night. A thread had fun culminating in a double fault. Why do I love debugging?
Adult Debugging
Adult Debugging - The act of debugging when you are dealing with Functions you don't know much about using public sources. Comes from famous xxx calls, for example:
win32k!xxxHkCallHook win32k!xxxCallHook2 win32k!xxxCallHook win32k!xxxReceiveMessage win32k!xxxRealSleepThread win32k!xxxSleepThread win32k!xxxInterSendMsgEx win32k!xxxSendMessageTimeout win32k!xxxWrapSendMessage
Example:
We do adult debugging from time to time.
Second Eye
Second Eye (or sometimes a stronger variant “second pair of eyes”) - another engineer you typically need when you don't see anything useful in a memory dump, software trace or source code for diagnostics and problem resolution purposes. You are anxious to recommend something useful.
Example:
Don't see anything in this huge trace. I need a second eye.
Abscess
Abscess - A Bad Service and Customer Experience Short Story. Can also be an abbreviation for a bad support.
Examples:
After combating an abscess a customer decided to take a social media approach. An abscess process.
Finction
Finction (or simply Finc) - A function with a flaw, having abnormal behavior, a candidate for a fix or axing (Volume 4, page 325).
Examples:
After delivering a hotfix with axed code they were embarrassed to see that finction again on a stack trace.
Etymology:
Derived from “function”. Inspired by MDAA V3 errata50.
Mad OS and other Publishing Blunders
While thinking about writing an operating system for memory analysis and debugging we decided to check the abbreviation and found this publishing data submission error (we hope that was not intentional) for the book “Canvas 5 URW Type Library, Mad OS and Windows” by Editor. We put a screenshot just in case it is fixed when you are reading this book:
Further forward thinking led us to design the front cover for a book “Bugs in Publishing” (ISBN: 978-1906717803):
In our journey as a publisher (OpenTask51) we did a lot of debugging, for example, the first printed (literally) book was without page numbers on pages (but they were present in the table of contents).
Now the small print:
Please do not even think that the above book is about switching to Mac OS X! It is only about publishing: all other Interpretations are products of your wild imagination and a publisher does not assume any responsibility for the damage done…
The Ultimate Debugger's Desk
The ultimate human debugger's desk: monitors joined together around an engineer to have 360-degree memory surveillance. We also propose to use spherical coordinate system52 for memory analysis, in addition to cylindrical53 one.
Memceptions: Flags and Handles are Everywhere!
We frequently caught ourselves in recognizing bit values like 100084 when we're looking at car plate numbers. Sometimes we see a number and wonder whether it is a valid window handle.
Computer Memory Monsters
Here we start with our analysis of monsters in the realm of computer memory, software defects, malware, corrupt software structures and their behavior. Some of monsters are based on exaggerated crash dump54 and software trace55 patterns, some are based on the accumulated debugging and technical support wisdom. The first monster we present is called Chimera and it lives in DLL Hell. It is based on an exaggerated pattern called Module Variety (Volume 1, page 310). When opening a 64-bit memory dump it shows several pages of modules (Im WinDbg command):
As the monster's creator explained to us they used an experimental way to represent every class object as a loaded component. And it was a word processor where every paragraph, every sentence, every word and every letter was an object implemented in a separate module! The goal was to have any letter to interact in an object-oriented way and literally dance on a screen if necessary.
On President's Daily Briefs (PDBs)
We found it funny that President's Daily Brief56 is abbreviated as PDB. For intelligence analysts who might be reading this post there are a few links explaining PDB files:
• Program database57
• Symbol files explained (Volume 1, page 34)
I also suggest deabbreviating PDB files as Programmer's Daily Briefs in the context of nightly builds58 on Windows platforms.
The First Evidence for Process Resurrection
We recently (at the time of this writing) analyzed a process memory dump and noticed that it (up and running) survived system reboot:
0:000> version Windows Vista Version 6000 MP (2 procs) Free x64 Product: WinNt, suite: SingleUserTS Personal kernel32.dll version: 6.0.6000.16386 (vista_rtm.061101-2205) Machine Name: Debug session time: Tue Jul 12 16:53:07.000 2011 (UTC + 1:00) System Uptime: 0 days 1:27:04.516 Process Uptime: 1 days 4:05:35.000 Kernel time: 0 days 0:00:13.000 User time: 0 days 0:00:04.000 [...]
Vacuum Pages
It came to our attention that almost every huge or not so x64 kernel or complete memory dump is diagnosed with excessive pool usage. Sometimes it is too excessive like in the following example:
0: kd> !vm *** Virtual Memory Usage *** Physical Memory: 8387414 ( 33549656 Kb) Page File: ??D:pagefile.sys Current: 33856856 Kb Free Space: 33855520 Kb Minimum: 33856856 Kb Maximum: 46364420 Kb Available Pages: 7231844 ( 28927376 Kb) ResAvail Pages: 7763458 ( 31053832 Kb) Locked IO Pages: 0 ( 0 Kb) Free System PTEs: 33556220 ( 134224880 Kb) Modified Pages: 2759 ( 11036 Kb) Modified PF Pages: 2759 ( 11036 Kb) NonPagedPool Usage: 650867425 (2603469700 Kb) NonPagedPoolNx Usage: 83715 ( 334860 Kb) NonPagedPool Max: 6271754 ( 25087016 Kb) ********** Excessive NonPaged Pool Usage ***** PagedPool 0 Usage: 48923 ( 195692 Kb) PagedPool 1 Usage: 39797 ( 159188 Kb) PagedPool 2 Usage: 37412 ( 149648 Kb) PagedPool 3 Usage: 37536 ( 150144 Kb) PagedPool 4 Usage: 37453 ( 149812 Kb) PagedPool Usage: 201121 ( 804484 Kb) PagedPool Maximum: 33554432 ( 134217728 Kb) Session Commit: 15829 ( 63316 Kb) Shared Commit: 7198 ( 28792 Kb) Special Pool: 0 ( 0 Kb) Shared Process: 158498 ( 633992 Kb) PagedPool Commit: 201147 ( 804588 Kb) Driver Commit: 5761 ( 23044 Kb) Committed pages: 1126203 ( 4504812 Kb) Commit limit: 16851145 ( 67404580 Kb)
What we can see above is that the amount of used nonpaged pool is more than 2.5 TB which is far less than the amount of physical memory + page file size (both in total do not exceed 100 GB). So we conclude that Windows architects did the impossible and are able to create information (pages) from vacuum like matter can be created from vacuum fluctuations. Perhaps they are a step closer to implement some features from Cantor OS59.
Note: At the time of this writing we didn't know it is a bug60. What a disappointment.
WinDbg Command on Certificate
Finally everyone can even learn a WinDbg command from a certificate. Memory Dump Analysis Services61 created a certificate with dv WinDbg command on it:
Source: http://www.dumpanalysis.com/sample-certificate
Pleasing WinDbg SOS Extension
Recently when looking at one of process memory dumps with CLR runtime we got this message when trying to load SOS extension from the appropriate Framework location:
0:022> .load [..]Microsoft.NETFrameworkv2.0.50727sos.dll ------------------------------------------------------------ sos.dll needs a full memory dump for complete functionality. You can create one with .dump /ma <filename> ------------------------------------------------------------
So we literally did what was asked by saving a new dump from the dump:
0:022> .dump /ma c:userdumpsdump-as-asked.dmp Creating c:userdumpsdump-as-asked.dmp - mini user dump Dump successfully written
We got a slightly bigger dump than the original one and after that SOS didn't complain when we opened the new dump and loaded the extension.
Airport Terminal Services Incident
We were flying from an airport and observed “terminal services” incident first hand being the first in the registration queue for an hour while waiting for the problem resolution and “live debugging”. The system couldn't print tickets. The following dialog phrases were very amusing to hear:
- Press F6 to initialize PE
- A message reads: “Can't associate a printer with terminal session. Please enter the printer address.”
The problem was resolved by booting the previous system version. It's always Mr. Upgrade who's at fault…
Philosophical Self-Interview
In 3×3 format:
Q. What philosophical school do I belong to?
A. I consider myself the last Pre-Socratic62 philosopher.
Q. What is my difference from the first Pre-Socratics?
A. The philosophy of Memoidealism63 that I founded postulates that Memory is the essence of things, the first principle like fire or water.
Q. Can I name 3 great philosophers?
A. 3 V's: Giambattista Vico64, Circle Vienna65, Dmitry Vostokov66 (*). The circle is not one philosopher though but a cloud memory aggregate. If you insist on a person I would then replace it with Voltaire67.
(*) The idea came to me after reading that Ayn Rand could only recommend 3 A's - Aristotle68, Aquinas69, and Ayn Rand70
41 http://en.wikipedia.org/wiki/Domenico_Scarlatti
42 http://en.wikipedia.org/wiki/Binary_form
43 http://www.DumpAnalysis.com
44 http://en.wikipedia.org/wiki/Dublin_Zoo
45 http://www.amazon.com/gp/product/0689831609
46 http://www.dumpanalysis.org/blog/index.php/2010/01/09/system-freeze-in-nature/
47 Crash Era (Volume 5, page 238)
48 http://en.wikipedia.org/wiki/Philip_K._Dick
49 http://en.wikipedia.org/wiki/Do_Androids_Dream_of_Electric_Sheep%3F
50 http://www.dumpanalysis.org/MDAA-Volume3-Errata
52 http://en.wikipedia.org/wiki/Spherical_coordinate_system
53 http://en.wikipedia.org/wiki/Cylindrical_coordinate_system
54 http://www.dumpanalysis.org/blog/index.php/crash-dump-analysis-patterns/
55 http://www.dumpanalysis.org/blog/index.php/trace-analysis-patterns/
56 http://en.wikipedia.org/wiki/President's_Daily_Brief
57 http://en.wikipedia.org/wiki/Program_database
58 http://en.wikipedia.org/wiki/Neutral_build
59 http://www.dumpanalysis.org/blog/index.php/2009/02/25/cantor-operating-system-part-1/
60 http://support.microsoft.com/kb/2509968
61 http://www.dumpanalysis.com/
62 http://en.wikipedia.org/wiki/Pre-Socratic_philosophy
63 http://www.dumpanalysis.org/blog/index.php/category/memoidealism/
64 http://en.wikipedia.org/wiki/Giambattista_Vico
65 http://en.wikipedia.org/wiki/Vienna_Circle
66 http://www.dumpanalysis.org/blog/index.php/about/
67 http://en.wikipedia.org/wiki/Voltaire
68 http://en.wikipedia.org/wiki/Aristotle