12 ms·

> Developers spend less time staring at hex dumps of data, preferring more structured output, tracepoints, and interactive debuggers as ways of tracking down pr

by anyfoo 4y ago

> Developers spend less time staring at hex dumps of data, preferring more structured output, tracepoints, and interactive debuggers as ways of tracking down problems. Debugging features in the kernel's memory allocators mean that many sorts of memory-corruption issues will be caught directly. Magic numbers are just not as helpful as they once were. In most, maybe almost all of the places in the kernel, probably. If you get down to the very low-level nitty gritty: Bootstrapping code, low level memory management, exception handling, maybe context switching... expect to look at hex dumps a lot, possibly even directly through a hardware debugging interface that does not even know what debugging symbols are, let alone what "C code" looks like, and experience the joy the recognition of a magic number brings. Did Santa bring you saved state from an exception handler early this year? But the article, or the patch, are not wrong, far from it. You are most likely not in that situation while debugging terminal code, as the original magic number file states as example.

WastingMyTime89 4y ago
For the uninitiated who might find the idea particularly daunting, looking at hex dumps is not really looking at hex (I mean it kind of is after a while but that’s not the main idea). You have this raw binary dump of the content of something - generally memory or network flow - and tools which can help you turn the binary dump into a structured view. The issue is mapping the structures onto the dump. That’s where magic values and known values are useful. You can find them in the middle of the apparent garbage and use them to align your decoder (or to start reading the dump - if you do it often enough it becomes very Matrix like, “blonde, brunette” but with ip packets and C structs).
- urthor 4y ago
  It's funny how what you say is correct. ...But it's also familiar even to little ole me the neophyte, essentially the opposite of a class of 1978 greybeard, from good old Cheat Engine save file manipulation. Just funny how times change. Even some of the zoomers will know exactly what you're talking about because of Cheat Engine.
  - ModernMech 4y ago
    Ha yeah. I used to edit Baldur’s Gate save files with a hex editor, and my magic numbers I guess would have been the characters’ various stats. Once I found those, I could infer inventory, skills, spells, etc. I remember changing my character to a wyvern model and I gave myself a fireball spell, and pretended there was a dragon in my party. Good times…
- JoeAltmaier 4y ago
  It isn't just looking at hex ... until it is. I used to work on a medium-model kernel back in the 8086 days. When somebody brought me a crash-dump to look at, one process I'd use is to just page through the kernel data segment, watching the hex go by and relaxing my mind. As often as not I'd see the corrupt data go by. A string copied where no strings should be. A zero in a dense table that should not have any zeroes. A block duplicated. Whatever it was, your brain can pattern match way more than we imagine it can.
- anyfoo 4y ago
  No, I did actually mean looking at the hex values themselves, with not much more than eyes, mind, and an internal concept of how things work. In things like exception handling and bootstrapping code, there's often not much a tool that decodes structures would give you that you don't see with your own eyes and thoughts anyway. That is very different from debugging, say, networking code.
- genocidicbunny 4y ago
  > if you do it often enough it becomes very Matrix like, “blonde, brunette” but with ip packets and C structs At one job I used to spend a lot of time looking at crash dumps from a game, and at some point I was able to pretty reliably identify various objects in the engine (models, textures, physics volumes..etc) just from how they looked in a hex view of the crash dumps. If its a system you're familiar with enough, it really is Matrix-like as you say.
deleted 4y ago
[deleted]

by anyfoo 4y ago

WastingMyTime89 4y ago

For the uninitiated who might find the idea particularly daunting, looking at hex dumps is not really looking at hex (I mean it kind of is after a while but that’s not the main idea). You have this raw binary dump of the content of something - generally memory or network flow - and tools which can help you turn the binary dump into a structured view. The issue is mapping the structures onto the dump. That’s where magic values and known values are useful. You can find them in the middle of the apparent garbage and use them to align your decoder (or to start reading the dump - if you do it often enough it becomes very Matrix like, “blonde, brunette” but with ip packets and C structs).

urthor 4y ago
It's funny how what you say is correct. ...But it's also familiar even to little ole me the neophyte, essentially the opposite of a class of 1978 greybeard, from good old Cheat Engine save file manipulation. Just funny how times change. Even some of the zoomers will know exactly what you're talking about because of Cheat Engine.
- ModernMech 4y ago
  Ha yeah. I used to edit Baldur’s Gate save files with a hex editor, and my magic numbers I guess would have been the characters’ various stats. Once I found those, I could infer inventory, skills, spells, etc. I remember changing my character to a wyvern model and I gave myself a fireball spell, and pretended there was a dragon in my party. Good times…
JoeAltmaier 4y ago
It isn't just looking at hex ... until it is. I used to work on a medium-model kernel back in the 8086 days. When somebody brought me a crash-dump to look at, one process I'd use is to just page through the kernel data segment, watching the hex go by and relaxing my mind. As often as not I'd see the corrupt data go by. A string copied where no strings should be. A zero in a dense table that should not have any zeroes. A block duplicated. Whatever it was, your brain can pattern match way more than we imagine it can.
anyfoo 4y ago
No, I did actually mean looking at the hex values themselves, with not much more than eyes, mind, and an internal concept of how things work. In things like exception handling and bootstrapping code, there's often not much a tool that decodes structures would give you that you don't see with your own eyes and thoughts anyway. That is very different from debugging, say, networking code.
genocidicbunny 4y ago
> if you do it often enough it becomes very Matrix like, “blonde, brunette” but with ip packets and C structs At one job I used to spend a lot of time looking at crash dumps from a game, and at some point I was able to pretty reliably identify various objects in the engine (models, textures, physics volumes..etc) just from how they looked in a hex view of the crash dumps. If its a system you're familiar with enough, it really is Matrix-like as you say.

deleted 4y ago

[deleted]