5 ms·
The post is interesting itself, but the addendum, > This post brought to you by gdb and grep -a Where author recovers text from Firefox core dump, is just hil
by ansgri 4y ago
The post is interesting itself, but the addendum,
> This post brought to you by gdb and grep -a
Where author recovers text from Firefox core dump, is just hilarious.
- arkitaip 4y agoThat's an incredibly useful trick and now I wonder if there is a small Windows utility that makes it easy to recover similar ghost data?
- no_time 4y agoGDB and grep but built for windows. Or you could use Cheat Engine if you have a fear of terminals.
- gary_0 4y ago> GDB and grep but built for windows Beat me to it. Windows would be intolerable for me without MinGW/MSYS[0]. (Sure, there's WSL2, but that's not quite the same, and I was using MinGW and friends long before it existed.) [0] https://www.msys2.org/wiki/MSYS2-introduction/ https://www.msys2.org/wiki/MSYS2-introduction/
- pxc 4y agoFWIW, ripgrep has a native build for Windows which is much, much faster than using grep or rg via WSL2. (I'm not sure how it compares to grep from MinGW/MSYS2.)
- ChuckNorris89 4y agoWindows Sysinternals
- omnicognate 4y agogdb is a general-purpose debugger. The equivalent tool for Windows is windbg [0] which is free and extremely powerful, though famously arcane. You can certainly do this with it. [0] https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools https://learn.microsoft.com/en-us/windows-hardware/drivers/d...
- sva_ 4y agohttps://x64dbg.com/ https://x64dbg.com/
- grishka 4y agoThe task manager had the option to dump the memory of a process. It's been a while since I last used Windows though, so I don't remember whether that does, in fact, dump all of its pages.
- lynguist 4y agoThat part also grabbed my attention. How would I do the core dump? (How do I attach gdb to Firefox? Doesn’t it need debug data from the compiler like what you get with gcc -Og?)
- KeplerBoy 4y agoYou can attach gdb to any process. Debug information is not needed unless you want nice things like knowing which lines of code you are stepping through.
- newaccount74 4y agoOn macOS most binaries now use the hardened runtime which prevents attaching a debugger by default, so you can only attach to arbitrary processes when SIP is disabled.
- lathiat 4y agoYou can use 'gcore' (from gdb) to dump the process memory (on Linux) - it tries to create a core file as if it crashed, without crashing it. It's not 100% reliable it sometimes fails - not entirely sure why - but often works. Then as above you dont really need to understand the memory or variables with debug symbols (though on Linux they generally are available.. and increasingly on the newest distros will automatically be downloaded by debuginfod). You can jsut grep for the text you are looking for and likely it's roughly together in memory.
- kleiba 4y agoHow do you attach gdb to a running process?
- stefncb 4y agogdb <path> -p <pid>
- switch007 4y ago[flagged]
- Thev00d00 4y agoWhat is with these asterisk posts recently? have I missed a memo
- switch007 4y agoWhat are you on about?
- kalleboo 4y agoOccasionally a post will show up that is just three asterisks: "* * *". I assume it's some bug in the HN software. Edit: I just tried opening this reply itself in a private window, and it shows up as three asterisks. I presume it's some kind of placeholder for posts that have not been cached/processed somehow Edit 2: Now it loads properly, 3 minutes later.
- beepbooptheory 4y agoGo to your profile and set "Show Dead?" to "Yes". People I think are just tired of hearing about the chatGPT stuff, which I definitely get.
- switch007 4y agoI've had showdead on for years, as I don't always agree with the 'moderation'/groupthink
- saagarjha 4y agoIt's posts from people who have a delay set, I believe.
- raverbashing 4y agoYeah I was going to ask how does FF know about Mac speakers, but I was not expecting that (Neither that it would have kept the text there, I guess he was lucky)
- mandarax8 4y agoThe buffer could have been freed but not zeroed out maybe.
- _flux 4y agoPlug: Could have maybe used https://github.com/eras/memgrep/ https://github.com/eras/memgrep/