7 ms·
Why does trying to break into the NT 3.1 kernel reboot my 486DX4 machine?
- threeio 3y agoIs it bad that I knew that one without opening it? ... never mind I'll be over yelling at these young kids to get off my lawn :)
- deleted 3y ago[deleted]
- CodeWriter23 3y agoTroubleshooting was different when we came up. Just your wits and maybe some gurus you could call on a landline as backup. No fancy internet with tons of answers of varying degrees of usefulness.
- smokel 3y agoYou might have forgotten them, but there were also books printed on paper.
- theGeatZhopa 3y agoH4x0r doesn't need book. H4x0r try 4nd err0r. Books were just knowledge. Debugging was skill. At certain point in knowledge-gain, you develop a good skill and after that point, you don't need books anymore. Maybe from time to time. I still have a suse6 printed manual.. I can't see it in the cellar, but It've been HUUGE
- yetihehe 3y agoBut you still need some critical amount of knowledge that you need from somewhere. I wish I at least knew there exists something like assembler when I was 12. I naively tried to make some demos, but basic was not adequate, so I considered demoscene as "magic".
- elzbardico 3y agoThis is just macho bravado, and it can be fun, but definitely not the most efficient use of time for someone. If you have access, why would you debug machine code without using the reference manuals for a particular processor and OS and whatever else you're dealing with? You could spend hours chasing a "impossible" problem that could be easily be found in the errata for a giving stepping.
- ale42 3y agoAs long as you had access to a library... When I was 14 or so, I used the MS-DOS DEBUG program to run step-by-step an executable that did something to change blinking to high-intensity background in text mode. After one hour or so I found the magic BIOS call... which of course was documented in the technical manual I found in the library one year later (because new school = new library with more books).
- z500 3y agoWhen I was a kid I used to have this Charles Petzold book that I learned this stuff from, it was basically my Bible. I don't have it anymore, I wish I could remember what it was. People recommend Code a lot, but I don't think that was it. Edit: it wasn't Charles Petzold at all, it was DOS Power Tools by Paul Somerson
- deleted 3y ago[deleted]
- barryrandall 3y agoFidoNet and WWIVNet were also pretty good places to find people to ask questions.
- tzahifadida 3y agoI build a port check way back to determine if services are up. It crashed half the company by simply opening a few tcp ports to the machines. Ridiculous days :)
- deely3 3y agoWhoa, thats prettt funny.
- sambazi 3y agosounds like it was more than "a few"
- H8crilA 3y agoRemember when Win95 could be crashed or even rooted just by pinging it the right way? We really have come a long way. https://en.wikipedia.org/wiki/Ping_of_death https://en.wikipedia.org/wiki/Ping_of_death I also remember SMB vulnerabilities that stayed unpatched for years on some machines. That was already when Metasploit existed, so you could inject VNC into most Windows hosts on local network with just a few commands. These days at least the patching is super fast.
- cm2187 3y agoI remember those days. Even into the late 90s early 2000, modems (including ADSL) didn't come with a router, you had to establish a PPPoE connection from your computer, which also means your home machine was directly on the WAN with no firewall protection. I can't remember which version of windows but it must have been 98 or ME, you had to rush to download and install a patch when you connected it first to the internet before one of these exploits would make it crash. The introduction of NAT changed all of that.
- roomey 3y agoYes. I remember they would send UPS call to reboot your pc, within seconds of going online. A little popup saying visit such and such site to stop your pc rebooting, and a countdown timer
- b800h 3y agoThis is proper programming. None of this namby-pamby web scripting that passes for development these days.
- baq 3y agoSir we program in YAML exclusively now.
- rjbwork 3y agoSo 2020. We're on TOML now.
- bux93 3y agoIn a few years it will be LISP. wait..
- RedShift1 3y agoC is waiting to be rediscovered
- birracerveza 3y agoOh so that's why Zig is gaining popularity
- elzbardico 3y agoBut first we must pay penitence with dumbed down Java 1.4, also known as Golang.
- keyle 3y agostatistically compiled and checked, impossible to break code, orchestrated... in the flakiest way possible.
- deleted 3y ago[deleted]
- fulafel 3y ago"The fix is obvious" indeed.
- H8crilA 3y agoWell, once the bug is identified, yes. I wonder how do you find a bug like that, I guess you keep reading the disassembly of the trapping code until you find the problem. I don't think he could have used QEMU or some other form of debugging.
- pjgalbraith 3y agoHe does mention a bit more in a hidden comment: "NTOSKRNL.EXE + debug symbols + IDA helped me understand how the remote break-in is supposed to work. I knew that something in the remote break-in code path before the first debug packet is sent is going to reboot my machine. So I patched "JMP SHORT $" instructions into the relevant code-path. If I placed it before the crash point, the machine hangs. If I placed it after the crash point, the machine reboots. This allowed me to "bisect" where the crash is happening." ----- Here is a Chat-GPT breakdown of the comment: NTOSKRNL.EXE: This is the kernel of the Windows NT operating system. When people refer to the "Windows kernel," they're typically talking about this executable. debug symbols: These are additional pieces of data that describe the internal structures and functions within a binary (like an EXE or DLL). They make it much easier to understand what's going on when analyzing or debugging the binary. IDA: IDA (Interactive DisAssembler) is a popular disassembler and debugger used by security researchers and reverse engineers to analyze binaries. how the remote break-in is supposed to work: It sounds like the commenter is trying to understand how a specific feature or vulnerability related to remote debugging (or "remote break-in") operates. something in the remote break-in code path before the first debug packet is sent: There's a sequence of events or a code path in the kernel related to the remote debugging feature. The problem seems to manifest before the first debug packet is sent over the network. JMP SHORT $: This is an assembly instruction. The JMP instruction is used to jump to another part of the code. SHORT refers to a short jump, meaning the jump target is relatively close. The $ symbol refers to the current address of the instruction, so "JMP SHORT $" will cause the program to jump to itself, effectively causing an infinite loop. patched "JMP SHORT $" instructions into the relevant code-path: By inserting this instruction at various points in the code, the commenter created intentional hangs in the system. This helped isolate where the crash occurs. bisect: This term comes from the world of debugging and means to divide the code into smaller parts to determine where a problem is. In this context, the commenter is using the hang (from the JMP instruction) as an indicator. If they inserted the JMP instruction and the system hangs, it means the crash hasn't occurred yet. If they inserted the JMP instruction and the system reboots, it means the crash already happened. By moving the JMP instruction around, they can get closer to the exact point of the crash. In essence, the commenter used a mix of reverse engineering tools and clever debugging tricks to narrow down where a crash was occurring in the Windows NT 3.1 kernel when using a remote debugging feature.
- janwillemb 3y agoBreak as in Ctrl+C
- teddyh 3y agoSince this is Windows, wouldn’t that be Ctrl-Break?
- fragmede 3y agoDon't forget to read the how buried in the hidden comments at the end!
- thrdbndndn 3y agoSO's auto collapsing of comments just makes no sense every time I see it. It isn't hiding lowest voted ones, it isn't hiding newest or oldest ones. It feels random (and unnecessary). IMO they should just add paging to it than hiding if the space is the concern.
- unixhero 3y agoThe answer he got to his question was absolutely brilliant. Great topic and such a good answer.
- thequux 3y agoIn fact, he answered his own question. Still brilliant though
- underdeserver 3y agoWhy was the question asked and answered at the same timestamp?
- elzbardico 3y agoTo share the information. You'll see that the author of the question and the answer are the same person. He probably decided that posting this info as a Q&A in SO would be more permanent than writing a blog post that would never be found by anyone.
- keepamovin 3y agoAh, the retro-computing rabbit hole. Harmlessly divorced from any real-world consequences, but truly satisfying nonetheless. A real honey trap for nerds. I just had to click that 6 more comments expander
- qingcharles 3y agoI just about managed to snatch my cursor away as I saw it heading towards that expander. Might get some work done today!
- z500 3y agoTech history is basically crack.
- Simplicitas 3y agoHahah .. I cannot stop myself from clicking ..
- switchbak 3y agoI look back to the computers before my time - the PET's and such, and I think it'd be fun to play with them. Or maybe an old IRIX box. But a 486?? That brings back too many memories of blue screens and waiting forever because we couldn't afford memory and was thus swapping to disk. Still too soon for me, I suppose.
- technothrasher 3y agoI went back and booted my old Indigo from back in the day, as well as an old Sun 3/80 recently. It wasn't as great as I expected it to be, and all the annoyances from when I used to do actual work on them came flooding back quickly. Nostalgia is a heck of a drug. I still reserve the PET as a perfect machine because 1) it's the first machine I really used as a kid, and 2) I haven't yet been foolish enough to try and go back to one in over 40 years now.
- 3y ago
- ok123456 3y agoI knew this CPUID thing was a bad idea.
- mywittyname 3y agoI find it humorous that the Windows developers felt the need to put add a "trustworthiness" section in the struct.
- hornban 3y agoActually, that kind of thing makes a lot of sense to me and I think it's a good idea. I've read so many stories about hardware with bogus ACPI and EDID data causing problems with Linux support over the years. It seems to me that Linux tends to treat hardware information as always correct, whereas Windows is far less trusting and has information about device-specific bugs. The result is that while things tend to work out-of-the-box on Windows, they require far more tinkering on Linux.
- jcpham2 3y agoFWIW these slotket adapters and such for compatibility on the right boards, usually Abit, Asus, and maybe even MSI back then, Well they had REAL overclocking abilities - How fast is your RAM and what kind of clock settings can the motherboard get away with in terms of multipliers? This was the earlyish days of overclocking - Celerons and Pentium IIs I once had a Celeron 600 in one adapter for compatibility and then that was in Slot II to Socket 370 adapter, something comparable to [1] happily chugging along at 1.2Ghz, maybe even got that bad boy up to 1.4Ghz under Windows ME of all the OS before I eventually fried that CPU. [1]http://krick.3feetunder.com/370mod/ http://krick.3feetunder.com/370mod/
- smolder 3y agoOverclocking was fun, but I'm also glad modern CPUs can precisely control clocks and voltages to make use of what used to be safety margin.
- SomeoneFromCA 3y agoYeah, today it is even more fun. I underclocked my alder lake, now it consumes 10% less power at 100% load.
- mmis1000 3y agoSome recent processor has even more ridiculous curve, you can even get 80% performance with half power usage. Or even 1/2 performance with 1/4 power. Recent amd/intel processor has the habit to push the frequency to heat envelope (in other word, overclocked to the extreme by default) instead of a proper frequency with sane power usage.
- vkaku 3y agoAwesome, the person who asked the question also answered it. Great stuff this is :-) Plus I'm so happy people care about retrocomputing. It's great to document these problems and solutions for everyone.