Samuel Bronson's blog

GDB: Quickly attach to the only instance of a program

2011-10-12T13:51:00.000-04:00

Wouldn't it be nice if, instead running shell pidof foo and pasting the resulting PID into an attach command, you could just run one command to attach to your inferior? Sort of like this:

(gdb) qattach crawl
[Thread debugging using libthread_db enabled]
0xb7d1588e in __open_nocancel () at ../sysdeps/unix/syscall-template.S:82
82      ../sysdeps/unix/syscall-template.S: No such file or directory.
        in ../sysdeps/unix/syscall-template.S
(gdb)

Well, now you can! Just arrange for GDB to run the following Python code first, which (gdb) Python Commands and (gdb) Startup will show you how to do:

# Copyright (c) 2011 Samuel Bronson
#
# This software is made available under the same license as the
# "expat" XML library for C, or the "do whatever you want" license, at
# your option.

# Note: The subprocess.check_output() function is new in Python 2.7.

class QAttach(gdb.Command):
    """Quickly attach to the only instance of a program."""

    def __init__(self):
        super(QAttach, self).__init__("qattach", gdb.COMMAND_RUNNING, gdb.COMPLETE_FILENAME)

    def invoke(self, arg, from_tty):
        import subprocess

        if not arg:
            print "qattach: Missing target name!"
            return

        pids = subprocess.check_output(['pidof', arg]).split()

        if len(pids) != 1:
            print subprocess.check_output(['ps'] + pids)
        else:
            try:
                gdb.execute("detach")
            except:
                pass
            gdb.execute("attach "+pids[0])

QAttach()

CRC: A Paper On CRCs

2011-05-28T10:28:00.000-04:00

Check out this CRC paper, it really makes it easier to understand CRC implementations.

This CRC web was created because of the popularity of a paper on CRC algorithms written by Ross Williams and posted to some Internet newsgroups on 19 August 1993. This paper is available here:

http://www.ross.net/crc/download/crc_v3.txt.

http://www.repairfaq.org/filipg/LINK/F_crc_v3.html.

Here is the title and abstract of the paper:

A Painless Guide to CRC Error Detection Algorithms

This document explains CRCs (Cyclic Redundancy Codes) and their table-driven implementations in full, precise detail. Much of the literature on CRCs, and in particular on their table-driven implementations, is a little obscure. This document is an attempt to provide a clear and simple no-nonsense explanation of CRCs and to absolutely nail down every detail of the operation of their high-speed implementations. In addition to this, this document presents a parameterized model CRC algorithm called the "Rocksoft™ Model CRC Algorithm". The model algorithm can be parameterized to behave like most of the CRC implementations around, and so acts as a good reference for describing particular algorithms. A low-speed implementation of the model CRC algorithm is provided in the C programming language. Lastly there is a section giving two forms of high-speed table driven implementations, and providing a program that generates CRC lookup tables.

Tech Support Cheat Sheet

2010-09-18T13:21:00.000-04:00

Undocumented [debug] section in boot.ini enables boot debugger

2010-07-18T19:20:00.000-04:00

In order to use the .kdfiles command to replace a boot driver on the target for NT kernel debugging, it is necessary to use the ntldr "boot debugger", BD. This is because ntldr, not the NT kernel, is responsible for reading these drivers off of disk and loading them into memory: by the time the ordinary kernel debugging connection is established, it is far too late to do anything about the boot drivers. Ordinarily, the way you are supposed to do this is by using a special version of ntldr which automatically waits for a kernel debugging connection every time you start it. This version is included in the Driver Development Kit with the name ntldr_dbg. Unfortunately, each DDK only includes the ntldr_dbg for one version of Windows; there's no telling what might happen if e.g. you try to use the Windows Server 2003 SP1 ntldr_dbg with XP SP2. (At least, I didn't want to risk trying it. Maybe it would work fine.) However, it turns out that there is another way: at least in the checked build of ntldr, it is possible to enable the boot debugger using an undocumented section in boot.ini. For example, I just started it with a boot.ini that begins:

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[debug]
/debug /debugport=COM1 /baudrate=115200 /debugstop

[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="XP with Serial Debugging" /fastdetect /debug /debugport=COM1 /baudrate=115200

Warning: these flags will make it impossible to boot without attaching a kernel debugger to your system. It is therefore vital that you:

Have access to a second system on which to run the kernel debugger
Have a null-modem cable
Remember to remove the option when you're done, and while you still have the second system handy!

If you end up with a system that doesn't boot, don't say I didn't warn you... but you could probably fix things by using e.g. a copy of Knoppix to take out the offending lines of boot.ini.

The /DEBUGBREAK flag breaks into the debugger immediately after it is initialized, allowing you to single-step through the rest of the boot process. Note that in order to actually debug the bootloader, you will probably need to do something like the following after extracting the embedded PE image (internally called osloader.exe) from your ntldr:

kd> .readmem C:\code\deadweight-syms\ntldr.chk.pe 0x400000 L0x1000
Reading 1000 bytes..
kd> .imgscan /l /r 00400000 
MZ at 00400000 - size 81000
  Name: osloader.EXE
  Loaded osloader.EXE module

The value 0x400000 in these commands is the address at which the PE image got loaded; in my case, osloader.exe was a non-relocatable image with the usual image base address of 0x400000. I needed to run these commands because the ntldr I tried this on, the one from the checked build of Windows XP SP2, (a) did not have the PE header in memory at the time it broke into the debugger and (b) did not tell the debugger about it's base address and so on. There was a call to DbgLoadImageSymbols immediately prior to the breakpoint, but the DbgLoadImageSymbols in question did not actually do anything. I'm guessing that things are different if you actually use the version distributed as ntldr_dbg. Anyway, once you do the above dance, you should get symbols loaded just fine, assuming you've got the MS Symbol Server in your symbol path.

MSVC SEH handlers & signature strings

2010-07-13T21:26:00.000-04:00

This is just a table of the assembly-level names of SEH handling routines used by MSVC, along with the the (non-null-terminated) signature string that appears immediately prior to each of them. Each signature string is eight ASCII bytes, though even IDA usually mistakes it for machine code and disassembles it.

Signature	Handler name
`db 'VC10XC00'`	`__except_handler2`
`db 'VC20XC00'`	`__except_handler3`

For more information about SEH and its implementation in MSVC, see A Crash Course on the Depths of Win32™ Structured Exception Handling and Reversing Microsoft Visual C++ Part I: Exception Handling . The latter will even give you enough information that you should be able to figure out why the information in this table might be useful ;-).

Dr. Seuss on Parser Monads

2010-04-06T23:42:00.000-04:00

Nice trick to decompile HTML Help (.chm) files

2009-12-02T11:08:00.000-05:00

Well, I was searching for a chm decompiler just now, and I stumbled across this page in MSDN, which informed me that the viewer could do it, using a command like the following:

hh -decompile <hhw-project-dir>\ <help-file>.chm

Suing to get murder conviction removed from wikipedia article? You think we'll let you get away with that, do you?

2009-11-17T13:19:00.000-05:00

Hmm. I saw today in EFFector that someone thinks he can sue to get his name off a wikipedia page which (truthfully) names him as a perpetrator in a murder. As if we would let him get away with that! Without further ado, the Walter Sedlmayr article:

Walter Sedlmayr

From Wikipedia, the free encyclopedia

Walter Sedlmayr (6 January 1926 – 14 July 1990) was a Bavarian stage, television, and movie actor.

[edit] Career

After his 1945 wartime Abitur, Sedlmayr served as a Flakhelfer towards the end of World War II. His acting career began with minor roles with the Münchner Kammerspiele, for which he played more than 25 years, and in numerous Heimatfilme during the 1940s and 1950s. In 1971, by now an associate of Rainer Werner Fassbinder, Sedlmayr was briefly arrested because a stolen artwork, the Blutenburger Madonna, was found in his house. He was later acquitted of all charges, and the media attention given to his trial helped him gain major roles. His breakthrough came with the leading role in Hans-Jürgen Syberberg's movie Theodor Hirneis oder Wie man ehem. Hofkoch wird (1973). Afterwards, Sedlmayr was cast in numerous popular German TV shows, including Münchner Geschichten, Der Herr Kottnik, Der Millionenbauer, and Polizeiinspektion 1; he also frequently appeared on stage and in other media.

[edit] Murder

On 15 July 1990, Sedlmayr was found dead and mutilated in the bedroom of his Munich apartment. He had been tied up, stabbed in the stomach with a knife and beaten about the head with a hammer.^[1] On 21 May 1993, half-brothers Wolfgang Werlé and Manfred Lauber, former business associates of Sedlmayr, were sentenced to life in prison for his murder.^[2]^[3]^[4] Sedlmayr's life and murder were the subject of the 2001 biopic Wambo by Jo Baier, where he was played by Jürgen Tarrach, and of an episode of the ARD TV series Die großen Kriminalfälle. In October 2009, lawyers for Wolfgang Werlé sent the Wikimedia Foundation a cease and desist letter requesting that Werlé's name be removed from the English language Wikipedia article Walter Sedlmayr.^[5]^[6]^[7]

[edit] Filmography

1949: Die drei Dorfheiligen
1951: Heidelberger Romanze
1952: Zwei Menschen
1952: Der Hergottschnitzer von Ammergau
1953: Ehestreik
1954: Die kleine Stadt will Schlafen gehen
1954: Rosen-Resli
1955: Der Frontgockel
1955: Königswalzer
1957: Heiraten verboten
1958: Der Pauker
1959: Menschen im Netz
1959: Buddenbrooks
1960: Ein gewisses Röcheln
1964: Bei Tag und Nacht
1965: Radetzkymarsch

1969: Frei bis zum nächsten Mal
1969: Der Rückfall
1970: Baal
1970: Die Niklashauser Fahrt
1971: Rio das Mortes
1972: Händler der vier Jahreszeiten
1973: Theodor Hirneis oder Wie man ehemaliger Hofkoch wird
1973: Welt am Draht
1974: Die Reform
1974: Angst essen Seele auf
1975: Faustrecht der Freiheit
1976: Der verkaufte Großvater
1977: Die Jugendstreiche des Knaben Karl
1979: Anton Sittinger
1981: Mein Freund, der Scheich
1984: Rambo Zambo

[edit] TV appearances

1964: Kriminalmuseum
1968: Der Staudamm
1972: Tatort – Münchner Kindl
1972: Acht Stunden sind kein Tag
1973: Der Kommissar – Ein Funken in der Kälte
1973: Tatort – Tote brauchen keine Wohnung
1973: Drei Partner
1974–1975: Münchner Geschichten
1974–1975: Spannagl & Sohn
1974: Der Kommissar – Tod eines Landstreichers
1975: Der Kommissar – Das goldene Pflaster
1975: Der Kommissar – Ein Mord auf dem Lande

1976–1982: Reisen mit Walter Sedlmayr
1976: Vater Seidl und sein Sohn
1976: Alle Jahre wieder: Die Familie Semmeling
1977–1988: Polizeiinspektion 1
1979 und 1986/1987: Der Millionenbauer
1983: Monaco Franze – Der ewige Stenz
1983–1985: Unsere schönsten Jahre
1986–1987: Der Schwammerlkönig
Derrick
Der Alte
Der Herr Kottnik

[edit] Award

In 1973, Sedlmayr won the Outstanding Individual Achievement: Actor Deutscher Filmpreis award for his role in Theodor Hirneis oder Wie man ehemaliger Hofkoch wird.

[edit] References

^ "Sedlmayr-Mörder aus Haft entlassen" (in German). Der Spiegel. http://www.spiegel.de/panorama/justiz/0,1518,499192,00.html. Retrieved 2009-11-15.
^ Mordfall Walter Sedlmayr (on page 22) Focus magazine article, 17 January 2005, in German)
^ Jörg Völkerling (18 December 2004). "Neue Spur im Mordfall Sedlmayr" (in German). Berliner Morgenpost. http://www.morgenpost.de/printarchiv/panorama/article383706/Neue_Spur_im_Mordfall_Sedlmayr.html.
^ "Sedlmayr-Mord: Gericht prüft Wiederaufnahme des Verfahrens" (in German). Kölner Stadt-Anzeiger. 12 April 2005. http://www.ksta.de/html/artikel/1113229792888.shtml.
^ David Kravets (11 November 2009). "Threat Level Privacy, Crime and Security Online Convicted Murderer Sues Wikipedia, Demands Removal of His Name". Wired. http://www.wired.com/threatlevel/2009/11/wikipedia_murder/.
^ Copy of cease and desist letter
^ "Wikipedia sued for publishing convicted murderer's name". The Register. http://www.theregister.co.uk/2009/11/12/wikipedia_sued_by_convicted_murderer/.

[edit] External links

Walter Sedlmayr at the Internet Movie Database
Walter Sedlmayr in the German National Library catalogue (German)
Walter Sedlmayr at Find a Grave

How to do Namespaces in JavaScript

2009-10-05T17:22:00.000-04:00

I just found a nice suggestion about how to do namespacing in JavaScript. In case it goes down or something, this is the gist:

var DED = function() {
    var private_var;
    function private_method() {
        // do stuff here
    }
    return {
        method_1 : function() {
            // do stuff here
        },
        method_2 : function() {
            // do stuff here
        }
    };
}();

Dr. Seuss on Parser Monads

2009-10-03T16:53:00.000-04:00

Can't Haskell

2009-09-26T12:48:00.000-04:00

Stolen from Lambdacats.

Samuel Bronson's blog

GDB: Quickly attach to the only instance of a program

CRC: A Paper On CRCs

A Painless Guide to CRC Error Detection Algorithms

Tech Support Cheat Sheet

Undocumented [debug] section in boot.ini enables boot debugger

MSVC SEH handlers & signature strings

Dr. Seuss on Parser Monads

Nice trick to decompile HTML Help (.chm) files

Suing to get murder conviction removed from wikipedia article? You think we'll let you get away with that, do you?

Walter Sedlmayr

From Wikipedia, the free encyclopedia

Contents

[edit] Career

[edit] Murder

[edit] Filmography

[edit] TV appearances

[edit] Award

[edit] References

[edit] External links

How to do Namespaces in JavaScript

Dr. Seuss on Parser Monads

Can't Haskell