Inconsistent register dumps of 32-bit WoW64 targets between bdump.js and snapshot

[ducphanduyagentp]

While trying to get WTF to work with a test 32-bit program, I encoutered issues when tracing the execution for debugging purposes. It keeps generating page fault, resulting in CR3 and crashes. I followed every step recommended on WTF's README to no avail, even after reading a few blogposts from people that tried and had issues with 32-bit programs.

It turned out that the issues was due to some differences in regs.json in bdump.js and snapshot. I followed exactly what described in those posts and the only difference was that snapshot wasn't available at the time.

In the value of cs, ds, es, gs, ss, the limit was 0xffffffff in bdump and 0xfffff in snapshot. Changing these values in snapshot's regs.json makes the trace run as expected for me.

This only happens to 32-bit targets. I compiled the same program in 64-bit and the output from snapshot works fine. If you need the dumps, I would be happy to send it to your email.

Thanks!

[0vercl0k]

Thanks a lot - I'm going to investigate that this week! If you do have a dump that'd be helpful to accelerate my investigation :) Cheers

…

On Wed, Jul 24, 2024 at 8:19 PM Duc Phan ***@***.***> wrote: While trying to get WTF to work with a test 32-bit program, I encoutered issues when tracing the execution for debugging purposes. It keeps generating page fault, resulting in CR3 and crashes. I followed every step recommended on WTF's README to no avail, even after reading a few blogposts from people that tried and had issues with 32-bit programs. It turned out that the issues was due to some differences in regs.json in bdump.js and snapshot. I followed exactly what described in those posts and the only difference was that snapshot wasn't available at the time. In the value of cs, ds, es, gs, ss, the limit was 0xffffffff in bdump and 0xfffff in snapshot. Changing these values in snapshot's regs.json makes the trace run as expected for me. This only happens to 32-bit targets. I compiled the same program in 64-bit and the output from snapshot works fine. If you need the dumps, I would be happy to send it to your email. Thanks! — Reply to this email directly, view it on GitHub <#8>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALIORMWHN327NC4J7MC3QLZOBVFJAVCNFSM6AAAAABLNVFLU6VHI2DSMVQWIX3LMV43ASLTON2WKOZSGQZDQOBZGE3DCOI> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[0vercl0k]

Ok taking a look..

[0vercl0k]

Okay this should be fixed in v0.2.2, let me know if it isn't :)

Cheers