Hacker News Reader

Comment by ansgri | Hacker News Reader

The post is interesting itself, but the addendum,

> This post brought to you by gdb and grep -a

Where author recovers text from Firefox core dump, is just hilarious.

That's an incredibly useful trick and now I wonder if there is a small Windows utility that makes it easy to recover similar ghost data?

GDB and grep but built for windows.

Or you could use Cheat Engine if you have a fear of terminals.

> GDB and grep but built for windows

Beat me to it. Windows would be intolerable for me without MinGW/MSYS[0]. (Sure, there's WSL2, but that's not quite the same, and I was using MinGW and friends long before it existed.)

[0] https://www.msys2.org/wiki/MSYS2-introduction/

FWIW, ripgrep has a native build for Windows which is much, much faster than using grep or rg via WSL2. (I'm not sure how it compares to grep from MinGW/MSYS2.)

Windows Sysinternals

gdb is a general-purpose debugger. The equivalent tool for Windows is windbg [0] which is free and extremely powerful, though famously arcane. You can certainly do this with it.

[0] https://learn.microsoft.com/en-us/windows-hardware/drivers/d...

https://x64dbg.com/

The task manager had the option to dump the memory of a process. It's been a while since I last used Windows though, so I don't remember whether that does, in fact, dump all of its pages.

Plug: Could have maybe used https://github.com/eras/memgrep/

Yeah I was going to ask how does FF know about Mac speakers, but I was not expecting that

(Neither that it would have kept the text there, I guess he was lucky)

The buffer could have been freed but not zeroed out maybe.

How do you attach gdb to a running process?

gdb <path> -p <pid>

That part also grabbed my attention.

How would I do the core dump? (How do I attach gdb to Firefox? Doesn’t it need debug data from the compiler like what you get with gcc -Og?)

You can attach gdb to any process. Debug information is not needed unless you want nice things like knowing which lines of code you are stepping through.

On macOS most binaries now use the hardened runtime which prevents attaching a debugger by default, so you can only attach to arbitrary processes when SIP is disabled.

You can use 'gcore' (from gdb) to dump the process memory (on Linux) - it tries to create a core file as if it crashed, without crashing it. It's not 100% reliable it sometimes fails - not entirely sure why - but often works.

Then as above you dont really need to understand the memory or variables with debug symbols (though on Linux they generally are available.. and increasingly on the newest distros will automatically be downloaded by debuginfod). You can jsut grep for the text you are looking for and likely it's roughly together in memory.

Reply on news.ycombinator.com