News for hackers. Stuff that matters.
Re:Bypassing Windows ASLR using "skype4COM" protocol handler by barrkel on Sunday February 24, 2013 @07:58PM (#5276738)
Hardware breakpoints on memory accesses.

This is a somewhat common technique for tracing the value of a variable backwards in time in native code, particularly in the presence of buffer overflows or other memory corruption. When debugging, you find out that a variable has a weird value, a value it could never have according to the code. So you put a hardware breakpoint on the variable's address and restart the program. Play around with the step count on the breakpoint, and you can find the write that messes things up.

It only works when you can reliably reproduce the same execution steps every run, including heap addresses. And ASLR breaks the technique.

ASLR also tends to make buffer overflows and other memory corruption appear randomly rather than consistently.

Re:Bypassing Windows ASLR using "skype4COM" protocol handler by ghratch on Sunday February 24, 2013 @09:06PM (#5276902)
On Linux you could try using the Fast Reversible Debugger (https://github.com/fred-dbg/fred) for its memory-accurate record/replay feature. Full disclosure: I was a contributor on that project at one point.
Re:Bypassing Windows ASLR using "skype4COM" protocol handler by loeg on Monday February 25, 2013 @05:00PM (#5282140)
I haven't tried it yet myself, but supposedly GDB has supported reversible debugging since 2009[0] — any experience with that? Limitations?

[0]: https://www.gnu.org/software/gdb/news/reversible.html

Re:Bypassing Windows ASLR using "skype4COM" protocol handler by limmeau on Monday February 25, 2013 @05:32AM (#5278232)
I've never heard of DMTCP or FReD. It sounds interesting. Have you thought of submitting it to HN?
Re:Bypassing Windows ASLR using "skype4COM" protocol handler by to3m on Sunday February 24, 2013 @09:39PM (#5277010)
Yes, data breakpoints was mainly what I was thinking of. But I was thinking of assembly language breakpoints as well (Visual Studio doesn't store the addresses symbolically, or didn't seem to when I was trying it) - I've often found myself needing these too when trying to narrow down on some really ugly bug or other.

I've needed to do this on literally every single program I've ever worked on, and I've even missed them a few times in C#...