Analyze -v

Another long span without a post and another apologetic post about the delay…Eventually I’ll learn my lesson and stop doing this

It’s certainly shaping up to be an exciting year. With the release of Windows 8 we’ll have kernel debugging and crash analysis in Visual Studio, another processor architecture to learn, and new releases of WinDBG. Should be LOTS of fodder for blog posts in the months to come and remove any excuse I may have for not updating.

Looking forward to another year interacting with all of you and learning some new things. As always, feel free to keep me honest by joining my network on LinkedIn or following me on Twitter.

Here’s to hoping everyone has a healthy and prosperous new year!

-scott

Sometimes if I’m getting desperate and am running out of information from a dump file, I’ll run Strings on it and see if there are any interesting strings in the image. While I usually don’t know what I’m looking for when I start this excercise, generally what I find is fairly benign: machine names, URLs, PATH values, etc.

However, today I ran this on a dump from an application and I found art! A nice diversion from my normal activities:

And there were many others as well. This dump happened to come from a VPN application, so I suspect that these were put there on purpose to thwart someone from finding any interesting strings in their image. The idea being that if you put all kinds of bogus strings in your image then the amount of time it takes for someone to find an interesting string goes up. I guess we poor analysts are assumed guilty until proven innocent…

Update

A couple of comments cleared up the mystery and it turned out to be nothing bad at all (I’m clearly too paranoid). From Paolo Bonzini:

Definitely looks like XPM. XPM format images are designed to be #included in C source code (!), which would explain why you have no double quotes. The \n at the end of each scan line would be an artifact of strings, which found a NUL terminator and started a new printable string.

If you want updates on new blog posts and other such trivia, follow Analyze -v on Twitter! http://twitter.com/analyzev

Over two months since my last update! Guess I’ve been enjoying the Summer a bit too much…I plan on picking back up again in a couple of weeks when I’m back from vacation, until then look out for our upcoming issue of The NT Insider where I’ll be covering the details of DbgEng and writing your own debugger extensions.

Happy 2010 everyone! Hope it’s a healthy and prosperous year for us all.

After eight years in the community, this is my first year being nominated and selected as a Microsoft MVP. Hope this year is as good as the last eight and thanks to those who nominated me!

So why do I have to reboot when I get an IE update?