telescope : Error: TypeError: Cannot read properties of undefined (reading 'add') [at telescope (line 520 col 43)]

[soiax]

Hi,

On latest windbg, with a foxit pdf reader TTD recording, only happens with TTD:

0:000> !telescope @ecx
Populating the VA space with modules..
Populating the VA space with TEBs & thread stacks..
Populating the VA space with the PEB..
Populating the VA space with TTD.Data.Heap..
Error: TypeError: Cannot read properties of undefined (reading 'add') [at telescope (line 520 col 43)]

[0vercl0k]

Thanks for the report - I am catching up on Github issues / PR so it might take a week or two before I get to this one but I'll get there :)

Cheers

[0vercl0k]

Hmmm I cannot reproduce the issue; could you open the TTD trace and run the following command: dx -r1 @$cursession.TTD.Data.Heap()[0].Address and let me know what you see?

Cheers

[soiax]

This :

0:000> !telescope @edx
Populating the VA space with modules..
Populating the VA space with TEBs & thread stacks..
Populating the VA space with the PEB..
Populating the VA space with TTD.Data.Heap..
Error: TypeError: Cannot read properties of undefined (reading 'add') [at telescope (line 520 col 43)]
0:000> dx -r1 @$cursession.TTD.Data.Heap()[0].Address
Error: Unspecified error (0x80004005)
0:000> dx -r1 @$cursession.TTD.Data.Heap()[0]
Error: Unspecified error (0x80004005)
0:000> dx -r1 @$cursession.TTD.Data.Heap()
@$cursession.TTD.Data.Heap()                
    [0x0]            : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)]
    [0x1]            : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)]
    [0x2]            : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)]
    [0x3]            : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)]
    [0x4]            : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)]
    [0x5]            : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)]

If i load it with .scriptdebug it's:

0:000> !telescope @edx
Populating the VA space with modules..
Populating the VA space with TEBs & thread stacks..
Populating the VA space with the PEB..
Populating the VA space with TTD.Data.Heap..
>>> ****** SCRIPT BREAK telescope [Exception (first chance) 'TypeError: Cannot read properties of undefined (reading 'compareTo')'] ******
           Location: line = 1, column = 52
           Text: 

>>> Debug [telescope 1:52] >g
Error: TypeError: Cannot read properties of undefined (reading 'compareTo') [at telescope (line 241 col 25)]

[0vercl0k]

Okay thank you - I will try with a 32-bit trace this week; it looks like this is the environment the bug triggers in. Cheers

…

On Tue, Nov 5, 2024 at 7:56 AM soiax ***@***.***> wrote: This : 0:000> !telescope @edx Populating the VA space with modules.. Populating the VA space with TEBs & thread stacks.. Populating the VA space with the PEB.. Populating the VA space with TTD.Data.Heap.. Error: TypeError: Cannot read properties of undefined (reading 'add') [at telescope (line 520 col 43)] 0:000> dx -r1 @$cursession.TTD.Data.Heap()[0].Address Error: Unspecified error (0x80004005) 0:000> dx -r1 @$cursession.TTD.Data.Heap()[0] Error: Unspecified error (0x80004005) 0:000> dx -r1 @$cursession.TTD.Data.Heap() @$cursession.TTD.Data.Heap() [0x0] : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)] [0x1] : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)] [0x2] : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)] [0x3] : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)] [0x4] : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)] [0x5] : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)] If i load it with .scriptdebug it's: 0:000> !telescope @edx Populating the VA space with modules.. Populating the VA space with TEBs & thread stacks.. Populating the VA space with the PEB.. Populating the VA space with TTD.Data.Heap.. >>> ****** SCRIPT BREAK telescope [Exception (first chance) 'TypeError: Cannot read properties of undefined (reading 'compareTo')'] ****** Location: line = 1, column = 52 Text: >>> Debug [telescope 1:52] >g Error: TypeError: Cannot read properties of undefined (reading 'compareTo') [at telescope (line 241 col 25)] — Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALIORNQYSEH76RL3QNZS6TZ7DTC5AVCNFSM6AAAAABQ7HUZQSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINJXGU3DAOBVGI> . You are receiving this because you commented.Message ID: ***@***.***>

[0vercl0k]

I can reproduce on a Wow64 trace:

0:000> dx @$cursession.TTD.Data.Heap()
@$cursession.TTD.Data.Heap()                
    [0x0]            : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)]
    [0x1]            : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)]
    [0x2]            : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)]
    [0x3]            : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)]
    [0x4]            : Error: 64 bit value loses precision on conversion to number [at HeapAnalysis (line 157 col 60)]
...

0:000> dx @$cursession.TTD.Data.Heap()[0]
Error: Unspecified error (0x80004005)

Will take a look in more details - hopefully I can do something about it.. 🤞🏽

Cheers

[0vercl0k]

Okay I looked into this tonight - I think the bug is in the HeapAnalysis.js file that is shipped with WinDbg (C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2410.11001.0_x64__8wekyb3d8bbwe\x86\TTD\Analyzers\HeapAnalysis.js).

The bug is here:

                return (c.Flags === undefined) || ((c.Flags & exemptedFlagMask) == 0);

The issue is Flags is a 64-bit number but being AND'd with a regular JavaScript integer so there's an implicit conversion which triggers the following exception: Error: 64 bit value loses precision on conversion to number.

You can patch the file by replacing the above line with the below:

                return (c.Flags === undefined) || ((c.Flags.convertToNumber() & exemptedFlagMask) == 0);

You can save the file in a different path, then .scriptunload C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2410.11001.0_x64__8wekyb3d8bbwe\x86\TTD\Analyzers\HeapAnalysis.js, scriptload c:\foo\PatchedHeapAnalysis.js then !telescope should work:

0:000> !telescope @esp
Populating the VA space with modules..
Populating the VA space with TEBs & thread stacks..
Populating the VA space with the PEB..
Populating the VA space with TTD.Data.Heap..
Populating the VA space with VirtualAllocated regions..
Populating the VA space with MappedViewOfFile regions..
0x00affa60|+0x0000: 0x00000000 (Unknown)
0x00affa64|+0x0004: 0x00affa70 (Stack) -> 0x0001003f (Unknown)
0x00affa68|+0x0008: 0x77550000 (ntdll.dll) -> 0x00905a4d (Unknown)
0x00affa6c|+0x000c: 0x00000000 (Unknown)
0x00affa70|+0x0010: 0x0001003f (Unknown)
0x00affa74|+0x0014: 0x00000000 (Unknown)
0x00affa78|+0x0018: 0x00000000 (Unknown)
0x00affa7c|+0x001c: 0x00000000 (Unknown)
0x00affa80|+0x0020: 0x00000000 (Unknown)
0x00affa84|+0x0024: 0x00000000 (Unknown)
@$telescope(@esp)

I'll try to get this bug reported to MSFT :)

Cheers

[soiax]

Yeah that fixes it :)

But for some addresses there is a similar conversion error :

0:000> !telescope @ecx
Populating the VA space with modules..
Populating the VA space with TEBs & thread stacks..
Populating the VA space with the PEB..
Populating the VA space with TTD.Data.Heap..
Populating the VA space with VirtualAllocated regions..
Populating the VA space with MappedViewOfFile regions..
Error: Error: 64 bit value loses precision on conversion to number [at telescope (line 572 col 29)]

[soiax]

Sometimes it kills the whole enghost.exe btw. So probably windbg bug again.

[0vercl0k]

Hmmm will run more tests this week-end to see if I can trigger this - sorry for that ugh 😔 Cheers

…

On Fri, Nov 8, 2024 at 1:58 AM soiax ***@***.***> wrote: Sometimes it kills the whole enghost.exe btw. So probably windbg bug again. — Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALIORIQH346HP4LX4AGXY3Z7SDLTAVCNFSM6AAAAABQ7HUZQSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINRUGI4DEOJRGI> . You are receiving this because you commented.Message ID: ***@***.***>

[0vercl0k]

If you replace the below:

    const OrderedHits = Hits.sort(
        p => p.Size
    );

By:

    const OrderedHits = Hits.sort(
        p => p.Size.convertToNumber()
    );

Does it fix your issue above?

Sorry for the delayed answer!

Cheers

[soiax]

Yes it fixes it.
Thanks

[0vercl0k]

Okay - I'll patch this out tomorrow; thank you for trying out the fixes and reporting the issue! Cheers

…

On Sat, Nov 16, 2024 at 8:55 PM soiax ***@***.***> wrote: Yes it fixes it. Thanks — Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALIORPSJY5EGYF7GCV75H32BAOUXAVCNFSM6AAAAABQ7HUZQSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDIOBQHEZDMMBSG4> . You are receiving this because you commented.Message ID: ***@***.***>

[0vercl0k]

Sorry for the delay on this - @soiax are you able to try out #6 to make sure it also works on your trace? Will merge once I get your 👍🏽

Cheers

[soiax]

It works :)
With the heapanalysis.js patch, i see no errors.

I reported the windbg errors to MS here :
microsoftfeedback/WinDbg-Feedback#247

Thanks :)

[0vercl0k]

Amazing idea! I emailed but I have gotten no answer / ack, so probably best to use their GitHub, I subscribed to the issue :)

Let's merge this then.

Thanks for the report again!

Cheers