{"id":2361,"date":"2013-05-14T22:20:07","date_gmt":"2013-05-14T21:20:07","guid":{"rendered":"http:\/\/t-machine.org\/?p=2361"},"modified":"2013-05-14T22:20:07","modified_gmt":"2013-05-14T21:20:07","slug":"app-takes-all-the-ram-on-a-windows-tablet-turns-out-to-be-debug-code-the-manufacturer-left-in-by-accident","status":"publish","type":"post","link":"http:\/\/new.t-machine.org\/index.php\/2013\/05\/14\/app-takes-all-the-ram-on-a-windows-tablet-turns-out-to-be-debug-code-the-manufacturer-left-in-by-accident\/","title":{"rendered":"App takes all the RAM on a Windows tablet; turns out to be debug code the manufacturer left in by accident"},"content":{"rendered":"<p><a href=\"http:\/\/www.veracode.com\/blog\/2013\/05\/executable-archaeology-the-case-of-the-stupid-thing-eating-all-my-ram\/\">http:\/\/www.veracode.com\/blog\/2013\/05\/executable-archaeology-the-case-of-the-stupid-thing-eating-all-my-ram\/<\/a> &#8211; Doh!<\/p>\n<blockquote><p>\nEveryone has had that dreaded experience: you open up the task manager on your computer\u2026 and there\u2019s a program name you don\u2019t recognize. It gets worse when you google the name and can\u2019t find a concrete answer on what it is and why it\u2019s there. It gets even worse when you remove it from Autoruns and it comes back. It gets terrible when you realize it has keylogger functionality. The icing on the cake, however, is when the mystery program is also eating up all your RAM.<br \/>\n&#8230;<br \/>\nThe application does not store or transmit or even display the information polled. It does nothing. I spent the better part of two hours scouring the obscure corners of the binary, thinking surely I must be missing some cleverly hidden method that actually uses this data. I couldn\u2019t find one.<br \/>\n&#8230;<br \/>\nthat still leaves the question of why it\u2019s doing this at all. The clues are there, vestigial remnants of removed code, exciting to any Executable Archaeologist: The generically named \u201cForm1\u201d of the application contains several widgets which are never actually displayed: a start button, a stop button, a place for displaying mouse coordinates, and a text box for displaying some other unspecified data. I believe this was originally a debugging utility used by \u201cSpacer\u201d engineers to calibrate the accelerometer so that it would not go off when one simply tapped on the touchscreen (triggering a mouse event or keyboard event). They didn\u2019t bother to rigorously prevent memory leaks because it was never intended to run for more than a few minutes at a time. Somehow, through some miscommunication, a copy of this program with the logic for rendering the visuals stripped ended up on the list of utilities that needed to be kept in the final version of \u201cSpacer\u2019s\u201d Windows 8 image for this model of tablet.\n<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"<p>http:\/\/www.veracode.com\/blog\/2013\/05\/executable-archaeology-the-case-of-the-stupid-thing-eating-all-my-ram\/ &#8211; Doh! Everyone has had that dreaded experience: you open up the task manager on your computer\u2026 and there\u2019s a program name you don\u2019t recognize. It gets worse when you google the name and can\u2019t find a concrete answer on what it is and why it\u2019s there. It gets even worse when you remove [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30,20],"tags":[],"_links":{"self":[{"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/posts\/2361"}],"collection":[{"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/comments?post=2361"}],"version-history":[{"count":1,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/posts\/2361\/revisions"}],"predecessor-version":[{"id":2362,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/posts\/2361\/revisions\/2362"}],"wp:attachment":[{"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/media?parent=2361"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/categories?post=2361"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/tags?post=2361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}