What's new Search

Recent content by muhahaa

M
[SOLVED] BSOD 0x7f UPEXPECTED_KERNEL_TRAP_MODE caused by ntoskrnl.exe - Windows 8.1 x64

Re: BSOD 0x7f UPEXPECTED_KERNEL_TRAP_MODE caused by ntoskrnl.exe Windows 8.1 x64 Perhaps Windows uses tail call optimization. If the return value of KeExpandKernelStackAndCalloutInternal is the return value of KeExpandKernelStackAndCalloutEx, a jmp may be used instead of a call to avoid...
- muhahaa
- Post #13
- Jun 7, 2015
- Forum: BSOD Crashes, Kernel Debugging
M
NO BSOD restarts - Windows 8.1

The parameters are "reserved" (undocumented), but I suppose the bugcheck is due to a single bit error between 3 and 4. Single bit flip is a reason to suspect a hardware failure. 79799445af7dc52f=111100101111001100101000100010110101111011111011100010100101111...
- muhahaa
- Post #9
- Oct 22, 2014
- Forum: BSOD Crashes, Kernel Debugging
M
How the BSOD actually 'works', why, etc.

NtRaiseHardError is the user mode BSOD function. The function shows a blue screen if the ResponseOption parameter is OptionShutdownSystem (6). The application must first enable SeShutdownPrivilege.
- muhahaa
- Post #16
- Jul 6, 2014
- Forum: BSOD Library (Public)
M
Recent BlueScreens at random times - Windows 7 x64

8 is execution.
- muhahaa
- Post #19
- Jun 22, 2014
- Forum: BSOD Crashes, Kernel Debugging
M
[Question] What's the frink and brink free-list?

See: Safe Unlinking in the Kernel Pool - Security Research & Defense - Site Home - TechNet Blogs
- muhahaa
- Post #11
- Dec 30, 2013
- Forum: BSOD Kernel Dump Analysis Debugging Information
M
[SOLVED] Need help with random BSOD's (Packard Bell EasyNote ML61)

It seems that the reason of the crash is that the PteAddress member of the PFN entry (FFFFF68000002098 with the lowest two bits cleared) is not equal to the PTE address FFFFF680001700A0. Someone has overwritten the low dword of the PteAddress variable. 1: kd> .bugcheck Bugcheck code 0000001A...
- muhahaa
- Post #10
- Dec 2, 2013
- Forum: BSOD Crashes, Kernel Debugging
M
Dell XPS fairly frequent BSOD

Looks like a bad processor. FAULTING_IP: dxgmms1!VidSchSubmitCommand+23f 931534b1 8b4634 mov eax,dword ptr [esi+34h] EXCEPTION_RECORD: 9a394f20 -- (.exr 0xffffffff9a394f20) ExceptionAddress: 931534b1 (dxgmms1!VidSchSubmitCommand+0x0000023f) ExceptionCode: c0000005 (Access...
- muhahaa
- Post #10
- Oct 28, 2013
- Forum: BSOD Crashes, Kernel Debugging
M
CPU_CALL_ERROR?

I think it implies that the processor executed something else than what the CALL instruction told. However, I'd first consider the possibility of a stack buffer overflow, a common software vulnerability that can cause the function return address to be overwritten (possibly with an...
- muhahaa
- Post #8
- Oct 1, 2013
- Forum: BSOD Kernel Dump Analysis Debugging Information
M
BSOD when opening certain websites

The crashes are font related. Probably a buffer overflow vulnerability in Windows. 2: kd> k Child-SP RetAddr Call Site fffff880`0bdb0ae8 fffff800`03302be0 nt!KeBugCheckEx fffff880`0bdb0af0 fffff800`03282cae nt! ?? ::FNODOBFM::`string'+0x4518f fffff880`0bdb0c50...
- muhahaa
- Post #16
- Aug 31, 2013
- Forum: BSOD Crashes, Kernel Debugging
M
Misaligned IP

Misaligned IP: execution in the middle of an instruction, which forms another instruction, which is often invalid: an illegal instruction or illegal memory reference ("segfault"). Sort of like "more cycles" being read as "recycles". Example: BSOD errors every couple of minutes | AVForums.com -...
- muhahaa
- Post #4
- Aug 30, 2013
- Forum: BSOD Library (Public)
M
Misaligned IP

Why does WinDbg assume misaligned instruction pointer as a hardware failure instead of stack buffer overflow or other similar software bug?
- muhahaa
- Thread
- Aug 28, 2013
- Replies: 4
- Forum: BSOD Library (Public)
M
[SOLVED] Recurrent BSODs (every 1-2 days) clock interrupt

Broadcom network driver k57nd60a.sys and Comodo firewall driver inspect.sys appear on the raw stack of the hung processor. 0: kd> lmvm k57nd60a start end module name fffff880`04d91000 fffff880`04df8000 k57nd60a (no symbols) Loaded symbol image...
- muhahaa
- Post #20
- Aug 22, 2013
- Forum: BSOD Crashes, Kernel Debugging
M
Multiple and varying BSOD's

In most of these crashes the address claimed to be referenced and the actual address that the instruction references are different. Not sure if this is because of hardware failure or if there is code corruption that isn't saved in the minidumps. 061213-26738-01.dmp: IRQL_NOT_LESS_OR_EQUAL (a)...
- muhahaa
- Post #4
- Jun 23, 2013
- Forum: BSOD Crashes, Kernel Debugging
M
[SOLVED] BSOD - CLOCK_WATCHDOG_TIMEOUT_8_PROC. FIX: I changed motherboard.

4f is ASCII "O".
- muhahaa
- Post #26
- May 30, 2013
- Forum: BSOD Crashes, Kernel Debugging
M
BSoD files for Dan Bromberg

One of the dumps shows an obvious bit flip: 0: kd> kv Child-SP RetAddr : Args to Child : Call Site fffffa60`08c5fa08 fffff800`03045157 : 00000000`0000001e ffffffff`c0000005 fffff800`0301722a 00000000`00000000 ...
- muhahaa
- Post #3
- May 28, 2013
- Forum: BSOD Crashes, Kernel Debugging

muhahaa