[Question] What's the frink and brink free-list?

x BlueRobot · Jun 17, 2013

Hey everyone,

I have a quick question, I've noticed a few bugchecks mention things like the frink and brink free-list address/chain (correct me if I'm wrong), and I was wondering what they meant? I've searched everywhere and haven't been able to find anything about them.

Any answers will be appreciated.

Thanks as always,

Harry

Wrench97 · Jun 17, 2013

Do you have an example dmp you can post?

x BlueRobot · Jun 17, 2013

I do, I'll get the files. I think it's actually blink and flink.

The Kaval folder (View attachment Kaval.zip) mentions something about the lists being corrupt, and this folder contains the two mentioned as parameters (View attachment 061613-20592-01.zip).

Vir Gnarus · Jun 18, 2013

The free list I believe is referring to the free page list, which is a linked list of unallocated memory blocks which have previously been used but are now available. Free pages are memory blocks that happens to still have data left over from when it was released by a process and has not been scrubbed with zeroes by Windows memory manager prior to being ready for use again.

As for that particular example you gave, the corruption is because a byte in one of the freelist entries got overwritten with a '36'. That would be one of those "too late" scenarios where the culprit has already escaped. Driver Verifier helps quite often with pool fudging.

x BlueRobot · Jun 18, 2013

Thanks Vir, I was able to find how what a free-list was, and thanks for explaining the corrupted bit.

This Memory Management Glossary provides quite a good explanation for some of the memory related terminology.

cluberti · Jun 18, 2013

To answer your original question with a technical answer, the "flink" and "blink" you were questioning describe a Forward Link and Backward Link in a linked list. Lots of structures in Windows use linked lists to keep track of things, especially the memory manager, but the FLink and the BLink are ways of validating that a linked list is still valid, what's around, etc. It can be useful for debugging, but that's what it means.

Vir Gnarus · Jun 19, 2013

cluberti said:
To answer your original question with a technical answer, the "flink" and "blink" you were questioning describe a Forward Link and Backward Link in a linked list. Lots of structures in Windows use linked lists to keep track of things, especially the memory manager, but the FLink and the BLink are ways of validating that a linked list is still valid, what's around, etc. It can be useful for debugging, but that's what it means.

I've been curious as to why the bugcheck description says that the Flink and Blink should be identical to the pool entry address itself, and not rather pointing to any other allocations below and above it in the list like what is expected in a double linked list:

Code:

Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffff88002301350, the pool entry being checked.
Arg3: fffff88002301350, the read back flink freelist value (should be the same as 2).
Arg4: 36fff88002301350, the read back blink freelist value (should be the same as 2).

The pool freelist is corrupt.

(In a healthy list, the values of Parameters 2, 3, and 4 should be identical.)

I assume that because they are free and therefore unused allocations that they shouldn't be chained in any way? But then that wouldn't make much of a list, would it?

cluberti · Jun 19, 2013

If I remember correctly, this is the way a pool list entry is determined to be "free" and available for use. What you're seeing in that bugcheck scenario is that an address is on the free list (and thus should be available for allocation), but further basic checking for consistency says the address is actually coming back as non-free (it no longer has one address entry for the pool entry itself, and it's flink and blink). Something has either overrun, underrun, or simply sprayed into the wrong address range.

Vir Gnarus · Jun 19, 2013

Ahh, that makes perfect sense. Thanks, Carl!

x BlueRobot · Jun 20, 2013

Thanks for everyone input into this discussion, I managed to find another article related to Linked Lists, and it mentioned about Blink and Flink, I haven't managed to read through it all completely yet but it did look interesting and helpful.

The NT Insider:Kernel-Mode Basics: Windows Linked Lists

muhahaa · Dec 30, 2013

See: Safe Unlinking in the Kernel Pool - Security Research & Defense - Site Home - TechNet Blogs

Search

Search

[Question] What's the frink and brink free-list?

x BlueRobot

Administrator

Wrench97

Administrator, Hardware Expert

x BlueRobot

Administrator

Vir Gnarus

BSOD Kernel Dump Expert

x BlueRobot

Administrator

cluberti

Senior Member

Vir Gnarus

BSOD Kernel Dump Expert

cluberti

Senior Member

Vir Gnarus

BSOD Kernel Dump Expert

x BlueRobot

Administrator

muhahaa

Windows Specialist