Sample BSOD files

[mgrzeg]

Is there any place I can find samples for different bugchecks?

m.g.

 

[niemiro]

There is not one which I know of, unfortunately. Maybe someone else does.

However, I think that it would be very nice to maintain one here. It has been considered before, but never particularly seriously because everyone was so busy.

However, I would now be very happy to help write a few scripts to automate the categorisation of dump files if some of the biggest hitters here uploaded a whole bunch.

It certainly could be done, and I would be very happy to help maintain it. We could also automatically link them all to the carrona.org BSOD index.

 

[writhziden]

Here are 847 samples I've collected: https://skydrive.live.com/redir?resid=50663CB9E4C8946B!211

 

[mgrzeg]

@niemiro: great idea! :) Feel free to use the source from my tool :)
@writhziden: some stats of your files:

BSOD Count
0x00000000 1
0x00000001 2
0x0000000A 95
0x00000019 12
0x0000001A 37
0x0000001E 76
0x00000024 14
0x00000034 2
0x00000035 4
0x0000003B 59
0x0000003D 7
0x0000004E 7
0x00000050 122
0x0000007A 1
0x0000007E 1
0x0000007F 24
0x0000009F 29
0x000000BE 3
0x000000C2 3
0x000000C4 13
0x000000C5 3
0x000000C9 1
0x000000D1 94
0x000000DE 2
0x000000E3 2
0x000000E4 1
0x000000F4 4
0x000000F7 2
0x000000FC 9
0x000000FE 15
0x00000101 6
0x00000109 17
0x0000010E 6
0x00000116 48
0x00000119 2
0x00000124 19
0x00000135 1
0x00009087 4
0x1000000A 3
0x1000007E 41
0x1000008E 4
0x1000009F 43
0x100000D1 1
0xC000021A 2

These files seem to be broken:
053012-26473-01.dmp
062012-12651-01.dmp
072512-17316-01.dmp
072912-62244-01.dmp
082112-78343-01.dmp

m.g.

 

[writhziden]

Yeah, the broken ones are intentional, but I probably shouldn't have included them in the samples. They were for testing purposes for the apps.

 

[Vir Gnarus]

If you want some control and wish to make your own according to specific types of bugchecks, you can try NotMyFault on a VM or non-production PC.

 

[mgrzeg]

Yes, right, but all that notmyfault does to generate specific bugcheck is a call to KeBugCheckEx( BugCheckCode, 0, 0, 0, 0 ), so it's not a 'real' one, which can be tested and helpful in script preperations (or workshops) :)

m.g.

 

[usasma]

101 different memory dumps labelled BugCheck XX, {arg1, arg2, arg3, arg4}.dmp
Uploading to SkyDrive as I type.
Will be back in about ½ hour to post link (gotta feed the dogs)

 

[usasma]

It's called MyDumps.zip here: https://skydrive.live.com/#cid=5A5378E587A744C3&id=5A5378E587A744C3!139
Contains these dumps:

1
5
6
A
1A
1E
3B
3D
4A
4E
6B
7A
7C
7F
9C
9F
18
19
20
21
23
24
26
27
34
35
39
40
44
46
50
51
74
76
77
100007E
82
100008E
93
96
100009F
A0
A3
AB
B8
10000B8
BE
C1
C2
C4
C5
C7
C9
CA
CB
CD
10000CD
CE
D1
D3
D4
D5
D6
DA
DE
DF
E1
E3
E4
E6
EA
10000EA
F4
F5
F7
FC
FE
101
109
10D
10E
111
113
116
117
119
11B
122
124
12E
131
135
136
333
8086
9087
70860002
C000021A
C0000221
DEADDEAD
E0010002

 

[Vir Gnarus]

Yes, right, but all that notmyfault does to generate specific bugcheck is a call to KeBugCheckEx( BugCheckCode, 0, 0, 0, 0 ), so it's not a 'real' one, which can be tested and helpful in script preperations (or workshops) :)

m.g.

Err, are you sure about this? Whenever I use it the appropriate bugcheck occurs, because NotMyFault is actually causing environment corruption with intentionally developed driver bugs. If that kind of bugcheck is occurring, that's because of some form of corruption where the system could not save the crash context (or perhaps symbol issues?). There are certain types of bugchecks designed for drivers to call and induce or for manually-initiated crashes, and the one you mentioned isn't one of em.

 

[mgrzeg]

Err, are you sure about this?

Look at the sources of the tool. The driver part of NotMyFault is rather simple and most of the bugchecks are generated by this simple call.

Read More:

NTSTATUS  
MyfaultDeviceControl( 
    IN PFILE_OBJECT FileObject, 
    IN BOOLEAN Wait,
    IN PVOID InputBuffer, 
    IN ULONG InputBufferLength, 
    OUT PVOID OutputBuffer, 
    IN ULONG OutputBufferLength, 
    IN ULONG IoControlCode, 
    OUT PIO_STATUS_BLOCK IoStatus, 
    IN PDEVICE_OBJECT DeviceObject 
    ) 
{
    IoStatus->Status = STATUS_SUCCESS;
 IoStatus->Information = 0;
 switch ( IoControlCode ) {
    case IOCTL_BUFFER_OVERFLOW: 
        
        BufferOverflow();
        break;

>>>CUT<<<

    case IOCTL_BUG_CHECK:
        if( InputBufferLength != sizeof(ULONG)) {
            IoStatus->Status = STATUS_INVALID_PARAMETER;
            break;
        }
!!>>>>        BugCheck( *(PULONG) InputBuffer );
        break;
 default: 
        IoStatus->Status = STATUS_NOT_SUPPORTED;
        break;
 }
 return IoStatus->Status;
}

VOID
BugCheck(
    ULONG BugCheckCode
    )
{
>>>    KeBugCheckEx( BugCheckCode, 0, 0, 0, 0 );
}

(I'm still talking about /bugcheck cmdline parameter)

m.g.

 

[Vir Gnarus]

You're right, but that's only referring to one IOCTL that is sent to the myfault device. There are many, others that are sent to it which causes the device to perform some buggy nonsense operation that will crash/hang the system. The only time that IOCTL seems to be triggered is if you pass the /bugcheck argument to NotMyFault.exe in cmdline without specifying what code you want. It's an example to show you how a driver can create its own personal bugcheck code. So yes, I guess that is indeed a manually-triggered crash. However, it doesn't apply to any of the other functions of NotMyFault. I personally didn't even know it existed until you mentioned it.

Sorry if I sound like I'm just repeating you, it helps clarifies my thoughts if I speak out loud. Plus it helps clarify to everyone that all the functions NotMyFault does aren't just some gimmick where it's producing fake bugchecks. :)