View Full Version : Blue screen code
| [Originally Posted by mint77;95167] I am looking for some code that will cause a BSOD in order to study it. |
C:\WinDDK\7600.16385.1\src\bangbangbust>dir /b
bangbangbust.c
buildandcopy.bat
makefile
sources
C:\WinDDK\7600.16385.1\src\bangbangbust>type *.*
bangbangbust.c
#include <ntddk.h>
DRIVER_INITIALIZE DriverEntry;
DRIVER_UNLOAD DriverUnload;
void DriverUnload( PDRIVER_OBJECT DriverObject )
{
DbgPrint("Driver unloading\n";
}
NTSTATUS
DriverEntry( __in PDRIVER_OBJECT DriverObject, __in PUNICODE_STRING Registry
Path )
{
DriverObject->DriverUnload = DriverUnload;
DbgPrint("we are gonna bang bang bust now wanna blue with me\n"
DbgPrint("some western classical music in the background with windows runnin
g rodeo guns blazing\n"
_asm
{
mov eax,0
mov [eax],0
}
return STATUS_SUCCESS; // what the compiler knows we arent returning ever
}
buildandcopy.bat
REM doubledot for pushd as arg pushes currentdir
pushd ..
REM invoke xpcheckedbuild environment
@Call C:\WinDDK\7600.16385.1\bin\setenv.bat C:\WinDDK\7600.16385.1\ chk x86 WXP
REM go back to the dir that this batch was launched
popd
REM just to confirm if we are in dir we want list the directory
dir /b
REM we can now build the sources
build -bcZg
Echo install bang bang bust service in a vm with sc or osrloader and start the s
ervice to enjoy blue screen
makefile
!INCLUDE $(NTMAKEENV)\makefile.def
sources
TARGETNAME=bangbangbust
TARGETTYPE=DRIVER
TARGETPATH=obj
SOURCES = bangbangbust.c
C:\WinDDK\7600.16385.1\src\bangbangbust>buildandcopy.bat
C:\WinDDK\7600.16385.1\src\bangbangbust>REM doubledot for pushd as arg pushes cu
rrentdir
C:\WinDDK\7600.16385.1\src\bangbangbust>pushd ..
C:\WinDDK\7600.16385.1\src>REM invoke xpcheckedbuild environment
OACR monitor running already
bangbangbust.c
buildandcopy.bat
makefile
sources
BUILD: Compile and Link for x86
BUILD: Start time: Thu Aug 08 10:32:41 2013
BUILD: Examining c:\winddk\7600.16385.1\src\bangbangbust directory for files to
compile.
c:\winddk\7600.16385.1\src\bangbangbust Auto-cleaning queue for 'root:x86chk
' (1 of 1 file(s) removed)
Invalidating OACR warning log for 'root:x86chk'
BUILD: Compiling and Linking c:\winddk\7600.16385.1\src\bangbangbust directory
Configuring OACR for 'root:x86chk' - <OACR on>
_NT_TARGET_VERSION SET TO WINXP
Compiling - bangbangbust.c
Linking Executable - objchk_wxp_x86\i386\bangbangbust.sys
BUILD: Finish time: Thu Aug 08 10:32:43 2013
BUILD: Done
3 files compiled
1 executable built
install bang bang bust service in a vm with sc or osrloader and start the servic
e to enjoy blue screen
C:\WinDDK\7600.16385.1\src\bangbangbust>
watchdog!WdUpdateRecoveryState: Recovery enabled.
we are gonna bang bang bust now wanna blue with me
some western classical music in the background with windows running rodeo guns blazing
*** Fatal System Error: 0x0000007e
(0xC0000005,0xFAE6F4DE,0xFAC83BB4,0xFAC838B0)
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.
A fatal system error has occurred.
Connected to Windows XP 2600 x86 compatible target at (Thu Aug 8 10:24:29.125 2013 (UTC + 5:30)), ptr64 FALSE
Loading Kernel Symbols
...............................................................
...............................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7E, {c0000005, fae6f4de, fac83bb4, fac838b0}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
nt!RtlpBreakWithStatusInstruction:
804e3592 cc int 3
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: fae6f4de, The address that the exception occurred at
Arg3: fac83bb4, Exception Record Address
Arg4: fac838b0, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
bangbangbust!DriverEntry+2e [c:\winddk\7600.16385.1\src\bangbangbust\bangbangbust.c @ 20]
fae6f4de c60000 mov byte ptr [eax],0
EXCEPTION_RECORD: fac83bb4 -- (.exr 0xfffffffffac83bb4)
ExceptionAddress: fae6f4de (bangbangbust!DriverEntry+0x0000002e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 00000000
Attempt to write to address 00000000
CONTEXT: fac838b0 -- (.cxr 0xfffffffffac838b0)
eax=00000000 ebx=00000000 ecx=804ff063 edx=00000057 esi=e1704b82 edi=ffbc4030
eip=fae6f4de esp=fac83c7c ebp=fac83c7c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
bangbangbust!DriverEntry+0x2e:
fae6f4de c60000 mov byte ptr [eax],0 ds:0023:00000000=??
Resetting default scope
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 00000000
WRITE_ADDRESS: 00000000
FOLLOWUP_IP:
bangbangbust!DriverEntry+2e [c:\winddk\7600.16385.1\src\bangbangbust\bangbangbust.c @ 20]
fae6f4de c60000 mov byte ptr [eax],0
BUGCHECK_STR: 0x7E
DEFAULT_BUCKET_ID: CODE_CORRUPTION
LAST_CONTROL_TRANSFER: from 805a399d to fae6f4de
STACK_TEXT:
fac83c7c 805a399d ffbc4030 812d0000 00000000 bangbangbust!DriverEntry+0x2e [c:\winddk\7600.16385.1\src\bangbangbust\bangbangbust.c @ 20]
fac83d4c 805a3c73 80000198 00000001 00000000 nt!IopLoadDriver+0x66d
fac83d74 804e426b 80000198 00000000 812f5b30 nt!IopLoadUnloadDriver+0x45
fac83dac 8057aeff f74fbcf4 00000000 00000000 nt!ExpWorkerThread+0x100
fac83ddc 804f88ea 804e4196 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
| [Originally Posted by mint77;95172] 3. Microsoft compilers are stupid. :wallbash: |