Microsoft needs to remove GUI from kernel: BSOD with WinForms after KB5034848 (opens in new tab)

(gist.github.com)

7 pointsNevor2y ago7 comments

7 comments

It's crazy a such a simple script, which is actually the same as 6 years ago, can produce a BSOD in a deterministic way with the latest update of Windows. And nobody at MS seems to care about it.

nullindividual2y ago

It's actually been fixed. I didn't, and neither did OP, read far enough through the SO thread linked in the GitHub issue.

Fix was previously included in https://support.microsoft.com/en-us/topic/june-27-2017-kb402....

> Addressed issue (Error 0x7F) with Windows Forms (WinForms) that causes the system to crash after upgrading to the Creators Update.

afrisch2y ago

It has been fixed but a similar problem (with the same repro case) reappeared with a recent Windows update, only now when closing the popup.

nullindividual2y ago

No, no they don't. They already tried that with NT4. It went badly for anyone wanting decent graphics performance.

afrisch2y ago

So at least they should really work hard to not let a BSOD happen in case of excessive nesting of widgets. The repro case is actually the same than the one for a bug which was fixed 6 years ago, and it is straightforward (just nest enough panels in a modal popup, and close it). It's hard to understand how this could not be caught by a non regression test.

nullindividual2y ago

45 nested WinForms is bizarre. I think you'd melt a UX designer's eyeballs. It's possible that Microsoft sees this as low impact (small user base), or is too complex to fix, or too high risk to fix.

You could create an interesting payload with this, especially given it can be done via PoSh.

Get payload on machine -> enable Full memory dumps -> execute payload/BSOD -> upon recovery, exfiltrate memory dump.

Secrets galore.

afrisch2y ago

No doubt excessive nesting is bizarre, although the end user might not notice (nested panels that fit in their parent are not visible). That's not a reason to have your entire OS break :-(

j / k navigate · click thread line to collapse

7 comments

afrisch2y ago

It's crazy a such a simple script, which is actually the same as 6 years ago, can produce a BSOD in a deterministic way with the latest update of Windows. And nobody at MS seems to care about it.

nullindividual2y ago

It's actually been fixed. I didn't, and neither did OP, read far enough through the SO thread linked in the GitHub issue.

Fix was previously included in https://support.microsoft.com/en-us/topic/june-27-2017-kb402....

> Addressed issue (Error 0x7F) with Windows Forms (WinForms) that causes the system to crash after upgrading to the Creators Update.

afrisch2y ago

It has been fixed but a similar problem (with the same repro case) reappeared with a recent Windows update, only now when closing the popup.

nullindividual2y ago

No, no they don't. They already tried that with NT4. It went badly for anyone wanting decent graphics performance.

afrisch2y ago

nullindividual2y ago

45 nested WinForms is bizarre. I think you'd melt a UX designer's eyeballs. It's possible that Microsoft sees this as low impact (small user base), or is too complex to fix, or too high risk to fix.

You could create an interesting payload with this, especially given it can be done via PoSh.

Get payload on machine -> enable Full memory dumps -> execute payload/BSOD -> upon recovery, exfiltrate memory dump.

Secrets galore.

afrisch2y ago

No doubt excessive nesting is bizarre, although the end user might not notice (nested panels that fit in their parent are not visible). That's not a reason to have your entire OS break :-(

j / k navigate · click thread line to collapse