Monthly Archives: August 2013

Update: Flipped Bits

Firstly, thanks to YoYo155, for asking his friend about flipped bits and Segmentation faults. If the flipped bit is occurring within the exact same register consistently, then it’s a problem with the CPU for sure, and less likely to be … Continue reading

Posted in Debugging | Leave a comment

Segmentation Faults

A user at Sysnative Forums, asked a interesting question, and in my attempt to answer the question. I also started to learn myself some information about misaligned pointers and segmentation faults (also known as access violations and bus errors). The … Continue reading

Posted in Debugging | Leave a comment

Debugging Stop 0xD5 – DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL

Another debugging lesson, with a simple bugcheck, which is very similar to a Stop 0xD1 or Stop 0xA. Although, I’m sure this bugcheck only occurs with the use of Driver Verifier, but I may be wrong about this. The parameters … Continue reading

Posted in Stop 0xD5 | Leave a comment

Debugging Stop 0x18 – REFERENCE_BY_POINTER

I’ve found a new interesting bugcheck which is commonly related to objects and handles. Please note before reading, this a Minidump file, and some of the extensions which you would use may not work in this example, unless you have … Continue reading

Posted in Stop 0x18 | Leave a comment

Debugging Stop 0x1A – Out of Sync PFNs and Page Tables

I’ve seen this bugcheck and it’s parameter 403, becoming more common recently, and therefore thought I would share how I go around debugging the problem. Stop 0x1As rarely tell us what the parameters actually indicate and substitute to, therefore we … Continue reading

Posted in Stop 0x1A | Leave a comment

Process Working Set Internals

Hey everyone, I thought I’ll add some information about the the internals mechanisms of Windows, in this example I’m going to write about the process working set and the basic management of working set. The process working set is the … Continue reading

Posted in Windows Internals | Leave a comment

Debugging Stop 0xFC – ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

I’ve found a Minidump, in which I finally show the !pte extension, with this example a driver has attempted to execute a non-executable region of memory. Basically, a device driver has referenced a invalid memory address. The first parameter is … Continue reading

Posted in Uncategorized | Leave a comment