MOVB-15 "I cannot auto-terminate"

Yet another kernel bug delivered by FireFox+YouTube combination.

NtTerminateProcess() failed with the infamous IRQL_NOT_LESS_OR_EQUAL. It seems that MiDeleteAddressesInWorkingSet() tried to access data without any probe or exception handling. Did Vista kernel passed WHQL?

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace.

Arguments:
Arg1: c0053000, memory referenced
Arg2: 00000000, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8201985f, address which referenced memory

Debugging Details:
------------------
Missing image name, possible paged-out or corrupt data.
Unable to read KLDR_DATA_TABLE_ENTRY at 00000000 - NTSTATUS 0xC0000147

WARNING: .reload failed, module list may be incomplete
Missing image name, possible paged-out or corrupt data.
Unable to read KLDR_DATA_TABLE_ENTRY at 00000000 - NTSTATUS 0xC0000147

WARNING: .reload failed, module list may be incomplete

READ_ADDRESS: c0053000

CURRENT_IRQL: 0

FAULTING_IP:
nt!MiDeleteAddressesInWorkingSet+141
8201985f 8b0e mov ecx,dword ptr [esi]

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

TRAP_FRAME: af78f79c -- (.trap 0xffffffffaf78f79c)
ErrCode = 00000000
eax=0a600201 ebx=84ded3a8 ecx=c080f514 edx=c080a50c esi=c0053000 edi=c0801000
eip=8201985f esp=af78f810 ebp=af78fc6c iopl=0 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010287
nt!MiDeleteAddressesInWorkingSet+0x141:
8201985f 8b0e mov ecx,dword ptr [esi] ds:0023:c0053000=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8201985f to 8208fd84

STACK_TEXT:
af78f79c 8201985f badb0d00 c080a50c 85382cb5 nt!KiTrap0E+0x2ac
af78fc6c 82019cc7 84ded1d8 84ded1d8 84ded1d8 nt!MiDeleteAddressesInWorkingSet+0x141
af78fc9c 8221bd12 84ded1d8 af784644 84daf818 nt!MmCleanProcessAddressSpace+0x14f
af78fd04 8221ad7a 00000000 00000000 84daf5b8 nt!PspExitThread+0x64a
af78fd24 8221b265 84daf5b8 00000000 00000001 nt!PspTerminateThreadByPointer+0x5b
af78fd54 8208caaa ffffffff 00000000 0012fea4 nt!NtTerminateProcess+0x1e0
af78fd54 77b20f34 ffffffff 00000000 0012fea4 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012fea4 00000000 00000000 00000000 00000000 0x77b20f34

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiDeleteAddressesInWorkingSet+141
8201985f 8b0e mov ecx,dword ptr [esi]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiDeleteAddressesInWorkingSet+141

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 471ea39c

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_nt!MiDeleteAddressesInWorkingSet+141

BUCKET_ID: 0xA_nt!MiDeleteAddressesInWorkingSet+141

MOVB-14 DirectX BSoD

I have been lucky on this one.

My daughter was watching videos on YouTube, so I could not deliver MOVB of the day. And then Vista died with a DirectX BSoD ... Enjoy !

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00000403, The subtype of the bugcheck.
Arg2: c004e000
Arg3: 000002f5
Arg4: 00000000

Debugging Details:
------------------

BUGCHECK_STR: 0x1a_403
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 2
BAD_PAGES_DETECTED: 1
LAST_CONTROL_TRANSFER: from 82040566 to 8204099b

STACK_TEXT:
a9c778a0 82040566 c004e000 84c194f0 91f19768 nt!MiDeletePte+0x360
a9c779d4 820bf1bd 099c0000 09ebffff a9c7c12c nt!MiDeleteVirtualAddresses+0x8a1
a9c77a6c 8208caaa ffffffff 9073ccd0 9073cce4 nt!NtFreeVirtualMemory+0x655
a9c77a6c 8207e83d ffffffff 9073ccd0 9073cce4 nt!KiFastCallEntry+0x12a
a9c77af4 89461123 ffffffff 9073ccd0 9073cce4 nt!ZwFreeVirtualMemory+0x11
a9c77b1c 894621fb 9073ccc8 9246a008 850082d8 dxgkrnl!VIDMM_PROCESS_HEAP::Free+0x75
a9c77b50 89461b26 0006d258 00000001 00000000 dxgkrnl!VIDMM_GLOBAL::CloseLocalAllocation+0xd9
a9c77b90 89462b73 00000000 00000000 92548008 dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+0xe6
a9c77bb0 8946a49c af095c60 00000000 92548008 dxgkrnl!VIDMM_GLOBAL::CloseAllocation+0x37
a9c77c1c 89471394 b03d8e00 00000001 906d6268 dxgkrnl!DXGDEVICE::DestroyAllocations+0x176
a9c77c40 8946a96d b03d8e00 a94e3804 00000000 dxgkrnl!DXGDEVICE::DestroyResource+0x4b
a9c77c94 89463d14 a9c77cf0 00000001 a94e39c8 dxgkrnl!DXGDEVICE::DestroyAllocation+0x97
a9c77d58 8208caaa 099bfcfc 099bfd0c 76e80f34 dxgkrnl!DxgkDestroyAllocation+0x538
a9c77d58 76e80f34 099bfcfc 099bfd0c 76e80f34 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
099bfd0c 00000000 00000000 00000000 00000000 0x76e80f34

STACK_COMMAND: kb
SYMBOL_NAME: PAGE_NOT_ZERO_VISTA
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
BUCKET_ID: PAGE_NOT_ZERO_VISTA

Followup: MachineOwner
---------

*** Memory manager detected 1 instance(s) of page corruption, target is likely to have memory corruption.

MOVB-13 Minor annoyances

When importing pictures from a digital camera, you cannot selected pictures individually.

When doing anything that requires elevation from a network share (e.g. installing software), you have to re-enter network credentials after elevation (this is logical because of UAC design, yet annoying if you have a super-secure password :).

When creating a new folder in a "privileged" location, you have to go through UAC twice: once for creating the "new folder" directory, once for renaming it. Depending on the scenario, the number of UAC prompts can be as high as 4. Hopefully, "SP1 reduces the number of UAC (User Account Control) prompts from 4 to 1 when creating or renaming a folder at a protected location".

You cannot drag and drop files anywhere (like on the desktop) from a network share. You are restricted to a subset of folders, such as "Documents".

You cannot drag and drop inside a CMD anymore. This is "by design".

Windows Vista users cannot easily access files on a Windows XP partition in a dual-boot configuration. Default XP users are admins, and most files are accessible by the "Administrators" group only. Vista users are not admins, and Explorer cannot be elevated.

".HLP" files are not supported anymore.

HyperTerminal is not bundled anymore. There is no easy way to access the serial port on Windows Vista.

Telnet (and many other commands) are not available by default. You have to "re-enable" them from the Control Panel.

Other interesting annoyances (FireWire drives, etc.) can be found here.

MOVB-12 Application compatibility

When trying to install third party software under Vista, you can run into the following trouble:

Software would like to disable UAC entirely.

Sample application: EasyBCD

Software needs to be added to DEP exemption list, because it's somehow protected ("packed").

... and the error message will puzzle most (if not all) end-users :)

Sample application: AuctionSentry

Software needs a compatibility pack from Microsoft

I guess compatibility packs rely on the Shim Engine, but I have never dug too deep in those mechanisms. Let's say that it is a database of big hacks to get crappy applications working :)

Sample : March 2007 Windows Vista Application Compatibility Update

You wait 3 monthes for an upgrade

Sample : iTunes [*], Microsoft Visual Studio 2005 [**]

[*] It seems also that iTunes will never be Vista64-compatible.
[**] Visual Studio 2005 still needs to be "elevated" to run properly on Vista.

You wait 3 monthes, but the upgrade is not free

Sample : some Adobe products


Oh yeah, I almost forgot. The software can play nice on 1st try! ;)

MOVB-11 Vista logging

A nice finding about Windows Vista logging:
http://www.heysoft.de/Frames/Vista_Remarks1_en.htm

In short, most event log files are not properly referenced in the registry. Under HKLM\System\CCS\Services\EventLog\*\, the "File" entry has a ".elf" suffix, whereas Vista file format is ".evtx".

Consequently, most remote log reading tools (like Windows XP's Event Viewer, but most log collection tools could be affected) are unable to access Vista event logs.

This has been confirmed on my up-to-date Vista 64 system.

The conclusion from this guy is: "I must admit that I do now better understand all those people why say that they never install a Windows operating system in a production environment before its first Service Pack is out."

Fortunately, SP1 is due for Q1 2008 :)

MOVB-10 Bug or security flaw?

[ MOVB is back on track ... time to finish up, before Vista SP1 being out! ]

An interesting bug from Microsoft Knowledge Base 945438:

Consider the following scenario:

• On a computer that is running Windows Vista, you use Microsoft Office PowerPoint 2007 to record audio, or you use another application to record audio.
• The application calls the acmFormatChoose function to display a dialog box so that you can select the waveform-audio format.

In this scenario, the application crashes.

What is more interesting is the logic behind this bug:

The acmFormatChoose function tries to free a pointer that was not allocated.

Bug or security flaw? Given Vista heap protections, this one might be hard to exploit, even locally. But who dares to say impossible, when it comes to bug exploitation?

MOVB-09 Mobile devices support

So I plugged my Windows Mobile 2005 HTC SmartPhone on Vista64 ...

"Out of the box" software has multiple issues, such as:
- It does not allow access to the phone internal storage (as explained in Q931621) ;
- Windows Media Device Center (WMDC) shall be updated to version 6.1, otherwise you will experience various other issues.

Yet there is this nasty "feature" of Vista itself: you cannot import individual pictures from a camera. "All or none" is your only choice.

Last but not least, if you set the default browser to a 3rd party application (namely FireFox), WMDC will raise an "Unhandled Exception" error when opening external links.