[Autogenerated] The system has restarted from the
previous blue screen or green screen.
Now, I'm going to launch the debugger elevated.
Win debug elevated because it has to open,
a file from see Windows which requires elevated permissions.
So here's win debug opening up, I'm going to go,
to file, and then open, down file you,
can see It usually will also point that file here already ready.
To go.
But if not, you can always browse and get to the file wherever it.
Is actually located.
Based on the configuration, that We've seen then You can go ahead.
And click the open button here.
And We get some information about the system with symbols, are being loaded.
And we get some details about the dump here.
Some very fundamental details.
We can see that the top of the stack, is these function K B,
check E X which in fact, is the official function,
that generates blue screen freezes the system.
In fact, this function,
is documenting the Windows driver kit because sometimes
drivers can also generate a blue screen if they think
something very is very wrong with the system.
So you can see the debugger recommends to use the analyze dash V command,
to analyze the dump.
Let's go ahead.
And do that by simply clicking.
So you can see that we have here, a dump, which has the following.
Code let me, go scroll back up here where all these analysis starts.
It's called driver, not less or equal this is the textual description,
and Here's the actual value which is D one hex,
and you can see some explanation here provided by the
debugger and We have some arguments there.
Are always four parameters, four numbers attached,
to the blue screen, that occurred.
And This allows us to get some more information about the dump itself,
the _____ itself.
So for example, it, says here, that this was the address,
that was referenced in a bad context.
The R Q L wasn't good enough there.
That's kind of what these code hint,
although it's not exactly what it says necessarily,
I'll get to that in moment, you can see the R Q L,
that was there at the time of the _____.
That was R Q L number two, and there, are some flags here indicating that zero,
for example means that was a re operation.
If it was the one it would be a right?
Operation, and here, is the actual address that made the access in a bad way.
And then You can continue further down there.
Are some stuff here which I'm not.
Going to get into here.
Eventually we'll get some information about the call
stack that call the blue screen, and for simple call stacks like this one,
we can see that the blue screen, was caused by the my fault.
Module here.
In fact, the debugger is probably going to Give us the same information.
Say, hey, my fault,
dot CSS is the component or the module that's responsible for the
blue screen because that's the first module which is not the kernel
as part of this call stack Now because we don't have any kind of
symbols for my 4.cs we don't see the exact function name but it is
somewhere there.
So going back, to the way we generated the blue prints was using the tool,
not my fault.
And Since not my fault.
Is running in user mode How can not my fault create a blue screen,
and the answer, is It can't.
It has to have some kind of kernel component which is a driver called my fault,
dot CSS which was installed by the not my fault application.
And utilized by telling the driver, hey,
please generate a blue screen in such and such way,
based on our selection, in the dialogue box there.
So obviously the culprit here, is my fault,
dot CSS and We know that We have to do something about these
drivers such as remove it from the system or something like that
or contact the developer or whatever.
But of course, in this case,
this is something we essentially expected because it is what not my fault.
Is using to actually generate a blue screen we,
can see that There's some user mode stuff here.
And we might want to try to re load user mode symbols,
and all of that but that won't work very well because
we don't have user mode memory.
Really.
We just have addresses but trying to reference,
those will simply not work because we have the
automatic memory dump which is equivalent,
to a kernel memory dump, which means we only have kernel memory in place.
However, all other normal commands.
Are available, for example, we can use process 00,
to see all the processes, in the system,
just like any other call debugging session.
This only requires kernel memory which we do have we can do something else.
I look at the running threads on the system at the time of the _____.
So that might give us some hint as to who is actually doing the work here.
And of course.
We know already which threat.
That is its the one that's going to be running not my fault.
And all that but still it might be nice.
To see these things by using the threat command for example.
So you can see Here, there's the image here.
Is system.
This is not the threat.
That caused the exception, the blue screen.
That's simply some other thread.
That was running at the time.
It's part of the system process.
You.
Can see here, we can try other threads.
And we can see a different uh call stack here again,
something, that was happening at the time.
This is part of some S V C host um process here which again,
is is perfectly legitimate.
And maybe this is the one that actually caused the blue screen.
And It makes sense because notice this is the C P U,
that caused the blue screen, that the thread happened.
To run on that thread number, two Notice it, is threat, sorry, CPU number two.
So here's CP number two.
So we expect that thread, to be the actual culprit.
So let's just verify.
And You should see the that it, is part of not might,
false 60 64 is what we expect this is the thing,
that we are running actually, and it, is part of that process it,
was running, in the context of that process,
we can see the same call stack as we've seen,
in the blue screen information here.
So this is fairly straightforward.
And We'll look at a more complex one, a bit later.
But for now, let me show you a few more things.
If we press F1,
we can get to the documentation of the debugger One
of the things you can find here.
In the contents there, is an area called bug checks where you have a bug,
check code reference.
So this provides all the reference or at least a lot of
the references for the various bug,
check codes or stream codes you might encounter in the wild.
So when you get a blue screen,
code and you want to understand better about what that
actually means it's always a good idea.
To first check with debugger documentation,
that can provide some hint as to What that thing actually represents the
actual code might not be exactly what it represents underneath.
So for some of these entries, you'll find something like this.
That says Well, here's a back, check device,
Q,
node be has a value of two and these back checks
appear appears very infrequently,
which essentially means that We don't get any information here as to the reason,
this kind of blue screen can occur because it is probably very rare.
And usually with happen,
only for developers working within Microsoft So it also begs the question,
why is it here, in the first place, but it is here.
So fine.
However, for more useful back checks.
That do happen, in the wild, we get more information here.
Is where you can find the meaning of these four parameters.
That I mentioned that make some uh provide some details
about that particular blue screen, and then Later on you have some explanations.
That are sometimes pretty good.
And provide some underlying details as to Why that thing can happen.
And even some ideas of how to try to figure out why this is happening.
So this is an example of arc not less or go which is a fairly common one.
What we've seen here,
was a different number called D one which is
actually very similar in that respect.
So you can see Also here the information saying this is the memory reference,
that's the first parameter, the real of the time at the time of the reference.
That was our real two and then what operation,
that was we've seen there, was a zero there.
So that's a red, up operation,
and the memory which was actually making the call which is part.
In this case of my fault driver, that actually,
access that memory in a bad way, some kind of be way.