hi m5home!
While attempting to monitor the behavior of a PoC test of mine (a file which calls NtOpenProcess and NtGetNextThread) I experienced a BAD_POOL_CALLER BSOD.
The problem occurred while having the "Process Create & Exit", "Thread Create & Exit", and "Get Process & Thread Handle" options checked.
Although I tried to reproduce the crash I did not experience another, even when 30 min trying slightly different
workflows (still with only the above options) of using the behavior monitor.
However, I noticed a small bug which might have lead to this issue:
Initially, the status was "Monitor All Processes", however, since I only wanted to monitor my executable I tried to use the "Add PID(s) By Name" button
after which the monitor stated that I need to switch to "Monitor Specified Processes" status.
When I did I could enter the executable name (running already) and start monitoring.
If I afterwards clicked on "Clear Current Settings" (monitor was turned off) it deleted the PID and reset the status to "Monitor All Processes".
Thereafter, I was still able to retrieve a PID by name and to enter it.
Say, the "Add PID(s) By Name" button was still enabled and worked, thus I had a program state which you
initially (when switching to the tab "Behavior Monitor") managed to avoid.
Then I could even turn on the monitoring and it monitored either the process or all processes what I can't say for certain.
Another issue I noticed, is that I never saw any process/thread create/exit notifications of my process, but maybe that is correct
and it works only if the process starts or exits other processes.
Below, I have inserted a basic bugcheck analysis of WinDbg.
Additionally, I can provide you with a 660 MB dump file if you require further informations.
Microwave89
While attempting to monitor the behavior of a PoC test of mine (a file which calls NtOpenProcess and NtGetNextThread) I experienced a BAD_POOL_CALLER BSOD.
The problem occurred while having the "Process Create & Exit", "Thread Create & Exit", and "Get Process & Thread Handle" options checked.
Although I tried to reproduce the crash I did not experience another, even when 30 min trying slightly different
workflows (still with only the above options) of using the behavior monitor.
However, I noticed a small bug which might have lead to this issue:
Initially, the status was "Monitor All Processes", however, since I only wanted to monitor my executable I tried to use the "Add PID(s) By Name" button
after which the monitor stated that I need to switch to "Monitor Specified Processes" status.
When I did I could enter the executable name (running already) and start monitoring.
If I afterwards clicked on "Clear Current Settings" (monitor was turned off) it deleted the PID and reset the status to "Monitor All Processes".
Thereafter, I was still able to retrieve a PID by name and to enter it.
Say, the "Add PID(s) By Name" button was still enabled and worked, thus I had a program state which you
initially (when switching to the tab "Behavior Monitor") managed to avoid.
Then I could even turn on the monitoring and it monitored either the process or all processes what I can't say for certain.
Another issue I noticed, is that I never saw any process/thread create/exit notifications of my process, but maybe that is correct
and it works only if the process starts or exits other processes.
Below, I have inserted a basic bugcheck analysis of WinDbg.
Additionally, I can provide you with a 660 MB dump file if you require further informations.
Code: Select all
Best RegardsMicrosoft (R) Windows Debugger Version 10.0.10240.9 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
No .natvis files found at C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\Visualizers.
Windows 10 Kernel Version 10240 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 10240.16463.amd64fre.th1.150819-1946
Machine Name:
Kernel base = 0xfffff802`4d28a000 PsLoadedModuleList = 0xfffff802`4d5af030
Debug session time: Sun Sep 13 17:30:29.408 2015 (UTC + 2:00)
System Uptime: 0 days 0:53:54.444
Loading Kernel Symbols
.............................................................Page 10fd7a not present in the dump file. Type ".hh dbgerr004" for details
..
................................................................
......................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00007ff7`5885f018). Type ".hh dbgerr001" for details
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {7, 1254, 7c91a280, ffffe0007c91a290}
*** ERROR: Module load completed but symbols could not be loaded for WIN64AST.sys
Page 11edae not present in the dump file. Type ".hh dbgerr004" for details
Probably caused by : WIN64AST.sys ( WIN64AST+60a3 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 0000000000001254, (reserved)
Arg3: 000000007c91a280, Memory contents of the pool block
Arg4: ffffe0007c91a290, Address of the block of pool being deallocated
Debugging Details:
------------------
Page 11edae not present in the dump file. Type ".hh dbgerr004" for details
SYSTEM_SKU: System SKU#
SYSTEM_VERSION: 1.0
BIOS_DATE: 02/06/12
BASEBOARD_PRODUCT: Mac-F42D86C8
BASEBOARD_VERSION: Proto
BUGCHECK_P1: 7
BUGCHECK_P2: 1254
BUGCHECK_P3: 7c91a280
BUGCHECK_P4: ffffe0007c91a290
POOL_ADDRESS: ffffe0007c91a290 Nonpaged pool
BUGCHECK_STR: 0xc2_7
CPU_COUNT: 2
CPU_MHZ: ae2
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 17
CPU_STEPPING: 6
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: rtsectiontest.
CURRENT_IRQL: 0
ANALYSIS_VERSION: 10.0.10240.9 amd64fre
LAST_CONTROL_TRANSFER: from fffff8024d4fdf05 to fffff8024d3d8240
STACK_TEXT:
ffffd000`74840878 fffff802`4d4fdf05 : 00000000`000000c2 00000000`00000007 00000000`00001254 00000000`7c91a280 : nt!KeBugCheckEx
ffffd000`74840880 fffff800`e56f60a3 : ffffc001`645e4c20 00000000`0000001b ffffe000`7deb6701 00000000`0000007f : nt!ExFreePool+0x23d
ffffd000`74840960 fffff800`e56fc758 : fffff800`00000110 00000000`00000000 ffffffff`80001054 ffffe000`7deb6780 : WIN64AST+0x60a3
ffffd000`748409e0 fffff802`4d743e87 : ffffe000`7deb6780 fffff802`4d5e7418 00000000`00000001 ffffe000`7defc080 : WIN64AST+0xc758
ffffd000`74840a20 fffff802`4d7445d8 : ffffe000`7defc660 ffffd000`74840bd9 00000000`00000000 00000000`00000001 : nt!PspExitProcess+0x18b
ffffd000`74840a70 fffff802`4d72b32a : 00000000`c000001c ffffd000`74840b01 00007ff7`5885d000 ffffe000`7deb6780 : nt!PspExitThread+0x5b8
ffffd000`74840b70 fffff802`4d3e2863 : 00000000`00000efb 00000000`00000001 ffffe000`7defc080 ffffd000`74840cc0 : nt!NtTerminateProcess+0x11a
ffffd000`74840c40 00007ff9`ddd137ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000033`2729f758 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`ddd137ba
STACK_COMMAND: kb
FOLLOWUP_IP:
WIN64AST+60a3
fffff800`e56f60a3 33d2 xor edx,edx
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: WIN64AST+60a3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: WIN64AST
IMAGE_NAME: WIN64AST.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 55bdb697
BUCKET_ID_FUNC_OFFSET: 60a3
FAILURE_BUCKET_ID: 0xc2_7_VRF_WIN64AST!Unknown_Function
BUCKET_ID: 0xc2_7_VRF_WIN64AST!Unknown_Function
PRIMARY_PROBLEM_CLASS: 0xc2_7_VRF_WIN64AST!Unknown_Function
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xc2_7_vrf_win64ast!unknown_function
FAILURE_ID_HASH: {41f2cb66-70d6-4d38-a999-0d77fd8164c7}
Followup: MachineOwner
---------
Microwave89
