Microsoft needs to remove GUI from kernel: BSOD with WinForms after KB5034848

Microsoft needs to remove GUI from kernel: BSOD with WinForms after KB5034848(gist.github.com)

7 points by Nevor 2 years ago | 7 comments

afrisch 2 years ago |

It's crazy a such a simple script, which is actually the same as 6 years ago, can produce a BSOD in a deterministic way with the latest update of Windows. And nobody at MS seems to care about it.

nullindividual 2 years ago | |

It's actually been fixed. I didn't, and neither did OP, read far enough through the SO thread linked in the GitHub issue.

Fix was previously included in https://support.microsoft.com/en-us/topic/june-27-2017-kb402....

> Addressed issue (Error 0x7F) with Windows Forms (WinForms) that causes the system to crash after upgrading to the Creators Update.

afrisch 2 years ago | | |

It has been fixed but a similar problem (with the same repro case) reappeared with a recent Windows update, only now when closing the popup.

nullindividual 2 years ago |

No, no they don't. They already tried that with NT4. It went badly for anyone wanting decent graphics performance.

afrisch 2 years ago | |

So at least they should really work hard to not let a BSOD happen in case of excessive nesting of widgets. The repro case is actually the same than the one for a bug which was fixed 6 years ago, and it is straightforward (just nest enough panels in a modal popup, and close it). It's hard to understand how this could not be caught by a non regression test.

nullindividual 2 years ago | | |

45 nested WinForms is bizarre. I think you'd melt a UX designer's eyeballs. It's possible that Microsoft sees this as low impact (small user base), or is too complex to fix, or too high risk to fix.

You could create an interesting payload with this, especially given it can be done via PoSh.

Get payload on machine -> enable Full memory dumps -> execute payload/BSOD -> upon recovery, exfiltrate memory dump.

Secrets galore.