Windows 10: VulnScan - Automated Triage & Root Cause Analysis of Memory Corruption

Brink · Oct 4, 2017

The Microsoft Security Response Center (MSRC) receives reports about potential vulnerabilities in our products and it’s the job of our engineering team to assess the severity, impact, and root cause of these issues. In practice, a significant proportion of these reports turn out to be memory corruption issues. In order to root cause these issues, an MSRC security engineer typically needs to analyze the crash and try to understand what went wrong. This workflow isn’t unique to externally reported vulnerabilities; vulnerabilities that are discovered internally through fuzzing and variant investigation are also typically memory corruption issues and these need to be triaged and assessed for exploitability too.

For these reasons, MSRC has made significant investments over the course of many years to build tooling that helps us automate the root cause analysis process. VulnScan is a tool designed and developed by MSRC to help security engineers and developers determine the vulnerability type and root cause of memory corruption bugs. It is built on top of two internally developed tools: Debugging Tools for Windows (WinDbg) and Time Travel Debugging (TTD).

WinDbg is Microsoft's Windows debugger that has recently received a user interface makeover to make it even easier to use. You can find more information about the new WinDbg Preview version here.

Time Travel Debugging is an internally developed framework that records and replays execution of Windows applications. This technology was released during CPPCon 2017.

By leveraging WinDbg and TTD, VulnScan is able to automatically deduce the root cause of the most common types of memory corruption issues. Application Verifier’s mechanism called PageHeap is used to trigger an access violation closer to the root cause of the issue. The analysis starts from the crash location and progresses towards the root cause. Classes of memory corruption issues supported by VulnScan:
Click to expand...

Read more: VulnScan - Automated Triage and Root Cause Analysis of Memory Corruption Issues Defense

:)

MattSmith623 · Oct 4, 2017

Unexpected Reboots if the PC is idle on Windows 10-.

Hi Likhitha,

The system blue screens with an error message of WHEA_UNCORRECTABLE_ERROR. Running the driver verifier showed that a VMWare driver (vmci.sys) was causing but after uninstalling VMWare I am still having the same issue.

The system is relatively new so I have regularly been installing new software.

I've been able to narrow down the issue slightly. It's only when the GPU is idle that the error occurs.

I've pasted the analysis of the latest minidump below.

Regards,

Matt

--MINI DUMP--

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

WHEA_UNCORRECTABLE_ERROR (124)

A fatal hardware error has occurred. Parameter 1 identifies the type of error

source that reported the error. Parameter 2 holds the address of the

WHEA_ERROR_RECORD structure that describes the error conditon.

Arguments:

Arg1: 0000000000000000, Machine Check Exception

Arg2: ffffe001c2724028, Address of the WHEA_ERROR_RECORD structure.

Arg3: 00000000f6000f40, High order 32-bits of the MCi_STATUS value.

Arg4: 0000000000040150, Low order 32-bits of the MCi_STATUS value.

Debugging Details:

------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

BUGCHECK_STR: 0x124_GenuineIntel

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: svchost.exe

CURRENT_IRQL: f

BAD_PAGES_DETECTED: add9

STACK_TEXT:

ffffd001`213d96f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx

STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: PAGE_NOT_ZERO

Followup: MachineOwner

---------

*** Memory manager detected 44505 instance(s) of page corruption, target is likely to have memory corruption.

Sameer Mokate · Oct 4, 2017

SrtTrail.txt - root cause>registry is corrupted

Log File: G:\Windows\System32\Logfiles\Srt\SrtTrail.txt

Whenever I type this in cmd then it opens a notepad showing lot of tests with 1 root cause and that is 'registry is corrupted' with 'repair failed'.

Please Help!

Windows 10: VulnScan - Automated Triage & Root Cause Analysis of Memory Corruption

VulnScan - Automated Triage & Root Cause Analysis of Memory Corruption

VulnScan - Automated Triage & Root Cause Analysis of Memory Corruption

VulnScan - Automated Triage & Root Cause Analysis of Memory Corruption - Similar Threads - VulnScan Automated Triage

Root cause of a crash

CD Playback Static in Windows 11 – but not in Linux – on AM5 Desktop – A Root Cause Analysis

CD Playback Static in Windows 11 – but not in Linux – on AM5 Desktop – A Root Cause Analysis

Please revisit: Corrupt Registry: Root Cause in Startup Repair.

Please revisit: Corrupt Registry: Root Cause in Startup Repair.

root cause of mdump

root cause of mdump

root cause of mdump

Root Cause Analysis - System Reboot - v1809 (Windows Server 2019)