Bugcheck 0x139 v. 0x109

jcgriff2

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)
Staff member
Joined
Feb 19, 2012
Posts
21,541
Location
New Jersey Shore
Last edited:
Yeah, they're different. Granted, both involve kernel data corruption of some nature, but the actual type of data and the check used to inspect the integrity are different, with the 0x139 being newer checks implemented.

If anyone can correct me if I'm wrong, but I believe the newer checks stem from an attempt to prevent an application from trying to gain unauthorized kernel access and therefore run amok, using security checks on common procedures that attempt this (be they intended and therefore malicious, or unexpected). Malware particularly likes to use exception handling methods of Windows as a gateway into the kernel, and this security check stops that in its tracks often so that instead of the malicious code taking control during an exception as it normally would take place, the kernel just stops it all in its tracks and forces a bugcheck, with no permission to perform exception handling on it. This leaves the kernel being more paranoid and giving less chance for recovery on such faults, but personally from what I see reading what it checks for I don't believe there's any instance where a recovery can occur from such events, so it would be moot (and dangerous) to give a vain opportunity that would just lead to more security holes.

Think of a spy movie where the spy needs to get a device into like the security room of a high security environment but he can't just walk in and take it there. Instead he intentionally gets caught by the authorities, they frisk him and carry the seemingly innocent device to the room, where it'll do its work there. Wasn't there a Mission Impossible movie that did something like this? Anyways, something like that. These new security checks would be akin to having the authorities not take the device but instead destroy it right there on site and lock down everything to prevent further compromise.
 
Thank you for that great explanation.

So... a 0x109 = kernel has been corrupted or an attempt was made?

0x139 sounds like it has a few things in common with Driver Verifier.

Do you agree with my theory (posts actually) that kernel corruption at some level has occurred when "Unknown_Module"s are present in a dump v. a driver name?
 
In most cases I reckon these integrity checks are done after the fact, as in something as already gone in and fouled up the data, but when attempting to use the data again (be it execution, adding data to it, removing, etc.), the system does a check first to see if things are ok before continuing. Usually it gets fouled by not manipulating the data in a clean manner (like using alloc) and when something goes in to actually use it the way it was supposed too, the check gets triggered and the fault is raised. You'll have to examine the crashdump to see if the crash happened too late or not.

As for the Unknown_Module thing, could be. More likely scenario though is that the crashdump itself is corrupted or incomplete.
 
Was Kernel Patch Protection developed in response to "DLL Hell" -- or was DLL Hell pure usermode?

Asking as this was all before the time I learned Windows for the very 1st time under Vista.
 
Was Kernel Patch Protection developed in response to "DLL Hell" -- or was DLL Hell pure usermode?

Asking as this was all before the time I learned Windows for the very 1st time under Vista.

Not really. winsxs was introduced to deal with dll issues.

Dll hell was the problem of various redistributable usermode library .dll files (blocks of usermode code shared between multiple applications and often written by a third party, with Microsoft producing some of these libraries) being overwritten by different installers so the version in System32 kept on changing every time another installer was run, causing application instability. winsxs allowed all of these .dll files to co-exist.

But these files were really only .dll files which primarily came with application installers. They aren't really core OS files at all (even though some of these libraries would have come with the OS for Windows itself to use), and they certainly weren't kernel files.

So no, not really. KPP is literally just to prevent kernel files from being overwritten, not often third party, often not included with standard Windows, usermode library .dll files.

Richard
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top