Skip to content

Instantly share code, notes, and snippets.

View 0xbadfca11's full-sized avatar
💭
I'm currently depressed.

0xbadfca11

💭
I'm currently depressed.
View GitHub Profile
@0xbadfca11
0xbadfca11 / .md
Created December 21, 2018 11:30
Windows ReFS bug

Summary

Windows Server 2016 ReFS driver crashes when trying to mount ReFS 3.4 that disguised ReFS 3.1.

Affect

  • Windows Server 2016
    Tested with KB4483229 applied

Not affect

  • Windows 10 v1809
  • Windows Server 2019

How to crash

  1. Boot from Install media of Windows 10 v1809.
@0xbadfca11
0xbadfca11 / .md
Last active February 13, 2025 09:35
Don't use GetImageConfigInformation

Don't use GetImageConfigInformation.

GetImageConfigInformation bug

GetImageConfigInformation is hard coded that the Image Config Directory is 64 bytes.
It will not work in most environments.
Don't use GetImageConfigInformation. This API is waste.

@0xbadfca11
0xbadfca11 / 0.md
Created March 19, 2024 11:12
Using FileExtd.lib with newer Windows SDK
  1. Add kernel32.lib to Ignore Specific Default Libraries.
    But don't remove kernel32.lib from Additional Dependencies.
  2. Set Additional Dependencies to fileextd.lib;ntdll.lib;%(AdditionalDependencies).
    Order is important. fileextd.lib must come before kernel32.lib.
  3. FileExtd.lib was not created with __declspec(dllimport) in mind. Need to take precautions against the _imp__ symbol.
    Do either.
    • #define WINBASEAPI before #include <windows.h>. Although this is easy, keep in mind that it affects the entire source file.
  • Override __imp__SetFileInformationByHandle@16 using assembly.
@0xbadfca11
0xbadfca11 / .md
Last active September 3, 2025 09:53
Windows ReFS bug

Summary

FSCTL_QUERY_FILE_REGIONS stuck on sparse file on ReFS(v2) with 64KB cluster size.

Affect

  • Windows Server 2025 (26100.3194)

Not affect

How to stuck

Do Format E: /FS:ReFS /A:64K /Q.
Run below code.