Posts

Showing posts with the label Stop 0x18

Debugging Stop 0x18 - REFERENCE_BY_POINTER

Image
I've found a new interesting bugcheck which is commonly related to objects and handles. Please note before reading, this a Minidump file, and some of the extensions which you would use may not work in this example, unless you have a Kernel Memory dump available. Objects are system resources and managed by a sub system called the Object Manager. There are a range of different objects, and here's the complete list: Process - The 'box' of virtual address space in which thread objects execute and are controlled. Thread - Executable object for a process. Job - A group of processes connected to one object (More Information here - Job Objects (Windows) ) Section - A area of shared memory. File - Opened file or I/O device. Token - Security privileges and properties for a process or thread. Event - Synchronization and notification mechanism. Semaphore - Synchronization mechanism which allows a certain number of threads access to a resource.  Mutex - Allows only one thr...