Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rcedit --set-icon triggers BSOD (Blue Screen of Death) #99

Open
giladreich opened this issue Jul 11, 2020 · 0 comments
Open

rcedit --set-icon triggers BSOD (Blue Screen of Death) #99

giladreich opened this issue Jul 11, 2020 · 0 comments

Comments

@giladreich
Copy link

Environment:

  • Windows 10 (Version 2004 build 19041.329)
  • Latest release + also tried using a binary compiled from source.

Description:
I'm not sure if it has something to do with Qt generated installers using Qt's IFW, but I can definitely confirm this happened to me multiple times after trying to use the --set-icon command:
rcedit installer.exe --set-icon "path"

I even ran into the same issue trying to run this command on a Windows Sandbox, resulting to completely crashing the VM.

To reproduce this, you can use the exact sample binary I used that triggered this issue from here:
https://github.com/giladreich/QuickCut/actions/runs/165701757

and download one of the Setup samples.

BSOD Dump:

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffe3007ffc1002, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8046c768898, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

-----------------------------------------------------
TRAP_FRAME:  ffffe20110c5e890 -- (.trap 0xffffe20110c5e890)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000c0000225 rbx=0000000000000000 rcx=ffffe3007ffc1000
rdx=0000000000000127 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8046c768898 rsp=ffffe20110c5ea20 rbp=ffffe20110c5eb20
 r8=ffffe3006828a196  r9=000000000000000e r10=00000000ffffffff
r11=0000000000000100 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac pe cy
ahcache!AslpFileQueryVersionString+0x198:
fffff804`6c768898 0fb74102        movzx   eax,word ptr [rcx+2] ds:ffffe300`7ffc1002=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80462e35ecd to fffff80462ddda20

STACK_TEXT:  
ffffe201`10c5e5e8 fffff804`62e35ecd : 00000000`00000050 ffffe300`7ffc1002 00000000`00000000 ffffe201`10c5e890 : nt!KeBugCheckEx
ffffe201`10c5e5f0 fffff804`62c12ce0 : 00000000`00000100 00000000`00000000 ffffe201`10c5e910 00000000`00000000 : nt!MiSystemFault+0x1ad79d
ffffe201`10c5e6f0 fffff804`62debb1e : ffffe300`50e00100 fffff804`62c40a72 ffffe300`50e00340 0000006e`006f00ff : nt!MmAccessFault+0x400
ffffe201`10c5e890 fffff804`6c768898 : ffffe300`682901e0 00000000`00000000 ffffe201`10c5ea58 ffffe201`10c5ea50 : nt!KiPageFault+0x35e
ffffe201`10c5ea20 fffff804`6c7685f7 : ffffe300`58b24850 ffffe300`6dcdcb70 ffffe201`10c5ec70 ffffe201`10c5ec68 : ahcache!AslpFileQueryVersionString+0x198
ffffe201`10c5ebe0 fffff804`6c7684fb : ffffe300`6dcdcb70 00000000`00000005 ffffe300`7ffafdc0 00000000`00000020 : ahcache!AslpFileMakeStringVersionAttributes+0xcb
ffffe201`10c5ec60 fffff804`6c768209 : 00007df4`c67d60da 00000000`00000400 ffffe300`7ffafce0 ffffe300`7ffafd08 : ahcache!AslpFileGetVersionAttributes+0x43
ffffe201`10c5eca0 fffff804`6c7672a2 : 00007df4`c67d60da 00000000`00000016 00000000`0003f474 fffff804`6c766be0 : ahcache!AslFileAllocAndGetAttributes+0xe9
ffffe201`10c5ed00 fffff804`6c765dd3 : ffffe201`10c5edf0 ffffe300`5e1f9bf0 ffffe300`59ee8a20 fffff804`6c76792d : ahcache!SdbpCheckAllAttributes+0x502
ffffe201`10c5edc0 fffff804`6c7677e8 : ffffe201`10c5ee90 ffffe300`5e1f9bf0 ffffe300`59ee8a20 ffffe201`10c5f120 : ahcache!SdbpCheckMatchingFiles+0xa3
ffffe201`10c5ee50 fffff804`6c7667d3 : ffffe201`10c5ef58 00000000`00000000 ffffe201`10c5f120 ffffe300`59ee8a20 : ahcache!SdbpMatchList+0x2a8
ffffe201`10c5eed0 fffff804`6c7666d6 : ffffe300`59ee8a20 00000000`0003f424 ffffe201`10c5f120 00000000`00000000 : ahcache!SdbpCheckForMatch+0x77
ffffe201`10c5ef40 fffff804`6c7664b4 : ffffe300`59ee8a20 ffffe201`10c5f010 00000000`00000002 00000000`00000000 : ahcache!SdbpCheckExe+0x42
ffffe201`10c5ef90 fffff804`6c76001a : ffffe300`5e1f9bf0 00000000`00000000 ffffe201`00000000 ffffe201`10c5f120 : ahcache!SdbpSearchDB+0xe4
ffffe201`10c5f050 fffff804`6c75f853 : ffffe300`68710d90 00000000`00000000 ffffe300`68710d90 ffffe300`80a13a10 : ahcache!SdbGetMatchingExeEx+0x25e
ffffe201`10c5f250 fffff804`6c76bd1b : ffffe300`68710d90 ffffe201`10c5f479 00000000`00000000 ffffe300`68710d90 : ahcache!AhcpSdbQueryLookupExe+0x9f
ffffe201`10c5f2c0 fffff804`6c760d24 : 00000000`00000000 ffffe300`5cfbfc80 00000000`00000001 00000000`00000000 : ahcache!AhcSdbQueryLookup+0x15f
ffffe201`10c5f3c0 fffff804`6c7623da : ffffe201`10c5f528 00000000`00000000 ffffe300`51ef4700 00000000`00000000 : ahcache!AhcpCacheBuildSdbInfo+0x1fc
ffffe201`10c5f4c0 fffff804`6c761881 : ffffe201`10c5f680 ffffe300`51744c10 ffffe300`51ef4700 ffffe201`10c5f670 : ahcache!AhcCacheLookup+0x94a
ffffe201`10c5f610 fffff804`6c764358 : 00000000`06dadf00 ffffe201`10c5f999 ffffffff`800032f4 00000000`00000000 : ahcache!AhcApiLookup+0xe1
ffffe201`10c5f6e0 fffff804`6c7640d1 : ffffce86`98402a20 00000000`00001000 00000000`06dadd90 00000000`00220003 : ahcache!AhcDispatch+0x258
ffffe201`10c5f8d0 fffff804`62c46d25 : ffffce86`98402a20 00000000`00000000 00000000`00000000 ffffe201`10c5f9c0 : ahcache!AhcDriverDispatchDeviceControl+0x41
ffffe201`10c5f910 fffff804`630de450 : 00000000`00000001 ffffce86`9507a240 ffffce86`9507a240 ffffce86`9257c080 : nt!IofCallDriver+0x55
ffffe201`10c5f950 fffff804`62def375 : ffffce86`9257c080 00000000`00001000 00000000`00000000 00000000`00000000 : nt!NtApphelpCacheControl+0xf0
ffffe201`10c5fa00 00007ffa`1b90b714 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`06dadd38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`1b90b714
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant