Bad Drivers

One of the things that Microsoft did in engineering the Windows 8 kernel was to eliminate and mitigate entire categories of kernel-mode memory exploits, by hardening the implementation with various new checks and removing code that would swallow multiple exceptions. The upside of this is that the kernel is more tamper-resistant. The downside (or upside, depending on how you look at it) is that buggy drivers now cause immediate kernel panics as soon as an offending operation is performed.

In other words, leaky, exploitable in-kernel drivers from days of old now cause the system to blue screen immediately when they do something wrong. This is actually the correct behavior and should help new driver devs catch problems early, but it also means my mid-2009 13″ MacBook Pro (model 5,5) has been blue screening like crazy ever since I installed Boot Camp 4.

It also means that, when these bugchecks are happening on Windows 8, they aren’t necessarily happening on Windows 7, or Vista, or XP. These could be points for investigation, by people wanting to develop exploits on those systems, because they would know exactly where the driver is doing something wrong in kernel memory.

Anyway, I got down and dirty and took a look at the minidumps being generated by the Boot Camp Services. There’s no official support for Windows 8 from Apple yet, but having drivers that are buggy on Windows 7 but that don’t immediately error out is probably also not a great thing.

Apple, take note, your Hardware Abstraction Layer driver is buggy:


Loading Dump File [C:WindowsMinidump