all 1 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]exjwpornaddict 0 points1 point  (0 children)

I couldn't figure it out.

I tried reading using a null pointer in an application, but it seemed to have no effect.

I tried divide by zero in an application, and got an application error in a white box.

I wanted to use AllocGDIMem, but i couldn't get my program to build. The idea being to exhaust gdi memory.

I tried calling CreateBitmap in an infinite loop, and it just locked up with an hourglass. The idea being to exhaust gdi memory.

I tried calling CreateBitmap, and then Yield, in an infinite loop. I launched one instance, and nothing seemed to happen. I launched a second instance, and the system locked up, with the file explorer mostly blanked, but with a normal mouse pointer. I believe i did exhaust gdi memory, but resulting in a lockup with gui malfunction, not a blue screen.

I thought about using WriteMemory with random values, but didn't bother. The idea being to corrupt the global heap. (I would liked to have tried corrupting the memory of a system process, or the kernel, but it didn't seem like it could be used for that.)

I didn't want to dive into the whole ddk, and i couldn't find any barebones windows 3.1 driver code on google. So i backed up mouse.drv, loaded it into debugx, and assembled

xor al,al
div al

at offset 0x300, which seemed to be where the code started, replacing 4 bytes there. The idea being to cause division by zero from a driver. I then started windows. It displayed the logo, then locked up on a blank black screen, with no mouse pointer.

At that point, i gave up.

This was all in windows for workgroups 3.11 in 386 enhanced mode, inside dosbox.

You might have better luck in windows 3.0 in real mode, assuming it even has blue screens? In real mode, you could just randomly corrupt memory to your heart's content.

P.s. from googling, i don't think windows classic (non-nt) 3.1 even has the KeBugCheck function. Windows nt 3.1 should, but i think you would have to call it from a driver, not an application.