DOS game crashes XP

DOS game crashes XP

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
DOS game crashes XP nutso fasst 08-23-2006
---> Re: DOS game crashes XP Roger Abell [MV...08-24-2006
Posted by Roger Abell [MVP] on August 24, 2006, 9:32 am
If you were  Registered and logged in, you could reply and use other advanced thread options
You are running this as an admin account ?? and cannot do the same as a
limited user ??
I am just guessing that the vdm is making calls which XP only attempts to
fulfill because of the administrative rights letting it get hardware access
more directly than vdm is designed to support (Remember the vdm was written
back when video and other hardware was out in user mode, before the gdi etc
was moved into kernel mode in order to support the more performant needs of
DirectX - and, by the time of that change NT family was largely a corp OS
not home OS as XP caused, and in that environment it was very rare to see a
DOS app that used the vdm so there was probably near zero time put into it
post NT 3.5)


> Hello.
>
> A DOS game downloaded from
> http://www.reloaded.org/download/Castle-Wolfenstein/24/
>
> is able to completely lock up Windows XP running on a Duron system. The
> game
> loads, but runs in an extremely fast loop. There is no way to exit the
> game
> gracefully, so I press Alt + Enter to switch from fullscreen to Window
> mode.
> At this point my screen goes black and the keyboard is useless. I must do
> a
> hardware reset.
>
> How is this DOS game able to crash Windows XP?
>
> I found that if I launched the game at a very slow speed with Mo'Slo 4BIZ,
> I
> was able to use Alt + Enter, but instead of having the game appear FROZEN
> in
> a window, it was minimized. I could then close the game while minimized,
> but
> if I pressed Alt + Enter again, Windows locked up with black screen.
>
> Here's an oddity: With game minimized, I opened Task Manager. I saw a new
> process appear: wuauclt.exe. According to MS, this is the auto update
> process, but I don't have auto update enabled.
>
> How is this DOS game able to crash Windows XP? What would cause
> wuauclt.exe
> to suddenly run?
>
> thx,
> nf
>
>



Posted by nutso fasst on August 24, 2006, 1:24 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> You are running this as an admin account ?? and cannot do the same as a
> limited user ??

Same result in both cases.

> I am just guessing that the vdm is making calls which XP only attempts to
> fulfill because of the administrative rights letting it get hardware
access
> more directly than vdm is designed to support

DOS programs run in V-86 mode. A DOS program cannot directly access HW or
BIOS interrupts or use privileged instructions, no matter the rights of the
user. Any attempt to do so results in some kind of exception that is
serviced by the VDM. HW access, such as attempts to write to video board
registers, all go through the VDM's exception handling routines. A DOS
program "making calls" should not be able to lock up the entire operating
system no matter what those calls might be.

A while back I read of an exploit that, IIRC, relied on some kind of
callback routine in the VDM that allowed a DOS program to point a callback
routine - running in ring 0 with full privileges - to code within the DOS
program. In other words, hackers were not ignoring old DOS programs as a
potential means to gain control of a remote system. That hole into ring 0
was supposedly plugged by an update to the VDM. Could there be others?

Chances are that isn't the case with Castle Wolfenstein, even though the
program has apparently been patched (the exec is dated 2001 - wouldn't a
malicious hacker set the date back to 1983?). Perhaps there is some flaw in
the video driver or video chip on my system, such that a CGA register change
that should be benign is locking up the hardware because the video mode
isn't switching fast enough (thus, slowing the VDM with Mo'Slo allows the
switch). Nevertheless, it's conceivable the game could be trying to do some
badness.

> DOS app that used the vdm so there was probably near zero time put into it
> post NT 3.5)

Interesting...the NTVDM on my Win2K system is dated 2004, the one on my
fully-updated XP system is dated 2002. It must've been the W2K NTVDM that
had the security hole.

nf



Similar ThreadsPosted
MBSA safe against remote computers, no crashes? July 16, 2008, 10:00 am

The site map in XML format XML site map

Contact Us | Privacy Policy