[PATCH v2 2/6] ntoskrnl.exe/tests: Add tests with and without report IDs.

[Zebediah Figura (she/her)]

On 6/15/21 11:29 AM, Rémi Bernon wrote:
> On 6/14/21 9:26 AM, Marvin wrote:
>> === w864 (64 bit report) ===
>>
>> Report validation errors:
>> ntoskrnl.exe:ntoskrnl crashed (c0000374)
>>
> 
> FWIW this is crashing there:
> 
>       ret = CertCloseStore(ctx->root_store, CERT_CLOSE_STORE_CHECK_FLAG);
> 
> But I have absolutely no idea why. Somehow the certificate store got
> corrupted? It's not related to the patches, but it doesn't crash all the
> time.
> 

It seems it's been happening for a while now. Probably something's wrong 
with the cert code in the test. Unfortunately I haven't been able to 
find any errors from manual reëxamination, and I'm not sure how else to 
proceed.

Does anyone know of a memory checker that can be used on Windows? It may 
be tricky to use it while avoiding looking at crypt32 internals, but 
it's at least worth a try...