Windows crashes involving kernel code are easy to misdiagnose. AV, EDR, EPP are often affected. It's natural to blame the most recent addition, but it's not always that simple. A bad driver can silently suck until *anything else* is introduced. Then, kaboom.

Keith

@kwm

Windows crashes involving kernel code are easy to misdiagnose. AV, EDR, EPP are often affected.

It's natural to blame the most recent addition, but it's not always that simple. A bad driver can silently suck until *anything else* is introduced. Then, kaboom.

4/4/2018, 11:17:23 AM

Favs: 2

Retweets: 0

link

Keith

@kwm

Helpful resources for troubleshooting and/or debugging crashes involving minifilter drivers:

Minifilter Diagnostics: https://docs.microsoft.com/en-us/windows-hardware/test/assessments/minifilter-diagnostics

Debugging:

1. Generate a memory dump: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/enabling-a-kernel-mode-dump-file

2. WinDbg :)

4/4/2018, 11:23:39 AM

Favs: 3

Retweets: 1

link