Tell me more ×
Programming Puzzles & Code Golf Stack Exchange is a question and answer site for programming puzzle enthusiasts and code golfers. It's 100% free, no registration required.
up vote 15 down vote favorite
3

Write some code that causes a BSOD or kernel panic!

Rules:

  • On Windows, you must cause a BugCheck (Blue Screen of Death), on Linux (or other *nix systems) you must cause a kernel panic.
  • Must not damage the system (i.e. it should work on reboot)
  • Kernel-mode drivers are allowed.
  • State your OS and version information.
  • Explain how the crash is caused.
  • It's not against the rules to use tools that are specifically designed to cause a crash, but doing so isn't very creative!
  • Highest upvotes wins.
share|improve this question
Kernel mode drivers are allowed? Doesn't it make 1/0 a valid answer? – ugoren Jun 7 '12 at 20:37
2  
@urogen - Last time I checked, putting 1/0 in a file called driver.c doesn't constitute a valid kernel-mode driver. Regardless, the winner is based on upvotes, not code length. – Polynomial Jun 7 '12 at 20:40
Trying to say that using kernel drivers makes it uninteresting. Every crash in a driver crashes the kernel, and writing code that crashes isn't a challenge for most of us. – ugoren Jun 8 '12 at 21:21
@ugoren - Sure, but a generic kernel driver crash won't get many upvotes, so it's unlikely to win. If you can make the system crash due to some strange or obscure trick in kernel-mode, that's likely to win you some votes. – Polynomial Jun 11 '12 at 9:15
I haven't been following Meta Code Golf lately - is "highest-upvoted" now allowed? (If this is the case, this website just got 100x more awesome!) – rynah Jun 12 '12 at 3:55
show 1 more comment

7 Answers

up vote 9 down vote

Bash, x86 Linux 2.6.20 kernel

cat /dev/urandom > /dev/mem

Will output the following (try here). After this, the script hangs.

/var/root # cat /dev/urandom > /dev/mem                                        
BUG: unable to handle kernel paging request at virtual address 474e82a5         
 printing eip:                                                                  
c01450c4                                                                        
*pde = 00000000                                                                 
Oops: 0000 [#1]                                                                 
CPU:    0                                                                       
EIP:    0060:[<c01450c4>]    Not tainted VLI                                    
EFLAGS: 00000082   (2.6.20 #12)                                                 
EIP is at free_block+0x54/0xf0                                                  
eax: 00000000   ebx: 474e82a1   ecx: c00745c8   edx: c0005e80                   
esi: c0070ce0   edi: c002c1a0   ebp: 00000000   esp: c0085eec                   
ds: 007b   es: 007b   ss: 0068                                                  
Process events/0 (pid: 3, ti=c0084000 task=c0094030 task.ti=c0084000)           
Stack: c0076410 00000002 c0051db0 c0051db0 c0051da0 00000002 c002c1a0 c01457dd  
       00000000 c0070ce0 c002c1a0 c0091840 c0145800 c0145870 00000000 00000000  
       c02cb2a0 c02cb2a0 00000296 c011dd27 c003fab0 c0094030 c009413c 00047e6c  
Call Trace:                                                                     
 [<c01457dd>] drain_array+0x7d/0xa0                                             
 [<c0145800>] cache_reap+0x0/0x110                                              
 [<c0145870>] cache_reap+0x70/0x110                                             
 [<c011dd27>] run_workqueue+0x67/0x130                                          
 [<c011df17>] worker_thread+0x127/0x140                                                                
 [<c010c7d0>] default_wake_function+0x0/0x10                                    
 [<c010c817>] __wake_up_common+0x37/0x70                                        
 [<c010c7d0>] default_wake_function+0x0/0x10                                    
 [<c011ddf0>] worker_thread+0x0/0x140                                           
 [<c0120d94>] kthread+0x94/0xc0                                                 
 [<c0120d00>] kthread+0x0/0xc0                                                  
 [<c0102ee7>] kernel_thread_helper+0x7/0x10                                     
 =======================                                                        
Code: 04 0f 8d 8f 00 00 00 8b 44 24 08 8b 0c a8 8d 91 00 00 00 40 c1 ea 0c c1 e2

Here is another exception found with the same command:

/dev # cat urandom > mem                                                        
------------[ cut here ]------------                                            
Kernel BUG at c014514c [verbose debug info unavailable]                         
invalid opcode: 0000 [#1]                                                       
CPU:    0                                                                       
EIP:    0060:[<c014514c>]    Not tainted VLI                                    
EFLAGS: 00000046   (2.6.20 #12)                                                 
EIP is at free_block+0xdc/0xf0                                                  
eax: 1608347b   ebx: c009b010   ecx: c003f508   edx: c00057e0                   
esi: c009b000   edi: c002cd40   ebp: 00000000   esp: c0085eec                   
ds: 007b   es: 007b   ss: 0068                                                  
Process events/0 (pid: 3, ti=c0084000 task=c0094030 task.ti=c0084000)           
Stack: c009b010 00000004 c009b010 c009b010 c009b000 00000004 c002cd40 c01457dd  
       00000000 c02ddf20 c002cd40 c0091840 c0145800 c0145870 00000000 00000000  
       c02cb2a0 c02cb2a0 00000296 c011dd27 c005c5a0 c0094030 c009413c 000409ed
share|improve this answer
4  
I guess so. With great power comes great responsibility. – copy Jun 7 '12 at 19:26
2  
Violates the Must not damage the system requirement - if you run it enough times, it will eventually rewrite the disk driver with code that formats the disk. – ugoren Jun 7 '12 at 20:36
2  
@ugoren That is an extremely unlikely scenario. It would have to write a bunch of accurate 32 bit addresses and instructions at the right place and not overwrite others – copy Jun 7 '12 at 20:57
5  
" run it enough times, it will eventually rewrite the disk driver with code that formats the disk" - Not certain, urandom is pseudorandom. – slackwear Jun 8 '12 at 3:17
3  
@ugoren The "must not damage the system" rule is just to prevent answers like sudo rm -Rf /. The chances of causing permanent damage to the system using this method are less than the chances of, say, brute-forcing the output of a set of song lyrics based on the hash of the text. – Polynomial Jun 8 '12 at 10:02
show 6 more comments
up vote 8 down vote

C, 16 chars, for P5 x86

main=-926478352;

Remember the F00F bug everyone? I helped lock up a machine or two back in the day with this little program. (Yes, I've been golfing for that long.)

Granted, it's not quite what was asked for, and it only works on old steppings of the P5 Pentium chips. But in its favor, it's cross-platform, working on both Linux and Windows!

share|improve this answer
up vote 4 down vote

QBASIC 38 Characters

DEF SEG=0:FOR I=0 TO 4^8:POKE I,1:NEXT

Not sure how you would define a BSOD or Kernel panic in DOS, but this is probably pretty close. When run the screen just goes blank, and the machine responds to nothing, not even Ctrl+Alt+Delete. You have to restart with a hard reset or power cycle to get the machine going again. This is running on DOS 6.22 under VirtualBox. Not sure exactly why it causes the system to crash, but, basically the program is writing (POKE) to memory that it has no business writing to.

share|improve this answer
The reason it crashes is because you're overwriting system program memory with junk. – Polynomial Jun 10 '12 at 18:07
Yeah, I knew that, but I was thinking something a little more specific. I'm not even sure what part of memory it's writing to. – Kibbee Jun 10 '12 at 22:48
You're overwriting the DOS interrupt vectors and COMMAND.COM program code stored in low memory addresses. Source: img.tfd.com/cde/MEMMAP.GIF – Polynomial Jun 11 '12 at 9:13
up vote 3 down vote

sh (in JSLinux)

Linux gives the init process special protection against signals. However, I noticed that in JSLinux, /sbin/init is a shell script that executes other binaries (most symlinked to /bin/busybox).

This "infinite" while loop restarts sh as necessary:

while /bin/true; do

  setsid sh -c 'exec sh </dev/ttyS0 >/dev/ttyS0 2>&1'

done

However, what if /bin/true does not always return an exit code of 0? /bin is on the read-only root file system, yet Linux lets us change that using "bind" mounts:

cp -R /bin /tmp/boom
rm /tmp/boom/true
printf '#!/bin/sh\nexec [ $PPID != 1 ]' > /tmp/boom/true
chmod 755 /tmp/boom/true
mount -o bind /tmp/boom /bin
killall -9 sh

And we get:

/var/root # ./boom.sh
Killed
Kernel panic - not syncing: Attempted to kill init!
share|improve this answer
up vote 1 down vote 
:(){ :|:& };:

In bash shell,

I am not so sure if this counts here, but if you let it run long enough CPU overheats and system crashes, and it does reboots safely without harm, of course if you do it all the time there will be some system damage.

share|improve this answer
3  
This doesn't really work. It just spins the CPU at 100% usage, which is negated by any half-decent cooling system. I've ran Folding@Home for months at 100% CPU usage and never had the machine even stutter. – Polynomial Jun 8 '12 at 7:40
3  
Its a fork bomb – Prince John Wesley Jun 8 '12 at 16:03
@Polynomial I really didn't knew what 'kernel panic' meant so should I remove my answer? (luckily I haven't seen one yet, but I only switched to linux an year back, I have seen a lot of BSODs almost 7-8 times a month on 'XP', less so often on '7' but still noticeable. I think the shortest solution would be a windows one) – Optimus Jun 9 '12 at 7:12
2  
@Optimus You might as well leave it here - it's not a valid answer, but it's not doing any harm. I'd actually expect a Windows solution to be more difficult, since Linux allows you to break things if you really want to. – Polynomial Jun 10 '12 at 18:06
1  
@Polynomial I don't think that's true, Linux only better documents the ways you can break it. – leftaroundabout Jun 16 '12 at 18:57
show 1 more comment
up vote 1 down vote

Ruby (run as root), 36 or 40 chars (depending on matches for /p*/s*r)

See http://www.kernel.org/doc/Documentation/sysrq.txt and search for 'c' (including quotes!) to see why it works.

open(Dir['/p*/s*r'][0],?a){|f|f<<?c}

EDIT: Longer version that works if you have other things matching /p*/s*r

open('/proc/sysrq-trigger',?a){|f|f<<?c}

EDIT 2: Intentionally overkill.

share|improve this answer
up vote 1 down vote

Bash on Linux, 27 chars

echo c>/proc/sysrq-trigger

Or if you have sudo permissions:

echo c|sudo tee /proc/sysrq-trigger
share|improve this answer
This results in sh: can't create /proc/sysrq-trigger: nonexistent directory for me. (though this is in jsLinux, so I should probably test on a real box) – Polynomial Jun 15 '12 at 10:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.