35
\$\begingroup\$

Write some code that causes a BSOD or kernel panic!

Rules:

  • On Windows, you must cause a BugCheck (Blue Screen of Death), on Linux (or other *nix systems) you must cause a kernel panic.
  • Must not damage the system (i.e. it should work on reboot)
  • Kernel-mode drivers are allowed.
  • State your OS and version information.
  • Explain how the crash is caused.
  • It's not against the rules to use tools that are specifically designed to cause a crash, but doing so isn't very creative!
  • Highest upvotes wins.
Improve this question
\$\endgroup\$
24
  • 3
    \$\begingroup\$ @urogen - Last time I checked, putting 1/0 in a file called driver.c doesn't constitute a valid kernel-mode driver. Regardless, the winner is based on upvotes, not code length. \$\endgroup\$
    – Polynomial
    Commented Jun 7, 2012 at 20:40
  • 1
    \$\begingroup\$ I haven't been following Meta Code Golf lately - is "highest-upvoted" now allowed? (If this is the case, this website just got 100x more awesome!) \$\endgroup\$
    – Ry-
    Commented Jun 12, 2012 at 3:55
  • 1
    \$\begingroup\$ @minitech It's an objective criteria, so I don't see why it shouldn't be allowed. \$\endgroup\$
    – Polynomial
    Commented Jun 12, 2012 at 7:40
  • 2
    \$\begingroup\$ @Polynomial I've upvoted it and almost all of the answers, they're great and the community genuinely wish these sorts of challenges could be allowed, but that doesn't fit with the SE model. \$\endgroup\$
    – cat
    Commented Apr 29, 2016 at 16:41
  • 4
    \$\begingroup\$ I'm voting to close this question as off-topic because it requires malicious code, which violates our rules. meta.codegolf.stackexchange.com/a/4831/34718 \$\endgroup\$
    – mbomb007
    Commented Sep 7, 2016 at 20:45

12 Answers 12

Reset to default
26
\$\begingroup\$

Bash, x86 Linux 2.6.20 kernel

Warning: the following command may cause permanent damage to your system.

cat /dev/urandom > /dev/mem

Will output the following (try here). After this, the script hangs.

/var/root # cat /dev/urandom > /dev/mem                                        
BUG: unable to handle kernel paging request at virtual address 474e82a5         
 printing eip:                                                                  
c01450c4                                                                        
*pde = 00000000                                                                 
Oops: 0000 [#1]                                                                 
CPU:    0                                                                       
EIP:    0060:[<c01450c4>]    Not tainted VLI                                    
EFLAGS: 00000082   (2.6.20 #12)                                                 
EIP is at free_block+0x54/0xf0                                                  
eax: 00000000   ebx: 474e82a1   ecx: c00745c8   edx: c0005e80                   
esi: c0070ce0   edi: c002c1a0   ebp: 00000000   esp: c0085eec                   
ds: 007b   es: 007b   ss: 0068                                                  
Process events/0 (pid: 3, ti=c0084000 task=c0094030 task.ti=c0084000)           
Stack: c0076410 00000002 c0051db0 c0051db0 c0051da0 00000002 c002c1a0 c01457dd  
       00000000 c0070ce0 c002c1a0 c0091840 c0145800 c0145870 00000000 00000000  
       c02cb2a0 c02cb2a0 00000296 c011dd27 c003fab0 c0094030 c009413c 00047e6c  
Call Trace:                                                                     
 [<c01457dd>] drain_array+0x7d/0xa0                                             
 [<c0145800>] cache_reap+0x0/0x110                                              
 [<c0145870>] cache_reap+0x70/0x110                                             
 [<c011dd27>] run_workqueue+0x67/0x130                                          
 [<c011df17>] worker_thread+0x127/0x140                                                                
 [<c010c7d0>] default_wake_function+0x0/0x10                                    
 [<c010c817>] __wake_up_common+0x37/0x70                                        
 [<c010c7d0>] default_wake_function+0x0/0x10                                    
 [<c011ddf0>] worker_thread+0x0/0x140                                           
 [<c0120d94>] kthread+0x94/0xc0                                                 
 [<c0120d00>] kthread+0x0/0xc0                                                  
 [<c0102ee7>] kernel_thread_helper+0x7/0x10                                     
 =======================                                                        
Code: 04 0f 8d 8f 00 00 00 8b 44 24 08 8b 0c a8 8d 91 00 00 00 40 c1 ea 0c c1 e2

Here is another exception found with the same command:

/dev # cat urandom > mem                                                        
------------[ cut here ]------------                                            
Kernel BUG at c014514c [verbose debug info unavailable]                         
invalid opcode: 0000 [#1]                                                       
CPU:    0                                                                       
EIP:    0060:[<c014514c>]    Not tainted VLI                                    
EFLAGS: 00000046   (2.6.20 #12)                                                 
EIP is at free_block+0xdc/0xf0                                                  
eax: 1608347b   ebx: c009b010   ecx: c003f508   edx: c00057e0                   
esi: c009b000   edi: c002cd40   ebp: 00000000   esp: c0085eec                   
ds: 007b   es: 007b   ss: 0068                                                  
Process events/0 (pid: 3, ti=c0084000 task=c0094030 task.ti=c0084000)           
Stack: c009b010 00000004 c009b010 c009b010 c009b000 00000004 c002cd40 c01457dd  
       00000000 c02ddf20 c002cd40 c0091840 c0145800 c0145870 00000000 00000000  
       c02cb2a0 c02cb2a0 00000296 c011dd27 c005c5a0 c0094030 c009413c 000409ed
Improve this answer
\$\endgroup\$
14
  • 7
    \$\begingroup\$ I guess so. With great power comes great responsibility. \$\endgroup\$
    – copy
    Commented Jun 7, 2012 at 19:26
  • 15
    \$\begingroup\$ Violates the Must not damage the system requirement - if you run it enough times, it will eventually rewrite the disk driver with code that formats the disk. \$\endgroup\$
    – ugoren
    Commented Jun 7, 2012 at 20:36
  • 5
    \$\begingroup\$ @ugoren That is an extremely unlikely scenario. It would have to write a bunch of accurate 32 bit addresses and instructions at the right place and not overwrite others \$\endgroup\$
    – copy
    Commented Jun 7, 2012 at 20:57
  • 9
    \$\begingroup\$ " run it enough times, it will eventually rewrite the disk driver with code that formats the disk" - Not certain, urandom is pseudorandom. \$\endgroup\$
    – skeevey
    Commented Jun 8, 2012 at 3:17
  • 3
    \$\begingroup\$ @ugoren The "must not damage the system" rule is just to prevent answers like sudo rm -Rf /. The chances of causing permanent damage to the system using this method are less than the chances of, say, brute-forcing the output of a set of song lyrics based on the hash of the text. \$\endgroup\$
    – Polynomial
    Commented Jun 8, 2012 at 10:02
25
\$\begingroup\$

C, 16 chars, for P5 x86

main=-926478352;

Remember the F00F bug everyone? I helped lock up a machine or two back in the day with this little program. (Yes, I've been golfing for that long.)

Granted, it's not quite what was asked for, and it only works on old steppings of the P5 Pentium chips. But in its favor, it's cross-platform, working on both Linux and Windows!

Improve this answer
\$\endgroup\$
1
  • 2
    \$\begingroup\$ It's malicious, Isn't it? \$\endgroup\$
    – user54200
    Commented Jul 25, 2016 at 8:56
9
\$\begingroup\$

QBASIC, 38 Characters

DEF SEG=0:FOR I=0 TO 4^8:POKE I,1:NEXT

Not sure how you would define a BSOD or Kernel panic in DOS, but this is probably pretty close. When run the screen just goes blank, and the machine responds to nothing, not even Ctrl+Alt+Delete. You have to restart with a hard reset or power cycle to get the machine going again. This is running on DOS 6.22 under VirtualBox. Not sure exactly why it causes the system to crash, but, basically the program is writing (POKE) to memory that it has no business writing to.

Improve this answer
\$\endgroup\$
3
  • 2
    \$\begingroup\$ The reason it crashes is because you're overwriting system program memory with junk. \$\endgroup\$
    – Polynomial
    Commented Jun 10, 2012 at 18:07
  • \$\begingroup\$ Yeah, I knew that, but I was thinking something a little more specific. I'm not even sure what part of memory it's writing to. \$\endgroup\$
    – Kibbee
    Commented Jun 10, 2012 at 22:48
  • 1
    \$\begingroup\$ You're overwriting the DOS interrupt vectors and COMMAND.COM program code stored in low memory addresses. Source: img.tfd.com/cde/MEMMAP.GIF \$\endgroup\$
    – Polynomial
    Commented Jun 11, 2012 at 9:13
8
\$\begingroup\$

sh (in JSLinux)

Linux gives the init process special protection against signals. However, I noticed that in JSLinux, /sbin/init is a shell script that executes other binaries (most symlinked to /bin/busybox).

This "infinite" while loop restarts sh as necessary:

while /bin/true; do

  setsid sh -c 'exec sh </dev/ttyS0 >/dev/ttyS0 2>&1'

done

However, what if /bin/true does not always return an exit code of 0? /bin is on the read-only root file system, yet Linux lets us change that using "bind" mounts:

cp -R /bin /tmp/boom
rm /tmp/boom/true
printf '#!/bin/sh\nexec [ $PPID != 1 ]' > /tmp/boom/true
chmod 755 /tmp/boom/true
mount -o bind /tmp/boom /bin
killall -9 sh

And we get:

/var/root # ./boom.sh
Killed
Kernel panic - not syncing: Attempted to kill init!
Improve this answer
\$\endgroup\$
4
\$\begingroup\$

Bash on Linux, 27 chars

echo c>/proc/sysrq-trigger

Or if you have sudo permissions:

echo c|sudo tee /proc/sysrq-trigger
Improve this answer
\$\endgroup\$
1
  • 1
    \$\begingroup\$ This results in sh: can't create /proc/sysrq-trigger: nonexistent directory for me. (though this is in jsLinux, so I should probably test on a real box) \$\endgroup\$
    – Polynomial
    Commented Jun 15, 2012 at 10:28
4
\$\begingroup\$

GTB, 13 characters

Executed from a TI-84 calculator

:"+"→_[_+_→_]

If most of the RAM is free, it will crash with ERR:MEMORY

Otherwise, the calculator's RAM is so clogged that it turns off and clears it besides.

Great example of a "calculator virus"

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ I see, this just puts +, ++, ++++, etc. in Str0. It gave me ERR:MEMORY, but trying to display Str0's value instantly crashed my 84+. Also, this made me lose all of my programs. \$\endgroup\$
    – LegionMammal978
    Commented Oct 24, 2015 at 10:57
4
\$\begingroup\$

Batch (Windows 98)

\con\con

This is actually a BSOD Easter Egg of Windows 98...

Improve this answer
\$\endgroup\$
1
  • \$\begingroup\$ yessssssssssss! \$\endgroup\$
    – cat
    Commented Apr 29, 2016 at 12:30
2
\$\begingroup\$ 
:(){ :|:& };:

In bash shell,

I am not so sure if this counts here, but if you let it run long enough CPU overheats and system crashes, and it does reboots safely without harm, of course if you do it all the time there will be some system damage.

Improve this answer
\$\endgroup\$
8
  • 6
    \$\begingroup\$ This doesn't really work. It just spins the CPU at 100% usage, which is negated by any half-decent cooling system. I've ran Folding@Home for months at 100% CPU usage and never had the machine even stutter. \$\endgroup\$
    – Polynomial
    Commented Jun 8, 2012 at 7:40
  • 4
    \$\begingroup\$ Its a fork bomb \$\endgroup\$
    – Prince John Wesley
    Commented Jun 8, 2012 at 16:03
  • 2
    \$\begingroup\$ @Optimus You might as well leave it here - it's not a valid answer, but it's not doing any harm. I'd actually expect a Windows solution to be more difficult, since Linux allows you to break things if you really want to. \$\endgroup\$
    – Polynomial
    Commented Jun 10, 2012 at 18:06
  • 2
    \$\begingroup\$ @Polynomial I don't think that's true, Linux only better documents the ways you can break it. \$\endgroup\$
    – ceased to turn counterclockwis
    Commented Jun 16, 2012 at 18:57
  • 1
    \$\begingroup\$ @leftaroundabout I disagree. Windows is designed from the ground up to actively prevent you from damaging the system state from user-mode, and also stops you from modifying critical system files via Windows File Protection, locked system files, etc. Linux, on the other hand, is designed in a way that allows for maximum stability if you don't try to mess with it. But, if you do want to mess with it, you can. For example, I can modify /dev/mem or /dev/kmem as I wish from root. \$\endgroup\$
    – Polynomial
    Commented Jun 16, 2012 at 19:44
2
\$\begingroup\$

Ruby (run as root), 36 or 40 chars (depending on matches for /p*/s*r)

See http://www.kernel.org/doc/Documentation/sysrq.txt and search for 'c' (including quotes!) to see why it works.

open(Dir['/p*/s*r'][0],?a){|f|f<<?c}

EDIT: Longer version that works if you have other things matching /p*/s*r

open('/proc/sysrq-trigger',?a){|f|f<<?c}

EDIT 2: Intentionally overkill.

Improve this answer
\$\endgroup\$
2
\$\begingroup\$ 
get-process | stop-process -force

in powershell

Improve this answer
\$\endgroup\$
1
  • 1
    \$\begingroup\$ "It's not against the rules to use tools that are specifically designed to cause a crash, but doing so isn't very creative!" \$\endgroup\$
    – John Dvorak
    Commented Jan 3, 2014 at 5:43
1
\$\begingroup\$

Linux bash

cat /dev/zero > /dev/mem

Clear the entire memory and cause a infinite kernel panic.

Try it here.

Improve this answer
\$\endgroup\$
2
  • \$\begingroup\$ How different is this from this? s/zero/urandom/. \$\endgroup\$
    – NoOneIsHere
    Commented Jun 9, 2016 at 22:31
  • \$\begingroup\$ @NoOneIsHere The kernel panic never stop with this version, and here the memory is cleared, not filled with random bytes. \$\endgroup\$
    – TuxCrafting
    Commented Jun 28, 2016 at 18:07
0
\$\begingroup\$

Batch, 15 bytes

:A
start
goto A

Merely overflows the memory in linear time by starting up cmd.exe hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds of times.

There's a deadlier (but probably non-competing) 24-byte program that starts up itself over and over again, thus overflowing the memory in logarithmic time (i.e upgrading your RAM doesn't delay the crash). Suppose the below code is located in C:\a.bat:

:A
start C:\a.bat
goto A

.

Honestly I'm afraid to try those out.

Improve this answer
\$\endgroup\$
3
  • \$\begingroup\$ Did anyone notice that the latter program is a fork bomb? \$\endgroup\$
    – SE is dead
    Commented Jun 10, 2016 at 2:28
  • \$\begingroup\$ Yes, I did. :() { : | : & }; : \$\endgroup\$
    – NoOneIsHere
    Commented Jun 14, 2016 at 21:07
  • \$\begingroup\$ why not @0 instead of C:\a.bat? \$\endgroup\$
    – Johannes Kuhn
    Commented Jul 27, 2017 at 20:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.