Code Golf of Death [closed]

Write some code that causes a BSOD or kernel panic!

Rules:

• On Windows, you must cause a BugCheck (Blue Screen of Death), on Linux (or other *nix systems) you must cause a kernel panic.
• Must not damage the system (i.e. it should work on reboot)
• Kernel-mode drivers are allowed.
• State your OS and version information.
• Explain how the crash is caused.
• It's not against the rules to use tools that are specifically designed to cause a crash, but doing so isn't very creative!
• @urogen - Last time I checked, putting 1/0 in a file called driver.c doesn't constitute a valid kernel-mode driver. Regardless, the winner is based on upvotes, not code length. – Polynomial Jun 7 '12 at 20:40
• I haven't been following Meta Code Golf lately - is "highest-upvoted" now allowed? (If this is the case, this website just got 100x more awesome!) – Ry- Jun 12 '12 at 3:55
• @minitech It's an objective criteria, so I don't see why it shouldn't be allowed. – Polynomial Jun 12 '12 at 7:40
• @Polynomial I've upvoted it and almost all of the answers, they're great and the community genuinely wish these sorts of challenges could be allowed, but that doesn't fit with the SE model. – cat Apr 29 '16 at 16:41
• I'm voting to close this question as off-topic because it requires malicious code, which violates our rules. meta.codegolf.stackexchange.com/a/4831/34718 – mbomb007 Sep 7 '16 at 20:45

Bash, x86 Linux 2.6.20 kernel

Warning: the following command may cause permanent damage to your system.

cat /dev/urandom > /dev/mem


Will output the following (try here). After this, the script hangs.

/var/root # cat /dev/urandom > /dev/mem
BUG: unable to handle kernel paging request at virtual address 474e82a5
printing eip:
c01450c4
*pde = 00000000
Oops: 0000 [#1]
CPU:    0
EIP:    0060:[<c01450c4>]    Not tainted VLI
EFLAGS: 00000082   (2.6.20 #12)
EIP is at free_block+0x54/0xf0
eax: 00000000   ebx: 474e82a1   ecx: c00745c8   edx: c0005e80
esi: c0070ce0   edi: c002c1a0   ebp: 00000000   esp: c0085eec
ds: 007b   es: 007b   ss: 0068
Stack: c0076410 00000002 c0051db0 c0051db0 c0051da0 00000002 c002c1a0 c01457dd
00000000 c0070ce0 c002c1a0 c0091840 c0145800 c0145870 00000000 00000000
c02cb2a0 c02cb2a0 00000296 c011dd27 c003fab0 c0094030 c009413c 00047e6c
Call Trace:
[<c01457dd>] drain_array+0x7d/0xa0
[<c0145800>] cache_reap+0x0/0x110
[<c0145870>] cache_reap+0x70/0x110
[<c011dd27>] run_workqueue+0x67/0x130
[<c010c7d0>] default_wake_function+0x0/0x10
[<c010c817>] __wake_up_common+0x37/0x70
[<c010c7d0>] default_wake_function+0x0/0x10
=======================
Code: 04 0f 8d 8f 00 00 00 8b 44 24 08 8b 0c a8 8d 91 00 00 00 40 c1 ea 0c c1 e2


Here is another exception found with the same command:

/dev # cat urandom > mem
------------[ cut here ]------------
Kernel BUG at c014514c [verbose debug info unavailable]
invalid opcode: 0000 [#1]
CPU:    0
EIP:    0060:[<c014514c>]    Not tainted VLI
EFLAGS: 00000046   (2.6.20 #12)
EIP is at free_block+0xdc/0xf0
eax: 1608347b   ebx: c009b010   ecx: c003f508   edx: c00057e0
esi: c009b000   edi: c002cd40   ebp: 00000000   esp: c0085eec
ds: 007b   es: 007b   ss: 0068
Stack: c009b010 00000004 c009b010 c009b010 c009b000 00000004 c002cd40 c01457dd
00000000 c02ddf20 c002cd40 c0091840 c0145800 c0145870 00000000 00000000
c02cb2a0 c02cb2a0 00000296 c011dd27 c005c5a0 c0094030 c009413c 000409ed

• I guess so. With great power comes great responsibility. – copy Jun 7 '12 at 19:26
• Violates the Must not damage the system requirement - if you run it enough times, it will eventually rewrite the disk driver with code that formats the disk. – ugoren Jun 7 '12 at 20:36
• @ugoren That is an extremely unlikely scenario. It would have to write a bunch of accurate 32 bit addresses and instructions at the right place and not overwrite others – copy Jun 7 '12 at 20:57
• " run it enough times, it will eventually rewrite the disk driver with code that formats the disk" - Not certain, urandom is pseudorandom. – skeevey Jun 8 '12 at 3:17
• @ugoren The "must not damage the system" rule is just to prevent answers like sudo rm -Rf /. The chances of causing permanent damage to the system using this method are less than the chances of, say, brute-forcing the output of a set of song lyrics based on the hash of the text. – Polynomial Jun 8 '12 at 10:02

C, 16 chars, for P5 x86

main=-926478352;


Remember the F00F bug everyone? I helped lock up a machine or two back in the day with this little program. (Yes, I've been golfing for that long.)

Granted, it's not quite what was asked for, and it only works on old steppings of the P5 Pentium chips. But in its favor, it's cross-platform, working on both Linux and Windows!

• It's malicious, Isn't it? – user54200 Jul 25 '16 at 8:56

QBASIC, 38 Characters

DEF SEG=0:FOR I=0 TO 4^8:POKE I,1:NEXT


Not sure how you would define a BSOD or Kernel panic in DOS, but this is probably pretty close. When run the screen just goes blank, and the machine responds to nothing, not even Ctrl+Alt+Delete. You have to restart with a hard reset or power cycle to get the machine going again. This is running on DOS 6.22 under VirtualBox. Not sure exactly why it causes the system to crash, but, basically the program is writing (POKE) to memory that it has no business writing to.

• The reason it crashes is because you're overwriting system program memory with junk. – Polynomial Jun 10 '12 at 18:07
• Yeah, I knew that, but I was thinking something a little more specific. I'm not even sure what part of memory it's writing to. – Kibbee Jun 10 '12 at 22:48
• You're overwriting the DOS interrupt vectors and COMMAND.COM program code stored in low memory addresses. Source: img.tfd.com/cde/MEMMAP.GIF – Polynomial Jun 11 '12 at 9:13

sh (in JSLinux)

Linux gives the init process special protection against signals. However, I noticed that in JSLinux, /sbin/init is a shell script that executes other binaries (most symlinked to /bin/busybox).

This "infinite" while loop restarts sh as necessary:

while /bin/true; do

setsid sh -c 'exec sh </dev/ttyS0 >/dev/ttyS0 2>&1'

done


However, what if /bin/true does not always return an exit code of 0? /bin is on the read-only root file system, yet Linux lets us change that using "bind" mounts:

cp -R /bin /tmp/boom
rm /tmp/boom/true
printf '#!/bin/sh\nexec [ \$PPID != 1 ]' > /tmp/boom/true
chmod 755 /tmp/boom/true
mount -o bind /tmp/boom /bin
killall -9 sh


And we get:

/var/root # ./boom.sh
Killed
Kernel panic - not syncing: Attempted to kill init!


Bash on Linux, 27 chars

echo c>/proc/sysrq-trigger


Or if you have sudo permissions:

echo c|sudo tee /proc/sysrq-trigger

• This results in sh: can't create /proc/sysrq-trigger: nonexistent directory for me. (though this is in jsLinux, so I should probably test on a real box) – Polynomial Jun 15 '12 at 10:28

GTB, 13 characters

Executed from a TI-84 calculator

:"+"→_[_+_→_]


If most of the RAM is free, it will crash with ERR:MEMORY

Otherwise, the calculator's RAM is so clogged that it turns off and clears it besides.

Great example of a "calculator virus"

• I see, this just puts +, ++, ++++, etc. in Str0. It gave me ERR:MEMORY, but trying to display Str0's value instantly crashed my 84+. Also, this made me lose all of my programs. – LegionMammal978 Oct 24 '15 at 10:57

Batch (Windows 98)

\con\con


This is actually a BSOD Easter Egg of Windows 98...

• yessssssssssss! – cat Apr 29 '16 at 12:30
:(){ :|:& };:


In bash shell,

I am not so sure if this counts here, but if you let it run long enough CPU overheats and system crashes, and it does reboots safely without harm, of course if you do it all the time there will be some system damage.

• This doesn't really work. It just spins the CPU at 100% usage, which is negated by any half-decent cooling system. I've ran Folding@Home for months at 100% CPU usage and never had the machine even stutter. – Polynomial Jun 8 '12 at 7:40
• Its a fork bomb – Prince John Wesley Jun 8 '12 at 16:03
• @Optimus You might as well leave it here - it's not a valid answer, but it's not doing any harm. I'd actually expect a Windows solution to be more difficult, since Linux allows you to break things if you really want to. – Polynomial Jun 10 '12 at 18:06
• @Polynomial I don't think that's true, Linux only better documents the ways you can break it. – ceased to turn counterclockwis Jun 16 '12 at 18:57
• @leftaroundabout I disagree. Windows is designed from the ground up to actively prevent you from damaging the system state from user-mode, and also stops you from modifying critical system files via Windows File Protection, locked system files, etc. Linux, on the other hand, is designed in a way that allows for maximum stability if you don't try to mess with it. But, if you do want to mess with it, you can. For example, I can modify /dev/mem or /dev/kmem as I wish from root. – Polynomial Jun 16 '12 at 19:44

Ruby (run as root), 36 or 40 chars (depending on matches for /p*/s*r)

See http://www.kernel.org/doc/Documentation/sysrq.txt and search for 'c' (including quotes!) to see why it works.

open(Dir['/p*/s*r'][0],?a){|f|f<<?c}


EDIT: Longer version that works if you have other things matching /p*/s*r

open('/proc/sysrq-trigger',?a){|f|f<<?c}


EDIT 2: Intentionally overkill.

get-process | stop-process -force


in powershell

• "It's not against the rules to use tools that are specifically designed to cause a crash, but doing so isn't very creative!" – John Dvorak Jan 3 '14 at 5:43

Linux bash

cat /dev/zero > /dev/mem


Clear the entire memory and cause a infinite kernel panic.

Try it here.

• How different is this from this? s/zero/urandom/. – NoOneIsHere Jun 9 '16 at 22:31
• @NoOneIsHere The kernel panic never stop with this version, and here the memory is cleared, not filled with random bytes. – TuxCrafting Jun 28 '16 at 18:07

Batch, 15 bytes

:A
start
goto A


Merely overflows the memory in linear time by starting up cmd.exe hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds and hundreds of times.

There's a deadlier (but probably non-competing) 24-byte program that starts up itself over and over again, thus overflowing the memory in logarithmic time (i.e upgrading your RAM doesn't delay the crash). Suppose the below code is located in C:\a.bat:

:A
start C:\a.bat
goto A


.

Honestly I'm afraid to try those out.

• Did anyone notice that the latter program is a fork bomb? – dorukayhan Jun 10 '16 at 2:28
• Yes, I did. :() { : | : & }; : – NoOneIsHere Jun 14 '16 at 21:07
• why not @0 instead of C:\a.bat? – Johannes Kuhn Jul 27 '17 at 20:16