Nick Kuo
Session Space
When debugging Windows kernels, sometimes you see addresses that “looks” like kernel space memory. It begins with 0xffff, resides within module presen
read more0x19C.50 Stx S3S4Restart
- Nick Kuo
- BSOD Analysis
- 21 Feb, 2024
6: kd> .bugcheck Bugcheck code 0000019C Arguments 00000000`00000050 ffff800b`a18fa380 00000000`00000000 00000000`000000006: kd> .thread
read more0x9F.3 Strix Stress ACP
- Nick Kuo
- BSOD Analysis
- 04 Mar, 2024
6: kd> .bugcheck Bugcheck code 0000009F Arguments 00000000`00000003 ffff948f`e9be4060 ffffe381`3d0ef040 ffff948f`ee90eba06: kd> !addrMap
read more0x19C.50 Stx S4 Resume Video Playing
- Nick Kuo
- BSOD Analysis
- 21 Feb, 2024
5: kd> .bugcheck Bugcheck code 0000019C Arguments 00000000`00000050 ffff808e`23621380 00000000`00000000 00000000`000000005: kd> !thread
read more0x133.1 3xW6400 PBR
- Nick Kuo
- BSOD Analysis
- 30 Mar, 2024
0: kd> .bugcheck Bugcheck code 00000133 Arguments 00000000`00000001 00000000`00001e00 fffff807`0a91c340 00000000`000000000: kd> !corelis
read more!pte "Levels not implemented for this platform"
!pte command comes from extension kdexts.dll, which is bundled with debuggers for Windows package. The command performs machine type check with t
read more0x9F.3 Strix S4
- Nick Kuo
- BSOD Analysis
- 22 Jul, 2024
5: kd> .bugcheck Bugcheck code 0000009F Arguments 00000000`00000003 ffff800f`943e4360 ffffc906`fbaa7178 ffff800f`a4a6c7505: kd> !irp ffff
read moreRecursively Debug User-Mode Child Process
When you enable “debug child process” in WinDbg, it only attempts to debug the children. 0:000> sxe -c ".childdbg 1;bu wlanapi!WlanQueryInterfac
read moreRundown Protection
Acquire with nt!ExAcquireRundownProtection. 0: kd> uf fffff802`148c8d80 nt!ExAcquireRundownProtection [minkernel\ntos\ex\rundown.c @ 333]: 3
read morestd::shared_mutex Usage and Characteristics
- Nick Kuo
- Programming
- 28 Dec, 2023
std::shared_mutex is a reader contention aware lock. When exclusive access is pending due to existing shared access, No more shared access can be
read more0x50 AcpBt EBox Plug In
- Nick Kuo
- BSOD Analysis
- 14 Nov, 2024
Issue Description Repro step:Boot system without EBOX connected normally connect EBOX with RTX3060 Wait 5s System BSODIssue CND if
read morePower IRP Source
All Windows drivers / component / internally dispatch Power IRP with the routine. 0: kd> dt nt!PoRequestPowerIrp PoRequestPowerIrp long ( _D
read more0x0 Live AcpWdfWorkItem Leak
- Nick Kuo
- BSOD Analysis
- 14 Nov, 2024
Customer observed higher memory usage after using Edge to play music overnight. Captured live dump after playing music for a while. 0: kd> !p
read more0x0 Live Lid Close Open Screen Dim
- Nick Kuo
- BSOD Analysis
- 13 Dec, 2024
Symptom The display dims automatically 5s after lid close → open. Issue occurs only on SKUs with ToF sensor (HPD). Display Connect a live syste
read more0x19C.50 Lid
- Nick Kuo
- BSOD Analysis
- 25 Dec, 2024
2: kd> .bugcheck Bugcheck code 0000019C Arguments 00000000`00000050 ffffbf87`de64a3c0 00000000`00000000 00000000`000000002: kd> !thread
read moreBlock Linux driver with PCI Device ID
1. Find the device ID to blacklist nick@swae-ws:~$ lspci | grep VGA 43:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI]
read more0x9F.3 Gfx Stuck Cause Acp PoIrp Timeout
- Nick Kuo
- BSOD Analysis
- 06 Feb, 2025
5: kd> .bugcheck Bugcheck code 0000009F Arguments 00000000`00000003 ffffcf07`04d3caf0 ffffcd04`6bb4f010 ffffcf07`0dec88a0 9: kd> k # Child-SP
read more0x19C.50 WuReject PostT7Delay
- Nick Kuo
- BSOD Analysis
- 05 Mar, 2025
In dce110_edp_backlight_control, we request a wait of "post_T7_delay". This wait was n
read moreWinDbg System Uptime
Trace print code of “System Uptime” unicode string. 0:007> !for_each_module s-u @#Base @#End "System Uptime" 00007ffe`d8ec8e30 0053 0079 0073
read moreNT Wait Times
NT Wait Time OS store shared data as nt!_KUSER_SHARED_DATA . It is always mapped to 0xfffff78000000000 in all process. It is done through page t
read moreSelf-Signed WHQL Certificate for Testing
Root Certificate $params = @{ Type = 'Custom' SerialNumber = '28cc3a25bfba44ac449a9b586b4339aa' KeyAlgorithm = 'RSA' HashAlgo
read more0x133.0 NPU Line Interrupt
- Nick Kuo
- BSOD Analysis
- 31 Mar, 2025
The BSOD sequence of event looks like this:OS is starting up NPU device.Something w
read moreWhen entering S3/S4, GFX receives D0 request
What is the D0? Set BP on our handler, and filter by cond BP for set power state 12: kd> bl 0 e Disable Clear fffff802`7b359020 000
read more