Thursday 29 August 2013

Segmentation Faults

A user at Sysnative Forums, asked a interesting question, and in my attempt to answer the question. I also started to learn myself some information about misaligned pointers and segmentation faults (also known as access violations and bus errors).

The thread can be found here - Misaligned IP - Sysnative Forums

A posted a few links related to the question in my two posts answering that question.

"A segmentation fault (often shortened to segfault), bus error, or access violation is generally an attempt to access memory that the CPU cannot physically address. It occurs when the hardware notifies an operating system about a memory access violation."

All the links to information about the specifics of misaligned pointers can be found in the thread.

The main reason for this blog post, is because I think I've managed to relate a potentially bad CPU to Access Violation error within this dump file.


The second parameter is the address of the exception record, and the third parameter contains the address of the context record. It's important to note that segmentation faults are usually caused by drivers and in rare cases is it really a hardware issue.

Notice the random b at the beginning of the address for the rcx register? This indicates a flipped bit which is usually related to a CPU, PSU or motherboard error.

Using the .formats command on the rcx register and rbx register, we can get the binary representation of the address, and therefore see which a bit has been flipped. In fact, in a earlier dump file, there was also a flipped bit within the exact same register.


There seems to be random 0 within the rcx register, whereas, this isn't present within the normal rbx register.

As I've said in other blog posts, access violation errors are usually a result of a invalid memory address being referenced, this may be slightly true here too. A program or driver has referenced a memory address, which the CPU isn't physically able to translate into a physical memory address.

I'll continue to read and learn about misaligned pointers.



No comments:

Post a Comment