Adventures in application compatibility: The case of the jump into the middle of an instruction from nowhere - The Old New Thing
March 24th, 2023
A spike of Explorer crashes occurred with the release of a particular Windows Insider build. The crash looked like this:
explorer!SomeRandomInternalFunction+0x7d4:
00007ffe`27b00720 006639 add byte ptr [rsi+39h],ah ds:00000000`0000003a=??
This is most likely a nonsense instruction. There’s no obvious reason to be adding a partial upper register.
It looks like this is either a corrupted instruction pointer or corrupted code, because the first code byte is suspicious ...
Read more at devblogs.microsoft.com