Skip to content

Instantly share code, notes, and snippets.

@0xbadfca11

0xbadfca11/.md

Last active August 22, 2020 09:27
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save 0xbadfca11/189e52ad0613202a7d466a248147d62c to your computer and use it in GitHub Desktop.
Save 0xbadfca11/189e52ad0613202a7d466a248147d62c to your computer and use it in GitHub Desktop.
Download ZIP
Windows ReFS bug
Raw
.md

Summary

Windows ReFS driver crashes when enabling integrity streams of large file.

Affect

  • Windows Server 2012
  • Windows Server 2012 R2
  • Windows Server 2016 (with ReFS 1.2)
  • Windows 10 v1703 (with ReFS 1.2)

Not affect

  • Windows Server 2016 (with ReFS 3.1)
  • Windows 10 v1703 (with ReFS 3.2)

How to crash

D: is ReFS volume.
fsutil file setvaliddata requires Administrators privileges.
However, this is a limitation to call SetFileValidData() API, it has nothing to do with bugs.
If you dislike using Administrators privileges please write data for same size.
File size depends on available memory size. Increase file size if it does not occur.

PS C:\Windows\system32> fsutil file createnew D:\test.dat (1TB)
PS C:\Windows\system32> fsutil file setvaliddata D:\test.dat (1TB)
PS C:\Windows\system32> Set-FileIntegrity -FileName D:\test.dat -Enable $false
PS C:\Windows\system32> Set-FileIntegrity -FileName D:\test.dat -Enable $true

Only fsutil file createnew cannot reproduction. Because createnew makes all region of file is uninitialized state.

If fsutil file setvaliddata refuse ReFS volume (That's the older Windows fsutil), use vhdxtool instead.

PS C:\Windows\system32> vhdxtool create -f D:\test.vhdx -s (1TB)
PS C:\Windows\system32> Set-FileIntegrity -FileName D:\test.vhdx -Enable $false
PS C:\Windows\system32> Set-FileIntegrity -FileName D:\test.vhdx -Enable $true
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment