windows3-7  Exercise 1: Decode Your Own Bugchecks
=================================================================

Verification: Level 1 (run on the author's machine, read-only, no administrator rights).

Prediction (work this out before running the script):

  Before running: write down what you expect parameter 1 to be for your own crash, and whether the two
  crashes (if you have two) will share it.

Command (bugcheck_decode.ps1 saved in the current folder; it decodes 0x13A. For a different stop code, read Microsoft's
page for that code and replace the table):

  .\bugcheck_decode.ps1

Output (real, from the author's machine on 2026-10-24; your numbers will differ):

  2026-10-19 15:38  BugcheckCode 314 decimal = 0x13A
    P1 0x11 = invalid internal state during the operation (possibly a double-free or heap corruption)
    P2 0xffff840729100140 = address of the heap that reported the corruption
    P3 0xffff8407770608e0 = address at which the corruption was detected
    P4 0x0 = reserved
  2026-10-24 17:02  BugcheckCode 314 decimal = 0x13A
    P1 0x11 = invalid internal state during the operation (possibly a double-free or heap corruption)
    P2 0xffffb00ee3100140 = address of the heap that reported the corruption
    P3 0xffffb00f1e44e350 = address at which the corruption was detected
    P4 0x0 = reserved

WHY THIS WORKS AS AN ANSWER
---------------------------
  Both bugchecks: BugcheckCode 314 decimal = 0x13A (KERNEL_MODE_HEAP_CORRUPTION). P1 = 0x11: Microsoft's text is
  "invalid internal state during the current operation. This can be the result of a double-free or heap
  corruption". P2 is the address of the heap that reported the corruption and P3 the address at which it was
  detected (both kernel addresses); P4 is reserved.
  Two things the event log cannot tell you: which driver or component owns that heap, and whether the code that
  was running at the crash caused it (Microsoft says "can be the result of", and heap corruption can be caused earlier).
  Common mistakes: looking up 314 instead of 0x13A; reading P2 and P3 as "the faulty driver's address" (they are
  addresses within kernel memory, and the owner is not named in the event); and treating two matching P1 values as proof of the same cause.