How Microsoft's New CrowdStrike BSOD Recovery Tool Works

28 thoughts on “How Microsoft's New CrowdStrike BSOD Recovery Tool Works”

• The fact that any static analyzer can pick up dereference of a random pointer, and yet it was doing that in a kernel module is concerning.

• 0:03 …the BSOD day—from CrowdStrike—and their famous update…

  Instead, try, "…their infamous update." As we all know, from The Three Amigos (1986), infamous¹ means "more than famous". ¯_(ツ)_/¯

  (1) Actually… in•fa•mous /ˈinfəməs/ adjective → well known for some bad quality or deed; wicked; abominable.
  From the Latin, infamis → Medieval Latin, infamosus → late Middle English, infamous.

• Thio sir, do you know how to remove any Government logo or splash screen from the boot screen in windows 10. I got a old Government PC. Hp Elite Desk 705 G3 SFF. But I am unable to remove the image as it was verry annoying. Please help me if you can or just make a video on this topic. Thank you.

• If the option to repair the Windows boot falure is a file that shall be deleted,and bitlocker is not active, just use a live cd to delete it. I recomend to have a Hirens Boot CD PE and a windows installation media ready to fix such issues.

• So Great!

• Best presentation I have seen on Crowdstrike.

• Hi Buddy, do u still make fake vids??😂😂😂😂

  Anyhow,use to watch your vids long ago. Came back today to check if the channel is still active. I m amazed by how active you r even after so many years…..

  Theo Joe Supremacy…

• what if you delete $AV_ASW and $WinREAgent?

• Your Crowdstrike video file was a corrupted file filled with zeroes? Damn that's just poetic

• 0:29 voice crack lol

• This thing is like:'How to recover your pc from crowd strike'
  Step-1: Log in to your computer

  And I'm stuck at step 1

• 👍🏿👊🏿

• CROWDSTRIKE ISSUE:
  USA = Panic and destruction
  UK = Ugh?

• Unchecked and non validated kernel supporting file, that’s all you need to know. The fact that this beta file got through to feed its parent .dll file is the embarrassing side. The initial blame falls with CrowdStrike but Microsoft validates too and the EU allowed 3rd parties to run in kernel mode in the first place. That’s the true price of “allowing” competition, a weakened MS operating system. I’m sure Apple will use this as ammo (as it should) in future cases to protect its own OS system.

• The problem with that new tool is that it requires the admin credentials, so the IT people still need physical access to the computer. It might make their job faster, but in most cases, the biggest delay was to get the IT on site. They should make a recovery tool that can only reverse updates that are causing bugs without needing any credentials.

• My take on that one viral tweet is that while it does appear to be some kind of null-pointer ultimately triggering the crash, that was just the inevitable result of some underlying (and more interesting!) root cause. As noted, the value being dereferenced is not strictly zero but appear to have been offset from zero, which is typical of accessing static elements of a class object (in this case having a base pointer of zero).

• So Microsoft cobbled together some window dressing (ugh! pun) to pretend that they are doing something.

• you can disable internet in one click literally. so scary

• this airline cancelation due to W.E.F., BLACKROCK, & MICROSOFT IS A DRY RUN TERRORIST CYBER ATTACK…PLANNED GLOBALLY TO USHER IN DIGITAL PRISON, CURRENCY, ID, PASSPORTS, SURVEILLANCE BY A.I. TECHOCRACY 🔥🔥🔥LIKE CCP CHINA'S CONTROL ON PEOPLE🔥🔥

• So from a BSOD state how do you download said Windoze fix?

• Same thing that happened to windows 10 not only 11?! About crowdstike BSODing on windows 10

• the thing I thought was very cool about the Microsoft fix tool was it just runs a cmd file after it gets access to the drive. Let's consider what we can replace that batch file with. Maybe a net user command that creates a new local admin account. Or really anything you can do from a command line that you want to automate from a usb drive. You gotta know I saved an iso for this thing for future use.

• Dave's Garage (youtube channel) goes into what happened, in detail.

• Don't we just miss the good old floppy drive to boot up and delete the bullsh*t they installed …
  Ancient knowledge would be much more efficient in dealing with this absurd failure of professionals. (they should be jailed !)
  Any other person would never see the light of day again if they generate soo much damage as they did !
  This smells like a WEF action !!!

• Engineer A: it's null
  Engineer B: no, it's uninitialized
  Me: it's invalid either way

• I didn't get a BSOD, but just in case I printed out my work PCs Bitlocker key, 'cause you never know.

• So without the bitlocker keys nor the admin credentials, companies still have to rely on their frantic sys admins to fix everything?

• I heard somewhere that the driver was corrupted because when they opened to see its hex code, they saw that it was only 00

Comments are closed.