Odd memory corruption...

Does this memory pattern look familiar to anyone? I was looking at a
corrupted Software registry file, and a good chunk of it is filled with this
pattern over and over, namely, it starts at 0x01 and then counts up by 0x03
each byte.

I assume that the HBINs of the Registry were paged into memory and then
something decided to “test” that memory. (The Registry does no checking on
pages when they are paged out, so in-memory corruption is typically not
found until the following boot.) However, I’ve never seen this pattern
before, and so am unsure where to start looking for the corruption.

Any pointers would be appreciated! (A web search on “CFILORUX” came up with
essentially nothing but lots of binary pages.)

(Hopefully, you’re looking at the following in a non-proportional font. The
first part is the offset, the next are 16 bytes, and then finally the ASCII
representation of each character. This was done in the EMACS HEXL mode, if
you’re curious.)

00871500: 0104 070a 0d10 1316 191c 1f22 2528 2b2e …"%(+.
00871510: 3134 373a 3d40 4346 494c 4f52 5558 5b5e 147:=@CFILORUX[^
00871520: 6164 676a 6d70 7376 797c 7f82 8588 8b8e adgjmpsvy|…
00871530: 9194 979a 9da0 a3a6 a9ac afb2 b5b8 bbbe …
00871540: c1c4 c7ca cdd0 d3d6 d9dc dfe2 e5e8 ebee …
00871550: f1f4 f7fa fd00 0306 090c 0f12 1518 1b1e …
00871560: 2124 272a 2d30 3336 393c 3f42 4548 4b4e !$'*-0369<?BEHKN
00871570: 5154 575a 5d60 6366 696c 6f72 7578 7b7e QTWZ]`cfilorux{~
00871580: 8184 878a 8d90 9396 999c 9fa2 a5a8 abae …
00871590: b1b4 b7ba bdc0 c3c6 c9cc cfd2 d5d8 dbde …
008715a0: e1e4 e7ea edf0 f3f6 f9fc ff02 0508 0b0e …
008715b0: 1114 171a 1d20 2326 292c 2f32 3538 3b3e … #&),/258;>
008715c0: 4144 474a 4d50 5356 595c 5f62 6568 6b6e ADGJMPSVY_behkn
008715d0: 7174 777a 7d80 8386 898c 8f92 9598 9b9e qtwz}…
008715e0: a1a4 a7aa adb0 b3b6 b9bc bfc2 c5c8 cbce …
008715f0: d1d4 d7da dde0 e3e6 e9ec eff2 f5f8 fbfe …


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com