{ "id": "c33ea5ef-2136-4f97-9192-633f4b2e6bc5", "created_at": "2026-04-06T00:16:38.689485Z", "updated_at": "2026-04-10T13:11:27.92987Z", "deleted_at": null, "sha1_hash": "8b2a4bd46b035429c5a45ee87bfad1d9b34f4e0e", "title": "GitHub - lzcapp/NotMe-BSOD: Codes that could trigger BSOD (Blue Screen of Death) on Windows.", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 254538, "plain_text": "GitHub - lzcapp/NotMe-BSOD: Codes that could trigger BSOD\r\n(Blue Screen of Death) on Windows.\r\nBy lzcapp\r\nArchived: 2026-04-05 15:34:41 UTC\r\n⚠️ SOLELY FOR SECURITY RESEARCH PURPOSES. DO NOT USE THIS REPO FOR ILLEGAL\r\nPURPOSES. ⚠️\r\nThe name \"NotMe\" is inspired by the Microsoft tool \"NotMyFault\", also a tool that can be used to cause BSOD\r\n(Blue Screen of Death) on Windows system.\r\nB U I L D N O S T A T U S\r\n   GitHub Release\r\nProject Structure\r\nNotMe_CPP\r\nC++ project that uses CMake and CLion to build.\r\nToolchain: MinGW32 from MSYS2\r\nNotMe_CSharp\r\nC# and .Net Framework 4 . Including a GUI app.\r\nNtRaiseHardError \u0026 ZwRaiseHardError\r\nRef: http://undocumented.ntinternals.net/index.html?\r\npage=UserMode%2FUndocumented%20Functions%2FError%2FNtSetDefaultHardErrorPort.html\r\nBoth functions are undocumented Windows APIs (NTAPI) included in ntdll.dll , which can cause BlueScreen\r\n(BSOD, Blue Screen of Death) with certain parameters.\r\nNtRaiseHardError(\r\n IN NTSTATUS ErrorStatus,\r\n IN ULONG NumberOfParameters,\r\n IN PUNICODE_STRING UnicodeStringParameterMask OPTIONAL,\r\n IN PVOID *Parameters,\r\n IN HARDERROR_RESPONSE_OPTION ResponseOption,\r\n OUT PHARDERROR_RESPONSE Response\r\n);\r\nhttps://github.com/lzcapp/NotMe-BSOD\r\nPage 1 of 5\n\nZwRaiseHardError(\r\n IN NTSTATUS ErrorStatus,\r\n IN ULONG NumberOfParameters,\r\n IN PUNICODE_STRING UnicodeStringParameterMask OPTIONAL,\r\n IN PVOID *Parameters,\r\n IN HARDERROR_RESPONSE_OPTION ResponseOption,\r\n OUT PHARDERROR_RESPONSE Response\r\n);\r\nErrorStatus Error code.\r\nNumberOfParameters Number of optional parameters in Parameters array.\r\nUnicodeStringParameterMask Optional string parameter (can be only one per error code).\r\n*Parameters Array of DWORD parameters for use in error message string.\r\nResponseOption See HARDERROR_RESPONSE_OPTION for possible values description.\r\nResponse Pointer to HARDERROR_RESPONSE enumeration.\r\nParameters\r\nPUNICODE_STRING\r\ntypedef struct _UNICODE_STRING {\r\n USHORT Length;\r\n USHORT MaximumLength;\r\n PWSTR Buffer;\r\n} UNICODE_STRING, *PUNICODE_STRING;\r\nHARDERROR_RESPONSE_OPTION\r\ntypedef enum _HARDERROR_RESPONSE_OPTION {\r\n OptionAbortRetryIgnore,\r\n OptionOk,\r\n OptionOkCancel,\r\n OptionRetryCancel,\r\n OptionYesNo,\r\n OptionYesNoCancel,\r\n OptionShutdownSystem\r\n} HARDERROR_RESPONSE_OPTION, *PHARDERROR_RESPONSE_OPTION;\r\nPHARDERROR_RESPONSE\r\ntypedef enum _HARDERROR_RESPONSE {\r\n ResponseReturnToCaller,\r\n ResponseNotHandled,\r\nhttps://github.com/lzcapp/NotMe-BSOD\r\nPage 2 of 5\n\nResponseAbort,\r\n ResponseCancel,\r\n ResponseIgnore,\r\n ResponseNo,\r\n ResponseOk,\r\n ResponseRetry,\r\n ResponseYes\r\n} HARDERROR_RESPONSE, *PHARDERROR_RESPONSE;\r\nSetProcessIsCritical\r\nRef: http://www.netcore2k.net/projects/freeram\r\nRtlSetProcessIsCritical is yet another undocumented function hidden in the Windows kernel. It is one of the few\r\nwhich do not have a kernel32 equivalent.\r\nRtlSetProcessIsCritical sets a process to a system critical status. This means that the process is now \"critical\" to\r\nthe running of Windows, which also means that on termination of your process, Windows itself terminates as well.\r\nWhen a system critical process ends/terminates, the stop code is CRITICAL_PROCESS_DIED (0xEF) for process\r\nexiting, and CRITICAL_OBJECT_TERMINATION (0xF4) if the process was abnormally terminated.\r\n/**\r\n * @param NewValue the new critical setting: 1 for a critical process, 0 for a normal process\r\n * @param OldValue if not null, will receive the old setting for the process\r\n * @param bNeedScb specifics whether system critical breaks will be required (and already enabled) for\r\n */\r\nNTSTATUS RtlSetProcessIsCritical (IN BOOLEAN bNew, OUT BOOLEAN *pbOld, IN BOOLEAN bNeedScb);\r\nThis means that calling RtlSetProcessIsCritical(TRUE, NULL, FALSE) would make a process critical, while\r\nanother call to RtlSetProcessIsCritical(FALSE, NULL, FALSE) would return the process to normal. When critical\r\nstatus is set, termination or ending of the process in any way will usually cause either a BSOD (if BSOD-ing is\r\nenabled), or will cause the system to reboot itself.\r\nCloseWindowStation\r\nHWINSTA CreateWindowStationA(\r\n [in, optional] LPCSTR lpwinsta,\r\n DWORD dwFlags,\r\n [in] ACCESS_MASK dwDesiredAccess,\r\n [in, optional] LPSECURITY_ATTRIBUTES lpsa\r\n);\r\nBOOL CloseWindowStation(\r\n [in] HWINSTA hWinSta\r\nhttps://github.com/lzcapp/NotMe-BSOD\r\nPage 3 of 5\n\n);\r\nNTSD_Winlogon\r\ncmd /c start /min ntsd -c q -pn winlogon.exe 1\u003enul 2\u003enul\r\nPowerShell_Wininit\r\nTaskKill_Wininit\r\ntaskkill /f /im wininit.exe\r\nCompatibility\r\nNtRaiseHardError \u0026 ZwRaiseHardError\r\nWorks on all Windows systems with Windows NT kernel ( ntdll.dll ). Does not triger the UAC (User Account\r\nControl) prompt.\r\nSetProcessIsCritical\r\nRequire ntdll.dll versions 5.1 ( Windows XP ) and higher.\r\nNeeds Administrator privilege / trigers UAC (User Account Control) on Winodws 10 and Windows 11 .\r\nCompatibility Table\r\nReactOS\r\n0.4.14\r\nWindows\r\n2000\r\nWindows\r\nXP\r\nWindows\r\nVista\r\nWindows\r\n7\r\nWindows\r\n10\r\nWindows\r\n11\r\nNtRaiseHardError /\r\nZwRaiseHardError ❌ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️\r\nSetProcessIsCritical ✔️ ❌ ✔️ ⭕ ⭕ ⭕ ⭕\r\nCloseWindowStation ❌ ❌ ✔️ ❌ ❌ ❌ ❌\r\nNTSD_Winlogon ❌ ✔️ ✔️ ❌ ❌ ❌ ❌\r\nPowerShell_Wininit ❌ ❌ ❌ ❌ ⭕ ❌ ❌\r\nTaskKill_Wininit ❌ ❌ ❌ ⭕ ⭕ ❌ ❌\r\n✔️: Works Well\r\n⭕: Requires Administrator Privilege / UAC (User Account Control)\r\nhttps://github.com/lzcapp/NotMe-BSOD\r\nPage 4 of 5\n\n❌: Not Working\r\nStar History\r\nstar-history.com\r\n2023 2024 2025 2026\r\n5\r\n10\r\n15\r\n20\r\nlzcapp/notme-bsod\r\nStar History\r\nDate\r\nGitHub Stars\r\nSource: https://github.com/lzcapp/NotMe-BSOD\r\nhttps://github.com/lzcapp/NotMe-BSOD\r\nPage 5 of 5", "extraction_quality": 1, "language": "EN", "sources": [ "MITRE" ], "origins": [ "web" ], "references": [ "https://github.com/lzcapp/NotMe-BSOD" ], "report_names": [ "NotMe-BSOD" ], "threat_actors": [], "ts_created_at": 1775434598, "ts_updated_at": 1775826687, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/8b2a4bd46b035429c5a45ee87bfad1d9b34f4e0e.pdf", "text": "https://archive.orkl.eu/8b2a4bd46b035429c5a45ee87bfad1d9b34f4e0e.txt", "img": "https://archive.orkl.eu/8b2a4bd46b035429c5a45ee87bfad1d9b34f4e0e.jpg" } }