Why an uninstaller broke File Explorer: the technical analysis from the former Microsoft

Raymond Chen

Raymond Chen, a historical figure in Windows development, recently shared a detailed technical analysis of a series of crashes that afflicted File Explorer, bringing back his famous saying: every sufficiently advanced uninstaller is indistinguishable from malware.

The issue emerged during routine debugging sessions of the Microsoft team when an anomalous spike in reports raised concerns about the presence of a critical bug in the Windows code. However, the investigation into the memory dumps revealed a different reality, closely tied to legacy compatibility and superficial programming by third-party developers.

The first key clue was the crash target: the 32-bit version of File Explorer (located in SysWOW64) running on a 64-bit operating system. This instance of Explorer does not manage the user's taskbar or desktop, but is usually called by older applications for shell operations. If this process is active and crashes, it means that external software is using it to carry out what Chen defines as dirty work, often injecting code directly into the process to manipulate the file system.

When the uninstaller behaves like malware: Raymond Chen's latest story

The heart of the problem lies in a fundamental yet devastating technical error in managing calling conventions. The code injected by the uninstaller called Windows functions using the _cdecl convention instead of the correct _stdcall. In a standard 32-bit Windows environment, the latter convention dictates that it is the called function's responsibility to clean the stack by removing parameters after execution. Conversely, in _cdecl, this task falls to the caller.

This discrepancy generated a phenomenon called double pop. Every time the uninstaller called a system function, that function cleaned the stack as expected by Microsoft protocols, but the uninstaller's code, believing it was operating in _cdecl, performed a second immediate cleanup. Because the filesystem operation failed, the uninstaller entered a retry loop, repeating the error thousands of times. With each iteration, the stack was eroded, moving the pointer towards memory areas not intended for data.

The most singular consequence of this bug is the nature of the final crash. The stack pointer advanced to such an extent that it physically entered the memory area where the code injected by the uninstaller resided. Instead of merely corrupting data, the stack began to overwrite the executable instructions of the uninstaller itself. When the processor attempted to execute the next logical instruction, it found not the original code but garbage data from the stack, generating an invalid instruction exception.

This behavior left behind what Chen describes as excellent corpses: seemingly inexplicable memory dumps that led the Windows team to doubt the stability of their operating system. Only a dissection of the logs and the stack allowed Redmond to be exonerated, confirming that the instability was caused by a software removal routine written without adhering to the fundamentals of Windows programming. The episode underscores once again how the support for 32-bit compatibility, although necessary, exposes the operating system to inefficiencies from external software that operate outside documented best practices.