Research on the analysis and collation of the system crash caused by 9 lines of code

There are a lot of places that have been reprinted using 9 lines of code history Windows crashes, but I find no analysis of why Windows crashes. Let me give you a look at the original text. Then tell me the specifics.

Microsoft has long claimed that Windows XP is so stable and reliable, but a few days ago a foreign programming enthusiast named Masaru Tsuchiyama a short piece of C language code. This 9-line applet, if run under Windows xp/2000, can cause the system to crash completely and reboot. However, this program has no effect on other versions of Windows. The code for this small program that produces an infinite loop output is as follows:

#include
int main (void)
{
for (; {
printf ("Hung up\t\t\b\b\b\b\b\b");
Print ("Hung up\t\t\b\b\b\b\b\b";
}
return 0;
}

If you remove the print statement, this program also causes the NT 4.0 system to have a blue screen error.

I hope Microsoft fixes this loophole quickly. Also remind you that this code can only be used for research purposes and not for any illegal activities.
If you remove the print statement, this program also causes the NT 4.0 system to have a blue screen error.

Above all over the Internet to reprint the original text.

Look at the analysis below for the reasons why the error is caused.

\b is a backspace.
The code uses BACKSPACE to return the cursor in the console to NULL,
It then displays any character (except \ t), which is a crash.
But the general \b is not allowed to withdraw from the specified area,
And if the previous character of \b is \ t, you can exit the specified area (bug?).
When you double-click Run, the system creates a new console, so our display is in the console
In the upper left corner, we can exit the screen with just two \b (the first one to eat \ t).
The reason is that the Win32 subsystem aborted unexpectedly, causing the system to crash. SMSs is the first user process established by the Windows system, and one of his tasks is to establish the CSRSS and Winlogon processes and then wait for the handles of both processes, if the two processes abort unexpectedly,
SMSS will cause the system to crash. The CSRSS process is the process that is responsible for communicating all Win32 processes and systems. All Win32 process system calls will be done by CSRSS. But doing so is too inefficient because of the need for process switching. So when windowsnt from 3.51 to 4.0, it moves many parts from the user state into the kernel, and the system calls to the Win32 process go directly to reduce process switching time. But there are still a few system calls that need to be CSRSS process completed, As far as I know CreateProcess
Is such a function, all the display on the console is such a function (and others).
When we call printf ("\t\b\ba"), the WriteFile API is eventually invoked.
WriteFile ((HANDLE) 7, "\t\b\ba", null,null) equals
printf ("\t\b\ba"), 7 is the handle to the console standard input.
WriteFile the handle type, as the file handle calls the Ntdll.dll in the
Ntwritefile function. If the console handle calls the Writeconsolea function.
The Writeconsolea function will call the Csrclientcallserver in the Ntdll.dll
function to notify the CSRSS process, and then call NtRequestWaitReplyPort to wait for the result.
It is estimated that the CSRSS process has made an error in processing this request.

A few years ago Houjie teacher analysis after I sorted out. Because there is no place to say, even simple analysis is not, so I turned him out: careful person found CSRSS error details did not describe, who have time to add it?