Windows 98: Arbitrary corruption of files in guest OS

[Konstantin Vlasov]

1. Create a VM for Win98 and install Windows 98SE there.
2. Inside this VM, install Total Commander 9.51rc3 (the exact version is important!).
3. Make a backup copy of the TC installation folder.
4. Start TC, then exit it (if you're lucky enough that it does not crash).
5. Compare the TOTALCMD.EXE file contents with the one from the backup copy (for example, you can have another version of TC installed into another directory; there is a built-in function for comparing files).

Result: The file contents is different from what it was initially.

Expected result: The file should not change, because Total Commander does not modify its own executable. This was confirmed by the author of TotalCmd, but just in case I also monitored the situation with Sysinternals FileMon. During the whole period from launching Total Commander to its exit, FileMon showed absolutely NONE write operations to the totalcmd.exe file by any process in the system. And still, the file ended up being modified.

The corruption always happens on cluster-level; that is, the changes always consist of one or more cluster-sized chunks (4096 bytes on my guest file system). The exact position and contents of the corrupted data may vary in different experiments.

The issue can be reproduced in VirtualBox 5.2.36 and 5.2.38. With 5.2.34 I could not reproduce it. For some reason, I could reproduce this issue only with that particular version of Total Commander; neither rc2 nor rc4 seem to trigger the corruption scenario. If the version 9.51rc3 is no longer available at the official web site at some later time, it can still be downloaded from here: ​http://totalcmd.net/beta/tc951x32_rc3.exe (the authenticity can be validated by the digital signature).

I understand that Win98 is completely outdated, but it's a really serious bug causing data loss! And since I don't know what causes it, I cannot be sure if it does not affect any other guest OS.

I've looked at the log files, but they contain nothing at all at the moment of the experiment. Just in case, I'll attach the log file, but you can see it's empty between 13.5 seconds (when the OS started) and 26-something minutes, when I shut down the guest OS after performing the experiments.

[Konstantin Vlasov]

Win98SE VM log file (5.2.36)

[Konstantin Vlasov]

And, of course, just as I report this bug, I go with 5.2.34, and there it is - the same file corruption issue... I've spent two weeks testing it, and never once did it happen on 5.2.34!

Oh, well. Please, ignore the part where I'm saying it's OK with 5.2.34; it's not. :-(