I wanted to add, if you are still looking for a way to crash windows, do try to find a way to influence those pointers. maybe the stackpointer. If you can modify that, and you can edit the memory stack of some critical windows process, you've won.