Win11 and Edge – I zip bombed myself

Scenario: I had the pleasure recently of downloading two memory dumps on a Windows 11 machine using normal channel Edge. The ‘problem’ was that these two zip files (both 11 GB in size) were compressed memory dumps (uncompressed size 110GB and 153GB respectively). I started downloading both at the same time, not thinking of it, so bad on me, but blame isn’t what this post is about…

For further information on zip bombs, click here.

What happened is that once Edge finished downloading the files, but prior to naming them their proper names and freeing them for use, they had to be processed by SmartScreen…this is where the magic happens….my system all but froze….

While taskmanager showed Edge taking up a reasonable amount of memory for downloading big honkin files…

Edge taking up about 25GB of ram total for 2 downloads

And there it sat…I checked the files in Windows Explorer, and sure enough, they aren’t “done” downloading yet. But the download progress bar in Edge reports them 100%

Windows Explorer shows files as not ready for use (download extension)

Ok, so what gives? My system was grinding to a halt, mouse movements took time to catch up to where the mouse pointer should be. I couldn’t open any minimized applications. Ah, this is why:

memory maxed

Memory is tapped out, ok, so its paging to the C: drive, no problem, right, it’s a PCI 4 nvme after all….oh

disk tapped out

Once I saw these symptoms, I noodled it out. SmartScreen is uncompressing the 2 zip files (which unzipped are 280 GB or so) so it can make sure they are safe, or if they need the “Are you sure you want to KEEP this file?” stuff you know?

I disabled these in Security Center and sure enough, everything rectified when I rebooted and re-downloaded the assets (rebooted to clear my cache, even the playing field on the two experiments).

disabled smartscreen and reputation

 

Am I saying you should turn this off in Edge? not all the time, hell no. It’s a decent enough feature. I submit that perhaps, the use case of downloading a couple hundred GB of compressed data over a browser session instead of SFTP or whatnot is probably more the root cause here….

Be the first to comment

Leave a Reply