What is causing my computer to BSOD at random times?

Hello vivs_lunchtime,

It was nice collaborating with you too, ably supported by Alex's trust and willingness to share information.

From what we have found in the Internet, this particular problem seems to be limited to Windows versions around the time of build 19041; free security updates from Microsoft for these versions ends in 9 months, so one can strongly recommend a Windows upgrade to those who encounter the problem.

One could also recommend that affected users read this thread - the recorded progression of ideas might enable someone to form a judgement about whether applying the workarounds that we have found could be appropriate for their circumstances.

Gary

Was nice doing analysis with you Gary.

But I continue to see a lot of persons with this BSOD.

Too late, but the findings are not interesting. It's as you say. bit and variable are set together in early kernel init (not in bootloader). Initial Cr4 value changed in bootloader, but not related to CET.
Cr4 (initial start value when bootloader begins): 40668

Cr4 (first write to Cr4 in bootloader): 310ee8

Cr4 write (early kernel init): b10ef8 (now with the CET bit).

Other writes didn't occur for me.

I cannot confirm happening it in KiSetControlEnforcement, that didn't happen for me.

Everybody with the shellcode-BSODs has three choices now: Core Isolation, Win11 24H2, and disabling CET entirely by using the bcdedit command "bcdedit /set xsaveremovefeature 0x800". I suggest doing "bcdedit /export "c:\someshortpath\bcdstorbackup" before using the bcdedit command.

I am tempted to say Alex remaining random crashes could point to hardware failure, but besides making sure all drivers and bios are uptodate, and perhaps doing memcheck and Hdd health check, not much advise. The other persons affected by the shellcode-BSOD apparently don't have crashes anymore (Core Isolation approach).

Ah and I think that too, PatchGuard was intimately involved in the crash. Two persons thinking that. ;-)

A personal take home message for me is that just having new hardware can put you into trouble unprovoked. On Linux, there is trouble with CET and the Linux OS as well. There is now experimental userspace CET support in Linux, and apparently a lot of people (with this new hardware) crashed with it and have trouble, the general advise is to put a disable CET boot parameter into the GRUB or whatever is used. CET support was not compiled into all distros yet, but it's coming.

Hello vivs_lunchtime,

I still think that PatchGuard was intimately involved in the crash.

We both seem to enjoy (and be quite good at) analysing the behaviour of Windows when debug symbols are available, the "goal" of the code is relatively clear and debugging (and general use of debugging tools) is possible.

PatchGuard and its obfuscation and anti-debugging measures violates several of the above conditions and pushes the effort required to understand it (from binary code alone) well beyond the level that I would be prepared to expend. I think that the final details of Alex's problem will remain a mystery.

Gary