What is causing my computer to BSOD at random times?

Hello Alex,

The visible symptoms may be different, but the dump file is another KMODE_EXCEPTION_NOT_HANDLED caused by the "mov cr0,rax" instruction.

Gary

@Gary

How can it be Patchguard? The shellcode does not look for the CR4.CET bit, a mere programming error, and this kills the people's PCs. In the dumps, it was set. Killing them on the spot. Outright unprofessional. And how could this have survived for so long? Such a mistake would immediately affect millions of people. Was it newly introduced, perhaps? In just Windows 10 with AMD/Ryzen platforms*. Sounds unlikely of course, yet you looked at the normal code (and so did I), the check (CR4.CET bit) appears to be missing.

I mean, that's an obvious error. Right? Regardless where the shellcode takes it from and it purpose, the programming error is then from Microsoft. If they fix it, the shellcode would take the "fixed" code and not bsod anymore...

What about Win11?

* @edit: nooo... AMD/Ryzen is still speculation... a new idea of me is that it happens on modern PCs, but perhaps with Win10, with CET, and CET enabled in BIOS, because it really just struck me ... most people tell they just built a new top-modern PC and were afraid of hardware defect. Is CET such a new feature?

Hi Gary and vivs_lunchtime,

Thank you very much for your investigation into my issue. Another strange things just occurred.

My computer froze for about 10 second and then crashed, going straight to a black screen without a BSoD at all. I put the minidump file in a new folder titled "Crash without BSoD" at the google drive link above.

For context, I had enabled secure boot as the last trouble-shooting step, but I have not yet enabled Core Isolation. Since my computer crashed again I will enable Core Isolation and see if this prevents the crashes from occurring. Maybe this new minidump file will reveal more information since it was a different type of crash then the last few.

Thank you,

Alex J

A few people don't have locked threads.

So, folks, for everybody tired, and also to help finding the origin of the CR0-manipulating rwx shellcode, can you please turn on the Core Isolation in control panel (and reboot)? Just put the switch to "enabled" (backup your most important data before that, perhaps). It does not remove the root cause, but it will shield the kernel, stop the rwx shellcode (with the culprit cr0-manipulating sequence), and because of that, hopefully stop the BSODs.

Dual boot users (with Linux): you can still have Core Isolation without secure boot if it needs be, by setting "RequireMicrosoftSignedBootChain" to 0 in Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard. Essentially you break the requirement of having the signed secure boot chain (because you want to keep your Linux). Core Isolation will then run anyway while hoping that your bootloader wasn't compromised.

Core Isolation needs VT-d enabled in the BIOS menu. On older PCs, that setting might be off per default, and you need to go into the BIOS menu yourself. On all modern (even gaming) PCs, it will be on per default. It has become de-facto standard.

If Core Isolation demands to remove some drivers, do it. Sometimes it's a tedious search. If they are OEM drivers, you can also go to the official OEM site and get an up-to-date version, which has the critical bugs and flaws removed (the cause why Core Isolation rejects them.) The new OEM driver will be accepted then. If not, pretty sure your OS can live without them, probably better than before. On the bad side, the shielding costs: Core Isolation may eat one or two FPS and certain functionality like overclocking, undervolting, controlling fans from OS side (you can still do all that from BIOS).

Removing drivers can be done with autoruns.exe from the MS sysinternals suite (under 'drivers' tab, as admin, by unchecking the drivers or even deleting the entry). Or by deinstalling the associated software. You also need to reboot (without these drivers). Core Isolation will tell if you were successfull.

Removing third party drivers that Core Isolation wants to be removed, may already kill your problem entirely, without having to run Core Isolation.

Please report back both in case if the BSOD vanishes or not.

I can't notify the other afflicted people, their thread seems to be locked. :-(

I'm sorry for them. I can't even tell them what's wrong and what they could do.