1

My Windows crashed, don't understand it shows 'Illegal instruction' on a simple 'strlen' instruction:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common BugCheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc000001d, The exception code that was not handled
Arg2: fffff80666bd1151, The address that the exception occurred at
Arg3: ffff9e8e84a36708, Exception Record Address
Arg4: ffff9e8e84a35f40, Context Record Address

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1656

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 1710

    Key  : Analysis.Init.CPU.mSec
    Value: 608

    Key  : Analysis.Init.Elapsed.mSec
    Value: 5677

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 107

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x7e

    Key  : Bugcheck.Code.KiBugCheckData
    Value: 0x7e

    Key  : Bugcheck.Code.Register
    Value: 0x7e

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


FILE_IN_CAB:  MEMORY_20220819.DMP

BUGCHECK_CODE:  7e

BUGCHECK_P1: ffffffffc000001d

BUGCHECK_P2: fffff80666bd1151

BUGCHECK_P3: ffff9e8e84a36708

BUGCHECK_P4: ffff9e8e84a35f40

EXCEPTION_RECORD:  ffff9e8e84a36708 -- (.exr 0xffff9e8e84a36708)
ExceptionAddress: fffff80666bd1151 (nt!strlen+0x0000000000000031)
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

CONTEXT:  ffff9e8e84a35f40 -- (.cxr 0xffff9e8e84a35f40)
rax=ffffa086f1dd9cc8 rbx=ffffa086f1dd9c10 rcx=00005f790e2263f0
rdx=0000000000000000 rsi=ffffa086f1e10078 rdi=0000000000000000
rip=fffff80666bd1151 rsp=ffff9e8e84a36948 rbp=ffff9e8e84a36a29
 r8=7efefefefefefeff  r9=eb636d60672c6b60 r10=ffffffff00000003
r11=8101010101010100 r12=ffff9e8e84a36d98 r13=0000000000000001
r14=ffffa086f1dd9c10 r15=ffffa086efab1028
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050246
nt!strlen+0x31:
fffff806`66bd1151 488b10          mov     rdx,qword ptr [rax] ds:002b:ffffa086`f1dd9cc8=392c303037313d65
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME:  System

ERROR_CODE: (NTSTATUS) 0xc000001d - {   ~}       T     O           @     T     O C

EXCEPTION_CODE_STR:  c000001d

EXCEPTION_STR:  0xc000001d

FAILED_INSTRUCTION_ADDRESS: 
nt!strlen+31
fffff806`66bd1151 488b10          mov     rdx,qword ptr [rax]

STACK_TEXT:  
ffff9e8e`84a36948 fffff807`311fe7b7     : ffffa086`ffe2fd50 00000000`00000000 ffffa086`f1dd9c10 fffff807`311fe347 : nt!strlen+0x31
ffff9e8e`84a36950 fffff807`311fe477     : fffff807`312bb710 00000000`00000000 ffffa086`f61c9470 00000000`f1e10078 : acpis!AgentSetState+0x76e7
ffff9e8e`84a36980 fffff807`311fe0e2     : d3e7328e`00020008 ffffa086`ffe2e440 ffffa086`efab1028 ffff9e8e`84a36b90 : acpis!AgentSetState+0x73a7
ffff9e8e`84a36a90 fffff807`312008ad     : 00000000`ffffffff 00000000`00000000 ffffa087`0a011808 ffffa086`f1dd9c10 : acpis!AgentSetState+0x7012
ffff9e8e`84a36ac0 fffff807`31200fea     : ffffa086`fb2f9228 ffff9e8e`84a36bc0 ffffa086`fb0e94a0 ffffa086`f1dd9c10 : acpis!sd_StrToUnicode+0x1335
ffff9e8e`84a36b00 fffff807`311fc6d0     : ffff9e8e`84a36d98 fffff807`312054b2 ffffa086`f61c9470 ffffa086`f1dd9c10 : acpis!ag_CacheReleaseEx2+0xe
ffff9e8e`84a36b30 fffff807`3113d20e     : ffffa086`fb2f9228 ffffa086`fb0e94a0 ffffa086`fb0e94a0 00000000`00000000 : acpis!AgentSetState+0x5600
ffff9e8e`84a36b60 fffff807`3113ca60     : ffff9e8e`84a36c38 00000000`00000000 ffffa086`f61c9470 ffff9e8e`84a36cf0 : acpis!sd_CommandRegister+0x1956
ffff9e8e`84a36bf0 fffff807`3113db0d     : 00000000`00000001 fffff807`31136327 ffff9e8e`84a36f10 ffff9e8e`84a36ef8 : acpis!sd_CommandRegister+0x11a8
ffff9e8e`84a36d10 fffff807`3113c71a     : 00000000`00000001 00000000`00000000 ffffa086`f61e24e8 ffffa086`f9d6ec68 : acpis!sd_CommandRegister+0x2255
ffff9e8e`84a36d50 fffff807`3113db0d     : 00000000`00000001 fffff807`3113693b ffff9e8e`84a37080 00000000`00020e7d : acpis!sd_CommandRegister+0xe62
ffff9e8e`84a36e70 fffff807`3113cb36     : 00000000`00000000 00000000`00000000 00000000`88963d99 ffffa086`f59ff288 : acpis!sd_CommandRegister+0x2255
ffff9e8e`84a36eb0 fffff807`3113db0d     : ffffa086`f72e2c50 ffffa087`2cc1b340 00000000`00000004 00000000`00000001 : acpis!sd_CommandRegister+0x127e
ffff9e8e`84a36fd0 fffff807`3113da79     : 00000000`00000000 ffffa086`f6153ca8 ffffa087`15025758 fffff807`311fdd16 : acpis!sd_CommandRegister+0x2255
ffff9e8e`84a37010 fffff807`3113bbc8     : 00000000`0000000a fffff807`311fe098 00000000`00020001 ffffa087`15025758 : acpis!sd_CommandRegister+0x21c1
ffff9e8e`84a37050 fffff807`3113bda9     : 00000000`00000000 ffffa086`f61c9208 ffffa086`f6153ca8 ffff9e8e`84a371e0 : acpis!sd_CommandRegister+0x310
ffff9e8e`84a370c0 fffff807`311481fd     : 00000000`00000000 ffffa087`038fc5e0 00000000`00000000 00000000`00000000 : acpis!sd_CommandRegister+0x4f1
ffff9e8e`84a37150 fffff807`311fdc31     : ffffa086`00000001 ffffa086`f3a56308 ffffa086`f3a56308 ffffa086`f3a56338 : acpis!sd_ShouldGenerateEvent+0x2131
ffff9e8e`84a372f0 fffff807`311fe3f5     : ffffa086`0002000f ffffa086`f5ffb030 ffff9e8e`84a373c0 00000000`00000000 : acpis!AgentSetState+0x6b61
ffff9e8e`84a37360 fffff807`31200dca     : ffffa086`f1e10780 fffff807`3114056d 00000000`00000000 00000000`ffffffff : acpis!AgentSetState+0x7325
ffff9e8e`84a373a0 fffff807`31147b92     : ffffa086`f7339b68 00000000`ffffffff 00000000`00000000 ffffa086`f6e0f190 : acpis!ag_CacheHandleIterateByKey+0x22
ffff9e8e`84a373e0 fffff807`31143b35     : ffffa086`f5ffb030 ffffa086`f6e0f190 ffffa087`097d1c30 ffffffff`00000001 : acpis!sd_ShouldGenerateEvent+0x1ac6
ffff9e8e`84a37450 fffff807`31143f8d     : ffffa086`f5ffb030 00000000`00000080 ffffa087`0a02bde8 00000000`000000fa : acpis!sd_PackageLookup+0x799
ffff9e8e`84a37480 fffff807`31143df2     : 00000000`000001f5 fffff807`3131fc78 00000000`00000080 fffff807`3131fc78 : acpis!sd_PackageLookup+0xbf1
ffff9e8e`84a374b0 fffff807`31201af7     : 00000000`00020008 ffffa086`f5fb8040 00000000`00000000 40200000`00020001 : acpis!sd_PackageLookup+0xa56
ffff9e8e`84a374e0 fffff806`66b58235     : ffffa086`00000001 ffffa086`f5fb8040 fffff807`31201a5c fffff807`3131fc78 : acpis!ag_CacheReleaseEx2+0xb1b
ffff9e8e`84a37510 fffff806`66bfff48     : ffffb681`de266180 ffffa086`f5fb8040 fffff806`66b581e0 40200000`00000000 : nt!PspSystemThreadStartup+0x55
ffff9e8e`84a37560 00000000`00000000     : ffff9e8e`84a38000 ffff9e8e`84a31000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME:  acpis!AgentSetState+76e7

MODULE_NAME: acpis

IMAGE_NAME:  acpis.sys

STACK_COMMAND:  .cxr 0xffff9e8e84a35f40 ; kb

BUCKET_ID_FUNC_OFFSET:  76e7

FAILURE_BUCKET_ID:  0x7E_C000001D_BAD_IP_acpis!AgentSetState

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {5e9d13b4-b1d6-a821-2e66-355ff6907131}

Followup:     MachineOwner
---------

7: kd> !blackboxpnp
    PnpActivityId      : {00000000-0000-0000-0000-000000000000}
    PnpActivityTime    : 133053779797965442
    PnpEventInformation: 3
    PnpEventInProgress : 0
    PnpProblemCode     : 24
    PnpVetoType        : 0
    DeviceId           : HID\{00001812-0000-1000-8000-00805f9b34fb}_Dev_VID&02046d_PID&b030_REV&0004_d34174814fef&Col02\9&1a638cbc&0&0001
    VetoString         :
Improve this question
6
  • AFAIK acpis.sys is not a standard Windows 10 driver. Have you checked it's signature where it comes from. You also forgot to mention your Windows version and CPU. May be the driver is simply designed for a CPU that has more/other CPU instructions than yours?
    – Robert
    Aug 23, 2022 at 7:24
  • I thought it is BIOS ACPI driver, but it was signed by GoSecure Inc. A network security software in our office.
    – GreenTea
    Aug 24, 2022 at 2:52
  • I would upload the file to Virustotal just to see if it is known at all and even if the signer seems to indicate that it comes from a security company.
    – Robert
    Aug 24, 2022 at 18:05
  • it is not malware, but I can't delete it, and I don't know how to unload it.
    – GreenTea
    Aug 24, 2022 at 23:25
  • If it really belongs to a security software it will be hard to uninstall (because the software usually protects itself from being uninstalled). best way is to boot into a different OS like a WindowsPE/RE and rename the file and potentially load registry and rename the entries that load it. Make sure you don't delete anything in case your system refuses to boot after making the changes.
    – Robert
    Aug 25, 2022 at 7:18

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.