movdqa cm bugcheck

Microsoft (R) Windows Debugger Version 10.0.22621.2428 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\v.alvarez\Desktop\twitter.cpubug.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Kernel base = 0xfffff806`4dc00000 PsLoadedModuleList = 0xfffff806`4e8130c0
System Uptime: 0 days 1:00:58.424
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
...................
For analysis of this file, run !analyze -v


################### kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00007fffffff0000, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 00000000000000c0, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8064df5ecf9, address which referenced memory

Debugging Details:
------------------

Unable to load image cm.sys, Win32 error 0n2

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 2796

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 7482

    Key  : Analysis.Init.CPU.mSec
    Value: 5671

    Key  : Analysis.Init.Elapsed.mSec
    Value: 217140

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 92


FILE_IN_CAB:  twitter.cpubug.dmp

DUMP_FILE_ATTRIBUTES: 0x1008
  Kernel Generated Triage Dump

BUGCHECK_CODE:  a

BUGCHECK_P1: 7fffffff0000

BUGCHECK_P2: ff

BUGCHECK_P3: c0

BUGCHECK_P4: fffff8064df5ecf9

READ_ADDRESS: fffff8064e91d468: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 00007fffffff0000

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME:  xxx.exe

TRAP_FRAME:  fffff8064b4f8f10 -- (.trap 0xfffff8064b4f8f10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00007fffffff0000 rbx=0000000000000000 rcx=00007fffffff0000
rdx=fffff8064b4f9258 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8064df5ecf9 rsp=fffff8064b4f90a0 rbp=fffff8064b4f96c0
 r8=0000000000040282  r9=0000000000000000 r10=fffff8064ea00038
r11=fffff8064b4f91c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di ng nz na pe nc
nt!RtlpxVirtualUnwind+0x419:
fffff806`4df5ecf9 0fb600          movzx   eax,byte ptr [rax] ds:00007fff`ffff0000=??
Resetting default scope

STACK_TEXT:
fffff806`4b4f8dc8 fffff806`4e027da9     : nt!KeBugCheckEx
fffff806`4b4f8dd0 fffff806`4e023434     : nt!KiBugCheckDispatch+0x69
fffff806`4b4f8f10 fffff806`4df5ecf9     : nt!KiPageFault+0x474
fffff806`4b4f90a0 fffff806`4df5ce35     : nt!RtlpxVirtualUnwind+0x419
fffff806`4b4f9160 fffff806`4de74ebe     : nt!RtlDispatchException+0x215
fffff806`4b4f98d0 fffff806`4e013902     : nt!KiDispatchException+0x1ae
fffff806`4b4f9fb0 fffff806`4e0138d0     : nt!KxExceptionDispatchOnExceptionStack+0x12
fffffe0d`f4def098 fffff806`4e027ef5     : nt!KiExceptionDispatchOnExceptionStackContinue
fffffe0d`f4def0a0 fffff806`4e022f83     : nt!KiExceptionDispatch+0x135
fffffe0d`f4def280 ffffba00`62fa9215     : nt!KiGeneralProtectionFault+0x343
fffffe0d`f4def418 ffffba00`62fa8000     : 0xffffba00`62fa9215
fffffe0d`f4def420 fffff806`4ce02415     : 0xffffba00`62fa8000
fffffe0d`f4def428 fffffe0d`f4def3f8     : cm+0x2415
fffffe0d`f4def430 00000000`00040282     : 0xfffffe0d`f4def3f8
fffffe0d`f4def438 fffff806`4ce03f91     : 0x40282
fffffe0d`f4def440 00000000`00000000     : cm+0x3f91


SYMBOL_NAME:  cm+2415

MODULE_NAME: cm

IMAGE_NAME:  cm.sys

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  2415

FAILURE_BUCKET_ID:  AV_cm!unknown_function

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {d4618ce6-e641-5b70-2af6-81a116836538}

Followup:     MachineOwner
---------


################### kd> .trap 0xfffff8064b4f8f10
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00007fffffff0000 rbx=0000000000000000 rcx=00007fffffff0000
rdx=fffff8064b4f9258 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8064df5ecf9 rsp=fffff8064b4f90a0 rbp=fffff8064b4f96c0
 r8=0000000000040282  r9=0000000000000000 r10=fffff8064ea00038
r11=fffff8064b4f91c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di ng nz na pe nc
nt!RtlpxVirtualUnwind+0x419:
fffff806`4df5ecf9 0fb600          movzx   eax,byte ptr [rax] ds:00007fff`ffff0000=??

################### kd> ub . L10
nt!RtlpxVirtualUnwind+0x3df:
fffff806`4df5ecbf 54              push    rsp
fffff806`4df5ecc0 2470            and     al,70h
fffff806`4df5ecc2 488b1a          mov     rbx,qword ptr [rdx]
fffff806`4df5ecc5 48895c2468      mov     qword ptr [rsp+68h],rbx
fffff806`4df5ecca 48b8fffffeffff7f0000 mov rax,7FFFFFFEFFFFh
fffff806`4df5ecd4 483bf0          cmp     rsi,rax
fffff806`4df5ecd7 7723            ja      nt!RtlpxVirtualUnwind+0x41c (fffff806`4df5ecfc)
fffff806`4df5ecd9 f6c303          test    bl,3
fffff806`4df5ecdc 7406            je      nt!RtlpxVirtualUnwind+0x404 (fffff806`4df5ece4)
fffff806`4df5ecde e85d246a00      call    nt!ExRaiseDatatypeMisalignment (fffff806`4e601140)
fffff806`4df5ece3 cc              int     3
fffff806`4df5ece4 488bc3          mov     rax,rbx
fffff806`4df5ece7 48b90000ffffff7f0000 mov rcx,7FFFFFFF0000h
fffff806`4df5ecf1 483bd9          cmp     rbx,rcx
fffff806`4df5ecf4 480f43c1        cmovae  rax,rcx
fffff806`4df5ecf8 90              nop
################### kd> u . L5
nt!RtlpxVirtualUnwind+0x419:
fffff806`4df5ecf9 0fb600          movzx   eax,byte ptr [rax]
fffff806`4df5ecfc eb05            jmp     nt!RtlpxVirtualUnwind+0x423 (fffff806`4df5ed03)
fffff806`4df5ecfe e90dcd0e00      jmp     nt!RtlpxVirtualUnwind+0xed130 (fffff806`4e04ba10)
fffff806`4df5ed03 488b8c2408010000 mov     rcx,qword ptr [rsp+108h]
fffff806`4df5ed0b 488b01          mov     rax,qword ptr [rcx]

################### kd> .cxr
Resetting default scope

################### kd> k
 # Child-SP          RetAddr               Call Site
00 fffff806`4b4f8dc8 fffff806`4e027da9     nt!KeBugCheckEx
01 fffff806`4b4f8dd0 fffff806`4e023434     nt!KiBugCheckDispatch+0x69
02 fffff806`4b4f8f10 fffff806`4df5ecf9     nt!KiPageFault+0x474
03 fffff806`4b4f90a0 fffff806`4df5ce35     nt!RtlpxVirtualUnwind+0x419
04 fffff806`4b4f9160 fffff806`4de74ebe     nt!RtlDispatchException+0x215
05 fffff806`4b4f98d0 fffff806`4e013902     nt!KiDispatchException+0x1ae
06 fffff806`4b4f9fb0 fffff806`4e0138d0     nt!KxExceptionDispatchOnExceptionStack+0x12
07 fffffe0d`f4def098 fffff806`4e027ef5     nt!KiExceptionDispatchOnExceptionStackContinue
08 fffffe0d`f4def0a0 fffff806`4e022f83     nt!KiExceptionDispatch+0x135
09 fffffe0d`f4def280 ffffba00`62fa9215     nt!KiGeneralProtectionFault+0x343
0a fffffe0d`f4def418 ffffba00`62fa8000     0xffffba00`62fa9215
0b fffffe0d`f4def420 fffff806`4ce02415     0xffffba00`62fa8000
0c fffffe0d`f4def428 fffffe0d`f4def3f8     cm+0x2415
0d fffffe0d`f4def430 00000000`00040282     0xfffffe0d`f4def3f8
0e fffffe0d`f4def438 fffff806`4ce03f91     0x40282
0f fffffe0d`f4def440 00000000`00000000     cm+0x3f91

###################
# Bring in non-volatile registers, more info than from the .trap command.
################### kd> .frame /c /r 3
03 fffff806`4b4f90a0 fffff806`4df5ce35     nt!RtlpxVirtualUnwind+0x419
rax=00007fffffff0000 rbx=fffffe0df4def438 rcx=00007fffffff0000
rdx=fffff8064b4f9258 rsi=0000000000040282 rdi=0000000000000000
rip=fffff8064df5ecf9 rsp=fffff8064b4f90a0 rbp=fffff8064b4f96c0
 r8=0000000000040282  r9=0000000000000000 r10=fffff8064ea00038
r11=fffff8064b4f91c0 r12=0000000000040282 r13=fffff8064ce00000
r14=0000000000000001 r15=fffff8064ce00000
iopl=0         nv up di ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00040082
nt!RtlpxVirtualUnwind+0x419:
fffff806`4df5ecf9 0fb600          movzx   eax,byte ptr [rax] ds:002b:00007fff`ffff0000=??

###################
# Here I've checked disasm of nt!RtlpxVirtualUnwind and its declaration somewhere on Github, just to make sure everything is in order.

################### kd> dps @rsp+e0 L1
fffff806`4b4f9180  fffff806`4b4f91c0
# That's "ContextRecord" arg to RtlpxVirtualUnwind func, checks out with r11 in trap frame above.

################### kd> .cxr @r11
rax=ffffffffc0000005 rbx=0000000000000000 rcx=fffff8064b4f91c0
rdx=fffff8064b4f8ec0 rsi=00007fffffff0000 rdi=00000000000035d0
rip=0000000000040282 rsp=fffffe0df4def438 rbp=0000000000300000
 r8=fffff8064b4f8ee0  r9=fffff8064b4f8950 r10=0000000000000018
r11=fffff8064b4f9130 r12=fffff8064cf843a0 r13=0000000000000001
r14=0000000000001200 r15=0000000001000000
iopl=0         nv up di ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050086
00000000`00040282 ??              ???

# Function RtlDispatchException repeatedly invokes RtlpxVirtualUnwind to perform unwinding (with virtual CONTEXT on the stack of RtlDispatchException).
# Somehow it came to situatuion where virtual RIP == 40282, and that checks out with R8 "ControlPC" argument for RtlpxVirtualUnwind. Note CS==10, so it's still ring0 code. Just virtual RIP is wrong (it actually looks like eflags), so likely unwinding information is broken/invalid.
# If you examine code of RtlpxVirtualUnwind leading to final exception, you'll see function checks RIP to determine cpu mode, which is unusual (and feels wrong). So having RIP==40282, func assumes cpu mode was ring3, and so it proceeds to sanitize virtual RSP, and also tries to dereference it (in tryblock).
# Original virtual RSP was regular ring0 stack address, so it got sanitized to userprobe region (7FFF`FFFF`0000 on this system). Since that region is never accessible, further probe-dereference caused Page Fault. That dereference was done in try-except block, but KiPageFault made no attempt to invoke exception dispatcher, but rather bugchecked system right away. That's because interrupts were disabled at that time (bugcheck params show IRQL is FF, and EFLAGS also have cleared bit9) - so taking pagefault was not an option.

###################
----------------------------------------------------------------------------------------------------
# Here I've switched to full kernel dump, coz minidump didn't contain instructions at shellcode-like region.

################### kd> .cxr
Resetting default scope
################### kd> k
 # Child-SP          RetAddr               Call Site
00 fffff807`3acaadc8 fffff807`37c27da9     nt!KeBugCheckEx
01 fffff807`3acaadd0 fffff807`37c23434     nt!KiBugCheckDispatch+0x69
02 fffff807`3acaaf10 fffff807`37b5ecf9     nt!KiPageFault+0x474
03 fffff807`3acab0a0 fffff807`37b5ce35     nt!RtlpxVirtualUnwind+0x419
04 fffff807`3acab160 fffff807`37a74ebe     nt!RtlDispatchException+0x215
05 fffff807`3acab8d0 fffff807`37c13902     nt!KiDispatchException+0x1ae
06 fffff807`3acabfb0 fffff807`37c138d0     nt!KxExceptionDispatchOnExceptionStack+0x12
07 fffff988`20ac70b8 fffff807`37c27ef5     nt!KiExceptionDispatchOnExceptionStackContinue
08 fffff988`20ac70c0 fffff807`37c22f83     nt!KiExceptionDispatch+0x135
09 fffff988`20ac72a0 ffffc780`21740215     nt!KiGeneralProtectionFault+0x343
0a fffff988`20ac7438 ffffc780`2173f000     0xffffc780`21740215
0b fffff988`20ac7440 fffff807`64a72415     0xffffc780`2173f000
0c fffff988`20ac7448 fffff988`20ac7418     cm+0x2415
0d fffff988`20ac7450 00000000`00040282     0xfffff988`20ac7418
0e fffff988`20ac7458 fffff807`64a73ef9     0x40282
0f fffff988`20ac7460 fffff807`64a738b0     cm+0x3ef9
10 fffff988`20ac75e0 fffff807`37b14d95     cm+0x38b0
11 fffff988`20ac7620 fffff807`37fcd140     nt!IofCallDriver+0x55
12 fffff988`20ac7660 fffff807`37fcc1d0     nt!IopSynchronousServiceTail+0x1d0
13 fffff988`20ac7710 fffff807`37fcb2a6     nt!IopXxxControlFile+0x700
14 fffff988`20ac7900 fffff807`37c274e5     nt!NtDeviceIoControlFile+0x56
15 fffff988`20ac7970 00007ffe`e378f4d4     nt!KiSystemServiceCopyEnd+0x25
16 000000cf`92d4f618 00000000`00000000     0x00007ffe`e378f4d4

################### kd> .trap fffff988`20ac72a0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000179b8 rbx=0000000000000000 rcx=ffffc780217569b8
rdx=0000000000000010 rsi=0000000000000000 rdi=0000000000000000
rip=ffffc78021740215 rsp=fffff98820ac7438 rbp=0000000000300000
 r8=ffff83023a2a9f00  r9=ffff83023a2a9f88 r10=0000000000000001
r11=ffffc78021740200 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di ng nz na po nc
ffffc780`21740215 660f7f01        movdqa  xmmword ptr [rcx],xmm0 ds:ffffc780`217569b8=00000000000000000000000000000000

################### kd> .cxr
################### kd> .frame /c /r a
0a fffff988`20ac7438 ffffc780`2173f000     0xffffc780`21740215
rax=00000000000179b8 rbx=0000000000000000 rcx=ffffc780217569b8
rdx=0000000000000010 rsi=00007fffffff0000 rdi=00000000000035d0
rip=ffffc78021740215 rsp=fffff98820ac7438 rbp=0000000000300000
 r8=ffff83023a2a9f00  r9=ffff83023a2a9f88 r10=0000000000000001
r11=ffffc78021740200 r12=fffff80764bf43a0 r13=0000000000000001
r14=0000000000001200 r15=0000000001000000
iopl=0         nv up di ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00040082
ffffc780`21740215 660f7f01        movdqa  xmmword ptr [rcx],xmm0 ds:002b:ffffc780`217569b8=00000000000000000000000000000000

# So the initial #GP exception is due to unaligned "movdqa" access.


>Let's find out the source of offending code.
################### kd> u .-15
ffffc780`21740200 4881e900120000  sub     rcx,1200h
ffffc780`21740207 48b8b879010000000000 mov rax,179B8h
ffffc780`21740211 51              push    rcx
ffffc780`21740212 4803c8          add     rcx,rax
ffffc780`21740215 660f7f01        movdqa  xmmword ptr [rcx],xmm0
ffffc780`21740219 59              pop     rcx
ffffc780`2174021a 66480f6ec1      movq    xmm0,rcx
ffffc780`2174021f 51              push    rcx
################### kd> u . L4
ffffc780`21740215 660f7f01        movdqa  xmmword ptr [rcx],xmm0
ffffc780`21740219 59              pop     rcx
ffffc780`2174021a 66480f6ec1      movq    xmm0,rcx
ffffc780`2174021f 51              push    rcx

################### kd> ? @rcx-179b8
Evaluate expression: -62121845723136 = ffffc780`2173f000

################### kd> lma .
Browse full module list
start             end                 module name
################### kd> !pool . 2
Pool page ffffc780217569b8 region is Unknown
ffffc78021756000 is not a valid large pool allocation, checking large session pool...
Unable to read large session pool table (Session data is not present in mini and kernel-only dumps)
ffffc78021756000 is not valid pool. Checking for freed (or corrupt) pool
Address ffffc78021756000 could not be read. It may be a freed, invalid or paged out page


# No dice with `lm` and `!pool`, let's check stack.
################### kd> dps @rsp L4
fffff988`20ac7438  ffffc780`2173f000
fffff988`20ac7440  fffff807`64a72415 cm+0x2415
fffff988`20ac7448  fffff988`20ac7418
fffff988`20ac7450  00000000`00040282

################### kd> ub cm+0x2415 L8
cm+0x23f5:
fffff807`64a723f5 8991b8f1ffff    mov     dword ptr [rcx-0E48h],edx
fffff807`64a723fb 8cea            mov     edx,gs
fffff807`64a723fd 8991bcf1ffff    mov     dword ptr [rcx-0E44h],edx
fffff807`64a72403 8cd2            mov     edx,ss
fffff807`64a72405 8991b0f1ffff    mov     dword ptr [rcx-0E50h],edx
fffff807`64a7240b 8cca            mov     edx,cs
fffff807`64a7240d 8991acf1ffff    mov     dword ptr [rcx-0E54h],edx
fffff807`64a72413 ffd1            call    rcx
################### kd> u cm+0x2415 L2
cm+0x2415:
fffff807`64a72415 4881c100120000  add     rcx,1200h
fffff807`64a7241c 488b916cf1ffff  mov     rdx,qword ptr [rcx-0E94h]

################### kd> u .-15 L2
ffffc780`21740200 4881e900120000  sub     rcx,1200h
ffffc780`21740207 48b8b879010000000000 mov rax,179B8h
################### kd> db .-15 L10
ffffc780`21740200  48 81 e9 00 12 00 00 48-b8 b8 79 01 00 00 00 00  H......H..y.....
################### kd> s -b cm L100000 48 81 e9 00 12 00 00 48 b8 b8 79 01
fffff807`64a76340  48 81 e9 00 12 00 00 48-b8 b8 79 01 00 00 00 00  H......H..y.....
################### kd> ? fffff807`64a76340 - cm
Evaluate expression: 25408 = 00000000`00006340

################### kd> !dh cm
...
SECTION HEADER #4
   .data name
    6000 virtual address
  XXXX00 size of raw data
...

# Code from shellcode-like region also present in `cm` driver at offset 6340, in ".data" section.


###################
So the case is solved. General Protection exception happened due to unaligned access with "movdqa" instruction, situated in shellcode-like region. Offending shellcode was invoked from the "cm" driver, and that shellcode also present in the driver's ".data" section.
Windows attempt to dispatch #GP exception resulted in #PF exception on invalid virtual RSP dereference in RtlpxVirtualUnwind. Invalid virtual RSP came to be due to absense of unwinding information in the shellcode. Since interrupts were disabled during "movdqa" instruction execution (and thus also during page fault), Windows Page Fault handler triggered appropriate bugcheck.

What I would consider to solve the issue:
1) Align important shellcode regions. The safest x86/64 min alignment whatsoever is 0x40.
2) Alternatively, use "movdqu" instead of "movdqa". Their performance is basically the same for modern CPUs anyway.
3) If exceptions are expected to propagate across shellcode funcs, they ought to be structured as leaf functions (i.e. no change to RSP or non-volatile regs, no other func invocations).