In this case, a thread encountered the exception
Executing an instruction not allowed in current machine mode.
This error was raised by the CPU itself. Some code tried to execute an instruction that it isn't allowed to do. Likely this is caused by memory corruption; where kernel code tried to execute junk data.
This kind of error really is impossible to pinpoint. There was an error in "kernel" code that shouldn't have happened. It's extraordinarily unlikely that there's a software bug in any of Microsoft's code; which is when you begin to look elsewhere.
- Third Party Drivers. Kernel mode drives have full access to the physical hardware. Any stray bug in any 3rd party driver (e.g. video, sound, network, USB 3.0, SATA) and it can corrupt code or data of anything else in the system. Next steps: try removing newly added hardware (so some third party drivers are not loaded), try booting in safe mode (so some third party drivers are not loaded), or reinstall Windows (so some 3rd party drivers are not loaded)
- Bad RAM. If a bit was flipped, and it turned a perfectly benign instruction into a different, invalid, instruction, you could get this error. Next Steps: Remove RAM stick, move RAM to other slots, unclock RAM, change power supplies
Overclocking. Sometimes extraordinarily strange things can happen when you overclock. Hopefully everyone is sending Microsoft their crash dumps; because Microsoft does investigate them. A common error they would get is when the CPU is executing the instruction:
xor eax, eax;
This is an extraordinarily simple operation that the CPU can execute; it's simply setting an internal CPU register
EAX to zero. There's no way it can fail; except when you overclock - or other physical problems.
tl;dr: If you've eliminated the software, then it's the hardware.
Update: Troubleshooting Methodology
i wanted to mention the details that i went through, almost mindlessly when looking at this error.
The first was the actual bugcheck code:
0x1000007E - SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
Binging that on Google gives the Microsoft documentation page
Bug Check 0x1000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
This indicates that a system thread generated an exception which the error handler did not catch.
i know, from experience being a developer, that if my application (or one of its threads) experiences an "exception", and i don't "handle" the exception, Windows will eventually handle it by killing the application. If an unhandled exception happens while in kernel mode, the OS has no choice but to handle it by shutting down the kernel. What i was interested in is which exception was being thrown. i assumed (incorrectly, it turns out) it was an "Access Violation".
i know that all bugchecks are accompanied by four parameters that describe what actually happened:
- Parameter 1: 0xFFFFFFFFC0000096
- Parameter 2: 0xFFFFF80003610698
- Parameter 3: 0xFFFFF8800614C7B8
- Parameter 4: 0xFFFFF8800614C010
But what the hell do these mean?! That's when we turn back to the documentation page, which doesn't describe them. But it does say:
Bug check 0x1000007E has the same meaning and parameters as bug check 0x7E (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED).
Excellent. And this other page documents the parameters:
The following parameters appear on the blue screen.
- Parameter 1: The exception code that was not handled
- Parameter 2: The address where the exception occurred
- Parameter 3: The address of the exception record
- Parameter 4: The address of the context record
This is what i wanted, the exception code that was not handled. In your case it was exception code:
i know, from experience, that you're running on a 64-bit Windows, because that code is 64-bits long. Really i only want the lower 32-bits:
Normally i would have expected to find that error code in
winerror.h in my development directory; but it wasn't there. It took some Binging, but i found that searching for:
lead me to a page on winehq, that declared the constant:
STATUS_PRIVILEGED_INSTRUCTION = 0xC0000096
Binging for that constant lead me a canonical Microsoft documentation page:
STATUS_PRIVILEGED_INSTRUCTION:Executing an instruction not allowed in current machine mode.
I also know that this exception is thrown by the CPU itself. i know that because "Privileged Instruction" means you tried to execute a CPU instruction you're not allowed. i also can know this because the page is called Hardware Exceptions.
So we're at the point were some code was running that tried to execute a CPU instruction it wasn't supposed to. There's two possibilities:
- memory was corrupted; the software wasn't written to try to execute that code, but that's what just ended up in RAM
- it really is buggy software, and it tried to do something it's not allowed.
Given that Microsoft's code is constantly being field tested in millions of machine's every day, it's more likely:
- to be a problem with your hardware
- a bug in someone else's code causing problems
Anyway, that was how i worked on that bugcheck. Maybe by knowing how i went through it, it can help you the next time you have a bugcheck.