7

I have a freshly-installed 64-bit Windows 10 system, with VirtualBox installed and a CentOS 7.0 VM image. Whenever I try to start the VM, Windows BSODs with SYSTEM_SERVICE_EXCEPTION, code 0x0000003b.

After extensive (and frustrating) Googling, I have found many references to this being caused by Windows 10's Hyper-V virtualisation, so I have turned this off via Windows Features; and ensured that no Hyper-V services are running, or set to run on startup. This has not prevented the BSODs.

This exact same setup, including hardware, but with Win 7 32-bit instead of Win 10 64-bit, was working perfectly until IT re-imaged my machine to Windows 10.

Below is the output of VBox.log, although it doesn't look like anything relevant is in it.

VirtualBox VM 5.0.40 r115130 win.amd64 (Apr 28 2017 19:55:07) release log
00:00:00.308913 Log opened 2017-07-10T13:36:10.933562500Z
00:00:00.308914 Build Type: release
00:00:00.308917 OS Product: Windows 10
00:00:00.308918 OS Release: 10.0.14393
00:00:00.308918 OS Service Pack: 
00:00:00.383912 DMI Product Name: B85M-E
00:00:00.386322 DMI Product Version:  
00:00:00.386327 Host RAM: 8063MB total, 3856MB available
00:00:00.386329 Executable: C:\Program Files\Oracle\VirtualBox\VBoxHeadless.exe
00:00:00.386329 Process ID: 9952
00:00:00.386330 Package type: WINDOWS_64BITS_GENERIC
00:00:00.389754 Installed Extension Packs:
00:00:00.389787   None installed!

Can anyone suggest a way forward?

Edit: Minidump available here, for identical failure except on VirtualBox v 5.1.22.

  • You are not running 1703 is there a reason? Honestly this sounds like a problem only your IT department can diagnose since your unlikely to have the ability/permission require to get the required information to diagnose the crash. Specifically, we would need the dmp file created, otherwise we can't perform any trace analysis – Ramhound Jul 10 '17 at 14:40
  • @Ramhound - 1703 being a version of Windows or VirtualBox? I do have (many) minidump files for the crashes, if you can point me somewhere I should submit them. – Chowlett Jul 10 '17 at 14:47
  • How you get the dmp file to us is entirely up to you, be sure you have permission to release them, it's something you should upload without permission. 1703 is the current feature update of Windows 10, you currently are running 1607, again this is the type of problem your IT staff should be looking into not you. You don't indicate what version of VirtualBox you are even using. – Ramhound Jul 10 '17 at 14:49
  • @Ramhound - ok, thanks. This is the version of Win 10 imaged on to my system by IT; I can check if they're OK with upgrading. I would guess they're unlikely to be able to offer much help with the problem itself, although I am talking to them in parallel. VirtualBox is version 5.0.40 in that log (it says at the top), because a colleague has that as Known Good; it also fails with 5.1.22 (latest stable). I'll check if I can release my DMPs. – Chowlett Jul 10 '17 at 14:58
  • Are you running the latest drivers as provided by your motherboard or computer vendor? – Steven Jul 10 '17 at 15:01
6

As it turns out, disabling Hyper-V is not enough. There is another Windows feature, called Virtualization Based Security, that employs Hyper-V. You need to disable that as well.

All I needed to do was to change one registry key and reboot:

Use regedit to set

HKEY_LOCAL_MACHINE\SYSTEM\Software\CurrentControlSet\Control\DeviceGuard

to 0, and reboot.

There is a nice description of Device Guard / Virtualization Based Security here: Windows 10 Device Guard and Credential Guard Demystified.

  • 2
    Early indications are good for this fix - except that the key was HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\EnableVirtualizationBasedSecurity on our system (Windows 10 Enterprise Version 1607 (OS Build 14393.1770)) – Chowlett Oct 31 '17 at 15:46
3

Have this issue on the new Windows 10 Fall Creator Update (1709) build 16299 and Virtual Box. Both VirtualBox versions were tested also: - Version 5.1.26 r117224 (Qt5.6.2) - Version 5.2.2 r119230 (Qt5.6.2) HyperV features are NOT deployed but by default, MSINFO32 shows up "Hypervisor enforced Code Integrity" on the new Fall Creator Update build.

Result from MSINFO32.EXE enter image description here

It looks like that this feature will lead VirtualBox to a BSOD.

You lucky guys, there is a fast and dirty way to fix this: DISABLE SECURE BOOT.

(Just to test!!! your security department won't like it) If I get a clean solution I'll post it ;-)

Cheers

  • Hi guys, this issue will happen when Hyper-V is enabled. – Laurent Vonau Feb 23 '18 at 14:22
  • Note that Hyper-V can run even if you disable the feature! This happens if you enable VBS (Virtual Based Security) like for instance Credential Guard. Check output from msinfo32.exe to know if it's running or not. In this case, W10 starts "virtualized" (NVRAM para hypervisorlaunchtype = Auto). So in fact, on W10, when HV or VBS is running, your OS is "virtualized", hence, VirtualBox won't like it. I think these guys should check if W10 is running this mode or not, and display a message "Can I make crash your Windows?" – Laurent Vonau Feb 23 '18 at 14:32
0

we can't fix this because Windbg shows the Virtualbox driver as cause, wich tries to execute a command that is not allowed (Privileged instruction):

EXCEPTION_CODE: (NTSTATUS) 0xc0000096 - Privileged instruction.

00 nt!KeBugCheckEx
01 nt!KiBugCheckDispatch
02 nt!KiSystemServiceHandler
03 nt!RtlpExecuteHandlerForException
04 nt!RtlDispatchException
05 nt!KiDispatchException
06 nt!KiExceptionDispatch
07 nt!KiGeneralProtectionFault
08 0x0
09 0x0
0a 0x0
0b VMMR0

    Image path: \??\C:\Program Files\Oracle\VirtualBox\VMMR0.r0
    Image name: VMMR0.r0
    Browse all global symbols  functions  data
    Timestamp:        Fri Apr 28 17:37:03 2017 

try lastest testbuilds and if you still get the issue report it to the developers in their bug tracker .

  • Apologies if this is a dumb question (I confess to not being knowledgeable about Windows internals), but are apps run as Administrator allowed to execute Privileged instructions? – Chowlett Jul 10 '17 at 16:02
  • Privileged instructions refers to special rings where some calls are not allowed – magicandre1981 Jul 10 '17 at 16:21
  • Ok. I can log a bug with VirtualBox. I'm a little surprised, though, that a bug like this doesn't affect everyone running that combination of OS and application. Any idea why that would be? – Chowlett Jul 10 '17 at 16:26
0

On this Windows 10 Enterprise ("10.0.16299 Build 16299") machine in addition to n0ha's answer I had to disable Device Guard/Credential Guard:

On the host operating system, click Start > Run, type gpedit.msc, and click Ok. The Local group Policy Editor opens.

Go to Local Computer Policy > Computer Configuration > Administrative Templates > System > Device Guard > Turn on Virtualization Based Security.

Select Disabled.

Doing both re-enabled the "Acceleration" tab and stopped the HYPERVISOR_ERROR BSODs on VM start.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.