BSOD (SYSTEM_SERVICE_EXCEPTION 0x0000003b) on host machine immediately after powering on guest machine

[Anton Lisnenko]

Hello.

I get BSOD (SYSTEM_SERVICE_EXCEPTION 0x0000003b) immediately on host machine after powering on guest machine.

I have searched the forums and did not find anything corresponding to my problem.

Host: Windows 7 SP1 x64 Guest: Windows 2012

[Anton Lisnenko]

Minidump

[Anton Lisnenko]

Msinfo32 export. Russian language.

[Anton Lisnenko]

Configuration of VM that I try to launch. Default settings.

[Anton Lisnenko]

VBoxStartup.log

[sunlover]

According to the minidump the crash is caused by CProCtrl.sys driver, which is apparently a component of КриптоПро.

You could try to uninstall КриптоПро and check whether the crash is still happening.

[Anton Lisnenko]

Hello, sunlover.

Yes, it is CryptoPro. I have uninstalled it and my virtual machine had started normally, but after some seconds it gave another error. I will post vbox.log.

It is strange for me that BlueScreenView from Nirsoft did not point me to the CProCtrl.sys, only to ntoskrnl.exe

[Anton Lisnenko]

VBox.log

[Anton Lisnenko]

This error occurs when I start VM, Windows 2012 R2 setup tries to load the files and it occurs.

[sunlover]

You assigned 512MB of RAM for the VM. Most likely it is not enough for Windows Server 2012 R2 64bit. Actually Microsoft documented that: ​http://technet.microsoft.com/en-us/library/dn303418.aspx

Try to assign at least 1GB or better 2GB RAM for the VM.

[Anton Lisnenko]

Hello, sunlover.

Thanks for an answer.

I have 2 questions.

1. But what to do with CProCtrl.sys (CryptoPro/КриптоПро)? It is latest version. I need this software, it is for an authentication purposes with smart-card. I suppose nobody will fix it from VirtualBox developers?
2. I've tried with 2 GB of RAM some minutes ago and the result was also disappointing. I will attach a screenshot.

[sunlover]

From the log:

00:00:02.458333 CPUM: WARNING! Can't turn on NX/XD when the host doesn't support it!

Apparently eXecute Disable (XD) is turned off in your host BIOS. Check your BIOS and make sure this is enabled. Core i3-380M CPU supports this feature.

[Anton Lisnenko]

Hello, sunlover.

I didn't even think about it. I thought it was enabled. I have only Virtualization switch in my BIOS. :(

[sunlover]

To answer your questions from comment 5:

1) It is not clear whether it is a problem with CryptoPro or with VirtualBox. We can not spend resources on investigations. It would be necessary to reproduce it here.

Please try to get a full memory dump for the BSOD, upload the dump somewhere and send me the URL to Vitali dot Pelenjow at oracle dot com.

2) If 'eXecute Disable' is turned off, then it is not possible to run this guest. Maybe this feature is called differently in the BIOS? Also you could check if there is a newer BIOS and try to update it.

[Frank Mehnert]

And please also try to enable DEP in your Windows system settings (System, Performance Options, Data Execution Prevention / DEP).

[Anton Lisnenko]

Hello, frank.

It is enabled only for main programs and windows services and there is written (in my translation):

--- Processor of this computer does not allow hardware DEP support. However you can use software DEP support to prevent some kinds of attacks. ---

I will test second variant with "All programs and services" and post reply.

[Anton Lisnenko]

Hello, sunlover.

Thanks for an answers.

1. I've made and uploaded full memory dump.

​https://drive.google.com/file/d/0B2AsTKauiGfEdmpVWlc1MWhYT2c/view?usp=sharing

2. Unfortunately no, this is known problem with Insyde BIOSes.

One of many links corresponding to this problem - ​http://h30434.www3.hp.com/t5/Notebook-Hardware/Insyde-BIOS-Silently-Disables-NX-DX-DEP-Security-Features/td-p/291826

[sunlover]

Thanks for the dump. CProCtrl driver calls RtlImageNtHeader with an invalid module address (0x00000000`60000000). It looks like some problem with CryptoPro. You probably could contact CryptoPro developers and pass the dump to them.

Also it is not possible to run Windows Server 2012 guest on your system because of hardware limitation (no XD).

[Anton Lisnenko]

Hello, Frank.

I've tried to enable DEP for all programs and services and launch Windows 2012 R2 guest OS.

The result is the same as shown in screenshots, that I've attached earlier.

[Anton Lisnenko]

Hello.

It seems to me that I had not the latest version of CryptoPro installed, but I couldn't get more latest version, because there weren't any links on the official site of CryptoPro. ​https://www.cryptopro.ru/products/uec/arm_ca

I have contacted their technical support and they:

1. Gave me version 3.9.8209

​https://www.cryptopro.ru/system/files/private/uec/1.05.1643_3.9.8209/cadespluginucsp.exe (Special version of CryptoPro CSP for UECARD) and told me that the problem with bsods was fixed in "CSP (Normal) 3.6 R4" two years ago. But there were no links on their official web-site, section for UECARDs. That section had only this list:

---

CryptoPro CSP 3.6 R2 for 32-bit OS

CryptoPro CSP 3.6 R2 for 64-bit OS

CryptoPro UEC CSP (CryptoPro CSP 3.6.1 fix.8 together with Browser plug-in). Версия 1.5.1493 (Version of UEC CSP 3.6.6784)

---

I have installed third version in this list and all this thread down to this message is about problems with it.

2. Gave me link to their thread, where this problem is also discussed. They tell that it is the problem of VirtualBox and it's developers.

​http://www.cryptopro.ru/forum2/default.aspx?g=posts&m=51797#post51797

When I installed latest VirtualBox and CryptoPro, launched VM, there was no BSOD, but there were errors, that I will attach on the screenshots.

[sunlover]

Please attach VBoxStartup.log (see errors-2.jpg).

[Anton Lisnenko]

Hello, sunlover.

Sorry, forgot to do it! Here it comes.

[petruchito]

I just have encountered similar BSODs on Win7 x64, CryptoPro 3.6RT and VirtualBox 4.3.26-98988, after removing the CryptoPro the problem disappeared.

This can be due to their USB drivers for Rutoken USB key and they can use USB mass storage devices as a token too...

[Sagrer]

it seems that a workaround posted here: ​http://www.cryptopro.ru/forum2/default.aspx?g=posts&m=55035#post55035

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\CProExclude\VirtualBox]
"FileName"="VirtualBox.exe"

and reboot