Cannot start any VM guest: Make sure the kernel module has been loaded successfully. VERR_SUP_VP_MEMORY_VS_FILE_MISMATCH -Error -5600 in supR3HardenedWinReSpawn! (enmWhat=3)

[floogy]

Hello,

I got an issue after upgrading from 6.0.22r 137980 to 6.1.12r 139181.

{{{When starting a VM-guest, I receive an error message NtCreateFile(\Device\VBoxDrvStub) failed: unknown Status -5600 (0xffffea20) (rcNt=0xe986ea20) CBoxDrvStub error: ntdll.dll: 11 difference between 0x9fe12 and 0x9fe1c in #1 (.text), first: 8b != b8(rc=-5600)

Make sure the kernel module has been loaded successfully.

where supR3HardenedWinReSpawn what: 3 VERR_SUP_VP_MEMORY_VS_FILE_MISMATCH (-5600) - Process Verification Failure: The memory content does not match the image file.}}}

I may run into this, because I didn't instantly restarted the Windows 10 (2004) host after Installation? Also the installer complained the first try, that something (i don't remember, what) was in use by virtualBox. I then restarted the installer and everything went just fine on the second try. But I didn't saw the message box that instructed to reboot, and the installer offered to start virtualbox instead immediately! The virualbox management Window got focus and covered the prompt "You must reboot your computer!".

The VirtualBox Window popped up a message box that prompted for updating the VirtualBox 6.1.12 Oracle VM VirtualBox Extension Pack!

So I just installed it and THEN I rebooted (maybe this is the culprit? If so, the installer shouldn't allow to start VirtualBox instantly, if in the fierst place it should restart the host to install virtual box first completely before updating the extension pack! Not to mention the focus issue of the covered prompt to reboot to fully perform the installation and complete the process ...

I found an outdated bug report (5 years ago) somewhat related:

VirtualBox 4.3.26 https://www.virtualbox.org/query?status=%21closed&version=VirtualBox+4.3.26 (closed defect: fixed) Opened 5 years ago Last modified 4 years ago VirtualBox fails to launch any virtual machine: NtCreateFile failed https://www.virtualbox.org/ticket/14052

Now the errors:

The virtual machine 'Debian pv10' has terminated unexpectedly during startup with exit code 1 (0x1).  More details may be available in 'L:\Data\VirtualBox VMs\Debian pv10\Logs\VBoxHardening.log'.

Fehlercode: E_FAIL (0x80004005)
Komponente: MachineWrap
Interface: IMachine {85632c68-b5bb-4316-a900-5eb28d3413df}

35e8.550c: supR3HardNtChildPurify: Done after 517 ms and 0 fixes (loop #0).
384c.548c: Log file opened: 6.1.12r139181 g_hStartupLog=0000000000000004 g_uNtVerCombined=0xa047bb00
384c.548c: supR3HardenedVmProcessInit: uNtDllAddr=00007ffc7dac0000 g_uNtVerCombined=0xa047bb00 (stack ~00000000010ffa48)
384c.548c: ntdll.dll: timestamp 0xb29ecf52 (rc=VINF_SUCCESS)
384c.548c: New simple heap: #1 0000000001200000 LB 0x400000 (for 2031616 allocation)
384c.548c: supR3HardenedWinInitAppBin(0x0): '\Device\HarddiskVolume17\Program Files\Oracle\VirtualBox'
384c.548c: System32:  \Device\HarddiskVolume17\Windows\System32
384c.548c: WinSxS:    \Device\HarddiskVolume17\Windows\WinSxS
384c.548c: KnownDllPath: C:\Windows\System32
384c.548c: supR3HardenedVmProcessInit: Opening vboxdrv stub...
35e8.550c: supR3HardNtEnableThreadCreationEx:
384c.548c: supR3HardenedWinReadErrorInfoDevice: 'ntdll.dll: 11 differences between 0x9fe12 and 0x9fe1c in #1 (.text), first: 8b != b8'
384c.548c: Error -5600 in supR3HardenedWinReSpawn! (enmWhat=3)
384c.548c: NtCreateFile(\Device\VBoxDrvStub) failed: Unknown Status -5600 (0xffffea20) (rcNt=0xe986ea20)
VBoxDrvStub error: ntdll.dll: 11 differences between 0x9fe12 and 0x9fe1c in #1 (.text), first: 8b != b8
35e8.550c: supR3HardenedWinCheckChild: enmRequest=2 rc=-5600 enmWhat=3 supR3HardenedWinReSpawn: NtCreateFile(\Device\VBoxDrvStub) failed: Unknown Status -5600 (0xffffea20) (rcNt=0xe986ea20)
VBoxDrvStub error: ntdll.dll: 11 differences between 0x9fe12 and 0x9fe1c in #1 (.text), first: 8b != b8
384c.548c: KiUserExceptionDispatcher: 0xc0000005 (0000000000000001, 0000000000000024) @ 00007ffc7dac72a6 (flags=0x0)
  rax=0000000000000000 rbx=00007ffc7dc252c0 rcx=00007ffc7dc252c0 rdx=00000000fffffffa
  rsi=0000000000000000 rdi=00007ffc7dc24f00 r8 =0000000000000000 r9 =00007ffc7dc25200
  r10=0000000000000000 r11=00000000010f92e0 r12=0000000000000000 r13=0000000000f34000
  r14=0000000000000001 r15=0000000000000000  P1=0000000000000000  P2=0000000000000000
  rip=00007ffc7dac72a6 rsp=00000000010f9140 rbp=00000000ffffea00    ctxflags=0010005f
  cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b    eflags=00010213   mxcrx=00001f80
   P3=0000000000000000  P4=0000000000000000  P5=00000000010f9368  P6=00007ff7fa73a900
  dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000 dr3=0000000000000000
  dr6=0000000000000000 dr7=0000000000000000 vcr=00007ff7fa6d47f0 dcr=00000000010f9300
  lbt=0000000000000000 lbf=0000000000000000 lxt=0000000000000000 lxf=0000000000000000
35e8.550c: Error -5600 in supR3HardenedWinReSpawn! (enmWhat=3)
35e8.550c: NtCreateFile(\Device\VBoxDrvStub) failed: Unknown Status -5600 (0xffffea20) (rcNt=0xe986ea20)
VBoxDrvStub error: ntdll.dll: 11 differences between 0x9fe12 and 0x9fe1c in #1 (.text), first: 8b != b8

I'll attach the complete VBox Hardening.log

Thanks in Advance

floogy

[floogy]

Error 1

[floogy]

Error In supR3HardeningWinReSpawn

[floogy]

Error

[floogy]

Log: VBoxHardening.7z

[floogy]

Wanted to include the image in the body of the report and change the first code block, so that it would appear visual in the style of a codeblock ... Don't know how, though.

[floogy]

Ooops: After another (second) reboot of the Windows 10 Host the error is gone and VirtualBox works expected. At least I'm able to boot into the Debian 10 Buster VM guest!

I'm sorry for the noise.

But maybe the installer should not offer to start virtual box immediately, but gives a hint to reboot the Host a second time on eventually occurring errors, and takes focus in foreground to prompt for reboot as a feature request ...

Kind regards

floogy