POE 2 Complete PC Freeze while loading screen

After countless hours and money spent on trying to figure out why my game was crashing I finally determined the root cause.

For those of you with an i9 14900k go to your bios settings and sync all pcore ratios to 55. This completely fixed the game for me and I'm even able to use directx12 with everything on high settings
And the newest version of windows 24h2

I hope this helps someone

Good luck out there exiles
Zuletzt bearbeitet von glitche#2433 um 18.02.2025, 23:57:27
Even after the new patch. still hard crashing. this sucks.
Reminder to use the "--ex-crash-report" to send crash report data to GGG whenever you crash.

(freeze or crash, both works)

For Steam:

Goto Library->Path of Exile 2 properties by right-clicking the icon->General->Launch Option-> Add --ex-crash-report
to the box.



For Standalone client:

Right the desktop shortcut->Properties->In the target field add --ex-crash-report



Zuletzt bearbeitet von Climet#7103 um 18.02.2025, 06:37:18
"
Cainrith#2807 schrieb:
"
IceCool10#6669 schrieb:
Ok, so because I was angry and my pc still freezes I was investigating the bug a bit more and it seems to be a deadlock at first glance. I triggered the bug multiple times with multiple breakpoints.

I hope this helps and this bug will be fixed....
I will try to investigate it further when I have some time


From what I've seen:

First of all: All the first few frames are from PathOfExileSteam, meaning the crash originates within the game’s own code, not a system DLL (like ntdll.dll or KERNEL32.dll).

...


Something tells me the two of you would have solved this issue in 1 day if you where given permissions to the actual code.

Would be so sad but hilarious if the actual issue is because someone commented out code somewhere in the engine that no-one dares to touch anymore. Or if it were their own doing even: like "This piece of code don't seem to do anything .. load-times will likely be a bit faster if we just remove it"

We will likely never know, but lets hope that the info might help them solve the issue. Im actually rooting for them. I believe no fans of the genre actually wants to see GGG fail.

This old crappy engine they are using is really staring to become a huge problem though.

Zuletzt bearbeitet von snurrfint#5780 um 18.02.2025, 09:03:25
Because I have some time I tried to investigate the hang some more. But then I saw that there was an update and I tried to generate the hang "burning" some low tier maps. Entering the map and then go back to hideout and after like 10+ maps I had 0 crashes :). Idk what happened and idk if my last analysis helped GGG but at first glance it seems to be fixed

// LE: Nvm. Just got a crash
Zuletzt bearbeitet von IceCool10#6669 um 18.02.2025, 13:21:56
can't play since I "upgraded" to windows 11...

online up to 5-10mins.

hard crash, freeze...

this is rubbish!

fix it please.

DxDiag has been sent.
I gave up and uninstalled the game.

Good luck.
Just uninstall the game at this point and move on with your life, it will not change any time soon or for the better. This trend has persisted for a while by GGG.

Call them out on every single social media platform, don't let them get away with this.

Like so may others I paid to play this game and I can not even do that.

There will be a fix in a few years... maybe... sigh



Someone should start a class action lawsuit to refund the early access purchase price.

They delivered not even half of what they promised in EA and the game is actually unplayable.
Zuletzt bearbeitet von Braric#4417 um 18.02.2025, 18:28:06
After some hours I've managed to trigger another crash again. And I kinda saw something. I can't say that I have some good info but who knows, maybe it helps. Also, my debugger bugged and it prints the same thing twice ( sorry about that ) but I didn't have that much time to make the output look nice and I didn't want to try to restart the debugger and try to generate another crash.

So I was printing the stack trace from all threads when the exception occurs:
"

# 15 Id: 298c.502c Suspend: 1 Teb: 000000be`6be5a000 Unfrozen
# Child-SP RetAddr Call Site
00 00 000000be`73ff7d50 00007ff6`42e90d27 KERNELBASE!RaiseException+0x8a
000000be`73ff7d50 00007ff6`42e90d27 KERNELBASE!RaiseException+0x8a
01 01 000000be`73ff7e50 00007ff6`42e87300 PathOfExileSteam+0x2360d27
000000be`73ff7e50 00007ff6`42e87300 PathOfExileSteam+0x2360d27
02 02 000000be`73ff7ec0 00007ff6`42f520c8 PathOfExileSteam+0x2357300
000000be`73ff7ec0 00007ff6`42f520c8 PathOfExileSteam+0x2357300
03 03 000000be`73ff7ef0 00007ff6`42e87260 PathOfExileSteam+0x24220c8
000000be`73ff7ef0 00007ff6`42e87260 PathOfExileSteam+0x24220c8
04 04 000000be`73ff7f20 00007ff6`42e7e17e PathOfExileSteam+0x2357260
000000be`73ff7f20 00007ff6`42e7e17e PathOfExileSteam+0x2357260
05 05 000000be`73ff7f50 00007ff9`263a3886 PathOfExileSteam+0x234e17e
000000be`73ff7f50 00007ff9`263a3886 PathOfExileSteam+0x234e17e
06 06 000000be`73ff8020 00007ff6`417860b9 ntdll!RcConsolidateFrames+0x6
000000be`73ff8020 00007ff6`417860b9 ntdll!RcConsolidateFrames+0x6
07 07 000000be`73fff9e0 00007ff9`24ace8d7 PathOfExileSteam+0xc560b9
000000be`73fff9e0 00007ff9`24ace8d7 PathOfExileSteam+0xc560b9
08 08 000000be`73fffa40 00007ff9`2633bf2c KERNEL32!BaseThreadInitThunk+0x17
000000be`73fffa40 00007ff9`2633bf2c KERNEL32!BaseThreadInitThunk+0x17
09 09 000000be`73fffa70 00000000`00000000 ntdll!RtlUserThreadStart+0x2c

16 Id: 298c.1910 Suspend: 1 Teb: 000000be`6be5c000 Unfrozen
# Child-SP RetAddr Call Site
000000be`73fffa70 00000000`00000000 ntdll!RtlUserThreadStart+0x2c

16 Id: 298c.1910 Suspend: 1 Teb: 000000be`6be5c000 Unfrozen
# Child-SP RetAddr Call Site
00 00 000000be`747ff908 00007ff9`262f3524 ntdll!NtWaitForAlertByThreadId+0x14
000000be`747ff908 00007ff9`262f3524 ntdll!NtWaitForAlertByThreadId+0x14
01 01 000000be`747ff910 00007ff9`23afde78 ntdll!RtlSleepConditionVariableSRW+0x1c4
000000be`747ff910 00007ff9`23afde78 ntdll!RtlSleepConditionVariableSRW+0x1c4
02 02 000000be`747ff9b0 00007ff6`42e06a19 KERNELBASE!SleepConditionVariableSRW+0x38
000000be`747ff9b0 00007ff6`42e06a19 KERNELBASE!SleepConditionVariableSRW+0x38
03 03 000000be`747ff9f0 00007ff6`41785d7b PathOfExileSteam+0x22d6a19
000000be`747ff9f0 00007ff6`41785d7b PathOfExileSteam+0x22d6a19
04 04 000000be`747ffa20 00007ff6`417838d1 PathOfExileSteam+0xc55d7b
000000be`747ffa20 00007ff6`417838d1 PathOfExileSteam+0xc55d7b
05 05 000000be`747ffa50 00007ff6`40cfb636 PathOfExileSteam+0xc538d1
000000be`747ffa50 00007ff6`40cfb636 PathOfExileSteam+0xc538d1
06 06 000000be`747ffaa0 00007ff6`40cfaf71 PathOfExileSteam+0x1cb636
000000be`747ffaa0 00007ff6`40cfaf71 PathOfExileSteam+0x1cb636
07 07 000000be`747ffad0 00007ff6`417860b9 PathOfExileSteam+0x1caf71
000000be`747ffad0 00007ff6`417860b9 PathOfExileSteam+0x1caf71
08 08 000000be`747ffb00 00007ff9`24ace8d7 PathOfExileSteam+0xc560b9
000000be`747ffb00 00007ff9`24ace8d7 PathOfExileSteam+0xc560b9
09 09 000000be`747ffb60 00007ff9`2633bf2c KERNEL32!BaseThreadInitThunk+0x17
000000be`747ffb60 00007ff9`2633bf2c KERNEL32!BaseThreadInitThunk+0x17
0a 0a 000000be`747ffb90 00000000`00000000 ntdll!RtlUserThreadStart+0x2c

17 Id: 298c.4ab4 Suspend: 1 Teb: 000000be`6be5e000 Unfrozen
# Child-SP RetAddr Call Site
000000be`747ffb90 00000000`00000000 ntdll!RtlUserThreadStart+0x2c

17 Id: 298c.4ab4 Suspend: 1 Teb: 000000be`6be5e000 Unfrozen
# Child-SP RetAddr Call Site
00 00 000000be`74fff558 00007ff9`262f3524 ntdll!NtWaitForAlertByThreadId+0x14
000000be`74fff558 00007ff9`262f3524 ntdll!NtWaitForAlertByThreadId+0x14
01 01 000000be`74fff560 00007ff9`23afde78 ntdll!RtlSleepConditionVariableSRW+0x1c4
000000be`74fff560 00007ff9`23afde78 ntdll!RtlSleepConditionVariableSRW+0x1c4
02 02 000000be`74fff600 00007ff6`42e06a19 KERNELBASE!SleepConditionVariableSRW+0x38
000000be`74fff600 00007ff6`42e06a19 KERNELBASE!SleepConditionVariableSRW+0x38
03 03 000000be`74fff640 00007ff6`41785d7b PathOfExileSteam+0x22d6a19
000000be`74fff640 00007ff6`41785d7b PathOfExileSteam+0x22d6a19
04 04 000000be`74fff670 00007ff6`417838d1 PathOfExileSteam+0xc55d7b
000000be`74fff670 00007ff6`417838d1 PathOfExileSteam+0xc55d7b
05 05 000000be`74fff6a0 00007ff6`40cfb636 PathOfExileSteam+0xc538d1
000000be`74fff6a0 00007ff6`40cfb636 PathOfExileSteam+0xc538d1
06 06 000000be`74fff6f0 00007ff6`40cfaf71 PathOfExileSteam+0x1cb636
000000be`74fff6f0 00007ff6`40cfaf71 PathOfExileSteam+0x1cb636
07 07 000000be`74fff720 00007ff6`417860b9 PathOfExileSteam+0x1caf71
000000be`74fff720 00007ff6`417860b9 PathOfExileSteam+0x1caf71
08 08 000000be`74fff750 00007ff9`24ace8d7 PathOfExileSteam+0xc560b9
000000be`74fff750 00007ff9`24ace8d7 PathOfExileSteam+0xc560b9
09 09 000000be`74fff7b0 00007ff9`2633bf2c KERNEL32!BaseThreadInitThunk+0x17
000000be`74fff7b0 00007ff9`2633bf2c KERNEL32!BaseThreadInitThunk+0x17
0a 0a 000000be`74fff7e0 00000000`00000000 ntdll!RtlUserThreadStart+0x2c

18 Id: 298c.24b8 Suspend: 1 Teb: 000000be`6be60000 Unfrozen
# Child-SP RetAddr Call Site
000000be`74fff7e0 00000000`00000000 ntdll!RtlUserThreadStart+0x2c

18 Id: 298c.24b8 Suspend: 1 Teb: 000000be`6be60000 Unfrozen
# Child-SP RetAddr Call Site
00 00 000000be`757ffbd8 00007ff9`262f3524 ntdll!NtWaitForAlertByThreadId+0x14
000000be`757ffbd8 00007ff9`262f3524 ntdll!NtWaitForAlertByThreadId+0x14
01 01 000000be`757ffbe0 00007ff9`23afde78 ntdll!RtlSleepConditionVariableSRW+0x1c4
000000be`757ffbe0 00007ff9`23afde78 ntdll!RtlSleepConditionVariableSRW+0x1c4
02 02 000000be`757ffc80 00007ff6`42e06a19 KERNELBASE!SleepConditionVariableSRW+0x38
000000be`757ffc80 00007ff6`42e06a19 KERNELBASE!SleepConditionVariableSRW+0x38
03 03 000000be`757ffcc0 00007ff6`41785d7b PathOfExileSteam+0x22d6a19
000000be`757ffcc0 00007ff6`41785d7b PathOfExileSteam+0x22d6a19
04 04 000000be`757ffcf0 00007ff6`417838d1 PathOfExileSteam+0xc55d7b
000000be`757ffcf0 00007ff6`417838d1 PathOfExileSteam+0xc55d7b
05 05 000000be`757ffd20 00007ff6`40cfb636 PathOfExileSteam+0xc538d1
000000be`757ffd20 00007ff6`40cfb636 PathOfExileSteam+0xc538d1
06 06 000000be`757ffd70 00007ff6`40cfaf71 PathOfExileSteam+0x1cb636
000000be`757ffd70 00007ff6`40cfaf71 PathOfExileSteam+0x1cb636
07 07 000000be`757ffda0 00007ff6`417860b9 PathOfExileSteam+0x1caf71
000000be`757ffda0 00007ff6`417860b9 PathOfExileSteam+0x1caf71
08 08 000000be`757ffdd0 00007ff9`24ace8d7 PathOfExileSteam+0xc560b9
000000be`757ffdd0 00007ff9`24ace8d7 PathOfExileSteam+0xc560b9
09 09 000000be`757ffe30 00007ff9`2633bf2c KERNEL32!BaseThreadInitThunk+0x17
000000be`757ffe30 00007ff9`2633bf2c KERNEL32!BaseThreadInitThunk+0x17
0a 0a 000000be`757ffe60 00000000`00000000 ntdll!RtlUserThreadStart+0x2c

19 Id: 298c.209c Suspend: 1 Teb: 000000be`6be62000 Unfrozen
# Child-SP RetAddr Call Site
000000be`757ffe60 00000000`00000000 ntdll!RtlUserThreadStart+0x2c

19 Id: 298c.209c Suspend: 1 Teb: 000000be`6be62000 Unfrozen
# Child-SP RetAddr Call Site
00 00 000000be`75fff578 00007ff9`262f3524 ntdll!NtWaitForAlertByThreadId+0x14
000000be`75fff578 00007ff9`262f3524 ntdll!NtWaitForAlertByThreadId+0x14
01 01 000000be`75fff580 00007ff9`23afde78 ntdll!RtlSleepConditionVariableSRW+0x1c4
000000be`75fff580 00007ff9`23afde78 ntdll!RtlSleepConditionVariableSRW+0x1c4
02 02 000000be`75fff620 00007ff6`42e06a19 KERNELBASE!SleepConditionVariableSRW+0x38
000000be`75fff620 00007ff6`42e06a19 KERNELBASE!SleepConditionVariableSRW+0x38
03 03 000000be`75fff660 00007ff6`41785d7b PathOfExileSteam+0x22d6a19
000000be`75fff660 00007ff6`41785d7b PathOfExileSteam+0x22d6a19
04 04 000000be`75fff690 00007ff6`417838d1 PathOfExileSteam+0xc55d7b
000000be`75fff690 00007ff6`417838d1 PathOfExileSteam+0xc55d7b
05 05 000000be`75fff6c0 00007ff6`40cfb636 PathOfExileSteam+0xc538d1
000000be`75fff6c0 00007ff6`40cfb636 PathOfExileSteam+0xc538d1
06 06 000000be`75fff710 00007ff6`40cfaf71 PathOfExileSteam+0x1cb636
000000be`75fff710 00007ff6`40cfaf71 PathOfExileSteam+0x1cb636
07 07 000000be`75fff740 00007ff6`417860b9 PathOfExileSteam+0x1caf71
000000be`75fff740 00007ff6`417860b9 PathOfExileSteam+0x1caf71
08 08 000000be`75fff770 00007ff9`24ace8d7 PathOfExileSteam+0xc560b9
000000be`75fff770 00007ff9`24ace8d7 PathOfExileSteam+0xc560b9
09 09 000000be`75fff7d0 00007ff9`2633bf2c KERNEL32!BaseThreadInitThunk+0x17
000000be`75fff7d0 00007ff9`2633bf2c KERNEL32!BaseThreadInitThunk+0x17
0a 0a 000000be`75fff800 00000000`00000000 ntdll!RtlUserThreadStart+0x2c


That is just a snippet but the thing is : Thread 15 has the same lpStartAddress as the others ( bold text ) and yes, that is a return address not the start address of the thread but based on the assembly code the start address is the same. But for some reason thread 15 generates an exception.


"
text:0000000140C560B0 sub_140C560B0 proc near ; DATA XREF: sub_140C53930+102↑o
.text:0000000140C560B0 ; .pdata:0000000143D42BB0↓o
.text:0000000140C560B0 ; __unwind { // __CxxFrameHandler4
.text:0000000140C560B0 48 83 EC 58 sub rsp, 58h
.text:0000000140C560B4 E8 A7 4E 57 FF call sub_1401CAF60
.text:0000000140C560B9 90 nop <--- this is the return address
.text:0000000140C560BA 33 C0 xor eax, eax
.text:0000000140C560BC 48 83 C4 58 add rsp, 58h
.text:0000000140C560C0 C3 retn
.text:0000000140C560C0 ; } // starts at 140C560B0
.text:0000000140C560C0 sub_140C560B0 endp


And this is the code that creates those threads:

"
.text:0000000140C53A16 C7 43 20 00 00 08 00 mov dword ptr [rbx+20h], 80000h
.text:0000000140C53A1D 41 8B C6 mov eax, r14d
.text:0000000140C53A20 86 03 xchg al, [rbx]
.text:0000000140C53A22 8B 53 20 mov edx, [rbx+20h] ; dwStackSize
.text:0000000140C53A25 4C 89 74 24 28 mov [rsp+0A8h+lpThreadId], r14 ; lpThreadId
.text:0000000140C53A2A 44 89 74 24 20 mov [rsp+0A8h+dwCreationFlags], r14d ; dwCreationFlags
.text:0000000140C53A2F 4C 8B CB mov r9, rbx ; lpParameter
.text:0000000140C53A32 4C 8D 05 77 26 00 00 lea r8, sub_140C560B0 ; lpStartAddress
.text:0000000140C53A39 33 C9 xor ecx, ecx ; lpThreadAttributes
.text:0000000140C53A3B FF 15 07 E9 8D 01 call cs:CreateThread <-------- This is the call that generates the thread
.text:0000000140C53A41 48 89 43 08 mov [rbx+8], rax
.text:0000000140C53A45 48 85 C0 test rax, rax
.text:0000000140C53A48 74 5C jz short loc_140C53AA6
.text:0000000140C53A4A EB 03 jmp short loc_140C53A4F



And those other threads that don't generate an exception are waiting and here is the code:

"
.text:00000001422D69F4 40 53 push rbx
.text:00000001422D69F6 48 83 EC 20 sub rsp, 20h
.text:00000001422D69FA 83 4A 48 FF or dword ptr [rdx+48h], 0FFFFFFFFh
.text:00000001422D69FE 48 8B DA mov rbx, rdx
.text:00000001422D6A01 FF 4A 4C dec dword ptr [rdx+4Ch]
.text:00000001422D6A04 48 83 C1 08 add rcx, 8 ; ConditionVariable
.text:00000001422D6A08 48 83 C2 10 add rdx, 10h ; SRWLock
.text:00000001422D6A0C 45 33 C9 xor r9d, r9d ; Flags <-------- Exclusive lock
.text:00000001422D6A0F 41 83 C8 FF or r8d, 0FFFFFFFFh ; dwMilliseconds
.text:00000001422D6A13 FF 15 77 BC 25 00 call cs:SleepConditionVariableSRW <----- Call that makes other threads wait
.text:00000001422D6A19 85 C0 test eax, eax


And this code is called from here ( from sub_140C55D10 ):

"

.text:0000000140C55D10 40 57 push rdi
.text:0000000140C55D12 48 83 EC 20 sub rsp, 20h
.text:0000000140C55D16 48 8B 41 08 mov rax, [rcx+8]
.text:0000000140C55D1A 48 8B F9 mov rdi, rcx <---------- First parameter
.text:0000000140C55D1D 0F B6 80 10 01 00 00 movzx eax, byte ptr [rax+110h]
.text:0000000140C55D24 84 C0 test al, al
.text:0000000140C55D26 74 6F jz short loc_140C55D97
.text:0000000140C55D28
.text:0000000140C55D28 loc_140C55D28: ; DATA XREF: .rdata:0000000142CD107C↓o
.text:0000000140C55D28 ; .rdata:0000000142CD108C↓o ...
.text:0000000140C55D28 48 89 5C 24 30 mov [rsp+28h+arg_0], rbx
.text:0000000140C55D2D 0F 1F 00 nop dword ptr [rax]
.text:0000000140C55D30
.text:0000000140C55D30 loc_140C55D30: ; CODE XREF: sub_140C55D10+80↓j
.text:0000000140C55D30 48 8B 47 20 mov rax, [rdi+20h]
.text:0000000140C55D34 4C 8B 47 18 mov r8, [rdi+18h]
.text:0000000140C55D38 48 8B 57 10 mov rdx, [rdi+10h]
.text:0000000140C55D3C 48 8B 4F 08 mov rcx, [rdi+8]
.text:0000000140C55D40 44 8B 48 28 mov r9d, [rax+28h]
.text:0000000140C55D44 44 03 48 24 add r9d, [rax+24h]
.text:0000000140C55D48 E8 A3 DD FF FF call sub_140C53AF0
.text:0000000140C55D4D 84 C0 test al, al
.text:0000000140C55D4F 75 32 jnz short loc_140C55D83
.text:0000000140C55D51 48 8B 5F 08 mov rbx, [rdi+8] <------ RBX comes from here ( a condition variable is read from rbx+0x50 -> see below), and RDI is the first parameter or this function
.text:0000000140C55D55 48 83 C3 30 add rbx, 30h ; '0'
.text:0000000140C55D59 48 8B CB mov rcx, rbx
.text:0000000140C55D5C E8 BF 3B 68 01 call sub_1422D9920
.text:0000000140C55D61 85 C0 test eax, eax
.text:0000000140C55D63 75 48 jnz short loc_140C55DAD
.text:0000000140C55D65 8B 43 4C mov eax, [rbx+4Ch]
.text:0000000140C55D68 3D FF FF FF 7F cmp eax, 7FFFFFFFh
.text:0000000140C55D6D 74 2E jz short loc_140C55D9D
.text:0000000140C55D6F 48 8D 4B 50 lea rcx, [rbx+50h] <------ Condition variable
.text:0000000140C55D73 48 8B D3 mov rdx, rbx
.text:0000000140C55D76 E8 79 0C 68 01 call sub_1422D69F4 <------ This is the call to the above function that calls SleepConditionVariableSRW
.text:0000000140C55D7B 48 8B CB mov rcx, rbx ; _Mtx_t
.text:0000000140C55D7E E8 A5 3B 68 01 call _Mtx_unlock


Then I searched for a call to this function (sub_140C55D10) to try to understand what might cause the exception but there are no calls. At least not in the main executable. All I could found was an array that contains this function:

"
.rdata:00000001427D3C30 C0 5D C5 40 01 00 00 00 off_1427D3C30 dq offset loc_140C55DC0 ; DATA XREF: sub_140C53CD0+390↑o
.rdata:00000001427D3C30 ; .text:loc_140C55DC0↑o
.rdata:00000001427D3C38 C0 5D C5 40 01 00 00 00 dq offset loc_140C55DC0
.rdata:00000001427D3C40 10 5D C5 40 01 00 00 00 dq offset sub_140C55D10
.rdata:00000001427D3C48 00 5D C5 40 01 00 00 00 dq offset sub_140C55D00
.rdata:00000001427D3C50 20 75 11 40 01 00 00 00 dq offset sub_140117520
.rdata:00000001427D3C58 40 4E 0D 40 01 00 00 00 dq offset ?GetLocaleT@_LocaleUpdate@@QEAAPEAU__crt_locale_pointers@@XZ ; _LocaleUpdate::GetLocaleT(void)



Then I've searched for that array in the code:
"
.text:0000000140C54054 48 8B 1E mov rbx, [rsi]
.text:0000000140C54057 48 8B 76 08 mov rsi, [rsi+8]
.text:0000000140C5405B 48 3B DE cmp rbx, rsi
.text:0000000140C5405E 74 6A jz short loc_140C540CA
.text:0000000140C54060 4C 8D 2D C9 FB B7 01 lea r13, off_1427D3C30 <------ the array
.text:0000000140C54067 4C 8B B5 38 01 00 00 mov r14, [rbp+100h+arg_28]
.text:0000000140C5406E 4C 8B BD 30 01 00 00 mov r15, [rbp+100h+arg_20]
.text:0000000140C54075 4C 8B A5 28 01 00 00 mov r12, [rbp+100h+arg_18]
.text:0000000140C5407C 0F 1F 40 00 nop dword ptr [rax+00h]
.text:0000000140C54080
.text:0000000140C54080 loc_140C54080: ; CODE XREF: sub_140C53CD0+3F8↓j
.text:0000000140C54080 48 89 7C 24 48 mov qword ptr [rsp+200h+pExceptionObject], rdi
.text:0000000140C54085 4C 89 7C 24 50 mov qword ptr [rsp+200h+pExceptionObject+8], r15
.text:0000000140C5408A 4C 89 74 24 58 mov [rsp+58h], r14
.text:0000000140C5408F 48 89 5C 24 60 mov [rsp+200h+var_1A0], rbx
.text:0000000140C54094 4C 89 6D 88 mov [rbp+100h+var_178], r13
.text:0000000140C54098 0F 10 44 24 48 movups xmm0, [rsp+200h+pExceptionObject]
.text:0000000140C5409D 0F 11 45 90 movups [rbp+100h+var_170], xmm0
.text:0000000140C540A1 0F 10 4C 24 58 movups xmm1, xmmword ptr [rsp+58h]
.text:0000000140C540A6 0F 11 4D A0 movups [rbp+100h+var_160], xmm1
.text:0000000140C540AA 48 8D 45 88 lea rax, [rbp+100h+var_178]
.text:0000000140C540AE 48 89 45 C0 mov [rbp+100h+var_140], rax
.text:0000000140C540B2 4C 8D 45 88 lea r8, [rbp+100h+var_178]



Ok, so this looks like a function that prepares an EXCEPTION_RECORD struct or something like that. Now this code seems to be called only if cmp rbx, rsi is NOT true ( RBX != RSI ) and RBX and RSI are two QWORDs that are sequentially in memory RBX = *RSI and then RSI = *(RSI+8). Now I was trying to understand what are those and when RBX != RSI but unfortunately I don't have too much time now. All I've seen was a
.text:0000000140C53EFC 48 8D B7 F8 00 00 00 lea rsi, [rdi+0F8h]
and
.text:0000000140C53CF8 49 8B F0 mov rsi, r8

So RSI comes initially from RDI+0xF8 or from the third parameter ?? ( although it's a variadic function ) ( probably first case -> RDI+0xF8 ).
And while I am writing this, Im pretty sure it's from [rdi+0xf8]. Seeing that 0xf8 I was like "WAIT A MINUTE!". I know that value. It's the offset of RIP from the _CONTEXT structure :).
"

0:015> dt -r _CONTEXT
MSVCP140!_CONTEXT
+0x000 P1Home : Uint8B
+0x008 P2Home : Uint8B
+0x010 P3Home : Uint8B
+0x018 P4Home : Uint8B
+0x020 P5Home : Uint8B
+0x028 P6Home : Uint8B
+0x030 ContextFlags : Uint4B
+0x034 MxCsr : Uint4B
+0x038 SegCs : Uint2B
+0x03a SegDs : Uint2B
+0x03c SegEs : Uint2B
+0x03e SegFs : Uint2B
+0x040 SegGs : Uint2B
+0x042 SegSs : Uint2B
+0x044 EFlags : Uint4B
+0x048 Dr0 : Uint8B
+0x050 Dr1 : Uint8B
+0x058 Dr2 : Uint8B
+0x060 Dr3 : Uint8B
+0x068 Dr6 : Uint8B
+0x070 Dr7 : Uint8B
+0x078 Rax : Uint8B
+0x080 Rcx : Uint8B
+0x088 Rdx : Uint8B
+0x090 Rbx : Uint8B
+0x098 Rsp : Uint8B
+0x0a0 Rbp : Uint8B
+0x0a8 Rsi : MSVCP140!_CONTEXT
+0x000 P1Home : Uint8B
+0x008 P2Home : Uint8B
+0x010 P3Home : Uint8B
+0x018 P4Home : Uint8B
+0x020 P5Home : Uint8B
+0x028 P6Home : Uint8B
+0x030 ContextFlags : Uint4B
+0x034 MxCsr : Uint4B
+0x038 SegCs : Uint2B
+0x03a SegDs : Uint2B
+0x03c SegEs : Uint2B
+0x03e SegFs : Uint2B
+0x040 SegGs : Uint2B
+0x042 SegSs : Uint2B
+0x044 EFlags : Uint4B
+0x048 Dr0 : Uint8B
+0x050 Dr1 : Uint8B
+0x058 Dr2 : Uint8B
+0x060 Dr3 : Uint8B
+0x068 Dr6 : Uint8B
+0x070 Dr7 : Uint8B
+0x078 Rax : Uint8B
+0x080 Rcx : Uint8B
+0x088 Rdx : Uint8B
+0x090 Rbx : Uint8B
+0x098 Rsp : Uint8B
+0x0a0 Rbp : Uint8B
+0x0a8 Rsi : Uint8B
+0x0b0 Rdi : Uint8B
+0x0b8 R8 : Uint8B
+0x0c0 R9 : Uint8B
+0x0c8 R10 : Uint8B
+0x0d0 R11 : Uint8B
+0x0d8 R12 : Uint8B
+0x0e0 R13 : Uint8B
+0x0e8 R14 : Uint8B
+0x0f0 R15 : Uint8B
+0x0f8 Rip : Uint8B <--------- here
+0x100 FltSave : _XSAVE_FORMAT
+0x000 ControlWord : Uint2B

And every thread has such a structure. So I am pretty sure rdi holds the _CONTEXT structure.
Idk how much this helps ( I hope it does ) but I guess at least I can come back to it when I have some more time.
I used to crashed to my desktop every 5m. After I lower my pcore to 46 I haven't crashed since. Thank you!

Beitrag melden

Konto melden:

Meldegrund

Weitere Informationen: