On Windows 11 if for some reason an exception or bugcheck happens during the boot phase it can be quite challenging to diagnose the issue since you only get the stop code (E.g 0x7E SYSTEM THREAD EXCEPTION NOT HANDLED). After failing for a number of times, Windows should eventuelly let you into a recovery enviroment that either allows you to boot into safe mode or get into the recovery commandline. This allows you access into Windows to perform further diagnosis of the problem. When an exception happens during boot Windows 11 will log relevant information into this directory:
Windows\SYSTEM32\LogFiles\Srt
This directory should contain several files relevant to diagnosing boot issues, but most interesting is the setupmem.dmp
file:
This file can then be opened the normal way to get a stack trace and bugcheck
code:
12: kd> .bugcheck Bugcheck code 1000007E Arguments ffffffff`c0000005
fffff806`8bf3e20b ffff8304`ec5d5308 ffff8304`ec5d4b10
We see that the bugcheck
is 0x7E and the actual exception is c0000005 (Memory access violation) We kan
then dump the stack of the failing thread:
Child-SP RetAddr : Args to Child :
Call Site ffff8304`ec5d4298 fffff806`ebccc350 : 00000000`0000007e
ffffffff`c0000005 fffff806`8bf3e20b ffff8304`ec5d5308 : nt!KeBugCheckEx
ffff8304`ec5d42a0 fffff806`ebafb7df : ffff8304`00000003 ffff8304`ec5d5308
ffff8304`ec5cf000 ffff8304`ec5d6000 : nt!PspSystemThreadStartup$filt$0+0x44
ffff8304`ec5d42e0 fffff806`ebcb42d2 : ffff8304`ec5d5308 ffff8304`ec5d48e0
00000000`00000000 00000000`00000000 : nt!_C_specific_handler+0x9f
ffff8304`ec5d4350 fffff806`eb87c492 : ffff8304`ec5d43e0 fffff806`eb600000
fffff806`eba870ba fffff806`eb6fb3f8 : nt!RtlpExecuteHandlerForException+0x12
ffff8304`ec5d4380 fffff806`eb9e866f : ffff8304`ec5d4b10 ffff8304`ec5d5010
ffff8304`ec5d4b10 ffff8304`ec5d51d0 : nt!RtlDispatchException+0x2d2
ffff8304`ec5d4ae0 fffff806`ebcbee45 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x35f
ffff8304`ec5d51d0 fffff806`ebcb9f82 : 00000000`00000000 00000000`00000000
00000000`0000ffff ffffe680`e4bc0180 : nt!KiExceptionDispatch+0x145
ffff8304`ec5d53b0 fffff806`8bf3e20b : ffffd382`97010000 00000000`0000ffff
00000000`00000004 fffff806`8bf3a5d2 : nt!KiPageFault+0x442 (TrapFrame @
ffff8304`ec5d53b0) ffff8304`ec5d5540 ffffd382`97010000 : 00000000`0000ffff
00000000`00000004 fffff806`8bf3a5d2 ffffd382`97010000 : mtkwl6ex+0xe20b
ffff8304`ec5d5548 00000000`0000ffff : 00000000`00000004 fffff806`8bf3a5d2
ffffd382`97010000 00000000`00000000 : 0xffffd382`97010000 ffff8304`ec5d5550
00000000`00000004 : fffff806`8bf3a5d2 ffffd382`97010000 00000000`00000000
fffff806`8c06b000 : 0xffff ffff8304`ec5d5558 fffff806`8bf3a5d2 :
ffffd382`97010000 00000000`00000000 fffff806`8c06b000 fffff806`8c059c58 : 0x4
ffff8304`ec5d5560 ffffd382`97010000 : 00000000`00000000 fffff806`8c06b000
fffff806`8c059c58 ffffd382`97010000 : mtkwl6ex+0xa5d2 ffff8304`ec5d5568
00000000`00000000 : fffff806`8c06b000 fffff806`8c059c58 ffffd382`97010000
fffff806`8bf4c35d : 0xffffd382`97010000
The stack trace reveals a third-party
driver, mtkwl6ex, which is a MediaTek Wireless Driver, the driver was quite
outdated (Timestamp Jan 2023) and updating it resolved the issue. Knowing the relevant
directory of where one could find the dump trace allowed us to very simply
diagnose and resolve the issue. Hope this is helpful for anyone else trying to
diagnose a Windows 11 system that fails to boot.
