Jump to content
Ry4nD

bedaisy.sys instant crash of Windows build 18305

Recommended Posts

Launching a fresh install of Arma 3 results in a complete system crash and green screen of death, and then restart. I am running insider preview build 18305.rs_prerelease.181212-2133 

 

Any ideas? 

 

my next step is to wipe arma, do a fresh install on this build to see if it will make a difference.

Share this post


Link to post
Share on other sites

Confirmed, fresh wipe and install of Arma 3 system crash stop code bedaisy.sys 

Share this post


Link to post
Share on other sites

Disabling battleye in the launcher, Arma runs perfectly fine, 70 FPS in 4K Ultra. Seems the battleye is causing the crash? any way to fix this from crashing windows? I get a green screen stop code thread exception for the BEdaisy.sys every time. 

Share this post


Link to post
Share on other sites
11 minutes ago, Ry4nD said:

Seems the battleye is causing the crash?

Well considering BEdaisy is battleyes kernel driver. And that bedaisy is causing the crash. It would seem likely that battleye is causing the crash.

Have you tried contacting battleye support?

Share this post


Link to post
Share on other sites

BE don't support insider builds
 

Quote

 

Preview Build 18298 Known issues

Launching games that use BattlEye anti-cheat will trigger a bug check (green screen) – we’re investigating.




Dear Pz,

Thanks for reporting, we are already aware of this. Please note that Windows Insider builds are not officially supported.

Your BattlEye Support Team


 

 

  • Like 1

Share this post


Link to post
Share on other sites

Yes, I've tried disabling windows defender and modifying the kernel dump parameters to no avail, looks like it's something BE has to modify within their kernel, 

 

based on some quick research and not knowing the accuracy, 

 

Quote

The process BEService.exe has their driver, called "BEDaisy" embedded in the .exe, as a byte array. 
On game launch, BEService.exe drops BEDaisy to your disk with CreateFile & WriteFile functions, loads the driver and deletes it

 

another suggested disabling this feature, I didn't find a way to stop that 

 

I also tried running BE in compatibility mode for Windows 8 and the same happens. 

Share this post


Link to post
Share on other sites
On 21.12.2018 at 9:51 AM, Ry4nD said:

another suggested disabling this feature, I didn't find a way to stop that 

But you previously said you successfully disabled it and it fixed your issue:

On 21.12.2018 at 9:22 AM, Ry4nD said:

Disabling battleye in the launcher, Arma runs perfectly fine

 

That's the fix. Disable Battleye.

Share this post


Link to post
Share on other sites

It is not a fix, if your server runs battleye... All good, I sent a message to Battleye, they don't support the dev versions of windows, so I rolled back, I can use a vm for testing new windows versions on my server. 

Share this post


Link to post
Share on other sites

Same for 18309 Arma 3 gives me a hard lock after clicking play on the launcher so no crashdump but Argo gives me a GSOD. 

Windbg output

Spoiler


Microsoft (R) Windows Debugger Version 10.0.18303.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 18309 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 18309.1000.amd64fre.rs_prerelease.181220-1256
Machine Name:
Kernel base = 0xfffff802`1d400000 PsLoadedModuleList = 0xfffff802`1d82e310
Debug session time: Sat Jan  5 00:07:46.547 2019 (UTC - 6:00)
System Uptime: 0 days 0:20:45.258
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.....................
Loading User Symbols

Loading unloaded module list
...............
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802`1d5b89a0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffea80`ce8048a0=000000000000007e
6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8021da94cb3, The address that the exception occurred at
Arg3: ffffea80ce8058b8, Exception Record Address
Arg4: ffffea80ce805100, Context Record Address

Debugging Details:
------------------


KEY_VALUES_STRING: 1


PROCESSES_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING:  18309.1000.amd64fre.rs_prerelease.181220-1256

SYSTEM_MANUFACTURER:  MSI

SYSTEM_PRODUCT_NAME:  MS-7885

SYSTEM_SKU:  Default string

SYSTEM_VERSION:  3.0

BIOS_VENDOR:  American Megatrends Inc.

BIOS_VERSION:  H.G4

BIOS_DATE:  03/23/2018

BASEBOARD_MANUFACTURER:  MSI

BASEBOARD_PRODUCT:  X99A GAMING 7 (MS-7885)

BASEBOARD_VERSION:  3.0

DUMP_TYPE:  1

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8021da94cb3

BUGCHECK_P3: ffffea80ce8058b8

BUGCHECK_P4: ffffea80ce805100

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

FAULTING_IP: 
nt!ExEnumHandleTable+63
fffff802`1da94cb3 4c8b07          mov     r8,qword ptr [rdi]

EXCEPTION_RECORD:  ffffea80ce8058b8 -- (.exr 0xffffea80ce8058b8)
ExceptionAddress: fffff8021da94cb3 (nt!ExEnumHandleTable+0x0000000000000063)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000001e63048
Attempt to read from address 0000000001e63048

CONTEXT:  ffffea80ce805100 -- (.cxr 0xffffea80ce805100)
rax=0000000001e63048 rbx=ffff818e456e60c0 rcx=ffff818e497ab9c0
rdx=0000000001e63048 rsi=0000000000000000 rdi=0000000001e63048
rip=fffff8021da94cb3 rsp=ffffea80ce805af0 rbp=ffff818e497ab9c0
 r8=0000000001e63038  r9=0000000000000004 r10=ffffea80ce805b20
r11=ffff818e47a11040 r12=0000000000000000 r13=ffff818e47a11040
r14=0000000000000000 r15=fffff802747e1c00
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
nt!ExEnumHandleTable+0x63:
fffff802`1da94cb3 4c8b07          mov     r8,qword ptr [rdi] ds:002b:00000000`01e63048=????????????????
Resetting default scope

CPU_COUNT: c

CPU_MHZ: dac

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3f

CPU_STEPPING: 2

CPU_MICROCODE: 6,3f,2,0 (F,M,S,R)  SIG: 3C'00000000 (cache) 3C'00000000 (init)

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

FOLLOWUP_IP: 
BEDaisy+1e1462
fffff802`749c1462 68415ae3be      push    0FFFFFFFFBEE35A41h

BUGCHECK_STR:  AV

READ_ADDRESS: Unable to get offset of nt!_MI_VISIBLE_STATE.SpecialPool
Unable to get value of nt!_MI_VISIBLE_STATE.SessionSpecialPool
 0000000001e63048 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000001e63048

ANALYSIS_SESSION_HOST:  MELEAGER

ANALYSIS_SESSION_TIME:  01-05-2019 00:30:35.0697

ANALYSIS_VERSION: 10.0.18303.1000 amd64fre

LAST_CONTROL_TRANSFER:  from fffff802749c1462 to fffff8021da94cb3

STACK_TEXT:  
ffffea80`ce805af0 fffff802`749c1462 : ffff818e`456e60c0 ffffea80`ce805bd0 00000000`00000000 ffffea80`ce805b60 : nt!ExEnumHandleTable+0x63
ffffea80`ce805b60 fffff802`749c2d4c : ffffea80`ce805bd0 ffffad06`6d978000 ffffad06`6ce87000 fffff802`747e3600 : BEDaisy+0x1e1462
ffffea80`ce805b90 fffff802`1d52f425 : ffff818e`47a11040 fffff802`0005d1a8 00000000`0005ce20 ffff818e`456e60c0 : BEDaisy+0x1e2d4c
ffffea80`ce805c10 fffff802`1d5bfeea : fffff802`1921b180 ffff818e`47a11040 fffff802`1d52f3d0 ffff818e`495da1f0 : nt!PspSystemThreadStartup+0x55
ffffea80`ce805c60 00000000`00000000 : ffffea80`ce806000 ffffea80`ce800000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a


THREAD_SHA1_HASH_MOD_FUNC:  6650584a1028ba3b33d8e3a721b5a4a601741113

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  c29a08675f664e07bda1c293fe726a45707b9ebc

THREAD_SHA1_HASH_MOD:  7cb4e7293930a584d039c7d205a7e4c2310076e1

FAULT_INSTR_CODE:  e35a4168

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  BEDaisy+1e1462

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: BEDaisy

IMAGE_NAME:  BEDaisy.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5a027199

STACK_COMMAND:  .cxr 0xffffea80ce805100 ; kb

BUCKET_ID_FUNC_OFFSET:  1e1462

FAILURE_BUCKET_ID:  AV_BEDaisy!unknown_function

BUCKET_ID:  AV_BEDaisy!unknown_function

PRIMARY_PROBLEM_CLASS:  AV_BEDaisy!unknown_function

TARGET_TIME:  2019-01-05T06:07:46.000Z

OSBUILD:  18309

OSSERVICEPACK:  0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  unknown_date

BUILDDATESTAMP_STR:  181220-1256

BUILDLAB_STR:  rs_prerelease

BUILDOSVER_STR:  10.0.18309.1000.amd64fre.rs_prerelease.181220-1256

ANALYSIS_SESSION_ELAPSED_TIME:  f38

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_bedaisy!unknown_function

FAILURE_ID_HASH:  {36b04c21-521f-babb-382f-2a12c3ddef17}

Followup:     MachineOwner
---------

 

 

Share this post


Link to post
Share on other sites

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now

×