Silent crash on startup

[hotpockette]

Bug Description

The Windows build of xemu works correctly on first boot and allows me to specify system files, but any subsequent launches will cause xemu to not respond and immediately close. The timing can sometimes vary by a few seconds, hanging on a "Guest has not initialized display (yet)" screen, but the outcome is consistent. (GIF example)
The crash also occurs with portable mode.

The log file (below, in additional context) does not specify an error message and indicates nothing out of the ordinary.
I have also provided an error report from Event Viewer.

Reproduction of issue:
1.) Launch xemu.
2.) Specify file path to BIOS, etc.
3.) Exit & restart xemu.
4.) xemu will crash.

Expected Behavior

xemu should launch after providing valid system file directories (or at least log an error upon crashing).

xemu Version

v0.7.99 - 158cc0d (latest at time of writing)

System Information

OS: Windows 11 Insider Build 23H2
CPU: 12th Gen Intel(R) Core(TM) i9-12900K
GPU: NVIDIA GeForce RTX 3080 Ti/PCIe/SSE2
GPU Driver: 4.0.0 NVIDIA 536.67

Windows & GPU drivers are both up-to-date at the time of writing.

Additional Context

xemu log file:

Created QEMU launch parameters: D:\Games\Emulation\xemu\xemu.exe -machine xbox,bootrom=D:\Games\Emulation\xemu\bios\mcpx_1.0.bin,kernel-irqchip=off,avpack=hdtv -device smbus-storage,file=C:\Users\Alex\AppData\Roaming\xemu\xemu\eeprom.bin -bios D:\Games\Emulation\xemu\bios\Complex_4627.bin -m 64 -drive index=0,media=disk,file=D:\Games\Emulation\xemu\xbox_hdd.qcow2,locked=on -drive index=1,media=cdrom,file= -display xemu -device usb-hub,port=1,ports=4 -audiodev none,id=snd0
xemu_version: 0.7.99
xemu_branch: master
xemu_commit: 158cc0d
xemu_date: Mon Jul 17 11:14:03 UTC 2023
xemu_settings_get_base_path: base path: C:\Users\Alex\AppData\Roaming\xemu\xemu
xemu_settings_get_path: config path: C:\Users\Alex\AppData\Roaming\xemu\xemu\xemu.toml
CPU: 12th Gen Intel(R) Core(TM) i9-12900K
OS_Version: 23H2
GL_VENDOR: NVIDIA Corporation
GL_RENDERER: NVIDIA GeForce RTX 3080 Ti/PCIe/SSE2
GL_VERSION: 4.0.0 NVIDIA 536.67
GL_SHADING_LANGUAGE_VERSION: 4.00 NVIDIA via Cg compiler
audio: Device ac97: audiodev default parameter is deprecated, please specify audiodev=snd0

Event Viewer error info:

Faulting application name: xemu.exe, version: 0.7.99.0, time stamp: 0x00000000
Faulting module name: msvcrt.dll, version: 7.0.22621.436, time stamp: 0xc4d8152c
Exception code: 0xc0000409
Fault offset: 0x0000000000033e74
Faulting process id: 0x0x4A24
Faulting application start time: 0x0x1D9B982A736B21A
Faulting application path: D:\Games\Emulation\xemu\xemu.exe
Faulting module path: C:\WINDOWS\System32\msvcrt.dll
Report Id: 17125a69-98bc-4891-95a5-81021e8a3e82
Faulting package full name:
Faulting package-relative application ID:

I am using the latest xemu release build at the time of writing: v0.7.99
This issue also affects all previous releases of xemu in my testing.

The only assessment I received from the #help channel of the xemu Discord server was that the crash is occurring "somewhere in the c runtime". A cursory search of the channel's message history led me to try adding windows defender & firewall exceptions to the xemu executable, but this did not work. Another suggestion was having an audio device setup, which I do have.

[mborgerson]

@hotpockette Thanks for filing a bug report. I'd like to help resolve the issue, but unfortunately I'm unable to reproduce the crash locally. Can you please create a process core dump for diagnosis and send it to me privately.

You can create a dump by first applying the registry edit found in this Zip file: xemu_dump_registry_config.zip This registry edit will configure Windows to create a dump whenever xemu crashes. The dump will be stored at %LOCALAPPDATA%\CrashDumps. You may notice a delay after xemu crashes while this file is saved.

Then, please download and run the debug build of xemu found at: https://github.com/xemu-project/xemu/releases/download/v0.7.99/xemu-win-debug.zip

[mborgerson]

@hotpockette Thanks for your assistance. I've investigated the crash a bit.

Apparently the Control Flow Guard platform security feature is somehow mistakenly being enabled when xemu.exe is loaded, causing an eventual crash in jump buffer validation at __except_validate_jump_buffer after longjmping when translation encounters an instruction crossing a page boundary.

From the crash we can see that CFG is enabled as icall_fptr is set to something other than the expected icall_nop handler, so the checks are executed (and eventually fail):

__guard_check_icall_fptr = LdrpValidateUserCallTarget

However, CFG is not supported for the mingw64 build of xemu and accordingly the flag which indicates CFG support is not set. At this point I suspect there is a bug with this version of Windows, not with xemu itself.

On a Windows 11 Pro 22H2 22621.1992 install, I'm unable to reproduce this particular issue, and I have verified that when this function is called, __guard_check_icall_fptr == _guard_check_icall_nop, so checks are bypassed and control jumps to the ret instruction.

As a workaround, please try creating a rule to disable Control Flow Guard security for xemu.exe specifically via Start > Windows Security > App & browser control > Exploit protection settings > Program settings > Add program to customize > By name > xemu.exe > Override system settings and disable CFG.

[hotpockette]

I can't believe the fix was so simple-- xemu works perfectly after setting the CFG override.
I was glad to help with debugging, thank you so much!!

[dekay]

Someone reported this same problem on Discord with Win11 22H2, and the same workaround got them going.