What does NTSTATUS 0xC00000FF (STATUS_BAD_FUNCTION_TABLE) mean?

 
Previous Next
STATUS_NO_SUCH_PACKAGE STATUS_VARIABLE_NOT_FOUND

STATUS_BAD_FUNCTION_TABLE

Runtime function metadata could not describe the current code

On 64-bit Windows, nonleaf functions are described by RUNTIME_FUNCTION entries in pdata, with unwind instructions and optional handlers in xdata. JITs and other dynamic-code generators must register equivalent tables. This status indicates that the table or the unwind result is malformed, inconsistent, or unable to make progress.

Check more than the table address. Entries must be sorted and aligned, code ranges must contain the control PC, unwind offsets must fit the function, and dynamically generated code must remain registered for its entire executable lifetime. A module unload race or freed JIT allocation can leave a formerly valid table pointing at unrelated memory.

What to inspect

  • Resolve the control PC to its RUNTIME_FUNCTION entry and image base.
  • Validate begin, end, unwind RVA, alignment, and chained-entry relationships.
  • Check RtlAddFunctionTable or callback registration and removal lifetimes.
  • Preserve the exact generated code and metadata together in crash captures.

References


Looking for a different code? Search another status or error code.