BSOD 195 (SYSTEM_IMAGE_BAD_SIGNATURE): causes and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: Windows rejected a system image because its signature or integrity state was invalid.

Could be also:
Constant	Type	OS
ERROR_INVALID_MINALLOCSIZE	Win32 error	Windows

Previous	Next
BAD_POOL_CALLER	DRIVER_VERIFIER_DETECTED_VIOLATION

SYSTEM_IMAGE_BAD_SIGNATURE

Bad system-image signature for SYSTEM_IMAGE_BAD_SIGNATURE

SYSTEM_IMAGE_BAD_SIGNATURE is bug check code 0x000000C3. This bug check belongs to system image integrity and driver/code signing. It means a boot-critical or kernel-mode image failed a signature/integrity expectation that Windows treats as fatal.

How to read it in a dump for SYSTEM_IMAGE_BAD_SIGNATURE

The failing image path, signature status, and load phase are more useful than the numeric code alone.
This can involve kernel-mode code signing, Secure Boot, catalog files, tampering, or a corrupted system image.
It is different from an ordinary application signature warning.

What to check for SYSTEM_IMAGE_BAD_SIGNATURE

Identify the image being loaded and verify its catalog/signature.
Check Secure Boot, Code Integrity events, recent driver installs, servicing operations, and disk corruption.
Do not bypass integrity protections before preserving the failing file for analysis.

References for SYSTEM_IMAGE_BAD_SIGNATURE

Dump evidence for SYSTEM_IMAGE_BAD_SIGNATURE

For SYSTEM_IMAGE_BAD_SIGNATURE, preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “SYSTEM_IMAGE_BAD_SIGNATURE”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.

Analysis order for SYSTEM_IMAGE_BAD_SIGNATURE

Run WinDbg !analyze -v, then inspect the documented meaning of each SYSTEM_IMAGE_BAD_SIGNATURE parameter instead of relying only on the probably-caused-by line.
For SYSTEM_IMAGE_BAD_SIGNATURE, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with system / image / signature.
For SYSTEM_IMAGE_BAD_SIGNATURE, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.

Do not repeatedly reboot a machine affected by SYSTEM_IMAGE_BAD_SIGNATURE before collecting the dump and event logs. For SYSTEM_IMAGE_BAD_SIGNATURE, recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.

Dump evidence for SYSTEM_IMAGE_BAD_SIGNATURE

Analysis order for SYSTEM_IMAGE_BAD_SIGNATURE

Run WinDbg !analyze -v, then inspect the documented meaning of each SYSTEM_IMAGE_BAD_SIGNATURE parameter instead of relying only on the probably-caused-by line.
For SYSTEM_IMAGE_BAD_SIGNATURE, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with system / image / signature.
For SYSTEM_IMAGE_BAD_SIGNATURE, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.

Looking for a different code? Search another status or error code.