What does BSOD 252 (ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY) mean?

 
Previous Next
RECURSIVE_MACHINE_CHECK DIRTY_NOWRITE_PAGES_CONGESTION

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

NX/DEP execute-permission violation for ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY is bug check code 0x000000FC. This bug check means control flow reached a virtual address that the memory manager does not allow to execute. Typical causes include corrupted function pointers, use-after-free, code injection attempts, bad driver trampolines, or memory marked with the wrong permissions.

How to read it in a dump for ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

  • Decode the faulting instruction pointer and PTE or VAD state if available.
  • The stack may be corrupted because control flow has already gone through bad memory.
  • This is stronger evidence than a generic access violation because execute permission specifically failed.

What to check for ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

  • Use WinDbg to inspect the faulting address, pool tag, call stack, and loaded module list.
  • Enable Driver Verifier, Special Pool, and code-integrity checks for suspect drivers.
  • Review any driver that writes executable stubs, hooks functions, or misuses MDLs and page protections.

References for ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

Dump evidence for ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

For ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY, preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. For ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY, allStat summarizes the condition as “An attempt was made to execute to non-executable memory.”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.

Analysis order for ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

  • Run WinDbg !analyze -v, then inspect the documented meaning of each ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY parameter instead of relying only on the probably-caused-by line.
  • For ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with attempted / execute / of / noexecute / memory.
  • For ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.

Do not repeatedly reboot a machine affected by ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY before collecting the dump and event logs. For ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY, recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.

Dump evidence for ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

For ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY, preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. For ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY, allStat summarizes the condition as “An attempt was made to execute to non-executable memory.”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.

Analysis order for ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

  • Run WinDbg !analyze -v, then inspect the documented meaning of each ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY parameter instead of relying only on the probably-caused-by line.
  • For ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with attempted / execute / of / noexecute / memory.
  • For ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.

Do not repeatedly reboot a machine affected by ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY before collecting the dump and event logs. For ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY, recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.

Looking for a different code? Search another status or error code.