| Previous | Next |
| STATUS_UNWIND | STATUS_INVALID_UNWIND_TARGET |
STATUS_BAD_STACK
The stack could not be trusted for exception unwinding
Windows validates stack bounds, alignment, and frame progression while dispatching and unwinding exceptions. This status means the current establisher frame or reconstructed stack state did not satisfy those rules. A corrupted return address, stack pointer overwrite, incorrect unwind metadata, or hand-written prolog that violates the ABI can all produce the same result.
The handler where validation stops is not necessarily the code that damaged the stack. Compare the current stack pointer with the TEB limits, inspect preceding frames for impossible sizes, and validate the module’s pdata/xdata. On x64, prologs and epilogs are deliberately restricted so the unwinder can reverse them; generated code must describe equivalent operations accurately.
What to inspect
- Check stack pointer alignment and whether it lies between stack limit and stack base.
- Validate the current RUNTIME_FUNCTION and unwind-code sequence.
- Look for overwritten return addresses and implausible frame transitions.
- Review hand-written assembly, hooks, and JIT prologs against the ABI.
References
- Microsoft Learn: x64 exception handling
- Microsoft Learn: x64 prolog and epilog
- ReactOS source: AMD64 unwind implementation
- Microsoft Learn: EXCEPTION_RECORD
Looking for a different code? Search another status or error code.