Bug check 3b can occur when the hook-core service crashes or isn't running

Technical Articles ID: KB93143
Last Modified: 2023-07-03 05:14:55 Etc/GMT

Environment

Endpoint Detection and Response (EDR) 3.1.x, 3.0.x
Endpoint Security (ENS) Threat Prevention 10.7.0 April 2020 Update

Problem

A blue screen error (system crash) with bug check 3b can occur when the hook-core service (mfehcs.exe) crashes or isn't running. The crashing thread tries to notify the hook-core service about an injection completion event, but the service isn't running. The result is a NULL pointer exception.

Cause

The hook-core service triggers injection into a process and crashes before the injection completes. This issue can lead to a bug check if the service stops before the hook-core driver (mfehck.sys) notifies the service about the injection completion event.

Solution

The following issues are resolved in McAfee Platform Technology (MPT) 20.5 and later.

The ENS 10.7.0 July 2020 Update contains a version of MPT with the fix. EDR 3.2, due for release in August 2020, contains MPT 20.5.

We resolved an issue with the hook-core service that can lead to crashes during injection if the injection fails.
We resolved the bug check 3b blue screen error.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

Our product software, upgrades, maintenance releases, and documentation are available on the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Bug check 3b can occur when the hook-core service crashes or isn't running

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Bug check 3b can occur when the hook-core service crashes or isn't running

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title