Crash ragemp_v.exe

[Mr.Kali]

A crash occurs, I think this is due to the fact that the processor does not support SSE4.1
CPU: AMD Athlon II X4 620
Windows: Windows 10 LTSC x64 build 17763

Crash:
ragemp_v.exe 1.1.0.0
Exception: 0xC000001D
Fault RVA: 0x08CD3AC7

Bytes:
66 0F 38 17 C9

Instruction:
PTEST xmm1, xmm1

Windows IsProcessorFeaturePresent:
SSE4.1: False
SSE4.2: False
AVX: False

The crash occurs repeatedly at exactly the same RVA.

[Mr.Kali]

RAGE:MP Client Crash — Unsupported SSE4.1 Instruction on AMD Athlon II X4 620

Summary

The current ragemp_v.exe client consistently crashes during startup on an AMD Athlon II X4 620 with:

Exception code: 0xC000001D
STATUS_ILLEGAL_INSTRUCTION

The crash always occurs at the same RVA:

ragemp_v.exe + 0x08CD3AC7

The instruction at the faulting address is:

66 0F 38 17 C9
PTEST xmm1, xmm1

PTEST requires SSE4.1.

The affected CPU does not support SSE4.1. A direct Windows feature check returns:

SSE4.1: False
SSE4.2: False
AVX: False

This strongly indicates that the current client executes an SSE4.1 instruction on a CPU where SSE4.1 is unavailable, without taking a compatible fallback path.

---

System Information

CPU:
AMD Athlon II X4 620 Processor

Cores: 4
Logical processors: 4
Clock: 2600 MHz

OS:
Windows 10 Enterprise LTSC
Version: 10.0.17763
Architecture: x64

The collected hardware report identifies the processor as AMD Athlon II X4 620 Processor, 4 cores / 4 logical processors at 2.6 GHz.

Windows version:

Microsoft Windows 10 Enterprise LTSC
10.0.17763
x64

---

Reproduction

1. Start the RAGE:MP installation normally through updater.exe.

2. ragemp_v.exe starts.

3. Approximately a few seconds after process startup, ragemp_v.exe terminates.

4. Windows Event Viewer reports:

Faulting application: ragemp_v.exe
Faulting module: ragemp_v.exe
Exception code: 0xc000001d
Fault offset: 0x0000000008cd3ac7

This has reproduced multiple times with exactly the same exception code and exactly the same fault offset.

For example:

ragemp_v.exe
Exception: 0xc000001d
Fault offset: 0x0000000008cd3ac7

The same fault was also recorded during earlier launches from different RAGE:MP installation paths, still at exactly 0x08CD3AC7.

---

CPU Feature Test

The following Windows API check was performed:

import ctypes

print(
    "SSE4.1:",
    bool(ctypes.windll.kernel32.IsProcessorFeaturePresent(37))
)
print(
    "SSE4.2:",
    bool(ctypes.windll.kernel32.IsProcessorFeaturePresent(38))
)
print(
    "AVX:",
    bool(ctypes.windll.kernel32.IsProcessorFeaturePresent(39))
)

Result:

SSE4.1: False
SSE4.2: False
AVX: False

Therefore SSE4.1 is not available on this system.

---

Static Analysis of the Faulting Instruction

The PE image was inspected at:

RVA:         0x08CD3AC7
File offset: 0x00C096C7
Section:     .text0

Raw bytes:

66 0f 38 17 c9

Disassembly:

0x0000000148CD3AC7:
66 0f 38 17 c9
ptest xmm1, xmm1

The instruction at the exact RVA reported by Windows is therefore an SSE4.1 PTEST.

---

WinDbg Crash Dump Analysis

A full user-mode dump was captured through Windows Error Reporting LocalDumps.

WinDbg exception record:

ExceptionAddress: 00007ff72a213ac7
ExceptionCode: c000001d (Illegal instruction)

The exception context confirms that RIP points directly at the same instruction:

rip=00007ff72a213ac7

and WinDbg disassembles it as:

00007ff7`2a213ac7 660f3817c9
ptest xmm1,xmm1

!analyze -v independently reports:

Failure.Bucket:
ILLEGAL_INSTRUCTION_c000001d_ragemp_v.exe!Unknown

Failure.Exception.Code:
0xc000001d

Failure.Exception.IP.Module:
ragemp_v

Failure.Exception.IP.Offset:
0x8cd3ac7

Failure.ProblemClass.Primary:
ILLEGAL_INSTRUCTION

The dump therefore confirms that the exception is generated by ragemp_v.exe itself at RVA:

0x08CD3AC7

---

Call Stack

The crash occurs in a worker thread created by ragemp_v.exe.

WinDbg stack:

ragemp_v + 0x8cd3ac7
ragemp_v
ragemp_v
ragemp_v
ucrtbase!thread_start
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart

The same stack is reported by !analyze -v.

This is not a crash originating inside CEF, NVIDIA, ntdll.dll, or another third-party DLL. The faulting instruction belongs to ragemp_v.exe.

---

Code Around the Fault

WinDbg shows the following sequence:

pxor    xmm0,xmmword ptr [rsi]
...
call    ...
por     xmm1,xmm0
push    r9
call    ...
ptest   xmm1,xmm1       ; crash
pushfq
mov     qword ptr [rsp],0FFFFFFFFDF1945E8h
call    ...

Notably, immediately after PTEST, the code performs:

pushfq
mov qword ptr [rsp], 0FFFFFFFFDF1945E8h

The value pushed by PUSHFQ is immediately overwritten.

The surrounding control flow and executable section layout appear heavily obfuscated or protected, so the PTEST may belong to a protection/virtualization layer rather than ordinary application logic.

This is an inference based on the binary structure and disassembly, not a confirmed identification of a specific protection system.

---

Additional Static Analysis Observation

Other SSE4.1 instructions were found in the normal executable code, but those code paths appear to contain CPU capability checks and alternative execution paths.

The crash-producing PTEST is located separately in the .text0 executable section and is reached on this SSE4.1-incompatible CPU.

This suggests the client may already contain compatibility handling for some SSE4.1 code while the protected/obfuscated path containing this PTEST lacks the equivalent feature check.

---

Process Behavior

The main ragemp_v.exe also creates another ragemp_v.exe child process along with several ragemp_ui.exe processes.

During one monitored launch:

Main:
ragemp_v.exe PID 2660

Child:
ragemp_v.exe PID 4548, PPID 2660

The main ragemp_v.exe is the process that terminates with:

EXIT_CODE=-1073741795

which corresponds to:

0xC000001D

while the ragemp_ui.exe child processes terminate normally afterward.

---

Expected Behavior

If older CPUs without SSE4.1 are intended to remain supported, the client should detect SSE4.1 availability before executing PTEST and select a compatible fallback implementation.

If SSE4.1 is now a mandatory requirement, the client should preferably detect the unsupported CPU during startup and display a clear compatibility error instead of terminating with an illegal-instruction exception.

---

Actual Behavior

On a CPU without SSE4.1:

ragemp_v.exe
    ↓
worker thread enters internal/protected code
    ↓
ragemp_v.exe + 0x08CD3AC7
    ↓
PTEST xmm1, xmm1
    ↓
CPU raises invalid-opcode exception
    ↓
Windows reports 0xC000001D
    ↓
ragemp_v.exe terminates

---

Suspected Root Cause

High confidence: the current ragemp_v.exe build executes an SSE4.1 PTEST instruction on a processor that does not support SSE4.1.

Possible implementations causing this include:

• missing CPUID/SSE4.1 feature check on this code path;

• a protection/obfuscation layer built with SSE4.1 enabled;

• an unintended increase in the minimum CPU instruction-set requirement.

The dump does not provide enough information to determine which of these is the exact implementation-level cause.

---

Fault Signature

Application:
ragemp_v.exe

Version:
1.1.0.0

Exception:
0xC000001D
STATUS_ILLEGAL_INSTRUCTION

Fault RVA:
0x08CD3AC7

Opcode:
66 0F 38 17 C9

Instruction:
PTEST xmm1, xmm1

CPU:
AMD Athlon II X4 620

SSE4.1:
Unavailable

Reproducibility:
Consistent / same fault RVA on every tested launch

The dump identifies the process version as 1.1.0.0.

---

Binary Identification

SHA-256 of the analyzed ragemp_v.exe:

1e89a0d641bf48f278f178e79d4e5835928762980a2422cdea3d362eb5c13a4e

This may be useful for identifying the exact client build.

---

Requested Developer Action

Please verify the code path corresponding to:

ragemp_v.exe RVA 0x08CD3AC7

in the client build matching SHA-256:

1e89a0d641bf48f278f178e79d4e5835928762980a2422cdea3d362eb5c13a4e

Specifically:

1. Check whether this path requires SSE4.1.

2. Verify that CPU capability detection is performed before entering it.

3. Check whether the protection/virtualization layer was compiled with SSE4.1 as a minimum target.

4. If SSE4.1 is intentionally mandatory, document it as a minimum CPU requirement and add an explicit startup compatibility check.

5. If SSE4.1 is not intended to be mandatory, provide a fallback or rebuild the affected code path without requiring SSE4.1.

A full ragemp_v.exe user-mode crash dump is available if required.

[Mr.Kali]

When is the fix?

[Mr.Kali]

Admins?