Scanning on Windows with Intel AMX

View as Markdown

Why do Windows Explorers or CLI scans crash on Intel AMX-capable systems?

On systems with Intel Advanced Matrix Extensions (AMX), third-party endpoint protection can cause the runZero Explorer process to crash mid-scan. This can affect both physical hardware and virtual machines. The problem is caused by third-party software injecting code without sizing the stack correctly; when this injected code triggers an exception, the AMX exception frame written corrupts the runZero thread.

There are two work-arounds available:

  1. Disable AMX
  • If the Explorer is running on Windows as a Hyper-V guest, enable Processor Compatibility for that VM, and restart.
  • For other types of virtual machines or physical systems, disable AMX in the BIOS or hypervisor CPU settings.
  1. Disable or replace the endpoint protection software.
  • In the case of Microsoft Defender, excluding the runZero process is not sufficient, as the buggy code is still injected into the runZero Explorer.
  • The system may require a full restart to return the service to a non-hooked state.

If the issue persists after applying one of the above mitigations, use the “Download Logs” option from the Explorer details page and reach out to runZero Support. The .err file in this ZIP will contain the crash logs as well as the current state of AMX and the list of loaded DLLs.

Updated