For quite a long time we have been using the PassFiltEx library for one of our customers to prevent users from setting weak passwords (the library checks passwords against blacklist dictionaries).
Recently we needed to update the library and encountered a problem: on one of the domain controllers, after updating the library, the system started going into a continuous reboot loop.
After rolling back the library from WinPE, the following message was found in the logs:
The process wininit.exe has initiated the restart of computer DC01 on behalf of user
for the following reason: No title for this reason could be found
Reason Code: 0x50006
Shutdown Type: restart
Comment: The system process ‘C:\Windows\system32\lsass.exe’ terminated unexpectedly
with status code -1073741795. The system will now shut down and restart.
The error -1073741795 corresponds to STATUS_ILLEGAL_INSTRUCTION.
Further analysis showed that the author compiled the library in a way that requires AVX/AVX2 instructions. On older CPUs that do not support these instructions, the LSASS process crashes.
After recompiling the library manually with the appropriate compiler flags, the problem did not occur on older systems.
Compilation command:
clang -target x86_64-pc-windows-msvc -shared -o .\bin\release\%PROJECTNAME%.dll *.c -Wall -Wextra -Wformat -O3 -D_WIN64 -march=x86-64 -mno-avx -mno-avx2 -mno-avx512f -mprefer-vector-width=128 -fms-runtime-lib=static -lkernel32 -Wl,%PROJECTNAME%.resThe build must be run from x64 Native Tools Command Prompt for Visual Studio.
You can inspect which instructions the DLL requires using the following command (also from the developer command prompt):
dumpbin /disasm passfiltex.dll > disasm.txtIn the output, pay attention to registers such as ymm1, ymm2 and instructions starting with v, for example vmovdqa, vmovaps, vpxor,vpaddq
These indicate usage of AVX instructions.
The system should have the appropriate development tools installed, such as:
- Visual Studio
- C++ workload
- CMake tools
- Clang
- MSVC toolchain
- Windows SDK
The exact set may vary depending on the environment.
Updated Full Build Script:
@echo off
REM ====================================
REM Build script for PassFiltEx
REM Joseph Ryan Ries 2025
REM ====================================
set "PROJECTNAME=PassFiltEx"
set "RCEXE="C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\rc.exe""
set "INCPATH1="C:\Program Files (x86)\Windows Kits\10\Include\10.0.26100.0\um""
set "INCPATH2="C:\Program Files (x86)\Windows Kits\10\Include\10.0.26100.0\shared""
%RCEXE% /nologo /r /i %INCPATH1% /i %INCPATH2% %PROJECTNAME%.rc
if "%~1"=="" goto no_args
if "%~1"=="debug" goto debug_build
if "%~1"=="release" goto release_build
:no_args
echo Must specify either debug or release!
exit
:debug_build
if not exist .\bin\ mkdir .\bin
if not exist .\bin\debug\ mkdir .\bin\debug
clang -shared -o .\bin\debug\%PROJECTNAME%.dll *.c -Wall -Wextra -Wformat -march=x86-64-v3 -O0 -g3 -D_DEBUG -D_WIN64 -Wl,%PROJECTNAME%.res
if %ERRORLEVEL% neq 0 goto build_fail
echo Debug build succeeded.
exit
:release_build
if not exist .\bin\ mkdir .\bin
if not exist .\bin\release\ mkdir .\bin\release
REM Original command
REM clang -target x86_64-pc-windows-msvc -shared -o .\bin\release\%PROJECTNAME%.dll *.c -Wall -Wextra -Wformat -march=x86-64-v3 -O3 -D_WIN64 -Wl,%PROJECTNAME%.res
REM Modified command (run from x64 Native Tools Command Prompt for VC)
clang -target x86_64-pc-windows-msvc -shared -o .\bin\release\%PROJECTNAME%.dll *.c -Wall -Wextra -Wformat -O3 -D_WIN64 -march=x86-64 -mno-avx -mno-avx2 -mno-avx512f -mprefer-vector-width=128 -fms-runtime-lib=static -lkernel32 -Wl,%PROJECTNAME%.res
if %ERRORLEVEL% neq 0 goto build_fail
echo Release build succeeded.
exit
:build_fail
echo **** BUILD FAILURE ****
exit %ERRORLEVEL%Just in case, here is the compiled library built this way (version 1.6.3.0).