eclipse-platform
JVM Crash on Windows 11 24H2 with SentinelOne installed
Let's make sure issue is not already fixed in latest builds first.
- [x] I verified I can reproduce this issue against latest Integration Build of Eclipse SDK
Steps to reproduce
On Windows 11, version 24H2, users who have SentinelOne security software installed experience a JVM crash at startup when launching Eclipse (observed in both Eclipse 4.31 and 4.35). The crash does not occur if SentinelOne is uninstalled or if the Eclipse executables and JVM are explicitly whitelisted in SentinelOne.
From a fresh installation and clean workspace:
- Install Windows 11, version 24H2
- Install SentinelOne security software
- Attempt to launch Eclipse 4.35 → JVM crash (Without SentinelOne: Eclipse launches successfully)
I tried
Whitelisting is not a viable long-term solution, as it exposes users to potential risks when installing third-party plugins.
I expected: The IDE to launch on Windows 11 24H2 that has SentinelOne installed.
But got: IDE crashes when attempting to launch.
Here is some relevant log output
The Windows Event Log consistently reports a crash involving ntdll.dll (32-bit):
Sig[3].Name=Fault Module Name
Sig[3].Value=ntdll.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=10.0.26100.2454
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=7cb6b6a8
Sig[6].Name=Exception Code
Sig[6].Value=c00000fd
Sig[7].Name=Exception Offset
Sig[7].Value=0000000000163df7
Stack traces point to callback functions bound to the 32-bit ntdll.dll, suspected to originate from the 32-bit Eclipse launcher on a 64-bit OS.
A related SentinelLabs post from 2020 recommends avoiding reliance on the 32-bit ntdll.dll: https://www.sentinelone.com/labs/case-study-why-you-shouldnt-trust-ntdll-from-kernel-image-load-callbacks/
Additionally, it appears the Windows GUID for version 24H2 is missing in the Eclipse launcher source code, though this may or may not be directly related.
We recommend evaluate updating the Eclipse launcher to avoid binding to 32-bit ntdll.dll on 64-bit systems.
Alternatively, engage with Microsoft to possibly issue a Block Update for Windows 11 24H2 until the root cause is clarified: https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-24h2
Tested under this environment:
- OS & version: Windows 11 24H2
- Eclipse IDE/Platform version (as shown in Help > About): 4.35
- ...Anything else that can be useful...
Community
- [X] I understand reporting an issue to this OSS project does not mandate anyone to fix it. Other contributors may consider the issue, or not, at their own convenience. The most efficient way to get it fixed is that I fix it myself and contribute it back as a good quality patch to the project.
Stack traces point to callback functions bound to the 32-bit ntdll.dll, suspected to originate from the 32-bit Eclipse launcher on a 64-bit OS.
The Equinox launcher, like SWT, is only provided for 64bit. 32bit binaries are gone for quite some time now.
But if you think something should be improved in the launcher, please propose it at Equinox: https://github.com/eclipse-equinox/equinox/
Besides that, as you already said that your AV software is causing this problem, I'm not sure what Eclipse can do about it generally.
I agree with Hannes that this rather sounds like an issue of the AV software than something Eclipse is supposed to do something about, at least unless we really see some issue in Eclipse itself (wich from the description can currently not be seen). Are you able to at least share an hs_err_pid file so that we may see which call exactly causes the issue? I am not sure how many methods from ntdll are used, but we had an issue last year where we also saw usages of it (though I think the issue there was a different one than we have here): https://github.com/eclipse-platform/eclipse.platform.swt/issues/1500
Von: Hannes Wellmann @.> Gesendet: Thursday, April 3, 2025 10:41:29 PM An: eclipse-platform/eclipse.platform @.> Cc: Subscribed @.***> Betreff: Re: [eclipse-platform/eclipse.platform] JVM Crash on Windows 11 24H2 with SentinelOne installed (Issue #1800)
Stack traces point to callback functions bound to the 32-bit ntdll.dll, suspected to originate from the 32-bit Eclipse launcher on a 64-bit OS.
The Equinox launcher, like SWT, is only provided for 64bit. 32bit binaries are gone for quite some time now.
But if you think something should be improved in the launcher, please propose it at Equinox: https://github.com/eclipse-equinox/equinox/
Besides that, as you already said that your AV software is causing this problem, I'm not sure what Eclipse can do about it generally.
— Reply to this email directly, view it on GitHubhttps://github.com/eclipse-platform/eclipse.platform/issues/1800#issuecomment-2776871428, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AAFYOEDDIL7OFT36FY5QAB32XWMHTAVCNFSM6AAAAAB2NDDJR6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDONZWHA3TCNBSHA. You are receiving this because you are subscribed to this thread.Message ID: @.***>
[HannesWell]HannesWell left a comment (eclipse-platform/eclipse.platform#1800)https://github.com/eclipse-platform/eclipse.platform/issues/1800#issuecomment-2776871428
Stack traces point to callback functions bound to the 32-bit ntdll.dll, suspected to originate from the 32-bit Eclipse launcher on a 64-bit OS.
The Equinox launcher, like SWT, is only provided for 64bit. 32bit binaries are gone for quite some time now.
But if you think something should be improved in the launcher, please propose it at Equinox: https://github.com/eclipse-equinox/equinox/
Besides that, as you already said that your AV software is causing this problem, I'm not sure what Eclipse can do about it generally.
— Reply to this email directly, view it on GitHubhttps://github.com/eclipse-platform/eclipse.platform/issues/1800#issuecomment-2776871428, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AAFYOEDDIL7OFT36FY5QAB32XWMHTAVCNFSM6AAAAAB2NDDJR6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDONZWHA3TCNBSHA. You are receiving this because you are subscribed to this thread.Message ID: @.***>
I agree that the AV + 24H2 seems to be causing some sort of issues.
SentinelOne + 23H2 seems to be fine from what I hear. And Windows 24H2 without that AV is fine too.
I suppose we thought it had to do with 32 bit binaries. But if that's not the case, we can rule that out.
So as posted above, without a crash log it's hard to say what is going on. Just as a pointer, there are even explicit calls to rtldll.dll from within SWT, such as RtlGetVersion, which for some reason is even accessed by dynamic linking:
https://github.com/eclipse-platform/eclipse.platform.swt/blob/0f21a6ef45900df1f564d52be3cbced83e1d399e/bundles/org.eclipse.swt/Eclipse%20SWT%20PI/win32/org/eclipse/swt/internal/win32/OS.java#L65-L69
But the extract of the error log in the original post indicates that a different method is involved here.
We will try to get more detailed information.
For our users, they are being mandated to update to the latest Windows and Sentinel One is mandated by their companies as well. So the individual users don't have much choice. Once their machines update, they can't use Eclipse anymore.
