drive.google.com
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and BugCheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 0000b06d13712b44, Actual security check cookie from the stack
Arg2: 0000b06d13712b44, Expected security check cookie
Arg3: ffff4f92ec8ed4bb, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 1921
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 9924
Key : Analysis.Init.CPU.mSec
Value: 609
Key : Analysis.Init.Elapsed.mSec
Value: 150921
Key : Analysis.Memory.CommitPeak.Mb
Value: 128
Key : Bugcheck.Code.DumpHeader
Value: 0xf7
Key : Bugcheck.Code.Register
Value: 0xf7
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 090822-9531-01.dmp
BUGCHECK_CODE: f7
BUGCHECK_P1: b06d13712b44
BUGCHECK_P2: b06d13712b44
BUGCHECK_P3: ffff4f92ec8ed4bb
BUGCHECK_P4: 0
SECURITY_COOKIE: Expected 0000b06d13712b44 found 0000b06d13712b44
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
ffffa20b`058a7c18 fffff803`6e4b1725 : 00000000`000000f7 0000b06d`13712b44 0000b06d`13712b44 ffff4f92`ec8ed4bb : nt!KeBugCheckEx
ffffa20b`058a7c20 fffff803`6e3fcaf4 : ffffffff`00000000 ffffe281`f770e440 ffffce0c`4af3a080 00000000`000003da : nt!_report_gsfailure+0x25
ffffa20b`058a7c60 00000000`00000000 : ffffa20b`058a8000 ffffa20b`058a2000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x54
SYMBOL_NAME: nt!_report_gsfailure+25
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1949
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 25
FAILURE_BUCKET_ID: 0xF7_ONE_BIT_MISSING_GSFRAME_nt!_report_gsfailure
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {8f84f302-dd0e-1f96-6f9c-0ea31ad59f42}
Followup: MachineOwner
---------*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000002, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8027b2a3577, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 1952
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 20624
Key : Analysis.Init.CPU.mSec
Value: 374
Key : Analysis.Init.Elapsed.mSec
Value: 143093
Key : Analysis.Memory.CommitPeak.Mb
Value: 127
Key : Bugcheck.Code.DumpHeader
Value: 0xa
Key : Bugcheck.Code.Register
Value: 0xa
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 1.dmp
BUGCHECK_CODE: a
BUGCHECK_P1: 2
BUGCHECK_P2: 2
BUGCHECK_P3: 1
BUGCHECK_P4: fffff8027b2a3577
WRITE_ADDRESS: fffff8027bcfb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000002
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
PROCESS_NAME: System
TRAP_FRAME: ffffae065e0a7530 -- (.trap 0xffffae065e0a7530)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000009 rbx=0000000000000000 rcx=fffff8027bd25440
rdx=0000000000000009 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8027b2a3577 rsp=ffffae065e0a76c0 rbp=000000030825b900
r8=0000000000000029 r9=000000000000ffff r10=000000000000ffff
r11=ffffb601ced00180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KiDeferredReadySingleThread+0x2e7:
fffff802`7b2a3577 000f add byte ptr [rdi],cl ds:00000000`00000000=??
Resetting default scope
MISALIGNED_IP:
nt!KiDeferredReadySingleThread+2e7
fffff802`7b2a3577 000f add byte ptr [rdi],cl
STACK_TEXT:
ffffae06`5e0a73e8 fffff802`7b40a869 : 00000000`0000000a 00000000`00000002 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffffae06`5e0a73f0 fffff802`7b406b69 : ffffb601`ced00180 fffff802`7bd25440 fffff802`00000000 fffff802`7b38e762 : nt!KiBugCheckDispatch+0x69
ffffae06`5e0a7530 fffff802`7b2a3577 : 0000004d`00000000 ffffc802`8b8020c0 00000000`00000008 00000000`00000000 : nt!KiPageFault+0x469
ffffae06`5e0a76c0 fffff802`7b2d05dd : 00000000`00135431 ffffae06`5e0a7b10 00000000`00000080 ffffb601`ced00180 : nt!KiDeferredReadySingleThread+0x2e7
ffffae06`5e0a78b0 fffff802`7b29db30 : ffffb601`ced00180 00000000`00000000 ffffc802`9771f1f0 ffffc802`7e6e81c0 : nt!KiReadyThread+0x4d
ffffae06`5e0a78e0 fffff802`7b26766d : 00000000`00000000 00000000`00000000 00000000`00140001 00000000`00135431 : nt!KiProcessExpiredTimerList+0x290
ffffae06`5e0a79d0 fffff802`7b3fc45e : ffffffff`00000000 ffffb601`ced00180 ffffb601`ced0b440 ffffc802`9c8780c0 : nt!KiRetireDpcList+0x5dd
ffffae06`5e0a7c60 00000000`00000000 : ffffae06`5e0a8000 ffffae06`5e0a2000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e
SYMBOL_NAME: nt!KiDeferredReadySingleThread+2e7
IMAGE_VERSION: 10.0.19041.1889
STACK_COMMAND: .cxr; .ecxr ; kb
MODULE_NAME: AuthenticAMD
IMAGE_NAME: AuthenticAMD.sys
FAILURE_BUCKET_ID: IP_MISALIGNED_AuthenticAMD.sys
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {716d112a-8330-4bbb-160c-ec98297019d2}
Followup: MachineOwner
---------
Hocam ne yapsam çözemedim. Konu ile alakalı insanların bir şeyler yazdığı bir yer buldum ama orada da nihai çözümü bulamamışlar galiba.
drive.google.com
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
BugCheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffffe7007a3eee70
Arg3: ffff86048dfe63b0
Arg4: fffff8070aaa0a66
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 546
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 6104
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 2
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 61
Key : Analysis.Init.Elapsed.mSec
Value: 2926
Key : Analysis.Memory.CommitPeak.Mb
Value: 137
Key : Bugcheck.Code.DumpHeader
Value: 0x7f
Key : Bugcheck.Code.Register
Value: 0x7f
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 100822-11062-01.dmp
BUGCHECK_CODE: 7f
BUGCHECK_P1: 8
BUGCHECK_P2: ffffe7007a3eee70
BUGCHECK_P3: ffff86048dfe63b0
BUGCHECK_P4: fffff8070aaa0a66
TRAP_FRAME: ffffe7007a3eee70 -- (.trap 0xffffe7007a3eee70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0a000003c5a70867 rbx=0000000000000000 rcx=1a000003c5a70867
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8070aaa0a66 rsp=ffff86048dfe63b0 rbp=0000000000000000
r8=0a000003c5a70867 r9=ffffd002f5c5d980 r10=ffffb95cae572fff
r11=ffffb95c80000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiLockPageTableInternal+0x76:
fffff807`0aaa0a66 4c89642470 mov qword ptr [rsp+70h],r12 ss:ffff8604`8dfe6420=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
STACK_TEXT:
ffffe700`7a3eed28 fffff807`0ac09169 : 00000000`0000007f 00000000`00000008 ffffe700`7a3eee70 ffff8604`8dfe63b0 : nt!KeBugCheckEx
ffffe700`7a3eed30 fffff807`0ac03f83 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffe700`7a3eee70 fffff807`0aaa0a66 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0x2c3
ffff8604`8dfe63b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiLockPageTableInternal+0x76
SYMBOL_NAME: nt!KiDoubleFaultAbort+2c3
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1288
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 2c3
FAILURE_BUCKET_ID: 0x7f_8_nt!KiDoubleFaultAbort
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {d1f8395a-8c58-45da-6ebf-e8bb4aad2fc5}
Followup: MachineOwner
---------Ekledim hocam.
