Çözüldü DRIVER_OVERRAN_STACK_BUFFER Mavi Ekran | win32kfull.sys

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.  This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned.  This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 00003002c75cb51e, Actual security check cookie from the stack
Arg2: 0000bbf340b58cfb, Expected security check cookie
Arg3: ffff440cbf4a7304, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 2

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on DESKTOP-1IBQR0U

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 2

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 74

    Key  : Analysis.System
    Value: CreateObject


ADDITIONAL_XML: 1

BUGCHECK_CODE:  f7

BUGCHECK_P1: 3002c75cb51e

BUGCHECK_P2: bbf340b58cfb

BUGCHECK_P3: ffff440cbf4a7304

BUGCHECK_P4: 0

SECURITY_COOKIE:  Expected 0000bbf340b58cfb found 00003002c75cb51e

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  atieclxx.exe

STACK_TEXT: 
ffffc806`c04d85a8 fffff804`0727c8a5 : 00000000`000000f7 00003002`c75cb51e 0000bbf3`40b58cfb ffff440c`bf4a7304 : nt!KeBugCheckEx
ffffc806`c04d85b0 fffff804`070de996 : ffff9186`1e73f640 00000000`0000000d 00000000`00000901 00000000`00029c00 : nt!_report_gsfailure+0x25
ffffc806`c04d85f0 ffff8005`3312962e : ffff8025`c07cf010 ffff8025`c07cf010 00000000`00000000 00000000`00000000 : nt!KeWaitForMultipleObjects+0x476
ffffc806`c04d8700 ffff8005`33129c55 : ffff881b`27614fd8 00000000`00000000 00000000`00000001 fffff780`00000000 : win32kfull!xxxRealSleepThread+0x2be
ffffc806`c04d8830 ffff8005`33122985 : ffffc806`c04d8b80 00000000`00000000 00000000`00000000 ffff8025`c07cf010 : win32kfull!xxxSleepThread2+0xb5
ffffc806`c04d8880 ffff8005`33120b02 : ffffc806`c04d8aa8 ffff9186`20f8c000 00000000`00000000 00000000`00000000 : win32kfull!xxxRealInternalGetMessage+0x1365
ffffc806`c04d8a60 fffff804`071d3c15 : ffff9186`20f8c080 00000000`00000000 00000000`00000020 00000000`00000000 : win32kfull!NtUserGetMessage+0x92
ffffc806`c04d8b00 00007ffa`4d691164 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000001`d11bf7b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`4d691164


SYMBOL_NAME:  win32kfull!xxxRealSleepThread+2be

MODULE_NAME: win32kfull

IMAGE_NAME:  win32kfull.sys

IMAGE_VERSION:  10.0.18362.778

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  2be

FAILURE_BUCKET_ID:  0xF7_MISSING_GSFRAME_win32kfull!xxxRealSleepThread

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {c8352eb7-e79e-9b4e-3f82-03020a3de70e}

Followup:     MachineOwner
---------

3: kd> lmvm win32kfull
Browse full module list
start             end                 module name
ffff8005`33000000 ffff8005`333a2000   win32kfull   (pdb symbols)          C:\ProgramData\Dbg\sym\win32kfull.pdb\3D0593220030EFF120FD60F9DF8F49801\win32kfull.pdb
    Loaded symbol image file: win32kfull.sys
    Mapped memory image file: C:\ProgramData\Dbg\sym\win32kfull.sys\F8F8CBEB3a2000\win32kfull.sys
    Image path: \SystemRoot\System32\win32kfull.sys
    Image name: win32kfull.sys
    Browse all global symbols  functions  data
    Image was built with /Brepro flag.
    Timestamp:        F8F8CBEB (This is a reproducible build file hash, not a timestamp)
    CheckSum:         0039C96B
    ImageSize:        003A2000
    File version:     10.0.18362.778
    Product version:  10.0.18362.778
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    Information from resource tables:
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     win32kfull.sys
        OriginalFilename: win32kfull.sys
        ProductVersion:   10.0.18362.778
        FileVersion:      10.0.18362.778 (WinBuild.160101.0800)
        FileDescription:  Full/Desktop Win32k Kernel Driver
        LegalCopyright:   © Microsoft Corporation. All rights reserved.
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.  This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned.  This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 00007687330ac51e, Actual security check cookie from the stack
Arg2: 0000a0bbada09eeb, Expected security check cookie
Arg3: ffff5f44525f6114, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 1

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on DESKTOP-1IBQR0U

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 4

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 74

    Key  : Analysis.System
    Value: CreateObject


ADDITIONAL_XML: 1

BUGCHECK_CODE:  f7

BUGCHECK_P1: 7687330ac51e

BUGCHECK_P2: a0bbada09eeb

BUGCHECK_P3: ffff5f44525f6114

BUGCHECK_P4: 0

SECURITY_COOKIE:  Expected 0000a0bbada09eeb found 00007687330ac51e

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  atieclxx.exe

STACK_TEXT: 
ffff8e86`2d9bf5a8 fffff801`1ea7c8a5 : 00000000`000000f7 00007687`330ac51e 0000a0bb`ada09eeb ffff5f44`525f6114 : nt!KeBugCheckEx
ffff8e86`2d9bf5b0 fffff801`1e8de996 : ffffd10b`b9f99ec0 00000000`0000000d 00000000`00000901 00000000`0007c300 : nt!_report_gsfailure+0x25
ffff8e86`2d9bf5f0 fffffb63`62d2962e : fffffb32`42807010 fffffb32`42807010 00000000`00000000 00000000`00000000 : nt!KeWaitForMultipleObjects+0x476
ffff8e86`2d9bf700 fffffb63`62d29c55 : ffffd89d`e1989fad 00000000`00000000 00000000`00000001 fffff780`00000000 : win32kfull!xxxRealSleepThread+0x2be
ffff8e86`2d9bf830 fffffb63`62d22985 : ffff8e86`2d9bfb80 00000000`00000000 00000000`00000000 fffffb32`42807010 : win32kfull!xxxSleepThread2+0xb5
ffff8e86`2d9bf880 fffffb63`62d20b02 : ffff8e86`2d9bfaa8 ffffd10b`b9fc6000 00000000`00000000 00000000`00000000 : win32kfull!xxxRealInternalGetMessage+0x1365
ffff8e86`2d9bfa60 fffff801`1e9d3c15 : ffffd10b`b9fc6080 00000000`00000000 00000000`00000020 00000000`00000000 : win32kfull!NtUserGetMessage+0x92
ffff8e86`2d9bfb00 00007ff8`16d61164 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000d8`c34ff728 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`16d61164


SYMBOL_NAME:  win32kfull!xxxRealSleepThread+2be

MODULE_NAME: win32kfull

IMAGE_NAME:  win32kfull.sys

IMAGE_VERSION:  10.0.18362.778

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  2be

FAILURE_BUCKET_ID:  0xF7_MISSING_GSFRAME_win32kfull!xxxRealSleepThread

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {c8352eb7-e79e-9b4e-3f82-03020a3de70e}

Followup:     MachineOwner
---------

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff806810a176f, Address of the instruction which caused the bugcheck
Arg3: ffffbf0271f4cea0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 2

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on DESKTOP-1IBQR0U

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 5

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 66

    Key  : Analysis.System
    Value: CreateObject


ADDITIONAL_XML: 1

BUGCHECK_CODE:  3b

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff806810a176f

BUGCHECK_P3: ffffbf0271f4cea0

BUGCHECK_P4: 0

CONTEXT:  ffffbf0271f4cea0 -- (.cxr 0xffffbf0271f4cea0)
rax=ffff4958929ffc11 rbx=ffffbf0271f4daa0 rcx=ffffa8854adfda00
rdx=0000000000000001 rsi=000000000000000f rdi=0000000000000000
rip=fffff806810a176f rsp=ffffbf0271f4d890 rbp=ffffbf0271f4db80
 r8=ffffbf0271f4daa0  r9=0000000000000000 r10=ffffa8854adfda00
r11=ffffe58543a78380 r12=0000000000000000 r13=0000000000000000
r14=0000000000000001 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!ExpSetTimerObject+0x3f:
fffff806`810a176f 440fb6e2        movzx   r12d,dl
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  audiodg.exe

STACK_TEXT: 
ffffbf02`71f4d890 fffff806`810a1663 : 00000000`00000000 ffffbf02`71f4daa0 00000015`961ff8a0 00000000`0000000f : nt!ExpSetTimerObject+0x3f
ffffbf02`71f4da30 fffff806`811d3c15 : 00000000`000004a0 ffffa885`4bf89080 00000000`0000000f ffffa885`493450e0 : nt!NtSetTimerEx+0x1b3
ffffbf02`71f4db00 00007ffc`6b11f584 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000015`961ff5e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`6b11f584


SYMBOL_NAME:  nt!ExpSetTimerObject+3f

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.18362.778

STACK_COMMAND:  .cxr 0xffffbf0271f4cea0 ; kb

BUCKET_ID_FUNC_OFFSET:  3f

FAILURE_BUCKET_ID:  0x3B_c0000005_nt!ExpSetTimerObject

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {5db43dd0-e321-8609-cb41-0f1e8d5bac8b}

Followup:     MachineOwner
---------

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.  This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned.  This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 0000488ae170951e, Actual security check cookie from the stack
Arg2: 00009eecabbb7a36, Expected security check cookie
Arg3: ffff6113544485c9, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 2

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on DESKTOP-1IBQR0U

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 5

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 74

    Key  : Analysis.System
    Value: CreateObject


ADDITIONAL_XML: 1

BUGCHECK_CODE:  f7

BUGCHECK_P1: 488ae170951e

BUGCHECK_P2: 9eecabbb7a36

BUGCHECK_P3: ffff6113544485c9

BUGCHECK_P4: 0

SECURITY_COOKIE:  Expected 00009eecabbb7a36 found 0000488ae170951e

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  atieclxx.exe

STACK_TEXT: 
ffffb08c`ed01a5a8 fffff806`0c87c8a5 : 00000000`000000f7 0000488a`e170951e 00009eec`abbb7a36 ffff6113`544485c9 : nt!KeBugCheckEx
ffffb08c`ed01a5b0 fffff806`0c6de996 : ffffd80f`c2f91c40 00000000`0000000d 00000000`00000901 00000000`0005eb00 : nt!_report_gsfailure+0x25
ffffb08c`ed01a5f0 ffff84c6`a532962e : ffff8498`8461d050 ffff8498`8461d050 00000000`00000000 00000000`00000000 : nt!KeWaitForMultipleObjects+0x476
ffffb08c`ed01a700 ffff84c6`a5329c55 : ffff15e1`e7cfcc53 00000000`00000000 00000000`00000001 fffff780`00000000 : win32kfull!xxxRealSleepThread+0x2be
ffffb08c`ed01a830 ffff84c6`a5322985 : ffffb08c`ed01ab80 00000000`00000000 00000000`00000000 ffff8498`8461d050 : win32kfull!xxxSleepThread2+0xb5
ffffb08c`ed01a880 ffff84c6`a5320b02 : ffffb08c`ed01aaa8 ffffd80f`c3c68000 00000000`00000000 00000000`00000000 : win32kfull!xxxRealInternalGetMessage+0x1365
ffffb08c`ed01aa60 fffff806`0c7d3c15 : ffffd80f`c3c68080 00000000`00000000 00000000`00000020 00000000`00000000 : win32kfull!NtUserGetMessage+0x92
ffffb08c`ed01ab00 00007ffa`937c1164 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0000009a`ac0ffba8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`937c1164


SYMBOL_NAME:  win32kfull!xxxRealSleepThread+2be

MODULE_NAME: win32kfull

IMAGE_NAME:  win32kfull.sys

IMAGE_VERSION:  10.0.18362.778

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  2be

FAILURE_BUCKET_ID:  0xF7_MISSING_GSFRAME_win32kfull!xxxRealSleepThread

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {c8352eb7-e79e-9b4e-3f82-03020a3de70e}

Followup:     MachineOwner
---------

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.  This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned.  This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 00007a0c1fd9851e, Actual security check cookie from the stack
Arg2: 000059c544acb1a0, Expected security check cookie
Arg3: ffffa63abb534e5f, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 1

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on DESKTOP-1IBQR0U

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 4

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 74

    Key  : Analysis.System
    Value: CreateObject


ADDITIONAL_XML: 1

BUGCHECK_CODE:  f7

BUGCHECK_P1: 7a0c1fd9851e

BUGCHECK_P2: 59c544acb1a0

BUGCHECK_P3: ffffa63abb534e5f

BUGCHECK_P4: 0

SECURITY_COOKIE:  Expected 000059c544acb1a0 found 00007a0c1fd9851e

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  atieclxx.exe

STACK_TEXT: 
ffff820d`1948b5a8 fffff801`06a7c8a5 : 00000000`000000f7 00007a0c`1fd9851e 000059c5`44acb1a0 ffffa63a`bb534e5f : nt!KeBugCheckEx
ffff820d`1948b5b0 fffff801`068de996 : ffffd70e`10e86680 00000000`0000000d 00000000`00000901 00000000`000b5c00 : nt!_report_gsfailure+0x25
ffff820d`1948b5f0 ffffb038`8da0962e : ffffb053`c2867220 ffffb053`c2867220 00000000`00000000 00000000`00000000 : nt!KeWaitForMultipleObjects+0x476
ffff820d`1948b700 ffffb038`8da09c55 : ffff52f8`add07f9c 00000000`00000000 00000000`00000001 fffff780`00000000 : win32kfull!xxxRealSleepThread+0x2be
ffff820d`1948b830 ffffb038`8da02985 : ffff820d`1948bb80 00000000`00000000 00000000`00000000 ffffb053`c2867220 : win32kfull!xxxSleepThread2+0xb5
ffff820d`1948b880 ffffb038`8da00b02 : ffff820d`1948baa8 ffffd70e`0aa84000 00000000`00000000 00000000`00000000 : win32kfull!xxxRealInternalGetMessage+0x1365
ffff820d`1948ba60 fffff801`069d3c15 : ffffd70e`0aa84080 00000000`00000000 00000000`00000020 00000000`00000000 : win32kfull!NtUserGetMessage+0x92
ffff820d`1948bb00 00007ffc`32eb1164 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000cb`47cff9c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`32eb1164


SYMBOL_NAME:  win32kfull!xxxRealSleepThread+2be

MODULE_NAME: win32kfull

IMAGE_NAME:  win32kfull.sys

IMAGE_VERSION:  10.0.18362.778

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  2be

FAILURE_BUCKET_ID:  0xF7_MISSING_GSFRAME_win32kfull!xxxRealSleepThread

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {c8352eb7-e79e-9b4e-3f82-03020a3de70e}

Followup:     MachineOwner
---------