KERNEL_SECURITY_CHECK_FAILURE (139) Mavi Ekran Hatası

Microsoft (R) Windows Debugger Version 10.0.21349.1004 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Ercument\Desktop\072621-14484-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff802`35e00000 PsLoadedModuleList = 0xfffff802`36a2a1d0
Debug session time: Mon Jul 26 16:21:01.924 2021 (UTC + 3:00)
System Uptime: 0 days 5:44:05.574
Loading Kernel Symbols
..

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.


.............................................................
................................................................
.........................................................
Loading User Symbols
Loading unloaded module list
..........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802`361f6f20 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff8d81`e8045690=0000000000000139
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000000, A stack-based buffer has been overrun.
Arg2: 0000000000000000, Address of the trap frame for the exception that caused the BugCheck
Arg3: 0000000000000000, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2374

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 2416

Key : Analysis.Init.CPU.mSec
Value: 499

Key : Analysis.Init.Elapsed.mSec
Value: 8677

Key : Analysis.Memory.CommitPeak.Mb
Value: 74


DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

BUGCHECK_CODE: 139

BUGCHECK_P1: 0

BUGCHECK_P2: 0

BUGCHECK_P3: 0

BUGCHECK_P4: 0

TRAP_FRAME: 0000000000000000 -- (.trap 0x0)

EXCEPTION_RECORD: 0000000000000000 -- (.exr 0x0)
Cannot read Exception record @ 0000000000000000

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

STACK_TEXT:
ffff8d81`e8045688 fffff802`361ffa2b : 00000000`00000139 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
ffff8d81`e8045690 fffff802`36087980 : ffffe701`2bed8180 ffff938c`5c147100 ffffe701`00000004 ffff8d81`e80456fc : nt!guard_icall_bugcheck+0x1b
ffff8d81`e80456c0 fffff802`360814bd : 00000000`000c0486 ffff8d81`e8045b10 00000000`00000080 ffffe701`2bed8180 : nt!KiDeferredReadySingleThread+0x500
ffff8d81`e80458b0 fffff802`360818a0 : ffffe701`2bed8180 00000000`00000000 ffff938c`5f20b1f0 00000000`00000000 : nt!KiReadyThread+0x4d
ffff8d81`e80458e0 fffff802`36099e89 : 00000000`00000000 00000000`00000000 00000000`00140001 00000000`000c0486 : nt!KiProcessExpiredTimerList+0x290
ffff8d81`e80459d0 fffff802`361faa8e : ffffffff`00000000 ffffe701`2bed8180 ffffe701`2bee31c0 ffff938c`64c9a080 : nt!KiRetireDpcList+0x9d9
ffff8d81`e8045c60 00000000`00000000 : ffff8d81`e8046000 ffff8d81`e8040000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e


SYMBOL_NAME: nt!guard_icall_bugcheck+1b

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.1110

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 1b

FAILURE_BUCKET_ID: 0x139_0_LEGACY_GS_VIOLATION_nt!guard_icall_bugcheck

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {9bee41a7-2ef9-07ca-7e59-7d5a0c6e2d05}

Followup: MachineOwner



2 ------------------------------------------------------------------------------------------------------------------


Microsoft (R) Windows Debugger Version 10.0.21349.1004 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Ercument\Desktop\072621-14468-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff806`47e00000 PsLoadedModuleList = 0xfffff806`48a2a1d0
Debug session time: Mon Jul 26 19:32:02.464 2021 (UTC + 3:00)
System Uptime: 0 days 3:10:27.165
Loading Kernel Symbols
..

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

.............................................................
................................................................
.......................................................
Loading User Symbols
Loading unloaded module list
.........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`481f6f20 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffffe02`20c45ab0=00000000000000f7
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and BugCheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 00007b579aca4ea9, Actual security check cookie from the stack
Arg2: 00007b579aca4d89, Expected security check cookie
Arg3: ffff84a86535b276, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1999

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 3743

Key : Analysis.Init.CPU.mSec
Value: 531

Key : Analysis.Init.Elapsed.mSec
Value: 8778

Key : Analysis.Memory.CommitPeak.Mb
Value: 73


DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

BUGCHECK_CODE: f7

BUGCHECK_P1: 7b579aca4ea9

BUGCHECK_P2: 7b579aca4d89

BUGCHECK_P3: ffff84a86535b276

BUGCHECK_P4: 0

SECURITY_COOKIE: Expected 00007b579aca4d89 found 00007b579aca4ea9

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

STACK_TEXT:
fffffe02`20c45aa8 fffff806`482b10f5 : 00000000`000000f7 00007b57`9aca4ea9 00007b57`9aca4d89 ffff84a8`6535b276 : nt!KeBugCheckEx
fffffe02`20c45ab0 fffff806`480172a8 : 00000000`00000000 00001f80`000e00ab 00000000`00000003 00000000`00000002 : nt!_report_gsfailure+0x25
fffffe02`20c45af0 fffff806`481faa44 : ffffffff`00000000 ffff9681`db09d1c0 ffffce08`d72e0080 00000000`00000af8 : nt!PoIdle+0x3a8
fffffe02`20c45c60 00000000`00000000 : fffffe02`20c46000 fffffe02`20c40000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x54


SYMBOL_NAME: nt!_report_gsfailure+25

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.1110

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 25

FAILURE_BUCKET_ID: 0xF7_THREE_BIT_MISSING_GSFRAME_nt!_report_gsfailure

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {78a85278-f601-c152-78ea-701afde9cf45}

Followup: MachineOwner
---------