TigeR_Bf109
Hectopat
Daha fazla
- Cinsiyet
- Erkek
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 9eed0000000087d4, Actual security check cookie from the stack
Arg2: 0000b99c9eedc3ea, Expected security check cookie
Arg3: ffff466361123c15, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 9eed0000000087d4
BUGCHECK_P2: b99c9eedc3ea
BUGCHECK_P3: ffff466361123c15
BUGCHECK_P4: 0
SECURITY_COOKIE: Expected 0000b99c9eedc3ea found 9eed0000000087d4
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xF7
PROCESS_NAME: Origin.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-07-2020 17:46:42.0743
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff8040627c485 to fffff804061c14e0
STACK_TEXT:
ffffb984`49cb7818 fffff804`0627c485 : 00000000`000000f7 9eed0000`000087d4 0000b99c`9eedc3ea ffff4663`61123c15 : nt!KeBugCheckEx
ffffb984`49cb7820 fffff804`06072ec2 : 00000000`00000000 00000000`003edef8 00000000`00000001 00000000`00000000 : nt!_report_gsfailure+0x25
ffffb984`49cb7860 fffff804`061cf520 : ffffe50a`c3869080 ffffb984`49cb7a80 00000000`00544000 ffffe50a`bfec6be0 : nt!MmAccessFault+0x322
ffffb984`49cb7a00 00000000`777316ae : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x360
00000000`003ee810 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777316ae
THREAD_SHA1_HASH_MOD_FUNC: a7dfa97d75a3d26079665ff6906966f05e95116b
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 96e6575e13f68d3c9c741a111f295a559c3bc146
THREAD_SHA1_HASH_MOD: d084f7dfa548ce4e51810e4fd5914176ebc66791
FOLLOWUP_IP:
nt!_report_gsfailure+25
fffff804`0627c485 cc int 3
FAULT_INSTR_CODE: cccccccc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!_report_gsfailure+25
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 25
FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
PRIMARY_PROBLEM_CLASS: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
TARGET_TIME: 2020-01-07T12:46:22.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 3de5
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xf7_missing_gsframe_nt!_report_gsfailure
FAILURE_ID_HASH: {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}
Followup: MachineOwner
---------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff807961d6021, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8074c43cfe0, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: fffff807961d6021
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8074c43cfe0
READ_ADDRESS: fffff8074c9733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff807961d6021
CURRENT_IRQL: 2
FAULTING_IP:
nt!KiMayStealStandbyThread+0
fffff807`4c43cfe0 0fb682a15e0000 movzx eax,byte ptr [rdx+5EA1h]
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: csrss.exe
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-07-2020 17:46:54.0749
ANALYSIS_VERSION: 10.0.18362.1 x86fre
TRAP_FRAME: ffffa5818ed78090 -- (.trap 0xffffa5818ed78090)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000007 rbx=0000000000000000 rcx=ffffbc000d7c7180
rdx=fffff8074a1d0180 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8074c43cfe0 rsp=ffffa5818ed78228 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000003 r10=0000000000000000
r11=fffff8074a1d0180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KiMayStealStandbyThread:
fffff807`4c43cfe0 0fb682a15e0000 movzx eax,byte ptr [rdx+5EA1h] ds:fffff807`4a1d6021=00
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8074c5d32e9 to fffff8074c5c14e0
STACK_TEXT:
ffffa581`8ed77f48 fffff807`4c5d32e9 : 00000000`0000000a fffff807`961d6021 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffa581`8ed77f50 fffff807`4c5cf62b : 00000000`00000000 ffff9589`7c8f4100 fffff807`4a1d0180 00000000`00000002 : nt!KiBugCheckDispatch+0x69
ffffa581`8ed78090 fffff807`4c43cfe0 : fffff807`4c43c8eb 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x46b
ffffa581`8ed78228 fffff807`4c43c8eb : 00000000`00000000 00000000`00000000 00000000`00000000 fffff807`4ceb7c54 : nt!KiMayStealStandbyThread
ffffa581`8ed78230 fffff807`4c43c2ec : fffff807`4a1d0180 ffffa581`fffffffe ffff9589`ffffffff 00000000`00000001 : nt!KiSearchForNewThreadOnProcessor+0x3b
ffffa581`8ed782c0 fffff807`4c43b644 : ffff9589`77d7c080 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwapThread+0x72c
ffffa581`8ed78360 fffff807`4c4884e7 : ffff9589`7c9a4000 fffff807`00000000 00000001`00000000 00000000`00000000 : nt!KiCommitThreadWait+0x144
ffffa581`8ed78400 fffff392`0b209c86 : ffffffff`ffff8ad0 00000000`00000000 00000000`00000003 00000000`00000002 : nt!KeWaitForMultipleObjects+0x287
ffffa581`8ed78510 fffff392`0ae0c779 : 00000000`00000003 00000000`00000003 fffff392`0b121308 00000000`00000004 : win32kbase!LegacyInputDispatcher::WaitAndDispatch+0x86
ffffa581`8ed78640 fffff392`0b24e87e : ffff9589`77d7c080 ffff9589`77d7c080 00000000`00000000 00000000`00000005 : win32kfull!RawInputThread+0x959
ffffa581`8ed788c0 fffff392`0ae2aff0 : ffff9589`77d7c080 00000000`00000000 00000000`00000005 00000000`00000000 : win32kbase!xxxCreateSystemThreads+0x9e
ffffa581`8ed789d0 fffff807`4c5d2d15 : ffff9589`77d7c080 00000000`00000005 0000023e`0e604340 00000000`00000248 : win32kfull!NtUserCallNoParam+0x70
ffffa581`8ed78a00 00007ff9`f7fd1144 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0000006f`07c3fa88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`f7fd1144
THREAD_SHA1_HASH_MOD_FUNC: ce93dcacf5833022134aa6002a897ec05d7efdcc
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: b81e53458752b0ac346801a7e319f05e6d97b507
THREAD_SHA1_HASH_MOD: 637ba5de44a7a77d210b2c1790ddac079fb3fbb2
FOLLOWUP_IP:
win32kbase!LegacyInputDispatcher::WaitAndDispatch+86
fffff392`0b209c86 0f1f440000 nop dword ptr [rax+rax]
FAULT_INSTR_CODE: 441f0f
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: win32kbase!LegacyInputDispatcher::WaitAndDispatch+86
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 86
FAILURE_BUCKET_ID: AV_win32kbase!LegacyInputDispatcher::WaitAndDispatch
BUCKET_ID: AV_win32kbase!LegacyInputDispatcher::WaitAndDispatch
PRIMARY_PROBLEM_CLASS: AV_win32kbase!LegacyInputDispatcher::WaitAndDispatch
TARGET_TIME: 2020-01-07T12:56:32.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 2bfd
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_win32kbase!legacyinputdispatcher::waitanddispatch
FAILURE_ID_HASH: {af9493bb-0913-2c87-0cc0-f458347dea63}
Followup: MachineOwner
---------
WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: ffff80063bb2a028, Address of the WHEA_ERROR_RECORD structure.
Arg3: 00000000be000000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000800400, Low order 32-bits of the MCi_STATUS value.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 0
BUGCHECK_P2: ffff80063bb2a028
BUGCHECK_P3: be000000
BUGCHECK_P4: 800400
BUGCHECK_STR: 0x124_GenuineIntel
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: f
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-31-2019 17:27:44.0677
ANALYSIS_VERSION: 10.0.18362.1 x86fre
STACK_TEXT:
fffff803`77028918 fffff803`713a4fe8 : 00000000`00000124 00000000`00000000 ffff8006`3bb2a028 00000000`be000000 : nt!KeBugCheckEx
fffff803`77028920 fffff803`74b81920 : ffff8006`3bba0550 00000000`00000000 ffff8006`3bb2a028 00000000`00000000 : hal!HalBugCheckSystem+0xd8
fffff803`77028960 fffff803`71740952 : ffff8006`3bba0550 fffff803`770289e9 00000000`00000000 ffff8006`3bb2a028 : PSHED!PshedBugCheckSystem+0x10
fffff803`77028990 fffff803`713a6946 : fffff803`77028ab0 00000000`00000000 ffff8006`3bba05a0 ffff8006`3bba0550 : nt!WheaReportHwError+0x382
fffff803`77028a50 fffff803`713a6dda : 00000000`00000010 ffff8006`3bba05a0 fffff803`77028c08 fffff803`77028e50 : hal!HalpMcaReportError+0x72
fffff803`77028bb0 fffff803`713a6cb4 : ffff8006`36ee3450 00000000`00000001 00000000`00000000 00000000`00000000 : hal!HalpMceHandlerCore+0xf2
fffff803`77028c00 fffff803`713a6f20 : 00000000`00000010 00000000`00000001 00000000`00000000 00000000`00000000 : hal!HalpMceHandler+0xe0
fffff803`77028c40 fffff803`713a5fc8 : 00000000`00000000 fffff803`77028ed0 00000000`00000000 00000000`00000000 : hal!HalpMceHandlerWithRendezvous+0xd4
fffff803`77028c70 fffff803`713a71a7 : ffff8006`36ee3450 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalpHandleMachineCheck+0x5c
fffff803`77028ca0 fffff803`716a4a20 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalHandleMcheck+0x37
fffff803`77028cd0 fffff803`715d04ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiHandleMcheck+0x10
fffff803`77028d00 fffff803`715d0171 : fffff803`00000000 fffff803`715d00ae ffffca80`9b9e4180 00000000`00000000 : nt!KxMcheckAbort+0x7a
fffff803`77028e40 fffff803`904b138f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiMcheckAbort+0x271
fffff803`7700c6a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : intelppm!MWaitIdle+0x1f
THREAD_SHA1_HASH_MOD_FUNC: 74d6f842f394d0bf91f311b36b5441a27b8e18a2
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 7715d22f386f5ddac4d5fb4b9bac1cc78014801d
THREAD_SHA1_HASH_MOD: 48245875d4c5535ecbacf57c10ad759e5c3df6ae
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: GenuineIntel
IMAGE_NAME: GenuineIntel
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: 0x124_GenuineIntel_PROCESSOR_MAE_INTERNAL_TIMER
BUCKET_ID: 0x124_GenuineIntel_PROCESSOR_MAE_INTERNAL_TIMER
PRIMARY_PROBLEM_CLASS: 0x124_GenuineIntel_PROCESSOR_MAE_INTERNAL_TIMER
TARGET_TIME: 2019-12-31T10:00:43.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: b1d
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x124_genuineintel_processor_mae_internal_timer
FAILURE_ID_HASH: {dbae0c63-5a7c-cd3f-eccf-de6e68aa7cf2}
Followup: MachineOwner
---------
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: d3cf000000005879, Actual security check cookie from the stack
Arg2: 0000a5e1d3cf5879, Expected security check cookie
Arg3: ffff5a1e2c30a786, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: d3cf000000005879
BUGCHECK_P2: a5e1d3cf5879
BUGCHECK_P3: ffff5a1e2c30a786
BUGCHECK_P4: 0
SECURITY_COOKIE: Expected 0000a5e1d3cf5879 found d3cf000000005879
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xF7
PROCESS_NAME: Origin.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-31-2019 17:27:48.0276
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff80044a7c485 to fffff800449c14e0
STACK_TEXT:
ffffbc83`dafc76c8 fffff800`44a7c485 : 00000000`000000f7 d3cf0000`00005879 0000a5e1`d3cf5879 ffff5a1e`2c30a786 : nt!KeBugCheckEx
ffffbc83`dafc76d0 fffff800`44e2151c : 00000000`00000001 00000000`00000002 ffffac8f`d56e6001 00000000`00000000 : nt!_report_gsfailure+0x25
ffffbc83`dafc7710 fffff800`449d2d15 : ffffac8f`00000000 00000000`00000001 00000000`00002710 ffffbc83`dafc7a80 : nt!NtWaitForMultipleObjects32+0x10c
ffffbc83`dafc7990 00000000`77331cbc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`108feeb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77331cbc
THREAD_SHA1_HASH_MOD_FUNC: 8bb4bf34ac8125baac6608877816dcc6edbb4238
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: fa04a0daaf12295d2a109054e9e6224ea97526ec
THREAD_SHA1_HASH_MOD: d084f7dfa548ce4e51810e4fd5914176ebc66791
FOLLOWUP_IP:
nt!_report_gsfailure+25
fffff800`44a7c485 cc int 3
FAULT_INSTR_CODE: cccccccc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!_report_gsfailure+25
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 25
FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
PRIMARY_PROBLEM_CLASS: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
TARGET_TIME: 2019-12-31T10:45:48.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 1f99
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xf7_missing_gsframe_nt!_report_gsfailure
FAILURE_ID_HASH: {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}
Followup: MachineOwner
---------
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: ca0a0000000041d2, Actual security check cookie from the stack
Arg2: 00007589ca0a41d2, Expected security check cookie
Arg3: ffff8a7635f5be2d, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: ca0a0000000041d2
BUGCHECK_P2: 7589ca0a41d2
BUGCHECK_P3: ffff8a7635f5be2d
BUGCHECK_P4: 0
SECURITY_COOKIE: Expected 00007589ca0a41d2 found ca0a0000000041d2
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xF7
PROCESS_NAME: NVIDIA Share.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-05-2020 17:46:19.0550
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff8006147c485 to fffff800613c14e0
STACK_TEXT:
ffffd984`7f12ed98 fffff800`6147c485 : 00000000`000000f7 ca0a0000`000041d2 00007589`ca0a41d2 ffff8a76`35f5be2d : nt!KeBugCheckEx
ffffd984`7f12eda0 fffff800`61268c32 : 00000000`00000032 ffffb68e`af5841f0 00000000`00000001 00000000`00000000 : nt!_report_gsfailure+0x25
ffffd984`7f12ede0 fffff800`61268aeb : ffffd984`7f12eff9 fffff800`00000000 00000000`00000000 ffffd984`7f12fa80 : nt!EtwWriteEx+0x132
ffffd984`7f12eef0 ffff85db`8ae0e5ee : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000001 : nt!EtwWriteTransfer+0x2b
ffffd984`7f12ef40 ffff85db`8aec2e92 : 00000000`00000000 00000000`7f12fa80 00000000`00000000 00000000`00000000 : win32kbase!McGenEventWrite+0x46
ffffd984`7f12ef80 ffff85db`8aea4fba : 00000000`00000000 ffff85db`8aaf06bd ffffffff`ffff63c0 ffff85b1`846c4350 : win32kbase!McTemplateK0p+0x42
ffffd984`7f12eff0 ffff85db`8aa2ad2e : 00000000`00040200 fffff800`61260000 ffffbb49`8deba927 ffff8500`00000000 : win32kbase!EtwTraceWakeInputIdle+0x7890a
ffffd984`7f12f020 ffff85db`8aa2a7a6 : 00000000`00001cff 00000000`00000000 00000000`ffffffff 00000000`ffffffff : win32kfull!xxxGetInputEvent+0xfe
ffffd984`7f12f060 fffff800`613d2d15 : ffffb68e`b1f5f080 0000003e`bcf9f3a8 0000003e`00000003 ffffd984`00001cff : win32kfull!NtUserMsgWaitForMultipleObjectsEx+0xc6
ffffd984`7f12f990 00007ff9`8ed79a84 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0000003e`bcf9f388 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`8ed79a84
THREAD_SHA1_HASH_MOD_FUNC: 6a681dec3a479189b78db6d44abea480eda3ee30
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 2322dd12c23c7eba9a2a5645ed7bb480181e3873
THREAD_SHA1_HASH_MOD: a0242fe08b65f8c4f561b085a37c32bbd80116a0
FOLLOWUP_IP:
win32kbase!McGenEventWrite+46
ffff85db`8ae0e5ee 0f1f440000 nop dword ptr [rax+rax]
FAULT_INSTR_CODE: 441f0f
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: win32kbase!McGenEventWrite+46
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 46
FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_win32kbase!McGenEventWrite
BUCKET_ID: 0xF7_MISSING_GSFRAME_win32kbase!McGenEventWrite
PRIMARY_PROBLEM_CLASS: 0xF7_MISSING_GSFRAME_win32kbase!McGenEventWrite
TARGET_TIME: 2020-01-05T13:41:55.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 23c8
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xf7_missing_gsframe_win32kbase!mcgeneventwrite
FAILURE_ID_HASH: {47b6f6ae-1014-c736-951a-bd44c74ca0a3}
Followup: MachineOwner
---------
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 9eed0000000087d4, Actual security check cookie from the stack
Arg2: 0000b99c9eedc3ea, Expected security check cookie
Arg3: ffff466361123c15, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 9eed0000000087d4
BUGCHECK_P2: b99c9eedc3ea
BUGCHECK_P3: ffff466361123c15
BUGCHECK_P4: 0
SECURITY_COOKIE: Expected 0000b99c9eedc3ea found 9eed0000000087d4
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xF7
PROCESS_NAME: Origin.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-07-2020 17:46:42.0743
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff8040627c485 to fffff804061c14e0
STACK_TEXT:
ffffb984`49cb7818 fffff804`0627c485 : 00000000`000000f7 9eed0000`000087d4 0000b99c`9eedc3ea ffff4663`61123c15 : nt!KeBugCheckEx
ffffb984`49cb7820 fffff804`06072ec2 : 00000000`00000000 00000000`003edef8 00000000`00000001 00000000`00000000 : nt!_report_gsfailure+0x25
ffffb984`49cb7860 fffff804`061cf520 : ffffe50a`c3869080 ffffb984`49cb7a80 00000000`00544000 ffffe50a`bfec6be0 : nt!MmAccessFault+0x322
ffffb984`49cb7a00 00000000`777316ae : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x360
00000000`003ee810 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777316ae
THREAD_SHA1_HASH_MOD_FUNC: a7dfa97d75a3d26079665ff6906966f05e95116b
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 96e6575e13f68d3c9c741a111f295a559c3bc146
THREAD_SHA1_HASH_MOD: d084f7dfa548ce4e51810e4fd5914176ebc66791
FOLLOWUP_IP:
nt!_report_gsfailure+25
fffff804`0627c485 cc int 3
FAULT_INSTR_CODE: cccccccc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!_report_gsfailure+25
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 25
FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
PRIMARY_PROBLEM_CLASS: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
TARGET_TIME: 2020-01-07T12:46:22.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 3de5
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xf7_missing_gsframe_nt!_report_gsfailure
FAILURE_ID_HASH: {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}
Followup: MachineOwner
---------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff807961d6021, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8074c43cfe0, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: fffff807961d6021
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8074c43cfe0
READ_ADDRESS: fffff8074c9733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff807961d6021
CURRENT_IRQL: 2
FAULTING_IP:
nt!KiMayStealStandbyThread+0
fffff807`4c43cfe0 0fb682a15e0000 movzx eax,byte ptr [rdx+5EA1h]
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: csrss.exe
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-07-2020 17:46:54.0749
ANALYSIS_VERSION: 10.0.18362.1 x86fre
TRAP_FRAME: ffffa5818ed78090 -- (.trap 0xffffa5818ed78090)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000007 rbx=0000000000000000 rcx=ffffbc000d7c7180
rdx=fffff8074a1d0180 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8074c43cfe0 rsp=ffffa5818ed78228 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000003 r10=0000000000000000
r11=fffff8074a1d0180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KiMayStealStandbyThread:
fffff807`4c43cfe0 0fb682a15e0000 movzx eax,byte ptr [rdx+5EA1h] ds:fffff807`4a1d6021=00
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8074c5d32e9 to fffff8074c5c14e0
STACK_TEXT:
ffffa581`8ed77f48 fffff807`4c5d32e9 : 00000000`0000000a fffff807`961d6021 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffa581`8ed77f50 fffff807`4c5cf62b : 00000000`00000000 ffff9589`7c8f4100 fffff807`4a1d0180 00000000`00000002 : nt!KiBugCheckDispatch+0x69
ffffa581`8ed78090 fffff807`4c43cfe0 : fffff807`4c43c8eb 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x46b
ffffa581`8ed78228 fffff807`4c43c8eb : 00000000`00000000 00000000`00000000 00000000`00000000 fffff807`4ceb7c54 : nt!KiMayStealStandbyThread
ffffa581`8ed78230 fffff807`4c43c2ec : fffff807`4a1d0180 ffffa581`fffffffe ffff9589`ffffffff 00000000`00000001 : nt!KiSearchForNewThreadOnProcessor+0x3b
ffffa581`8ed782c0 fffff807`4c43b644 : ffff9589`77d7c080 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwapThread+0x72c
ffffa581`8ed78360 fffff807`4c4884e7 : ffff9589`7c9a4000 fffff807`00000000 00000001`00000000 00000000`00000000 : nt!KiCommitThreadWait+0x144
ffffa581`8ed78400 fffff392`0b209c86 : ffffffff`ffff8ad0 00000000`00000000 00000000`00000003 00000000`00000002 : nt!KeWaitForMultipleObjects+0x287
ffffa581`8ed78510 fffff392`0ae0c779 : 00000000`00000003 00000000`00000003 fffff392`0b121308 00000000`00000004 : win32kbase!LegacyInputDispatcher::WaitAndDispatch+0x86
ffffa581`8ed78640 fffff392`0b24e87e : ffff9589`77d7c080 ffff9589`77d7c080 00000000`00000000 00000000`00000005 : win32kfull!RawInputThread+0x959
ffffa581`8ed788c0 fffff392`0ae2aff0 : ffff9589`77d7c080 00000000`00000000 00000000`00000005 00000000`00000000 : win32kbase!xxxCreateSystemThreads+0x9e
ffffa581`8ed789d0 fffff807`4c5d2d15 : ffff9589`77d7c080 00000000`00000005 0000023e`0e604340 00000000`00000248 : win32kfull!NtUserCallNoParam+0x70
ffffa581`8ed78a00 00007ff9`f7fd1144 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0000006f`07c3fa88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`f7fd1144
THREAD_SHA1_HASH_MOD_FUNC: ce93dcacf5833022134aa6002a897ec05d7efdcc
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: b81e53458752b0ac346801a7e319f05e6d97b507
THREAD_SHA1_HASH_MOD: 637ba5de44a7a77d210b2c1790ddac079fb3fbb2
FOLLOWUP_IP:
win32kbase!LegacyInputDispatcher::WaitAndDispatch+86
fffff392`0b209c86 0f1f440000 nop dword ptr [rax+rax]
FAULT_INSTR_CODE: 441f0f
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: win32kbase!LegacyInputDispatcher::WaitAndDispatch+86
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 86
FAILURE_BUCKET_ID: AV_win32kbase!LegacyInputDispatcher::WaitAndDispatch
BUCKET_ID: AV_win32kbase!LegacyInputDispatcher::WaitAndDispatch
PRIMARY_PROBLEM_CLASS: AV_win32kbase!LegacyInputDispatcher::WaitAndDispatch
TARGET_TIME: 2020-01-07T12:56:32.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 2bfd
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_win32kbase!legacyinputdispatcher::waitanddispatch
FAILURE_ID_HASH: {af9493bb-0913-2c87-0cc0-f458347dea63}
Followup: MachineOwner
---------