KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffeb836211a280, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffeb836211a1d8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
TRAP_FRAME: ffffeb836211a280 -- (.trap 0xffffeb836211a280)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff9f836e30e3b0 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8067dcc98cd rsp=ffffeb836211a410 rbp=ffff9f836efb2040
r8=0000000000000001 r9=0000000000000002 r10=ffff9f83649f8d00
r11=fffff8067a35c180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy
nt!KiExitDispatcher+0x1ad:
fffff806`7dcc98cd cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffeb836211a1d8 -- (.exr 0xffffeb836211a1d8)
ExceptionAddress: fffff8067dcc98cd (nt!KiExitDispatcher+0x00000000000001ad)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x139
PROCESS_NAME: System
CURRENT_IRQL: 2
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
EXCEPTION_STR: 0x0
LAST_CONTROL_TRANSFER: from fffff8067de05e69 to fffff8067ddf3ea0
STACK_TEXT:
ffffeb83`62119f58 fffff806`7de05e69 : 00000000`00000139 00000000`00000003 ffffeb83`6211a280 ffffeb83`6211a1d8 : nt!KeBugCheckEx
ffffeb83`62119f60 fffff806`7de06290 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffeb83`6211a0a0 fffff806`7de04623 : 00000000`00008000 00000000`00000001 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffeb83`6211a280 fffff806`7dcc98cd : 00000000`00000000 ffffeb83`6211a4c1 ffff9f83`7904d000 fffff806`00000000 : nt!KiRaiseSecurityCheckFailure+0x323
ffffeb83`6211a410 fffff806`7dc0c191 : fffff806`7a35c180 00000000`00000000 fffff806`7a35c101 fffff806`7e3b2094 : nt!KiExitDispatcher+0x1ad
ffffeb83`6211a480 fffff806`d99f42f2 : 00000000`00000200 ffff9f83`79365068 ffffdb07`58e5f010 00000000`00000002 : nt!KeInsertQueueApc+0x151
ffffeb83`6211a520 00000000`00000200 : ffff9f83`79365068 ffffdb07`58e5f010 00000000`00000002 00000000`00000000 : BEDaisy+0x3042f2
ffffeb83`6211a528 ffff9f83`79365068 : ffffdb07`58e5f010 00000000`00000002 00000000`00000000 00000000`00000000 : 0x200
ffffeb83`6211a530 ffffdb07`58e5f010 : 00000000`00000002 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffff9f83`79365068
ffffeb83`6211a538 00000000`00000002 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffdb07`58e5f010
ffffeb83`6211a540 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffb8f1`48d88f01 : 0x2
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff8067dd963ae-fffff8067dd963b1 4 bytes - nt!MiFreeUltraMapping+32
[ a0 7d fb f6:60 e7 ce 9d ]
4 errors : !nt (fffff8067dd963ae-fffff8067dd963b1)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_large
FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c}
Followup: memory_corruption
---------
*** WARNING: Unable to verify timestamp for BEDaisy.sys
*** ERROR: Module load completed but symbols could not be loaded for BEDaisy.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
Followup: memory_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffffe87f55df280, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffffe87f55df1d8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
TRAP_FRAME: fffffe87f55df280 -- (.trap 0xfffffe87f55df280)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffcc0311d6c370 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80533cc98cd rsp=fffffe87f55df410 rbp=ffffcc0312540140
r8=0000000000000001 r9=0000000000000002 r10=ffffcc0308bf8600
r11=fffff8052db16180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy
nt!KiExitDispatcher+0x1ad:
fffff805`33cc98cd cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: fffffe87f55df1d8 -- (.exr 0xfffffe87f55df1d8)
ExceptionAddress: fffff80533cc98cd (nt!KiExitDispatcher+0x00000000000001ad)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x139
PROCESS_NAME: System
CURRENT_IRQL: 2
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
EXCEPTION_STR: 0x0
LAST_CONTROL_TRANSFER: from fffff80533e05e69 to fffff80533df3ea0
STACK_TEXT:
fffffe87`f55def58 fffff805`33e05e69 : 00000000`00000139 00000000`00000003 fffffe87`f55df280 fffffe87`f55df1d8 : nt!KeBugCheckEx
fffffe87`f55def60 fffff805`33e06290 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffffe87`f55df0a0 fffff805`33e04623 : 00000000`000000ff 00000000`00000000 00000000`00000000 55555555`55555555 : nt!KiFastFailDispatch+0xd0
fffffe87`f55df280 fffff805`33cc98cd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x323
fffffe87`f55df410 fffff805`33c0c191 : fffff805`2db16180 00000000`00000000 fffff805`2db16101 fffff805`343b2094 : nt!KiExitDispatcher+0x1ad
fffffe87`f55df480 fffff805`8c806950 : 00000000`00000200 ffffcc03`1bb7d738 ffffde89`a6cf4010 00000000`00000002 : nt!KeInsertQueueApc+0x151
fffffe87`f55df520 00000000`00000200 : ffffcc03`1bb7d738 ffffde89`a6cf4010 00000000`00000002 00000000`00000000 : BEDaisy+0x306950
fffffe87`f55df528 ffffcc03`1bb7d738 : ffffde89`a6cf4010 00000000`00000002 00000000`00000000 00000000`00000000 : 0x200
fffffe87`f55df530 ffffde89`a6cf4010 : 00000000`00000002 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffcc03`1bb7d738
fffffe87`f55df538 00000000`00000002 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffde89`a6cf4010
fffffe87`f55df540 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 ffff179c`5f7e4001 : 0x2
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff80533d963ae-fffff80533d963b1 4 bytes - nt!MiFreeUltraMapping+32
[ a0 7d fb f6:80 28 51 a2 ]
4 errors : !nt (fffff80533d963ae-fffff80533d963b1)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_large
FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c}
Followup: memory_corruption
---------