KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000000, A stack-based buffer has been overrun.
Arg2: 0000000000000000, Address of the trap frame for the exception that caused the bugcheck
Arg3: 0000000000000000, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000100000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 4
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-K01TCKK
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 7
Key : Analysis.Memory.CommitPeak.Mb
Value: 71
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: 139
BUGCHECK_P1: 0
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 100000000
TRAP_FRAME: 0000000000000000 -- (.trap 0x0)
EXCEPTION_RECORD: 0000000000000000 -- (.exr 0x0)
Cannot read Exception record @ 0000000000000000
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: services.exe
DPC_STACK_BASE: FFFFF88863447FB0
STACK_TEXT:
fffff888`63447c58 fffff806`3bdc9c9b : 00000000`00000139 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff888`63447c60 fffff806`3bc6ba79 : ffff800f`48d0aea0 00000000`00000080 00000000`00000002 000000d7`00000002 : nt!guard_icall_bugcheck+0x1b
fffff888`63447c90 fffff806`3bc6a7d9 : 00000000`0000000a 00000000`00989680 00000000`0035c374 00000000`0000008c : nt!KiProcessExpiredTimerList+0x169
fffff888`63447d80 fffff806`3bdc8265 : d9e8e1cf`dfd7c4d7 ffffde01`f6280180 ffff800f`480d3000 fffff888`695463a4 : nt!KiRetireDpcList+0x4e9
fffff888`63447fb0 fffff806`3bdc8050 : 00000000`00000000 fffff806`3bb602cb 00000000`00000000 ffff800f`5c389830 : nt!KxRetireDpcList+0x5
fffff888`69545ff0 fffff806`3bdc7905 : fffff888`695463a4 fffff806`3bdc32a1 00000000`00099afc fffff888`695460b0 : nt!KiDispatchInterruptContinue
fffff888`69546020 fffff806`3bdc32a1 : 00000000`00099afc fffff888`695460b0 ffff800f`480d3000 ffff800f`00000240 : nt!KiDpcInterruptBypass+0x25
fffff888`69546030 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatchNoLockNoEtw+0xb1
SYMBOL_NAME: nt!guard_icall_bugcheck+1b
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1b
FAILURE_BUCKET_ID: 0x139_0_LEGACY_GS_VIOLATION_nt!guard_icall_bugcheck
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {9bee41a7-2ef9-07ca-7e59-7d5a0c6e2d05}
Followup: MachineOwner
---------
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80512e185f7, The address that the exception occurred at
Arg3: ffff880d574ba7f8, Exception Record Address
Arg4: ffffe38103991930, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.Sec
Value: 5
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-K01TCKK
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 12
Key : Analysis.Memory.CommitPeak.Mb
Value: 69
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff80512e185f7
BUGCHECK_P3: ffff880d574ba7f8
BUGCHECK_P4: ffffe38103991930
EXCEPTION_RECORD: ffff880d574ba7f8 -- (.exr 0xffff880d574ba7f8)
ExceptionAddress: fffff80512e185f7 (nt!MiGetPagesToZero+0x00000000000003a7)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffffe38103991930 -- (.cxr 0xffffe38103991930)
rax=0000000000000000 rbx=00000400001e6568 rcx=0000000000000068
rdx=0000000000000208 rsi=0000b40005b30380 rdi=ffffb787df4c3170
rip=fffff80512e185f7 rsp=ffff880d574baa30 rbp=ffffb787df4c3170
r8=fffff40000000028 r9=0000000000000000 r10=0000000000000000
r11=0000000fffffffff r12=fffff70000002800 r13=0000000000000003
r14=0000180000b66070 r15=0000000000000067
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050246
nt!MiGetPagesToZero+0x3a7:
fffff805`12e185f7 f0480fba6e183f lock bts qword ptr [rsi+18h],3Fh ds:002b:0000b400`05b30398=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff805133733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8051322a3c8: Unable to get Flags value from nt!KdVersionBlock
fffff8051322a3c8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
EXCEPTION_STR: 0xc0000005
BAD_STACK_POINTER: ffffe381039910c8
STACK_TEXT:
ffff880d`574baa30 fffff805`12f835e4 : 00000000`00000000 fffff805`1326a480 00000000`00000003 00000000`00000000 : nt!MiGetPagesToZero+0x3a7
ffff880d`574baac0 fffff805`12f2a725 : ffffb787`df443f30 fffff805`1326a480 ffffb787`df5ce080 666f736f`7263694d : nt!MiZeroPageThread+0xa4
ffff880d`574bab10 fffff805`12fc886a : ffffe381`03680180 ffffb787`df5ce080 fffff805`12f2a6d0 11301331`53550213 : nt!PspSystemThreadStartup+0x55
ffff880d`574bab60 00000000`00000000 : ffff880d`574bb000 ffff880d`574b4000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a
SYMBOL_NAME: nt!MiGetPagesToZero+3a7
MODULE_NAME: nt
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .cxr 0xffffe38103991930 ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 3a7
FAILURE_BUCKET_ID: AV_STACKPTR_ERROR_nt!MiGetPagesToZero
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {34f90351-d18d-9036-df35-8492622cafa3}
Followup: MachineOwner
---------
drive.google.com
