Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- *******************************************************************************
- * *
- * Bugcheck Analysis *
- * *
- *******************************************************************************
- KERNEL_SECURITY_CHECK_FAILURE (139)
- A kernel component has corrupted a critical data structure. The corruption
- could potentially allow a malicious user to gain control of this machine.
- Arguments:
- Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
- Arg2: fffff981dd4aeff0, Address of the trap frame for the exception that caused the BugCheck
- Arg3: fffff981dd4aef48, Address of the exception record for the exception that caused the BugCheck
- Arg4: 0000000000000000, Reserved
- Debugging Details:
- ------------------
- KEY_VALUES_STRING: 1
- Key : Analysis.CPU.mSec
- Value: 937
- Key : Analysis.Elapsed.mSec
- Value: 4019
- Key : Analysis.IO.Other.Mb
- Value: 7
- Key : Analysis.IO.Read.Mb
- Value: 1
- Key : Analysis.IO.Write.Mb
- Value: 32
- Key : Analysis.Init.CPU.mSec
- Value: 156
- Key : Analysis.Init.Elapsed.mSec
- Value: 29924
- Key : Analysis.Memory.CommitPeak.Mb
- Value: 102
- Key : Analysis.Version.DbgEng
- Value: 10.0.27725.1000
- Key : Analysis.Version.Description
- Value: 10.2408.27.01 amd64fre
- Key : Analysis.Version.Ext
- Value: 1.2408.27.1
- Key : Bugcheck.Code.LegacyAPI
- Value: 0x139
- Key : Bugcheck.Code.TargetModel
- Value: 0x139
- Key : Dump.Attributes.AsUlong
- Value: 808
- Key : Dump.Attributes.KernelGeneratedTriageDump
- Value: 1
- Key : FailFast.Name
- Value: CORRUPT_LIST_ENTRY
- Key : FailFast.Type
- Value: 3
- Key : Failure.Bucket
- Value: 0x139_3_CORRUPT_LIST_ENTRY_BEDaisy!unknown_function
- Key : Failure.Hash
- Value: {59d8eb10-b2e4-7df6-f6a5-49968226dbb8}
- Key : Hypervisor.Enlightenments.ValueHex
- Value: 1497cf94
- Key : Hypervisor.Flags.AnyHypervisorPresent
- Value: 1
- Key : Hypervisor.Flags.ApicEnlightened
- Value: 1
- Key : Hypervisor.Flags.ApicVirtualizationAvailable
- Value: 0
- Key : Hypervisor.Flags.AsyncMemoryHint
- Value: 0
- Key : Hypervisor.Flags.CoreSchedulerRequested
- Value: 0
- Key : Hypervisor.Flags.CpuManager
- Value: 1
- Key : Hypervisor.Flags.DeprecateAutoEoi
- Value: 0
- Key : Hypervisor.Flags.DynamicCpuDisabled
- Value: 1
- Key : Hypervisor.Flags.Epf
- Value: 0
- Key : Hypervisor.Flags.ExtendedProcessorMasks
- Value: 1
- Key : Hypervisor.Flags.HardwareMbecAvailable
- Value: 1
- Key : Hypervisor.Flags.MaxBankNumber
- Value: 0
- Key : Hypervisor.Flags.MemoryZeroingControl
- Value: 0
- Key : Hypervisor.Flags.NoExtendedRangeFlush
- Value: 0
- Key : Hypervisor.Flags.NoNonArchCoreSharing
- Value: 1
- Key : Hypervisor.Flags.Phase0InitDone
- Value: 1
- Key : Hypervisor.Flags.PowerSchedulerQos
- Value: 0
- Key : Hypervisor.Flags.RootScheduler
- Value: 0
- Key : Hypervisor.Flags.SynicAvailable
- Value: 1
- Key : Hypervisor.Flags.UseQpcBias
- Value: 0
- Key : Hypervisor.Flags.Value
- Value: 4853999
- Key : Hypervisor.Flags.ValueHex
- Value: 4a10ef
- Key : Hypervisor.Flags.VpAssistPage
- Value: 1
- Key : Hypervisor.Flags.VsmAvailable
- Value: 1
- Key : Hypervisor.RootFlags.AccessStats
- Value: 1
- Key : Hypervisor.RootFlags.CrashdumpEnlightened
- Value: 1
- Key : Hypervisor.RootFlags.CreateVirtualProcessor
- Value: 1
- Key : Hypervisor.RootFlags.DisableHyperthreading
- Value: 0
- Key : Hypervisor.RootFlags.HostTimelineSync
- Value: 1
- Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
- Value: 0
- Key : Hypervisor.RootFlags.IsHyperV
- Value: 1
- Key : Hypervisor.RootFlags.LivedumpEnlightened
- Value: 1
- Key : Hypervisor.RootFlags.MapDeviceInterrupt
- Value: 1
- Key : Hypervisor.RootFlags.MceEnlightened
- Value: 1
- Key : Hypervisor.RootFlags.Nested
- Value: 0
- Key : Hypervisor.RootFlags.StartLogicalProcessor
- Value: 1
- Key : Hypervisor.RootFlags.Value
- Value: 1015
- Key : Hypervisor.RootFlags.ValueHex
- Value: 3f7
- BUGCHECK_CODE: 139
- BUGCHECK_P1: 3
- BUGCHECK_P2: fffff981dd4aeff0
- BUGCHECK_P3: fffff981dd4aef48
- BUGCHECK_P4: 0
- FILE_IN_CAB: 010525-13531-01.dmp
- TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b
- DUMP_FILE_ATTRIBUTES: 0x808
- Kernel Generated Triage Dump
- FAULTING_THREAD: ffffd38eb5b495c0
- TRAP_FRAME: fffff981dd4aeff0 -- (.trap 0xfffff981dd4aeff0)
- NOTE: The trap frame does not contain all registers.
- Some register values may be zeroed or incorrect.
- rax=ffffd38ec3c68ab0 rbx=0000000000000000 rcx=0000000000000003
- rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
- rip=fffff8005721aff7 rsp=fffff981dd4af180 rbp=ffff9480c7911180
- r8=0000000000000001 r9=0000000000000002 r10=ffffd38ea27fe800
- r11=ffffd38efdae8e00 r12=0000000000000000 r13=0000000000000000
- r14=0000000000000000 r15=0000000000000000
- iopl=0 nv up ei pl nz na pe nc
- nt!KiExitDispatcher+0x1c7:
- fffff800`5721aff7 cd29 int 29h
- Resetting default scope
- EXCEPTION_RECORD: fffff981dd4aef48 -- (.exr 0xfffff981dd4aef48)
- ExceptionAddress: fffff8005721aff7 (nt!KiExitDispatcher+0x00000000000001c7)
- ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
- ExceptionFlags: 00000001
- NumberParameters: 1
- Parameter[0]: 0000000000000003
- Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
- CUSTOMER_CRASH_COUNT: 1
- PROCESS_NAME: System
- ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
- EXCEPTION_CODE_STR: c0000409
- EXCEPTION_PARAMETER1: 0000000000000003
- EXCEPTION_STR: 0xc0000409
- STACK_TEXT:
- fffff981`dd4aecc8 fffff800`5742ae29 : 00000000`00000139 00000000`00000003 fffff981`dd4aeff0 fffff981`dd4aef48 : nt!KeBugCheckEx
- fffff981`dd4aecd0 fffff800`5742b3f2 : 00000000`00000000 00000000`00000000 00000000`00000001 00000400`00000000 : nt!KiBugCheckDispatch+0x69
- fffff981`dd4aee10 fffff800`574290db : 00000000`00000000 00000000`00000000 ffffd38e`b5b495c0 00000000`00000001 : nt!KiFastFailDispatch+0xb2
- fffff981`dd4aeff0 fffff800`5721aff7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x35b
- fffff981`dd4af180 fffff800`5723d0fd : ffffd38e`fb6c15e0 00000000`00000000 ffffa60d`3d702260 fffff800`57aaa03e : nt!KiExitDispatcher+0x1c7
- fffff981`dd4af530 fffff800`6f3a716c : ffffd38e`fb6c1600 ffffd38e`fb6c1638 fffff981`dd4af6c0 00000000`00000000 : nt!KeInsertQueueApc+0x17d
- fffff981`dd4af5c0 ffffd38e`fb6c1600 : ffffd38e`fb6c1638 fffff981`dd4af6c0 00000000`00000000 00000000`00000000 : BEDaisy+0x4d716c
- fffff981`dd4af5c8 ffffd38e`fb6c1638 : fffff981`dd4af6c0 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffd38e`fb6c1600
- fffff981`dd4af5d0 fffff981`dd4af6c0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffd38e`fb6c1638
- fffff981`dd4af5d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff981`dd4af6c0
- SYMBOL_NAME: BEDaisy+4d716c
- MODULE_NAME: BEDaisy
- IMAGE_NAME: BEDaisy.sys
- STACK_COMMAND: .process /r /p 0xffffd38ea26d8040; .thread 0xffffd38eb5b495c0 ; kb
- BUCKET_ID_FUNC_OFFSET: 4d716c
- FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_BEDaisy!unknown_function
- OSPLATFORM_TYPE: x64
- OSNAME: Windows 10
- FAILURE_ID_HASH: {59d8eb10-b2e4-7df6-f6a5-49968226dbb8}
- Followup: MachineOwner
- ---------
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement