Hi
For the past 1-2 weeks i am constantly getting bsod
I analyzed a bit, But I don't understand it
Loading Dump File [C:\Users\jesus\Desktop\071124-7671-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 22621 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 22621.1.amd64fre.ni_release.220506-1250
Kernel base = 0xfffff803`66c00000 PsLoadedModuleList = 0xfffff803`67813510
Debug session time: Thu Jul 11 21:42:42.935 2024 (UTC + 2:00)
System Uptime: 0 days 22:48:53.536
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.......................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000080`d66dd018). Type ".hh dbgerr001" for details
Loading unloaded module list
..................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff803`67015df0 48894c2408 mov qword ptr [rsp+8],rcx ss:ffff980f`df9cf940=00000000000000f7
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and BugCheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 0000500dcedfbc46, Actual security check cookie from the stack
Arg2: 0000500dbcbe24c8, Expected security check cookie
Arg3: ffffaff2312043b9, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
*** WARNING: Check Image - Checksum mismatch - Dump: 0xb17b2, File: 0xb1718 - C:\ProgramData\Dbg\sym\win32k.sys\6C1AD5CCab000\win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 1843
Key : Analysis.Elapsed.mSec
Value: 4097
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 468
Key : Analysis.Init.Elapsed.mSec
Value: 23882
Key : Analysis.Memory.CommitPeak.Mb
Value: 140
Key : Bugcheck.Code.LegacyAPI
Value: 0xf7
Key : Bugcheck.Code.TargetModel
Value: 0xf7
Key : Failure.Bucket
Value: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
Key : Failure.Hash
Value: {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}
Key : WER.OS.Branch
Value: ni_release
Key : WER.OS.Version
Value: 10.0.22621.1
BUGCHECK_CODE: f7
BUGCHECK_P1: 500dcedfbc46
BUGCHECK_P2: 500dbcbe24c8
BUGCHECK_P3: ffffaff2312043b9
BUGCHECK_P4: 0
FILE_IN_CAB: 071124-7671-01.dmp
SECURITY_COOKIE: Expected 0000500dbcbe24c8 found 0000500dcedfbc46
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: ONCE_HUMAN.exe
STACK_TEXT:
ffff980f`df9cf938 fffff803`670fbd75 : 00000000`000000f7 0000500d`cedfbc46 0000500d`bcbe24c8 ffffaff2`312043b9 : nt!KeBugCheckEx
ffff980f`df9cf940 fffff803`66f47ee2 : ffffc887`2f6e3740 00000000`00000111 00000000`00000001 ffffc887`00000000 : nt!_report_gsfailure+0x25
ffff980f`df9cf980 fffff803`6702707e : 00000000`00000086 ffffc887`2aae8d60 000001d9`a1185b00 00000000`00000000 : nt!MmAccessFault+0x282
ffff980f`df9cfaa0 00007ffc`e621be75 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x37e
00000080`d986dc30 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`e621be75
SYMBOL_NAME: nt!_report_gsfailure+25
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.22621.3880
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 25
FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
OS_VERSION: 10.0.22621.1
BUILDLAB_STR: ni_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}
Followup: MachineOwner
---------
someone, help me?