- 惠普社区
- >
- 秋鸭 的帖子
最新主题
2024-11-20
13:12:24
大佬，又出现了新问题
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver...
查看更多...
大佬，又出现了新问题
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and BugCheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 0040c42afd83c20b, Actual security check cookie from the stack
Arg2: 0000c42afd83c20b, Expected security check cookie
Arg3: ffff3bd5027c3df4, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 500
Key : Analysis.Elapsed.mSec
Value: 6450
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 3
Key : Analysis.Init.CPU.mSec
Value: 328
Key : Analysis.Init.Elapsed.mSec
Value: 12754
Key : Analysis.Memory.CommitPeak.Mb
Value: 92
Key : Analysis.Version.DbgEng
Value: 10.0.27725.1000
Key : Analysis.Version.Description
Value: 10.2408.27.01 amd64fre
Key : Analysis.Version.Ext
Value: 1.2408.27.1
Key : Bugcheck.Code.LegacyAPI
Value: 0xf7
Key : Bugcheck.Code.TargetModel
Value: 0xf7
Key : Dump.Attributes.AsUlong
Value: 1008
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
Key : Failure.Bucket
Value: 0xF7_ONE_BIT_MISSING_GSFRAME_nt!_report_gsfailure
Key : Failure.Hash
Value: {8f84f302-dd0e-1f96-6f9c-0ea31ad59f42}
BUGCHECK_CODE: f7
BUGCHECK_P1: 40c42afd83c20b
BUGCHECK_P2: c42afd83c20b
BUGCHECK_P3: ffff3bd5027c3df4
BUGCHECK_P4: 0
FILE_IN_CAB: 111924-13656-01.dmp
DUMP_FILE_ATTRIBUTES: 0x1008
Kernel Generated Triage Dump
FAULTING_THREAD: ffffd58e20d38080
SECURITY_COOKIE: Expected 0000c42afd83c20b found 0040c42afd83c20b
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: msedge.exe
IP_IN_FREE_BLOCK: 0
STACK_TEXT:
ffff848e`143cec38 fffff803`54cfb965 : 00000000`000000f7 0040c42a`fd83c20b 0000c42a`fd83c20b ffff3bd5`027c3df4 : nt!KeBugCheckEx
ffff848e`143cec40 fffff803`54a3cbdf : 00000000`00000000 00000000`00000001 00000000`00000002 fffff803`54adb13f : nt!_report_gsfailure+0x25
ffff848e`143cec80 fffff803`54a3b774 : 00000000`00000001 ffffa301`21691180 00000000`00000001 ffff848e`143cf320 : nt!KiSearchForNewThreadOnProcessor+0x124f
ffff848e`143cf050 fffff803`54a3a950 : ffffd58e`237802a8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSearchForNewThread+0x724
ffff848e`143cf2a0 fffff803`54a3cd77 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwapThread+0x870
ffff848e`143cf3f0 fffff803`54b2d3cd : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : nt!KiCommitThreadWait+0x137
ffff848e`143cf4a0 fffff803`54b2c068 : ffffd58e`3118d470 00000000`00001000 0000183c`003e8800 ffffd58e`3118d310 : nt!KeRemoveQueueEx+0x111d
ffff848e`143cf860 fffff803`54ec176e : ffff848e`143cf9d0 00000000`00000001 0000183c`01c4c820 fffff803`54fec103 : nt!IoRemoveIoCompletion+0x98
ffff848e`143cf980 fffff803`54c2d938 : ffffd58e`20d38080 000000ec`27dff848 ffff848e`143cfa48 0000183c`0000f140 : nt!NtRemoveIoCompletion+0x13e
ffff848e`143cfa30 00007ffc`a894f484 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000ec`27dff828 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`a894f484
SYMBOL_NAME: nt!_report_gsfailure+25
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.22621.3447
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 25
FAILURE_BUCKET_ID: 0xF7_ONE_BIT_MISSING_GSFRAME_nt!_report_gsfailure
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {8f84f302-dd0e-1f96-6f9c-0ea31ad59f42}
Followup: MachineOwner
---------
2024-11-11
00:08:05
这是拿windbg查看的蓝屏代码 *******************************************************************************
* *
* ...
查看更多...
这是拿windbg查看的蓝屏代码 *******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff802350cc103, Address of the instruction which caused the BugCheck
Arg3: ffffbe8108cfec00, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 906
Key : Analysis.Elapsed.mSec
Value: 2234
Key : Analysis.IO.Other.Mb
Value: 14
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 23
Key : Analysis.Init.CPU.mSec
Value: 375
Key : Analysis.Init.Elapsed.mSec
Value: 46717
Key : Analysis.Memory.CommitPeak.Mb
Value: 87
Key : Analysis.Version.DbgEng
Value: 10.0.27725.1000
Key : Analysis.Version.Description
Value: 10.2408.27.01 amd64fre
Key : Analysis.Version.Ext
Value: 1.2408.27.1
Key : Bugcheck.Code.LegacyAPI
Value: 0x3b
Key : Bugcheck.Code.TargetModel
Value: 0x3b
Key : Dump.Attributes.AsUlong
Value: 1008
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
Key : Failure.Bucket
Value: AV_nt!ObpLookupObjectName
Key : Failure.Hash
Value: {474528e0-febc-e870-edfc-c0a99a0c8f3c}
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff802350cc103
BUGCHECK_P3: ffffbe8108cfec00
BUGCHECK_P4: 0
FILE_IN_CAB: 111024-13578-01.dmp
DUMP_FILE_ATTRIBUTES: 0x1008
Kernel Generated Triage Dump
FAULTING_THREAD: ffff9d8ee4f95080
CONTEXT: ffffbe8108cfec00 -- (.cxr 0xffffbe8108cfec00)rax=fffff80234a00000 rbx=ffffbe8108cff848 rcx=0000000000000000
rdx=0040000000000003 rsi=ffffbe8108cff840 rdi=ffffd50dbd031cd0
rip=fffff802350cc103 rsp=ffffbe8108cff620 rbp=ffffbe8108cff720
r8=ffffd50de26d37b0 r9=0000000000000022 r10=ffffbe8108cff840
r11=005c003f003f005c r12=ffff9d8ee78f01d0 r13=0000000000000000
r14=ffff9d8ee78f0010 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050206
nt!ObpLookupObjectName+0xa23:
fffff802`350cc103 488bb4d070e6d100 mov rsi,qword ptr [rax+rdx*8+0D1E670h] ds:002b:01fff802`3571e688=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: OmenCommandCen
STACK_TEXT:
ffffbe81`08cff620 fffff802`350cb192 : ffff9d8e`e78f0001 ffffbe81`08cff840 00000000`00000040 ffff9d8e`c6dfd220 : nt!ObpLookupObjectName+0xa23
ffffbe81`08cff7b0 fffff802`35193f21 : 00000000`00000000 ffff9d8e`e4dcc7f0 000000f7`b7dfe580 ffff9d8e`e4dcc808 : nt!ObOpenObjectByNameEx+0x1f2
ffffbe81`08cff8e0 fffff802`351eb9e8 : 000000f7`b7dfe610 00000000`00000000 000000f7`b7dfe580 000000f7`b7dfe5b0 : nt!IopCreateFile+0x431
ffffbe81`08cff9a0 fffff802`34e2d938 : 00000000`0000005c 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtOpenFile+0x58
ffffbe81`08cffa30 00007ff9`d858f9c4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000f7`b7dfe4e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`d858f9c4
SYMBOL_NAME: nt!ObpLookupObjectName+a23
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.22621.3447
STACK_COMMAND: .cxr 0xffffbe8108cfec00 ; kb
BUCKET_ID_FUNC_OFFSET: a23
FAILURE_BUCKET_ID: AV_nt!ObpLookupObjectName
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {474528e0-febc-e870-edfc-c0a99a0c8f3c}
Followup: MachineOwner
---------
