Loading Dump File [D:\CO\MiniDumps\072419-8171-01.dmp]
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000004, The thread's stack pointer was outside the legal stack
extents for the thread.
Arg2: ffff9b81d675eff0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff9b81d675ef48, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Probably caused by : memory_corruption
Owning Process ffffae0a307e8080 Image: Steam.exe
Attached Process N/A Image: N/A
ERROR_CODE: (NTSTATUS) 0xc0000409 - Das System hat in dieser Anwendung den Überlauf eines stapelbasierten Puffers ermittelt. Dieser Überlauf könnte einem bösartigen Benutzer ermöglichen, die Steuerung der Anwendung zu übernehmen.
Loading Dump File [D:\CO\MiniDumps\072419-8296-01.dmp]
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a portion of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffff86016a00b2b0
Arg3: ffffc080fc870f70
Arg4: fffff8020c27a7da
Probably caused by : memory_corruption
Owning Process ffffae0d6c7f5080 Image: Steam.exe
Attached Process N/A Image: N/A
ffff9b81`d675f180 fffff800`13c30f5e : 00000000`00000000 00000000`00000000 ffff9b81`d675f6f0 00007fff`00000003 : nt!RtlpGetStackLimitsEx+0x12a53b
10: kd> !whea
Error Source Table @ fffff8020c6ef818
0 Error Sources
Loading Dump File [D:\CO\MiniDumps\072419-8203-01.dmp]
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80129786659, address which referenced memory
Probably caused by : memory_corruption
Owning Process fffff80129b899c0 Image: System Process
Attached Process ffffbb8a35062040 Image: System
ffffdf86`6e4a75e0 fffff801`29786659 : 00000000`00000004 ffffdf86`6e4a7940 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x46b (TrapFrame @ ffffdf86`6e4a75e0)
Loading Dump File [D:\CO\MiniDumps\072419-8296-01.dmp]
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a portion of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffff86016a00b2b0
Arg3: ffffc080fc870f70
Arg4: fffff8020c27a7da
OVERLAPPED_MODULE: Address regions for 'vhdmp' and 'dump_storpor' overlap
Owning Process ffffae0d6c7f5080 Image: Steam.exe
Attached Process N/A Image: N/A
ffffc080`fc874080 fffff802`0c2ca54a : 00000000`00000445 00000000`00000000
ffffc080`fc874750 00007fff`ffff0000 : nt!KiPageFault+0x445
DEFAULT_BUCKET_ID: CODE_CORRUPTION
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
Loading Dump File [D:\CO\MiniDumps\072419-8203-01.dmp]
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80129786659, address which referenced memory
ffffdf86`6e4a75e0 fffff801`29786659 : 00000000`00000004 ffffdf86`6e4a7940 00000000`00000000 00000000`00000000 :
nt!KiPageFault+0x46b
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
Owning Process fffff80129b899c0 Image: System Process
Attached Process ffffbb8a35062040 Image: System
Loading Dump File [D:\CO\MiniDumps\072419-7968-01.dmp]
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 0000640be81b3700, Actual security check cookie from the stack
Arg2: 0000ef96605cf2e3, Expected security check cookie
Arg3: ffff10699fa30d1c, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
Owning Process fffff80040d899c0 Image: System Process
Attached Process ffff9f8bd606c040 Image: System
Loading Dump File [D:\CO\MiniDumps\072519-8640-01.dmp]
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80763070bba, Address of the instruction which caused the bugcheck
Arg3: ffff87881d819a40, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
Owning Process ffffd60bcec78080 Image: firefox.exe
Attached Process N/A Image: N/A
ffff8788`1d81a2a0 fffff807`63070bba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x445 (TrapFrame @ ffff8788`1d81a2a0)
ffff8788`1d81aad0 fffff807`631ce118 : 00000000`00007dfc 00000000`00000000 00000000`00000000 00000000`00000001 : dxgkrnl!DxgkGetDeviceState+0x24
Loading Dump File [D:\CO\MiniDumps\072619-10250-01.dmp]
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffb67fffc281b8, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80542081674, address which referenced memory
fffff389`265d3d30 fffff805`4de93140 : fffff805`4deb5aab 00000000`0000004b fffff389`265d3f4b fffff389`265d004b :
nt!KiPageFault+0x360
Owning Process ffff85037fdca4c0 Image: atiesrxx.exe
Attached Process N/A Image: N/A
Loading Dump File [D:\CO\MiniDumps\072619-9687-01.dmp]
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000000, A stack-based buffer has been overrun.
Arg2: 0000000000000000, Address of the trap frame for the exception that caused the bugcheck
Arg3: 0000000000000000, Address of the exception record for the exception that caused the bugcheck
Arg4: 000000000001003f, Reserved
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
Owning Process ffffbc83ab07f380 Image: System
Attached Process N/A Image: N/A
Loading Dump File [E:\CO\MiniDumps_2\072719-10296-01.dmp]
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff801248df67e, Address of the instruction which caused the bugcheck
Arg3: ffffec0afaeb48d0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%p verwies auf Arbeitsspeicher bei 0x%p.
Der Vorgang %s konnte im Arbeitsspeicher nicht durchgef hrt werden.
ffffec0a`faeb5550 fffff801`2fd4b5ca : 00000031`6527f530 00000000`00000020 ffffec0a`faeb5b80 00000000`00000000 : dxgkrnl!DxgkSignalSynchronizationObjectFromGpu2+0x969
FAILURE_BUCKET_ID: 0x3B_c0000005_dxgkrnl!DxgkLock2
Owning Process ffffd90a622be080 Image: dwm.exe
Attached Process N/A Image: N/A
ffffec0a`faeb5130 fffff801`248df67e : ffffd90a`6119eb10 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x445 (TrapFrame @ ffffec0a`faeb5130)
===============================================================================
Section 1138 : {870166ff-01e6-0000-4400-bf1a0300000f}
-------------------------------------------------------------------------------
Descriptor @ fffff801248f370e
Section @ fffff80125468609
Offset : 12095371
Length : 3353870336
Flags : 0xc88348d0 ResourceNotAvailable
Severity : Invalid
FRU Id : {031887be-0000-8b4c-cb44-0fbe878e0500}
FRU Text : ÿÿÿÿÿÿD?¿
* Unknown section format *
