MODULE_NAME: vgk
IMAGE_NAME: vgk.sys*** WARNING: Unable to verify timestamp for BEDaisy.sys
MODULE_NAME: vgk
IMAGE_NAME: vgk.sys*** WARNING: Unable to verify timestamp for BEDaisy.sysBunlar tam olarak neden sebep oluyorlar? Önceden kernel mode heap corruption'dan yiyordum onun sebebi BattleEye'dı ve buda mı anti-cheat yüzünden?
SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD (d4)
A driver unloaded without cancelling lookaside lists, DPCs, worker threads, etc.
The broken driver's name is displayed on the screen and saved in
KiBugCheckDriver.
When possible, the guilty driver's name (Unicode string) is printed on
the BugCheck screen and saved in KiBugCheckDriver.
An attempt was made to access the driver at raised IRQL after it unloaded.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff80064fe0dd0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff8004eee3daf, address which referenced memory!analyze -v komutunu çalıştırıyoruz ve aslında oldukça mantıklı bir açıklamayla karşılaşıyoruz. Bir sürücü sistemden unload edildiğinde sürücünün kullandığı kaynakların da serbest bırakılması gerekir. Ancak bir sürücü sistemden unload edilmesine rağmen bu kaynakları serbest bırakmamış. Hangi sürücü olduğunu görmek için argüman 1 olarak belirtilen bellek adresine bakalım.8: kd> ln fffff80064fe0dd0
Browse module
Set bu breakpoint
(fffff800`64fe0dd0) <Unloaded_vgk.sys>+0x80dd08: kd> kV
# Child-SP RetAddr : Args to Child : Call Site
00 ffff9388`2a5cceb8 fffff800`4f02c4e9 : 00000000`0000000a fffff800`64fe0dd0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
01 ffff9388`2a5ccec0 fffff800`4f027a34 : 00000000`00000000 00000000`00000000 ffffdfe0`cf3e4bbc 00000000`00000001 : nt!KiBugCheckDispatch+0x69
02 ffff9388`2a5cd000 fffff800`4eee3daf : ffffcc80`17091180 ffffde84`c943b080 00000000`00000000 fffff800`4ee6ebb7 : nt!KiPageFault+0x474 (TrapFrame @ ffff9388`2a5cd000)
03 ffff9388`2a5cd190 fffff800`4ee69c22 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiAcquireKobjectLockSafe+0xf
04 ffff9388`2a5cd1c0 fffff800`4ee1732d : ffffde84`c72f3010 00000000`00000000 ffffb982`834846d0 fffff800`4f6accae : nt!KiExitDispatcher+0x382
05 ffff9388`2a5cd570 fffff800`6966220e : ffffde84`c72f3000 ffffde84`c72f3068 ffff9388`2a5cd700 00000000`00000000 : nt!KeInsertQueueApc+0x17d
06 ffff9388`2a5cd600 ffffde84`c72f3000 : ffffde84`c72f3068 ffff9388`2a5cd700 00000000`00000000 00000000`00000000 : BEDaisy+0x4b220e
07 ffff9388`2a5cd608 ffffde84`c72f3068 : ffff9388`2a5cd700 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffde84`c72f3000
08 ffff9388`2a5cd610 ffff9388`2a5cd700 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffde84`c72f3068
09 ffff9388`2a5cd618 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffff9388`2a5cd7008: kd> .trap ffff9388`2a5cd000
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80064fe0dd0 rbx=0000000000000000 rcx=fffff80064fe0dd0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8004eee3daf rsp=ffff93882a5cd190 rbp=0000000000000000
r8=0000000000000001 r9=0000000000000002 r10=ffffde84aecf1600
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KiAcquireKobjectLockSafe+0xf:
fffff800`4eee3daf f00fba2907 lock bts dword ptr [rcx],7 ds:fffff800`64fe0dd0=????????
