Tane tane gidelim.
Adresleri takip et.
[CODE highlight="5,7"]DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an IRP for too long a time
Arg2: ffffd0086bf8da20, Physical Device Object of the stack
Arg3: fffff80031701178, nt!TRIAGE_9F_POWER on Win7 and higher, otherwise the Functional Device Object of the stack
Arg4: ffffd0086bdee010, The blocked IRP
[/CODE]
Mevzu ekran kartının dahili ses sürücüsünde patlamış, devam edelim.
Kod:
0: kd> !irp ffffd0086bdee010
Irp is active with 10 stacks 7 is current (= 0xffffd0086bdee290)
No Mdl: No System Buffer: Thread 00000000: Irp stack trace.
cmd flg cl Device File Completion-Context
>[IRP_MJ_POWER(16), IRP_MN_SET_POWER(2)]
0 e1 ffffd0086bf8da20 00000000 fffff80033a0b510-ffffd0086be6a1b0 Success Error Cancel pending
\Driver\HDAudBus portcls!PowerIrpCompletionRoutine
Args: 00000000 00000001 00000001 00000000
[IRP_MJ_POWER(16), IRP_MN_SET_POWER(2)]
0 1 ffffd0086be6a060 00000000 00000000-00000000 pending
Unable to load image AtihdWT6.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for AtihdWT6.sys
\Driver\AtiHDAudioService
Args: 00000000 00000001 00000001 00000000
[IRP_MJ_POWER(16), IRP_MN_SET_POWER(2)]
0 e1 ffffd0086f22ce00 00000000 fffff8002e72cf80-ffffd0086f2a0248 Success Error Cancel pending
\Driver\ksthunk nt!PopRequestCompletion
Args: 00000000 00000001 00000001 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-ffffd0086f2a0248
Evet suçlu o.
[CODE highlight="13"]0: kd> !devstack
Device object not found
0: kd> !devstack ffffd0086bf8da20
!DevObj !DrvObj !DevExt ObjectName
ffffd0086f22ce00 \Driver\ksthunk ffffd0086f22cf50 InfoMask field not found for _OBJECT_HEADER at ffffd0086f22cdd0
ffffd0086be6a060 \Driver\AtiHDAudioServiceffffd0086be6a1b0 InfoMask field not found for _OBJECT_HEADER at ffffd0086be6a030
ffffd0086bf8da20 \Driver\HDAudBus ffffd0086f218f40 Cannot read info offset from nt!ObpInfoMaskToOffset
!DevNode ffffd0086f20ac40 :
DeviceInst is "HDAUDIO\FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1008\7&96ba7e4&0&0001"
ServiceName is "AtiHDAudioService"
[/CODE]
Sürücüsü eski, güncellemen lazım.
Kod:
0: kd> lmvmAtihdWT6
Browse full module list
start end module name
fffff800`803f0000 fffff800`8042e000 AtihdWT6 T (no symbols)
Loaded symbol image file: AtihdWT6.sys
Image path: AtihdWT6.sys
Image name: AtihdWT6.sys
Browse all global symbols functions data
Timestamp: Tue Aug 22 07:42:10 2023 (64E43CA2)
CheckSum: 0004B3E7
ImageSize: 0003E000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
Açıklamayı dikkatli oku. Sisteme USB ile bağlı olan bir sürücü, Virtual Box adlı cihazın sürücüsü, Donanımsal bileşenlerle devreye girerek liste yapısını bozuyor. Listenin yapısını bozarken başka programlara veya sürücülere ait bellek adreslerine erişmeye çalışıyor ve burada bir sistem açığı oluştuğu için mavi ekran yiyorsun.
Kod:
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff30d57a3eea0, Address of the trap frame for the exception that caused the BugCheck
Arg3: fffff30d57a3edf8, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved
Kod:
22: kd> k
# Child-SP RetAddr Call Site
00 fffff30d`57a3eb78 fffff804`4c82c4e9 nt!KeBugCheckEx
01 fffff30d`57a3eb80 fffff804`4c82cab2 nt!KiBugCheckDispatch+0x69
02 fffff30d`57a3ecc0 fffff804`4c82a806 nt!KiFastFailDispatch+0xb2
03 fffff30d`57a3eea0 fffff804`9c875b31 nt!KiRaiseSecurityCheckFailure+0x346
04 fffff30d`57a3f030 fffff804`50f08c77 USBXHCI!Controller_WdfEvtWatchdogTimerFunc+0xb21
05 fffff30d`57a3f0d0 fffff804`50f08bf5 Wdf01000!FxTimer::TimerHandler+0x73
06 fffff30d`57a3f100 fffff804`4c6e3c11 Wdf01000!FxTimer::_FxTimerExtCallbackThunk+0x35
07 fffff30d`57a3f140 fffff804`4c6e3683 nt!KiExpireTimer2+0x421
08 fffff30d`57a3f250 fffff804`4c672ffc nt!KiTimer2Expiration+0x163
09 fffff30d`57a3f310 fffff804`4c81ba2e nt!KiRetireDpcList+0xa6c
0a fffff30d`57a3f5c0 00000000`00000000 nt!KiIdleLoop+0x9e
Suçlumuz, sistem boştayken harekete geçip mavi ekrana sebep olmuş.
Kod:
0xfffff30d57a3ee98 : 0xfffff8044c82a806 : nt!KiRaiseSecurityCheckFailure+0x346
0xfffff30d57a3eea0 : 0x0000000000000000 : Trap @ fffff30d57a3eea0
0xfffff30d57a3eef8 : 0xfffff8049c8c54b0 : USBXHCI!WPP_eecfbef36d1a35cfffa7ec1ff8c060f3_Traceguids
0xfffff30d57a3efd8 : 0xfffff80450f01152 : Wdf01000!imp_WdfSpinLockRelease+0x82
0xfffff30d57a3efe8 : 0xfffff80450f01085 : Wdf01000!imp_WdfSpinLockAcquire+0x75
0xfffff30d57a3eff8 : 0xfffff8049c8d3460 : USBXHCI!WPP_RECORDER_INITIALIZED
0xfffff30d57a3f008 : 0xfffff8049c875b31 : USBXHCI!Controller_WdfEvtWatchdogTimerFunc+0xb21
0xfffff30d57a3f0a8 : 0xfffff30d57a3f490 : 0xfffff80450f08bc0 : Wdf01000!FxTimer::_FxTimerExtCallbackThunk
0xfffff30d57a3f0b8 : 0xfffff80450f08bc0 : Wdf01000!FxTimer::_FxTimerExtCallbackThunk
0xfffff30d57a3f0c8 : 0xfffff80450f08c77 : Wdf01000!FxTimer::TimerHandler+0x73
0xfffff30d57a3f0f8 : 0xfffff80450f08bf5 : Wdf01000!FxTimer::_FxTimerExtCallbackThunk+0x35
0xfffff30d57a3f108 : 0xfffff8044c6e6926 : nt!KiInsertTimer2+0x4a
0xfffff30d57a3f138 : 0xfffff8044c6e3c11 : nt!KiExpireTimer2+0x421
0xfffff30d57a3f148 : 0xfffff80450f08bc0 : Wdf01000!FxTimer::_FxTimerExtCallbackThunk
0xfffff30d57a3f158 : 0xfffff8044c638a00 : nt!KiProcessThreadWaitList+0x180
0xfffff30d57a3f208 : 0xfffff8044d041f08 : nt!KiTimer2Collections+0x48
0xfffff30d57a3f218 : 0xfffff8044d041f38 : nt!KiNextTimer2DueTime
0xfffff30d57a3f248 : 0xfffff8044c6e3683 : nt!KiTimer2Expiration+0x163
0xfffff30d57a3f308 : 0xfffff8044c672ffc : nt!KiRetireDpcList+0xa6c
0xfffff30d57a3f3c0 : 0xfffff8044c40f7b8 : nt!Feature_1171241279_logged_traits
Unable to load image VBoxSup.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for VBoxSup.sys
0xfffff30d57a3f490 : 0xfffff80450f08bc0 : Wdf01000!FxTimer::_FxTimerExtCallbackThunk
0xfffff30d57a3f5b8 : 0xfffff8044c81ba2e : nt!KiIdleLoop+0x9e
Buradaki cihaz VirtualBox USB sürücüsüymüş, böyle bir şey kullanıyorsan kontrol et.
Kod:
DevNode 0xffff928182a80bb0 for PDO 0xffff9281825e5de0
Parent 0xffff928182a74bf0 Sibling 0xffff9281825f1bb0 Child 0xffff928183caab60
InterfaceType 0 Bus Number 0
InstancePath is "USB\Vid_80EE&Pid_CAFE\8&1dc14b6f&0&11"
ServiceName is ""
State = DeviceNodeStarted (0x30a)
Stack adresi mouse üzerinden sıkça çağrı almış, bu genelde ekran kartına işaret ediyor. Yani ilk dosya ile alakalı olabilir.
Kod:
STACK_TEXT:
ffffa602`0965db40 fffff805`3ce6ed48 : ffffe78a`c079e0c0 00000000`00000000 ffffa602`00000000 0000001e`0000001e : nt!KiInsertTimerTable+0xc0
ffffa602`0965dbc0 fffff805`3ce70ad6 : 00000003`00000000 fc000000`00000001 c0fffff8`0000004b 00000003`052ed730 : nt!KiCommitThreadWait+0x2c8
ffffa602`0965dc70 fffff805`3ce31a63 : ffffa602`0965e030 00000000`00000000 00000000`00000001 00000000`00000006 : nt!KeWaitForSingleObject+0x256
ffffa602`0965e010 ffffe738`9cd77366 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff805`3d3437f3 : nt!KeWaitForMultipleObjects+0x5d3
ffffa602`0965e270 ffffe738`9cd76feb : ffff958c`44d95010 ffffb37e`00000000 fffff805`00000000 ffffe738`00000000 : win32kfull!xxxRealSleepThread+0x2ce
ffffa602`0965e360 ffffe738`9cd79627 : ffff958c`7a4171d4 ffffa602`0965e871 00000000`00000000 00000000`00000000 : win32kfull!xxxSleepThread2+0xb3
ffffa602`0965e3b0 ffffe738`9cd6b6ad : 00000000`00000000 ffff958c`44d95010 00000000`00000200 ffffa602`0965e600 : win32kfull!xxxInterSendMsgEx+0xd77
ffffa602`0965e530 ffffe738`9cd9f4df : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000000 : win32kfull!xxxCallHook2+0xb05
ffffa602`0965e7b0 ffffe738`9cd9e9a7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32kfull!xxxMoveEventAbsolute+0x18b
ffffa602`0965e8c0 ffffe738`9cc24b6f : 00000000`00000000 ffffa602`0965ea98 ffffa602`0965f008 00000000`00000000 : win32kfull!EditionCommitMousePosAndMove+0x97
ffffa602`0965e930 ffffe738`9cbf0c55 : 00000000`00000001 00000000`00000000 00000000`0000003f ffffa602`0965eaf0 : win32kbase!EditionCommitMousePosAndMove+0x83
ffffa602`0965e9a0 ffffe738`9cae6b2a : 00000000`00000001 ffffa602`0965eaa9 00000000`00000000 00000000`00000000 : win32kbase!ApiSetEditionCommitMousePosAndMove+0x125
ffffa602`0965ea30 ffffe738`9cb01fd3 : 000005f2`00000114 ffffa602`0965ec10 ffffa602`0965eff0 00000000`00000000 : win32kbase!CMouseProcessor::CommitMousePosAndMoveCursor+0x17a
ffffa602`0965eb10 ffffe738`9cae792f : 000005f2`00000114 000005f2`00000114 00000000`00000000 00000000`00000001 : win32kbase!CMouseProcessor::ProcessMouseInputData+0xa9b17
ffffa602`0965ee70 ffffe738`9cae5e1a : ffff958c`425e5000 ffffe738`9cae5e9d ffff958c`425e5600 ffff958c`425e5080 : win32kbase!CMouseProcessor::ProcessInput+0x61b
ffffa602`0965f0a0 ffffe738`9cae6053 : ffff958c`425e5080 00000003`0504343d ffff958c`425e5600 ffffe78a`c2e520f8 : win32kbase!CMouseSensor::FlushMouseReports+0x42
ffffa602`0965f0e0 ffffe738`9cae5f84 : ffff958c`650a7990 00000000`00000018 ffff958c`44d97000 ffff958c`425e5080 : win32kbase!CMouseSensor::ProcessInputWithRateLimitingIfEnabled+0xb3
ffffa602`0965f130 ffffe738`9ca0ee43 : 00000000`00000000 00000000`00000006 ffff958c`44d97001 ffffb37e`63400000 : win32kbase!CMouseSensor::ProcessInput+0x54
ffffa602`0965f170 ffffe738`9ca58a98 : 00000000`00000002 00000000`00000002 00000000`00000000 00000000`00000002 : win32kbase!CBaseInput::OnReadNotification+0xb3
ffffa602`0965f1d0 ffffe738`9ca589c2 : 00000000`00000001 00000000`00000001 00000000`00000000 00000000`00000000 : win32kbase!CBaseInput::OnDispatcherObjectSignaled+0xc8
ffffa602`0965f230 ffffe738`9ca5bc51 : 00000000`00000001 00000000`00000001 ffff958c`44d97010 ffff958c`44d97010 : win32kbase!CBaseInput::_OnDispatcherObjectSignaled+0x12
ffffa602`0965f260 ffffe738`9ca59385 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000018 : win32kbase!IOCPDispatcher::HandleSensorDispatcherSignal+0x75
ffffa602`0965f2c0 ffffe738`9ca58770 : 00000000`00000001 00000000`00000001 00000000`00000000 00000000`00000000 : win32kbase!IOCPDispatcher::Dispatch+0x15
ffffa602`0965f320 ffffe738`9cac3dd1 : 00000000`00000000 00000201`8a2711d0 00000000`00000020 00000000`00000328 : win32kbase!UserKSTWait+0x130
ffffa602`0965f400 ffffe738`9d310ae9 : ffffe78a`c079e0c0 ffffa602`0965f4e0 00000201`8a2711d0 00000000`00000018 : win32kbase!NtKSTWait+0x21
ffffa602`0965f430 fffff805`3d02bbe8 : ffffe78a`0000032f 00000000`00000328 00000000`0000032c 00000000`00000001 : win32k!NtKSTWait+0x15
ffffa602`0965f460 00007ff8`ba107ab4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000e5`c349fdc8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`ba107ab4
Ekran kartı sürücülerini bilerek mi eski tutuyorsun bilmiyorum AMD kullanmadığım için ama hem onları hem dahili paketlerindeki ses sürücülerini güncellemen şart.
Kod:
20: kd> lmDvmamdkmdag
Browse full module list
start end module name
fffff805`8efb0000 fffff805`95581000 amdkmdag (deferred)
Image path: amdkmdag.sys
Image name: amdkmdag.sys
Browse all global symbols functions data
Timestamp: Wed Oct 25 17:46:53 2023 (65392A5D)
CheckSum: 06586471
ImageSize: 065D1000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
