Çözüldü Valorant SYSTEM_SERVICE_EXCEPTION (3b) hatası

bicy dedi:

Rich (BB code):

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck.
Arg2: fffff8067aaad398, Address of the instruction which caused the BugCheck.
Arg3: ffffe40f30cd68b0, Address of the context record for the exception that caused the BugCheck.
Arg4: 0000000000000000, zero.

Çok basit bir şekilde, sistem çöküyor çünkü bir bellek erişim ihlali oluyor. Bellek erişim ihlalleri bir sistem için normal davranışlar değildir. Özellikle buna kernel seviyede çalışan 3.taraf bir sürücü sebep oluyorsa daha büyük sıkıntıdır.

Rich (BB code):

2: kd> k
 # Child-SP RetAddr Call Site.
00 ffffe40f`30cd5f58 fffff806`7ac2ad29 nt!KeBugCheckEx
01 ffffe40f`30cd5f60 fffff806`7ac29dfc nt!KiBugCheckDispatch+0x69
02 ffffe40f`30cd60a0 fffff806`7ac2048f nt!KiSystemServiceHandler+0x7c
03 ffffe40f`30cd60e0 fffff806`7aa2eac3 nt!RtlpExecuteHandlerForException+0xf
04 ffffe40f`30cd6110 fffff806`7ab1813e nt!RtlDispatchException+0x2f3
05 ffffe40f`30cd6880 fffff806`7ac2ae7c nt!KiDispatchException+0x1ae
06 ffffe40f`30cd6f60 fffff806`7ac26163 nt!KiExceptionDispatch+0x13c
07 ffffe40f`30cd7140 fffff806`7aaad398 nt!KiPageFault+0x463 < Çökme noktası
08 ffffe40f`30cd72d8 fffff806`7aee1ea1 nt!RtlFindClearBitsEx+0x88
09 ffffe40f`30cd7300 fffff806`7aee1ccc nt!MiFindEmptyAddressRange+0x151 < Boş bir adres aralığı arıyor
0a ffffe40f`30cd73a0 fffff806`7aead28b nt!MiSelectUserAddress+0x15c
0b ffffe40f`30cd7440 fffff806`7aeaec1c nt!MiMapViewOfDataSection+0x4cb
0c ffffe40f`30cd7560 fffff806`7aeadc44 nt!MiMapViewOfSection+0x37c
0d ffffe40f`30cd76a0 fffff806`97fa0a2b nt!NtMapViewOfSection+0x154
0e ffffe40f`30cd77e0 fffff806`97f90000 vgk+0x10a2b
0f ffffe40f`30cd77e8 000000d8`8477d5b8 vgk < VANGUARD!

Sorunun sebebi Vanguard. Basitçe anlatıyorum neden bu soruna sebep olduğunu, bu yüzden Stack'leri incelemeye devam et.

Başka bir süreçte (yani "foreign process") tüm kullanılabilir adres alanını ayırmaya çalıştığınızda, virtualallocex (dosyada bulunmaz.) İşlevi, kilitlenmeye neden olabilir? Kilitlenme, senin dökümünde gösterildiği üzere, adres alanında uygun boş bitleri bulmaya çalışan rtlfindclearbitsex adlı bir işlevde gerçekleşiyor.

Tek tek açıklamak gerekirse:

1. adres alanı (address range) : Bellek ayırmak istediğinizde, işletim sistemi size mevcut bellekten bir alan tahsis eder. "tüm kullanılabilir adres alanı" ise bu süreçteki tüm boş belleği kapsayan alanı ifade eder basitçe anlatmak gerekirse.
2. rtlfindclearbitsex: Bellek ayırma işlemi sırasında boş (yani tahsis edilmemiş) bellek bitlerini bulmaya çalışan bir Windows işlevidir.

Eğer tüm adres alanını rezerve etmeye çalışıyorsa, rtlfindclearbitsex yeterli boş alan bulmakta zorlanır çünkü zaten tamamı rezerve edilmeye çalışıldığı için "boş bit" yoktur. Bu durumda, virtualallocex bu işlevin yanıt vermesini bekler ve işlev bir sonuca ulaşamayınca "kilitlenmiş" gibi görünür, yani yanıt veremez duruma gelir. Sürekli aynı işlevi döndürür durur.

Bu tip bir durum genellikle bellek yönetimi veya düşük seviye bellek ayırma işlemleriyle uğraşırken ortaya çıkıyor ve aynı şekilde bu soruna sebep olan aslında bu takılmaya neden olan da Vanguard. Yukarıda anlattığım şey tamamen kodlama ile alakalı bir hata.

Rich (BB code):

2: kd> .formats ffff8437804d7218.
Evaluate expression:
 Hex: ffff8437`804d7218
 Decimal: -136101066083816
 Decimal (unsigned) : 18446607972643467800.
 Octal: 1777774103360023271030
 Binary: 11111111 11111111 10000100 00110111 10000000 01001101 01110010 00011000.
 Chars: ...7.Mr.
 Time: ***** Invalid FILETIME.
 Float: low -7.11226e-039 high -1.#QNAN
 Double: -1.#QNAN

Tüm bitlerin nasıl dolu olduğuna dikkat ettin mi?

Rich (BB code):

nt!RtlFindClearBitsEx:
fffff806`7aaad310 48895c2410 mov qword ptr [rsp+10h],rbx
fffff806`7aaad315 48896c2418 mov qword ptr [rsp+18h],rbp
fffff806`7aaad31a 4889742420 mov qword ptr [rsp+20h],rsi
fffff806`7aaad31f 57 push rdi.
fffff806`7aaad320 4154 push r12.
fffff806`7aaad322 4156 push r14.
fffff806`7aaad324 4157 push r15.
fffff806`7aaad326 4c8b39 mov r15,qword ptr [rcx]
fffff806`7aaad329 4d8be0 mov r12,r8
fffff806`7aaad32c 4c8b7108 mov r14,qword ptr [rcx+8]
fffff806`7aaad330 4d3bc7 cmp r8,r15
fffff806`7aaad333 488bda mov rbx,rdx
fffff806`7aaad336 4d1bdb sbb r11,r11
fffff806`7aaad339 4d23d8 and r11,r8
fffff806`7aaad33c 4d8d57ff lea r10,[r15-1]
fffff806`7aaad340 4885d2 test rdx,rdx
fffff806`7aaad343 0f8495631e00 je nt!RtlFindClearBitsEx+0x1e63ce (fffff806`7ac936de) Branch.

nt!RtlFindClearBitsEx+0x39:
fffff806`7aaad349 4883ceff or rsi,0FFFFFFFFFFFFFFFFh

nt!RtlFindClearBitsEx+0x3d:
fffff806`7aaad34d 8364242800 and dword ptr [rsp+28h],0
fffff806`7aaad352 498bc2 mov rax,r10
fffff806`7aaad355 492bc3 sub rax,r11
fffff806`7aaad358 ba40000000 mov edx,40h
fffff806`7aaad35d 48ffc0 inc rax.
fffff806`7aaad360 483bc3 cmp rax,rbx
fffff806`7aaad363 0f8221010000 jb nt!RtlFindClearBitsEx+0x17a (fffff806`7aaad48a) Branch.

nt!RtlFindClearBitsEx+0x59:
fffff806`7aaad369 498bea mov rbp,r10
fffff806`7aaad36c 448d4ac1 lea r9d,[rdx-3Fh]
fffff806`7aaad370 482beb sub rbp,rbx
fffff806`7aaad373 418acb mov cl,r11b
fffff806`7aaad376 48ffc5 inc rbp.
fffff806`7aaad379 80e13f and cl,3Fh
fffff806`7aaad37c 49d3e1 shl r9,cl
fffff806`7aaad37f 488bc5 mov rax,rbp
fffff806`7aaad382 48c1e806 shr rax,6
fffff806`7aaad386 49ffc9 dec r9.
fffff806`7aaad389 498d3cc6 lea rdi,[r14+rax*8]
fffff806`7aaad38d 498bc3 mov rax,r11
fffff806`7aaad390 48c1e806 shr rax,6
fffff806`7aaad394 4d8d04c6 lea r8,[r14+rax*8]
fffff806`7aaad398 4d0b08 or r9,qword ptr [r8]
fffff806`7aaad39b 4883fb7f cmp rbx,7Fh
fffff806`7aaad39f 0f8747010000 ja nt!RtlFindClearBitsEx+0x1dc (fffff806`7aaad4ec) Branch.

nt!RtlFindClearBitsEx+0x95:
fffff806`7aaad3a5 483bda cmp rbx,rdx
fffff806`7aaad3a8 0f831d020000 jae nt!RtlFindClearBitsEx+0x2bb (fffff806`7aaad5cb) Branch.

nt!RtlFindClearBitsEx+0x9e:
fffff806`7aaad3ae 4883fb01 cmp rbx,1
fffff806`7aaad3b2 775f ja nt!RtlFindClearBitsEx+0x103 (fffff806`7aaad413) Branch.

nt!RtlFindClearBitsEx+0xa4:
fffff806`7aaad3b4 4c3bce cmp r9,rsi
fffff806`7aaad3b7 7512 jne nt!RtlFindClearBitsEx+0xbb (fffff806`7aaad3cb) Branch.

nt!RtlFindClearBitsEx+0xa9:
fffff806`7aaad3b9 4983c008 add r8,8
fffff806`7aaad3bd 4c3bc7 cmp r8,rdi
fffff806`7aaad3c0 0f87c4000000 ja nt!RtlFindClearBitsEx+0x17a (fffff806`7aaad48a) Branch.

nt!RtlFindClearBitsEx+0xb6:
fffff806`7aaad3c6 4d8b08 mov r9,qword ptr [r8]
fffff806`7aaad3c9 ebe9 jmp nt!RtlFindClearBitsEx+0xa4 (fffff806`7aaad3b4) Branch.

nt!RtlFindClearBitsEx+0xbb:
fffff806`7aaad3cb 49f7d1 not r9.
fffff806`7aaad3ce 498bd0 mov rdx,r8
fffff806`7aaad3d1 492bd6 sub rdx,r14
fffff806`7aaad3d4 48c1fa03 sar rdx,3
fffff806`7aaad3d8 490fbcc1 bsf rax,r9
fffff806`7aaad3dc 48c1e206 shl rdx,6
fffff806`7aaad3e0 4803d0 add rdx,rax

nt!RtlFindClearBitsEx+0xd3:
fffff806`7aaad3e3 483bd5 cmp rdx,rbp
fffff806`7aaad3e6 0f879e000000 ja nt!RtlFindClearBitsEx+0x17a (fffff806`7aaad48a) Branch.

nt!RtlFindClearBitsEx+0xdc:
fffff806`7aaad3ec 483bd6 cmp rdx,rsi
fffff806`7aaad3ef 0f8498000000 je nt!RtlFindClearBitsEx+0x17d (fffff806`7aaad48d) Branch.

nt!RtlFindClearBitsEx+0xe5:
fffff806`7aaad3f5 4c8bda mov r11,rdx

nt!RtlFindClearBitsEx+0xe8:
fffff806`7aaad3f8 488b5c2430 mov rbx,qword ptr [rsp+30h]
fffff806`7aaad3fd 498bc3 mov rax,r11
fffff806`7aaad400 488b6c2438 mov rbp,qword ptr [rsp+38h]
fffff806`7aaad405 488b742440 mov rsi,qword ptr [rsp+40h]
fffff806`7aaad40a 415f pop r15.
fffff806`7aaad40c 415e pop r14.
fffff806`7aaad40e 415c pop r12.
fffff806`7aaad410 5f pop rdi.
fffff806`7aaad411 c3 ret.

nt!RtlFindClearBitsEx+0x103:
fffff806`7aaad413 33d2 xor edx,edx
fffff806`7aaad415 49c1ea06 shr r10,6
fffff806`7aaad419 4b8d34d6 lea rsi,[r14+r10*8]

nt!RtlFindClearBitsEx+0x10d:
fffff806`7aaad41d 4983f9ff cmp r9,0FFFFFFFFFFFFFFFFh
fffff806`7aaad421 0f84ac000000 je nt!RtlFindClearBitsEx+0x1c3 (fffff806`7aaad4d3) Branch.

nt!RtlFindClearBitsEx+0x117:
fffff806`7aaad427 8364242800 and dword ptr [rsp+28h],0
fffff806`7aaad42c b940000000 mov ecx,40h
fffff806`7aaad431 490fbcc1 bsf rax,r9
fffff806`7aaad435 0f44c1 cmove eax,ecx
fffff806`7aaad438 8d0c02 lea ecx,[rdx+rax]
fffff806`7aaad43b 483bcb cmp rcx,rbx
fffff806`7aaad43e 0f838a000000 jae nt!RtlFindClearBitsEx+0x1be (fffff806`7aaad4ce) Branch.

nt!RtlFindClearBitsEx+0x134:
fffff806`7aaad444 498bd1 mov rdx,r9
fffff806`7aaad447 448bd3 mov r10d,ebx
fffff806`7aaad44a 48f7d2 not rdx.

nt!RtlFindClearBitsEx+0x13d:
fffff806`7aaad44d 488bc2 mov rax,rdx
fffff806`7aaad450 418bca mov ecx,r10d
fffff806`7aaad453 d1e9 shr ecx,1
fffff806`7aaad455 48d3e8 shr rax,cl
fffff806`7aaad458 4823d0 and rdx,rax
fffff806`7aaad45b 7424 je nt!RtlFindClearBitsEx+0x171 (fffff806`7aaad481) Branch.

nt!RtlFindClearBitsEx+0x14d:
fffff806`7aaad45d 442bd1 sub r10d,ecx
fffff806`7aaad460 4183fa01 cmp r10d,1
fffff806`7aaad464 77e7 ja nt!RtlFindClearBitsEx+0x13d (fffff806`7aaad44d) Branch.

nt!RtlFindClearBitsEx+0x156:
fffff806`7aaad466 480fbcd2 bsf rdx,rdx

nt!RtlFindClearBitsEx+0x15a:
fffff806`7aaad46a 4d2bc6 sub r8,r14
fffff806`7aaad46d 49c1f803 sar r8,3
fffff806`7aaad471 49c1e006 shl r8,6
fffff806`7aaad475 4903d0 add rdx,r8
fffff806`7aaad478 4883ceff or rsi,0FFFFFFFFFFFFFFFFh
fffff806`7aaad47c e962ffffff jmp nt!RtlFindClearBitsEx+0xd3 (fffff806`7aaad3e3) Branch.

nt!RtlFindClearBitsEx+0x171:
fffff806`7aaad481 4c3bc6 cmp r8,rsi
fffff806`7aaad484 7526 jne nt!RtlFindClearBitsEx+0x19c (fffff806`7aaad4ac) Branch.

nt!RtlFindClearBitsEx+0x176:
fffff806`7aaad486 4883ceff or rsi,0FFFFFFFFFFFFFFFFh

nt!RtlFindClearBitsEx+0x17a:
fffff806`7aaad48a 488bd6 mov rdx,rsi

nt!RtlFindClearBitsEx+0x17d:
fffff806`7aaad48d 4d85db test r11,r11
fffff806`7aaad490 0f845fffffff je nt!RtlFindClearBitsEx+0xe5 (fffff806`7aaad3f5) Branch.

nt!RtlFindClearBitsEx+0x186:
fffff806`7aaad496 4e8d1423 lea r10,[rbx+r12]
fffff806`7aaad49a 4d3bd7 cmp r10,r15
fffff806`7aaad49d 4d0f47d7 cmova r10,r15
fffff806`7aaad4a1 49ffca dec r10.
fffff806`7aaad4a4 4533db xor r11d,r11d
fffff806`7aaad4a7 e9a1feffff jmp nt!RtlFindClearBitsEx+0x3d (fffff806`7aaad34d) Branch.

nt!RtlFindClearBitsEx+0x19c:
fffff806`7aaad4ac 8364242800 and dword ptr [rsp+28h],0
fffff806`7aaad4b1 490fbdc1 bsr rax,r9
fffff806`7aaad4b5 0f843d621e00 je nt!RtlFindClearBitsEx+0x1e63e8 (fffff806`7ac936f8) Branch.

nt!RtlFindClearBitsEx+0x1ab:
fffff806`7aaad4bb ba3f000000 mov edx,3Fh
fffff806`7aaad4c0 2bd0 sub edx,eax

nt!RtlFindClearBitsEx+0x1b2:
fffff806`7aaad4c2 4983c008 add r8,8
fffff806`7aaad4c6 4d8b08 mov r9,qword ptr [r8]
fffff806`7aaad4c9 e94fffffff jmp nt!RtlFindClearBitsEx+0x10d (fffff806`7aaad41d) Branch.

nt!RtlFindClearBitsEx+0x1be:
fffff806`7aaad4ce 48f7da neg rdx.
fffff806`7aaad4d1 eb97 jmp nt!RtlFindClearBitsEx+0x15a (fffff806`7aaad46a) Branch.

nt!RtlFindClearBitsEx+0x1c3:
fffff806`7aaad4d3 4983c008 add r8,8
fffff806`7aaad4d7 4c3bc7 cmp r8,rdi
fffff806`7aaad4da 77aa ja nt!RtlFindClearBitsEx+0x176 (fffff806`7aaad486) Branch.

nt!RtlFindClearBitsEx+0x1cc:
fffff806`7aaad4dc 4d8b08 mov r9,qword ptr [r8]
fffff806`7aaad4df 4983f9ff cmp r9,0FFFFFFFFFFFFFFFFh
fffff806`7aaad4e3 74ee je nt!RtlFindClearBitsEx+0x1c3 (fffff806`7aaad4d3) Branch.

nt!RtlFindClearBitsEx+0x1d5:
fffff806`7aaad4e5 33d2 xor edx,edx
fffff806`7aaad4e7 e93bffffff jmp nt!RtlFindClearBitsEx+0x117 (fffff806`7aaad427) Branch.

nt!RtlFindClearBitsEx+0x1dc:
fffff806`7aaad4ec 40f6c53f test bpl,3Fh
fffff806`7aaad4f0 4c8d5708 lea r10,[rdi+8]
fffff806`7aaad4f4 4c0f44d7 cmove r10,rdi
fffff806`7aaad4f8 4d85c9 test r9,r9
fffff806`7aaad4fb 0f8465010000 je nt!RtlFindClearBitsEx+0x356 (fffff806`7aaad666) Branch.

nt!RtlFindClearBitsEx+0x1f1:
fffff806`7aaad501 4983c008 add r8,8
fffff806`7aaad505 49833800 cmp qword ptr [r8],0
fffff806`7aaad509 7545 jne nt!RtlFindClearBitsEx+0x240 (fffff806`7aaad550) Branch.

nt!RtlFindClearBitsEx+0x1fb:
fffff806`7aaad50b 8364242800 and dword ptr [rsp+28h],0
fffff806`7aaad510 490fbdc1 bsr rax,r9
fffff806`7aaad514 0f84cd611e00 je nt!RtlFindClearBitsEx+0x1e63d7 (fffff806`7ac936e7) Branch.

nt!RtlFindClearBitsEx+0x20a:
fffff806`7aaad51a b93f000000 mov ecx,3Fh
fffff806`7aaad51f 2bc8 sub ecx,eax
fffff806`7aaad521 eb5c jmp nt!RtlFindClearBitsEx+0x26f (fffff806`7aaad57f) Branch.

nt!RtlFindClearBitsEx+0x213:
fffff806`7aaad523 448bcb mov r9d,ebx
fffff806`7aaad526 442bc9 sub r9d,ecx
fffff806`7aaad529 4183e13f and r9d,3Fh
fffff806`7aaad52d 0f84b9feffff je nt!RtlFindClearBitsEx+0xdc (fffff806`7aaad3ec) Branch.

nt!RtlFindClearBitsEx+0x223:
fffff806`7aaad533 8364242800 and dword ptr [rsp+28h],0
fffff806`7aaad538 498b00 mov rax,qword ptr [r8]
fffff806`7aaad53b 480fbcc8 bsf rcx,rax
fffff806`7aaad53f b840000000 mov eax,40h
fffff806`7aaad544 0f44c8 cmove ecx,eax
fffff806`7aaad547 413bc9 cmp ecx,r9d
fffff806`7aaad54a 0f839cfeffff jae nt!RtlFindClearBitsEx+0xdc (fffff806`7aaad3ec) Branch.

nt!RtlFindClearBitsEx+0x240:
fffff806`7aaad550 498bc0 mov rax,r8
fffff806`7aaad553 4d3bc2 cmp r8,r10
fffff806`7aaad556 0f872effffff ja nt!RtlFindClearBitsEx+0x17a (fffff806`7aaad48a) Branch.

nt!RtlFindClearBitsEx+0x24c:
fffff806`7aaad55c 4983c008 add r8,8
fffff806`7aaad560 49833800 cmp qword ptr [r8],0
fffff806`7aaad564 75ea jne nt!RtlFindClearBitsEx+0x240 (fffff806`7aaad550) Branch.

nt!RtlFindClearBitsEx+0x256:
fffff806`7aaad566 488b00 mov rax,qword ptr [rax]
fffff806`7aaad569 8364242800 and dword ptr [rsp+28h],0
fffff806`7aaad56e 480fbdd0 bsr rdx,rax
fffff806`7aaad572 0f8476611e00 je nt!RtlFindClearBitsEx+0x1e63de (fffff806`7ac936ee) Branch.

nt!RtlFindClearBitsEx+0x268:
fffff806`7aaad578 b93f000000 mov ecx,3Fh
fffff806`7aaad57d 2bca sub ecx,edx

nt!RtlFindClearBitsEx+0x26f:
fffff806`7aaad57f 498bd0 mov rdx,r8
fffff806`7aaad582 448bc9 mov r9d,ecx
fffff806`7aaad585 492bd6 sub rdx,r14
fffff806`7aaad588 48c1fa03 sar rdx,3
fffff806`7aaad58c 48c1e206 shl rdx,6
fffff806`7aaad590 492bd1 sub rdx,r9
fffff806`7aaad593 483bd5 cmp rdx,rbp
fffff806`7aaad596 0f87eefeffff ja nt!RtlFindClearBitsEx+0x17a (fffff806`7aaad48a) Branch.

nt!RtlFindClearBitsEx+0x28c:
fffff806`7aaad59c 488bc3 mov rax,rbx
fffff806`7aaad59f 492bc1 sub rax,r9
fffff806`7aaad5a2 48c1e806 shr rax,6
fffff806`7aaad5a6 4d8d0cc0 lea r9,[r8+rax*8]

nt!RtlFindClearBitsEx+0x29a:
fffff806`7aaad5aa 4983c008 add r8,8
fffff806`7aaad5ae 4d3bc1 cmp r8,r9
fffff806`7aaad5b1 0f846cffffff je nt!RtlFindClearBitsEx+0x213 (fffff806`7aaad523) Branch.

nt!RtlFindClearBitsEx+0x2a7:
fffff806`7aaad5b7 49833800 cmp qword ptr [r8],0
fffff806`7aaad5bb 74ed je nt!RtlFindClearBitsEx+0x29a (fffff806`7aaad5aa) Branch.

nt!RtlFindClearBitsEx+0x2ad:
fffff806`7aaad5bd eb91 jmp nt!RtlFindClearBitsEx+0x240 (fffff806`7aaad550) Branch.

nt!RtlFindClearBitsEx+0x2af:
fffff806`7aaad5bf 4885c0 test rax,rax
fffff806`7aaad5c2 0f848c000000 je nt!RtlFindClearBitsEx+0x344 (fffff806`7aaad654) Branch.

nt!RtlFindClearBitsEx+0x2b8:
fffff806`7aaad5c8 498bd2 mov rdx,r10

nt!RtlFindClearBitsEx+0x2bb:
fffff806`7aaad5cb 4d85c9 test r9,r9
fffff806`7aaad5ce 7912 jns nt!RtlFindClearBitsEx+0x2d2 (fffff806`7aaad5e2) Branch.

nt!RtlFindClearBitsEx+0x2c0:
fffff806`7aaad5d0 4983c008 add r8,8
fffff806`7aaad5d4 4c3bc7 cmp r8,rdi
fffff806`7aaad5d7 0f87adfeffff ja nt!RtlFindClearBitsEx+0x17a (fffff806`7aaad48a) Branch.

nt!RtlFindClearBitsEx+0x2cd:
fffff806`7aaad5dd 4d8b08 mov r9,qword ptr [r8]
fffff806`7aaad5e0 ebe9 jmp nt!RtlFindClearBitsEx+0x2bb (fffff806`7aaad5cb) Branch.

nt!RtlFindClearBitsEx+0x2d2:
fffff806`7aaad5e2 8364242800 and dword ptr [rsp+28h],0
fffff806`7aaad5e7 490fbdc9 bsr rcx,r9
fffff806`7aaad5eb 7463 je nt!RtlFindClearBitsEx+0x340 (fffff806`7aaad650) Branch.

nt!RtlFindClearBitsEx+0x2dd:
fffff806`7aaad5ed b83f000000 mov eax,3Fh
fffff806`7aaad5f2 2bc1 sub eax,ecx

nt!RtlFindClearBitsEx+0x2e4:
fffff806`7aaad5f4 498bd0 mov rdx,r8
fffff806`7aaad5f7 448bc8 mov r9d,eax
fffff806`7aaad5fa 492bd6 sub rdx,r14
fffff806`7aaad5fd 48c1fa03 sar rdx,3
fffff806`7aaad601 48ffc2 inc rdx.
fffff806`7aaad604 48c1e206 shl rdx,6
fffff806`7aaad608 492bd1 sub rdx,r9
fffff806`7aaad60b 483bd5 cmp rdx,rbp
fffff806`7aaad60e 0f8776feffff ja nt!RtlFindClearBitsEx+0x17a (fffff806`7aaad48a) Branch.

nt!RtlFindClearBitsEx+0x304:
fffff806`7aaad614 488bcb mov rcx,rbx
fffff806`7aaad617 492bc9 sub rcx,r9
fffff806`7aaad61a 0f84ccfdffff je nt!RtlFindClearBitsEx+0xdc (fffff806`7aaad3ec) Branch.

nt!RtlFindClearBitsEx+0x310:
fffff806`7aaad620 4983c008 add r8,8
fffff806`7aaad624 41ba40000000 mov r10d,40h
fffff806`7aaad62a 498b00 mov rax,qword ptr [r8]
fffff806`7aaad62d 4c8bc8 mov r9,rax
fffff806`7aaad630 493bca cmp rcx,r10
fffff806`7aaad633 738a jae nt!RtlFindClearBitsEx+0x2af (fffff806`7aaad5bf) Branch.

nt!RtlFindClearBitsEx+0x325:
fffff806`7aaad635 8364242800 and dword ptr [rsp+28h],0
fffff806`7aaad63a 490fbcc1 bsf rax,r9
fffff806`7aaad63e 410f44c2 cmove eax,r10d
fffff806`7aaad642 483bc1 cmp rax,rcx
fffff806`7aaad645 0f83a1fdffff jae nt!RtlFindClearBitsEx+0xdc (fffff806`7aaad3ec) Branch.

nt!RtlFindClearBitsEx+0x33b:
fffff806`7aaad64b e978ffffff jmp nt!RtlFindClearBitsEx+0x2b8 (fffff806`7aaad5c8) Branch.

nt!RtlFindClearBitsEx+0x340:
fffff806`7aaad650 8bc2 mov eax,edx
fffff806`7aaad652 eba0 jmp nt!RtlFindClearBitsEx+0x2e4 (fffff806`7aaad5f4) Branch.

nt!RtlFindClearBitsEx+0x344:
fffff806`7aaad654 492bca sub rcx,r10
fffff806`7aaad657 0f848ffdffff je nt!RtlFindClearBitsEx+0xdc (fffff806`7aaad3ec) Branch.

nt!RtlFindClearBitsEx+0x34d:
fffff806`7aaad65d 4983c008 add r8,8
fffff806`7aaad661 4d8b08 mov r9,qword ptr [r8]
fffff806`7aaad664 ebcf jmp nt!RtlFindClearBitsEx+0x325 (fffff806`7aaad635) Branch.

nt!RtlFindClearBitsEx+0x356:
fffff806`7aaad666 33c9 xor ecx,ecx
fffff806`7aaad668 e912ffffff jmp nt!RtlFindClearBitsEx+0x26f (fffff806`7aaad57f) Branch.

nt!RtlFindClearBitsEx+0x1e63ce:
fffff806`7ac936de 4983e3f8 and r11,0FFFFFFFFFFFFFFF8h
fffff806`7ac936e2 e9119de1ff jmp nt!RtlFindClearBitsEx+0xe8 (fffff806`7aaad3f8) Branch.

nt!RtlFindClearBitsEx+0x1e63d7:
fffff806`7ac936e7 8bca mov ecx,edx
fffff806`7ac936e9 e9919ee1ff jmp nt!RtlFindClearBitsEx+0x26f (fffff806`7aaad57f) Branch.

nt!RtlFindClearBitsEx+0x1e63de:
fffff806`7ac936ee b940000000 mov ecx,40h
fffff806`7ac936f3 e9879ee1ff jmp nt!RtlFindClearBitsEx+0x26f (fffff806`7aaad57f) Branch.

nt!RtlFindClearBitsEx+0x1e63e8:
fffff806`7ac936f8 ba40000000 mov edx,40h
fffff806`7ac936fd 8bd2 mov edx,edx
fffff806`7ac936ff e9be9de1ff jmp nt!RtlFindClearBitsEx+0x1b2 (fffff806`7aaad4c2) Branch.

Sistemin nasıl aynı çağrıda döngüde kaldığına da dikkat ettin mi?

Rich (BB code):

CONTEXT: ffffe40f30cd68b0 -- (.cxr 0xffffe40f30cd68b0)
rax=0000000000000243 rbx=0000000000000001 rcx=ffffe40f30cd732a
rdx=0000000000000040 rsi=ffffffffffffffff rdi=ffff8437804d9ff8
rip=fffff8067aaad398 rsp=ffffe40f30cd72d8 rbp=000000000001ffff
 r8=ffff8437804d7218 r9=000003ffffffffff r10=000000000001ffff
r11=00000000000090ea r12=00000000000090ea r13=0000000000000000
r14=ffff8437804d6000 r15=0000000000020000
iopl=0 nv up ei pl nz na pe cy.
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050203
nt!RtlFindClearBitsEx+0x88:
fffff806`7aaad398 4d0b08 or r9,qword ptr [r8] ds:002b:ffff8437`804d7218=????????????????
Resetting default scope.

Rich (BB code):

2: kd> dc ffff8437804d7218 L10.
ffff8437`804d7218 ???????? ???????? ???????? ???????? ????????????????
ffff8437`804d7228 ???????? ???????? ???????? ???????? ???????????????? < Geçersiz bir adres alanı
ffff8437`804d7238 ???????? ???????? ???????? ???????? ????????????????
ffff8437`804d7248 ???????? ???????? ???????? ???????? ????????????????

Yani, bu durumda süreç sonlandırılamıyor, ya Valorant ya da Vanguard kapatılamıyor ve Windows bu sürecin kapanmak üzere olduğunu düşünüyor. Bu yüzden, sistem yeniden başlatılsa bile süreç kapatılmıyor. Sorunu çözmek için cihazın tamamen kapanıp tekrar açılması (Full Power cycle) gerekiyor.

Bu sorun, sürecin işletim sistemi tarafından “kapanıyor” olarak algılandığı bir durumda kalmasına yol açıyor. Bu durumda, süreç tamamen kilitlenmiş durumda olduğundan, normal yollarla kapatma veya yeniden başlatma işe yaramıyor.

Bununla alakalı ve tamamen aynı kilitlenmeye sebep olabilecek bir kod örneği.

---------------------------------------------------------------

Vanguard'ın bu tip bir hataya sebep olması da genel. Son 1 ayda Vanguard'ın ya kod entegresinde Windows 11 ile sorun yaşanıyor ya da bu arkadaşlar kodlamayı bilmiyorlar. İlki olduğunu düşünüyoruz şimdilik.

Rich (BB code):

2: kd> lmvm vgk.
Browse full module list.
start end module name.
fffff806`97f90000 fffff806`99b16000 vgk T (no symbols)
 Loaded symbol image file: vgk.sys
 Image path: vgk.sys
 Image name: vgk.sys
 Browse all global symbols functions data.
 Timestamp: Fri Oct 25 02:11:10 2024 < Güncel sürücü
 CheckSum: 01BC6D82.
 ImageSize: 01B86000.
 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
 Information from resource tables:

Eğer sık yaşamıyorsan bu sorunun Vanguard'dan dolayı ortaya çıktığını bil ve bilgisayarınla alakalı bir sorun olduğunu düşünme. Sık yaşıyorsan da bellek bütünlüğünü ayarını kapatmayı deneyebilirsin. Bu da kesin bir çözümdür diyebilir miyiz?.. Bilmiyorum. İşe yaradığı oluyor.

Genişletmek için tıkla...