DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and BugCheck call is the one that overran its local
variable(s).
Arguments:
Arg1: ffffce02e96a6d60, Actual security check cookie from the stack
Arg2: 00000b38cd24b8f6, Expected security check cookie
Arg3: fffff4c732db4709, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 749
Key : Analysis.Elapsed.mSec
Value: 1781
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 218
Key : Analysis.Init.Elapsed.mSec
Value: 19497
Key : Analysis.Memory.CommitPeak.Mb
Value: 85
Key : Bugcheck.Code.LegacyAPI
Value: 0xf7
Key : Bugcheck.Code.TargetModel
Value: 0xf7
Key : Dump.Attributes.AsUlong
Value: 1008
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
Key : Failure.Bucket
Value: 0xF7_MISSING_GSFRAME_eaanticheat!unknown_function
Key : Failure.Hash
Value: {481c4c76-a7d7-4788-afc1-fb485413496d}
BUGCHECK_CODE: f7
BUGCHECK_P1: ffffce02e96a6d60
BUGCHECK_P2: b38cd24b8f6
BUGCHECK_P3: fffff4c732db4709
BUGCHECK_P4: 0
FILE_IN_CAB: 042324-7468-01.dmp
DUMP_FILE_ATTRIBUTES: 0x1008
Kernel Generated Triage Dump
SECURITY_COOKIE: Expected 00000b38cd24b8f6 found ffffce02e96a6d60
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: FC24.exe
STACK_TEXT:
ffffce02`e96a6c78 fffff802`e5f97b37 : 00000000`000000f7 ffffce02`e96a6d60 00000b38`cd24b8f6 fffff4c7`32db4709 : nt!KeBugCheckEx
ffffce02`e96a6c80 00000000`000000f7 : ffffce02`e96a6d60 00000b38`cd24b8f6 fffff4c7`32db4709 00000000`00000000 : eaanticheat+0x487b37
ffffce02`e96a6c88 ffffce02`e96a6d60 : 00000b38`cd24b8f6 fffff4c7`32db4709 00000000`00000000 aab85042`6be593e3 : 0xf7
ffffce02`e96a6c90 00000b38`cd24b8f6 : fffff4c7`32db4709 00000000`00000000 aab85042`6be593e3 fffffffe`00000003 : 0xffffce02`e96a6d60
ffffce02`e96a6c98 fffff4c7`32db4709 : 00000000`00000000 aab85042`6be593e3 fffffffe`00000003 fffff802`e5c42aa1 : 0x00000b38`cd24b8f6
ffffce02`e96a6ca0 00000000`00000000 : aab85042`6be593e3 fffffffe`00000003 fffff802`e5c42aa1 c88b4414`79c08500 : 0xfffff4c7`32db4709
SYMBOL_NAME: eaanticheat+487b37
MODULE_NAME: eaanticheat
IMAGE_NAME: eaanticheat.sys
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 487b37
FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_eaanticheat!unknown_function
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {481c4c76-a7d7-4788-afc1-fb485413496d}
Followup: MachineOwner
