Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\051811-20950-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`03860000 PsLoadedModuleList = 0xfffff800`03a9de50
Debug session time: Wed May 18 02:53:10.533 2011 (GMT-4)
System Uptime: 0 days 21:58:04.390
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
.........
Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck F7, {fff4f8210520e8d1, 2b992ddfa232, ffffd466d2205dcd, 0}
Probably caused by : nvlddmkm.sys ( nvlddmkm+120cc6 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: fff4f8210520e8d1, Actual security check cookie from the stack
Arg2: 00002b992ddfa232, Expected security check cookie
Arg3: ffffd466d2205dcd, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
DEFAULT_BUCKET_ID: GS_FALSE_POSITIVE_MISSING_GSFRAME
SECURITY_COOKIE: Expected 00002b992ddfa232 found fff4f8210520e8d1
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0xF7
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff88004f44cc6 to fffff800038d0740
STACK_TEXT:
fffff800`0520e888 fffff880`04f44cc6 : 00000000`000000f7 fff4f821`0520e8d1 00002b99`2ddfa232 ffffd466`d2205dcd : nt!KeBugCheckEx
fffff800`0520e890 00000000`000000f7 : fff4f821`0520e8d1 00002b99`2ddfa232 ffffd466`d2205dcd 00000000`00000000 : nvlddmkm+0x120cc6
fffff800`0520e898 fff4f821`0520e8d1 : 00002b99`2ddfa232 ffffd466`d2205dcd 00000000`00000000 00000000`00000000 : 0xf7
fffff800`0520e8a0 00002b99`2ddfa232 : ffffd466`d2205dcd 00000000`00000000 00000000`00000000 fffffa80`0736b4f0 : 0xfff4f821`0520e8d1
fffff800`0520e8a8 ffffd466`d2205dcd : 00000000`00000000 00000000`00000000 fffffa80`0736b4f0 fffff880`0507e0bf : 0x2b99`2ddfa232
fffff800`0520e8b0 00000000`00000000 : 00000000`00000000 fffffa80`0736b4f0 fffff880`0507e0bf fffffa80`05bb7040 : 0xffffd466`d2205dcd
STACK_COMMAND: kb
FOLLOWUP_IP:
nvlddmkm+120cc6
fffff880`04f44cc6 ?? ???
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nvlddmkm+120cc6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nvlddmkm
IMAGE_NAME: nvlddmkm.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a6e492b
FAILURE_BUCKET_ID: X64_0xF7_MISSING_GSFRAME_nvlddmkm+120cc6
BUCKET_ID: X64_0xF7_MISSING_GSFRAME_nvlddmkm+120cc6
Followup: MachineOwner
---------
