Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Minidump\081915-6234-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available ************* Symbol Path validation summary ************** Response Time (ms) Location Deferred SRV*C:\Minidump\SYMBOLS*http://msdl.microsoft.com/download/symbols Symbol search path is: SRV*C:\Minidump\SYMBOLS*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 8 Kernel Version 9600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 9600.17936.amd64fre.winblue_ltsb.150715-0840 Machine Name: Kernel base = 0xfffff802`8920b000 PsLoadedModuleList = 0xfffff802`894e07b0 Debug session time: Wed Aug 19 13:13:43.142 2015 (UTC + 2:00) System Uptime: 0 days 0:47:58.641 Loading Kernel Symbols ............................................................... ................................................................ ............................... Loading User Symbols Loading unloaded module list ...................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 139, {2, ffffd00020b1b2a0, ffffd00020b1b1f8, 0} Probably caused by : win32k.sys ( win32k!_report_gsfailure+5 ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_SECURITY_CHECK_FAILURE (139) A kernel component has corrupted a critical data structure. The corruption could potentially allow a malicious user to gain control of this machine. Arguments: Arg1: 0000000000000002, Stack cookie instrumentation code detected a stack-based buffer overrun. Arg2: ffffd00020b1b2a0, Address of the trap frame for the exception that caused the bugcheck Arg3: ffffd00020b1b1f8, Address of the exception record for the exception that caused the bugcheck Arg4: 0000000000000000, Reserved Debugging Details: ------------------ TRAP_FRAME: ffffd00020b1b2a0 -- (.trap 0xffffd00020b1b2a0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff960004dc900 rbx=0000000000000000 rcx=0000000000000002 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff960002f0ad5 rsp=ffffd00020b1b438 rbp=ffffd00020b1b5a0 r8=fffff9600048f7c4 r9=ffffd00020b1c6c8 r10=ffffd00020b1c6c8 r11=00000000000001c0 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na pe nc win32k!_report_gsfailure+0x5: fffff960`002f0ad5 cd29 int 29h Resetting default scope EXCEPTION_RECORD: ffffe00100769080 -- (.exr 0xffffe00100769080) ExceptionAddress: ffffe00100769088 ExceptionCode: 00000006 ExceptionFlags: 00000000 NumberParameters: 0 CUSTOMER_CRASH_COUNT: 1 BUGCHECK_STR: 0x139 PROCESS_NAME: csrss.exe CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000409 - System wykry EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - System wykry EXCEPTION_PARAMETER1: 0000000000000002 DEFAULT_BUCKET_ID: STACK_COOKIE_CHECK_FAILURE ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre LAST_CONTROL_TRANSFER: from fffff802893664e9 to fffff8028935a9a0 STACK_TEXT: ffffd000`20b1af78 fffff802`893664e9 : 00000000`00000139 00000000`00000002 ffffd000`20b1b2a0 ffffd000`20b1b1f8 : nt!KeBugCheckEx ffffd000`20b1af80 fffff802`89366810 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69 ffffd000`20b1b0c0 fffff802`89365a34 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0 ffffd000`20b1b2a0 fffff960`002f0ad5 : fffff960`002f0b7f ffffd000`20b1c6c8 fffff802`89278f77 ffffd000`20b1ba40 : nt!KiRaiseSecurityCheckFailure+0xf4 ffffd000`20b1b438 fffff960`002f0b7f : ffffd000`20b1c6c8 fffff802`89278f77 ffffd000`20b1ba40 00000000`00000000 : win32k!_report_gsfailure+0x5 ffffd000`20b1b440 fffff802`89361eed : ffffd000`20b1bba0 00000000`00000000 ffffd000`20b1c398 ffffd000`20b1b5a0 : win32k!_GSHandlerCheck+0x13 ffffd000`20b1b470 fffff802`89278cbd : 00000000`00000001 fffff960`00106000 ffffd000`20b1c300 00000000`00000000 : nt!RtlpExecuteHandlerForException+0xd ffffd000`20b1b4a0 fffff802`8927d07e : ffffd000`20b1c398 ffffd000`20b1c0a0 ffffd000`20b1c398 fffff960`004af3d0 : nt!RtlDispatchException+0x1a5 ffffd000`20b1bb70 fffff802`893665c2 : ffffe001`00769080 ffffd000`20b1c300 00000000`00000000 fffff802`8925e077 : nt!KiDispatchException+0x646 ffffd000`20b1c260 fffff802`89364d14 : 00000000`00000000 fffff901`400e0c30 ffffe001`03287200 ffffe001`03877b30 : nt!KiExceptionDispatch+0xc2 ffffd000`20b1c440 fffff802`894aa033 : fffff901`400e0c30 fffff901`400e0c88 00000000`00000000 00000000`20707249 : nt!KiPageFault+0x214 ffffd000`20b1c5d8 fffff960`002e97a7 : 00000000`00000000 00000000`004af3d0 fffff901`400e0c30 00000000`00000000 : nt!ExFreePoolWithTag+0x33 ffffd000`20b1c6c8 ffffe001`00769261 : ffffe001`00769080 00000000`00000000 fffff802`892932b5 00000000`00000000 : win32k!bBlurCursorShadow+0x20b ffffd000`20b1c8c8 ffffe001`00769080 : 00000000`00000000 fffff802`892932b5 00000000`00000000 ffffd000`c1f98180 : 0xffffe001`00769261 ffffd000`20b1c8d0 00000000`00000000 : fffff802`892932b5 00000000`00000000 ffffd000`c1f98180 ffffe001`006cf800 : 0xffffe001`00769080 STACK_COMMAND: kb FOLLOWUP_IP: win32k!_report_gsfailure+5 fffff960`002f0ad5 cd29 int 29h SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: win32k!_report_gsfailure+5 FOLLOWUP_NAME: MachineOwner MODULE_NAME: win32k IMAGE_NAME: win32k.sys DEBUG_FLR_IMAGE_TIMESTAMP: 55b28a70 IMAGE_VERSION: 6.3.9600.17995 BUCKET_ID_FUNC_OFFSET: 5 FAILURE_BUCKET_ID: 0x139_2_win32k!_report_gsfailure BUCKET_ID: 0x139_2_win32k!_report_gsfailure ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0x139_2_win32k!_report_gsfailure FAILURE_ID_HASH: {cee3a4c3-f5b9-54f7-e416-5bb981245c9a} Followup: MachineOwner ---------